type osint · CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems

Merged from event 82379

• e1ff729f45b587a5ebbc8a8a97a7923fc4ada14de4973704c9b4b89c50fd1146
• a739f44390037b3d0a3942cd43d161a7c45fd7e7
• 92ef0aaf5f622b1253e5763f11a08857
• 893750547255b848a273bd1668e128a5e169011e79a7f5c7bb86cc5d7b2153bc
• c69db1b120d21bd603f13006d87e817fed016667
• 84837778682450cdca43d1397afd2310
• 928d8dde63b0255feffc3d03db30aa76f7ed8913238321cc101083c2c5056ffa
• b7afb8c91f8f9df4f18764c25251576a0f8bef6f
• a89251cd4c15909a8e15256ead40584e
• ebe98d5e1ab6966ec1e292fafbd5ef21c2b15bd7c7bb871d8e756971b8b6877a

Merged from event 82379

• Backdoors related to Sandworm

• alert tcp any any -> any any ( sid:2000210015; msg:"P.A.S. webshell - passwd BruteForce form parameters"; \ flow:to_server,established; content:"POST"; http_method; \ content:"br=&brp%5B%5D="; http_client_body; fast_pattern; \ pcre:"/br=&brp%5B%5D=[hfmysp]&h%5B[hfmysp]%5D=.{1,64}&p%5B[hfmysp]%5D=[0-9]{1,5}/"; http_client_body;)
• alert tcp any any -> any any ( sid:2000210001; msg:"P.A.S. webshell - Explorer - download file"; \ flow:to_server,established; content:"POST"; http_method; \ content:"fe=&fdw=%2F"; http_client_body; offset:0) alert tcp any any -> any any ( sid:2000210002; msg:"P.A.S. webshell - Explorer - copy file"; \ flow:to_server,established; content:"POST"; http_method; \ content:"fe=&fcf=%2F"; http_client_body; offset:0) alert tcp any any -> any any ( sid:2000210003; msg:"P.A.S. webshell - Explorer - move file"; \ flow:to_server,established; content:"POST"; http_method; \ content:"fe=&fm=%2F"; http_client_body; offset:0) alert tcp any any -> any any ( sid:2000210004; msg:"P.A.S. webshell - Explorer - del file"; \ flow:to_server,established; content:"POST"; http_method; \ content:"fe=&fd=%2F"; http_client_body; offset:0) alert tcp any any -> any any ( sid:2000210005; msg:"P.A.S. webshell - Explorer - multi file download"; \ flow:to_server,established; content:"POST"; http_method; \ content:"fe=&fc%5B%5D=%2F"; http_client_body; offset:0; \ content:"&fdwa=Download"; http_client_body; ) alert tcp any any -> any any ( sid:2000210006; msg:"P.A.S. webshell - Explorer - multi file copy"; \ flow:to_server,established; content:"POST"; http_method; \ content:"fe=&fc%5B%5D=%2F"; http_client_body; offset:0; \ content:"&fca=Copy"; http_client_body;) alert tcp any any -> any any ( sid:2000210007; msg:"P.A.S. webshell - Explorer - multi file move"; \ flow:to_server,established; content:"POST"; http_method; \ content:"fe=&fc%5B%5D=%2F"; http_client_body; offset:0; \ content:"&fma=Move"; http_client_body; ) alert tcp any any -> any any ( sid:2000210008; msg:"P.A.S. webshell - Explorer - multi file delete"; \ flow:to_server,established; content:"POST"; http_method; \ content:"fe=&fc%5B%5D=%2F"; http_client_body; offset:0; \ content:"&fda=Delete"; http_client_body; ) alert tcp any any -> any any ( sid:2000210009; msg:"P.A.S. webshell - Explorer - paste"; \ flow:to_server,established; content:"POST"; http_method; \ content:"fe=&fbp=Paste"; http_client_body; offset:0; )
• alert tcp any any -> any any ( sid:2000210000; msg:"P.A.S. webshell - Response Footer"; \ flow:to_client,established; content:"200"; http_stat_code; \ file_data; content:"<fieldset class=\"footer\"><table width=\"100%\" border=\"0\"><tr><td>P.A.S. v";)
• alert tcp any any -> any any ( sid:2000210012; msg:"P.A.S. webshell - Network Tools - Bind Port"; \ flow:to_server,established; content:"POST"; http_method; \ content:"pb="; offset:0; http_client_body; \ pcre:"/pb=[0-9]{1,5}&nt=bp/"; ) alert tcp any any -> any any ( sid:2000210013; msg:"P.A.S. webshell - Network Tools - Back-connect"; \ flow:to_server,established; content:"POST"; http_method; \ content:"hbc="; offset:0; http_client_body; \ pcre:"/hbc=[a-z0-9.-]{4,63}&pbc=[0-9]{1,5}&nt=bc/"; ) alert tcp any any -> any any ( sid:2000210014; msg:"P.A.S. webshell - Network Tools - Port scanner"; \ flow:to_server,established; content:"POST"; http_method; \ content:"hs="; offset:0; http_client_body; \ pcre:"/hs=[a-z0-9.-]{4,63}&pf=[0-9]{1,5}&pl=[0-9]{1,5}&sc=[0-9]{1,5}&nt=ps/"; )
• alert tcp any any -> any any ( sid:2000211001; msg:"P.A.S. webshell - Password cookie"; \ flow:established; content:"g__g_="; http_cookie; offset:0; ) alert tcp any any -> any any ( sid:2000211002; msg:"P.A.S. webshell - Password form var"; \ flow:to_server,established; content:"POST"; http_method; \ content:"g__g_="; http_cookie; http_client_body; offset:0; )
• alert tcp any any -> any any ( sid:2000210016; msg:"P.A.S. webshell - Bind shell session"; \ content:"Hello from P.A.S. Bind Port"; ) alert tcp any any -> any any ( sid:2000210017; msg:"P.A.S. webshell - Reverse shell session"; \ content:"Hello from P.A.S. BackConnect"; )
• alert tcp any any -> any any ( sid:2000210010; msg:"P.A.S. webshell - Searcher form parameters"; \ flow:to_server,established; content:"POST"; http_method; \ content:"fe=&fsr="; offset:0; fast_pattern; \ pcre:"/fe=&fsr=[0-2]&fst=[0-2]&fsn=(\*|[A-Za-z0-9 *._%-]+)&fsp=[A-Za-z0-9 *._%-]+&fs=%3E&fss=.*/";)
• alert tcp any any -> any any ( sid:2000210011; msg:"P.A.S. webshell - SQL-client connect parameters"; \ flow:to_server,established; content:"POST"; http_method; \ content:"sc%5Btp%5D="; offset:0; http_client_body; fast_pattern; \ pcre:"/sc%5Btp%5D=(mysql|mssql|pg)&sc%5Bha%5D=/"; http_client_body;)

• Centreon

• centreon_module_linux_app64Merged from event 82379
• search.phpMerged from event 82379
• DB-Drop.phpMerged from event 82379
• /bin/backupMerged from event 82379
• CERTFR-2021-CTI-004.pdf

• all
• all
• all
• all
• all
• The following indicators, SNORT rules and YARA rules are from ANSSI’s analysis of an intrusion campaign targeting the monitoring software Centreon attributed to the intrusion set Sandworm which resulted in the breach of several French entities. This intrusion campaign is described in the following report CERTFR-2021-CTI-005. These technical elements are provided to help detecting malicious activities in logs, on systems and inside live network trafic. Every detection with these elements cannot be considered as a proof of intrusion and should be investigated to confirm. Some elements are detecting tools shared between several attackers so their detection is not sufficient to link an intrusion to this campaign. ANSSI is interested in every incident discovered and linked to this campaign.
• CERTFR-2021-CTI-004

• /* configuration file */ rule exaramel_configuration_key { meta: author = "FR/ANSSI/SDO" description = "Encryption key for the configuration file in sample e1ff72[...]" TLP = "White" strings: $ = "odhyrfjcnfkdtslt" condition: all of them } rule exaramel_configuration_name_encrypted { meta: author = "FR/ANSSI/SDO" description = "Name of the configuration file in sample e1ff72[...]" TLP = "White" strings: $ = "configtx.json" condition: all of them } rule exaramel_configuration_file_plaintext { meta: author = "FR/ANSSI/SDO" description = "Content of the configuration file (plaintext)" TLP = "White" strings: $ = /{"Hosts":\[".{10,512}"\],"Proxy":".{0,512}","Version":".{1,32}","Guid":"/ condition: all of them } rule exaramel_configuration_file_ciphertext { meta: author = "FR/ANSSI/SDO" description = "Content of the configuration file (encrypted with key odhyrfjcnfkdtslt, sample e1ff72[...]" TLP = "White" strings: $ = {6F B6 08 E9 A3 0C 8D 5E DD BE D4} // encrypted with key odhyrfjcnfkdtslt condition: all of them } /* persistence */ private rule exaramel_persistence_file_systemd { meta: author = "FR/ANSSI/SDO" description = "Beginning of the file /etc/systemd/system/syslogd.service created for persistence with systemd" TLP = "White" strings: $ = /\[Unit\]\nDescription=Syslog daemon\n\n\[Service\]\nWorkingDirectory=.{1,512}\nExecStartPre=\/bin\/rm \-f \/tmp\/\.applocktx\n/ condition: all of them } private rule exaramel_persistence_file_upstart { meta: author = "FR/ANSSI/SDO" description = "Part of the file /etc/init/syslogd.conf created for persistence with upstart" TLP = "White" strings: $ = /start on runlevel \[2345\]\nstop on runlevel \[06\]\n\nrespawn\n\nscript\nrm \-f \/tmp\/\.applocktx\nchdir/ condition: all of them } private rule exaramel_persistence_file_systemv { meta: author = "FR/ANSSI/SDO" description = "Part of the file /etc/init.d/syslogd created for persistence with upstart" TLP = "White" strings: $ = "# Short-Description: Syslog service for monitoring \n### END INIT INFO\n\nrm -f /tmp/.applocktx && cd " condition: all of them } rule exaramel_persistence_file { meta: author = "FR/ANSSI/SDO" description = "File created for persistence. Depends on the environment" TLP = "White" condition: exaramel_persistence_file_systemd or exaramel_persistence_file_upstart or exaramel_persistence_file_systemv } /* misc */ rule exaramel_socket_path { meta: author = "FR/ANSSI/SDO" description = "Path of the unix socket created to prevent concurrent executions" TLP = "White" strings: $ = "/tmp/.applocktx" condition: all of them } rule exaramel_task_names { meta: author = "FR/ANSSI/SDO" description = "Name of the tasks received by the CC" TLP = "White" strings: $ = "App.Delete" $ = "App.SetServer" $ = "App.SetProxy" $ = "App.SetTimeout" $ = "App.Update" $ = "IO.ReadFile" $ = "IO.WriteFile" $ = "OS.ShellExecute" condition: all of them } rule exaramel_struct { meta: author = "FR/ANSSI/SDO" description = "Beginning of type _type struct for some of the most important structs" TLP = "White" strings: $struct_le_config = {70 00 00 00 00 00 00 00 58 00 00 00 00 00 00 00 47 2d 28 42 0? [2] 19} $struct_le_worker = {30 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 46 6a 13 e2 0? [2] 19} $struct_le_client = {20 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 7b 6a 49 84 0? [2] 19} $struct_le_report = {30 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 bf 35 0d f9 0? [2] 19} $struct_le_task = {50 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 88 60 a1 c5 0? [2] 19} condition: any of them } private rule exaramel_strings_url { meta: author = "FR/ANSSI/SDO" description = "Misc strings coming from URL parts" TLP = "White" strings: $url1 = "/tasks.get/" $url2 = "/time.get/" $url3 = "/time.set" $url4 = "/tasks.report" $url5 = "/attachment.get/" $url6 = "/auth/app" condition: 5 of ($url*) } private rule exaramel_strings_typo { meta: author = "FR/ANSSI/SDO" description = "Misc strings with typo" TLP = "White" strings: $typo1 = "/sbin/init | awk " $typo2 = "Syslog service for monitoring \n" $typo3 = "Error.Can't update app! Not enough update archive." $typo4 = ":\"metod\"" condition: 3 of ($typo*) } private rule exaramel_strings_persistence { meta: author = "FR/ANSSI/SDO" description = "Misc strings describing persistence methods" TLP = "White" strings: $ = "systemd" $ = "upstart" $ = "systemV" $ = "freebsd rc" condition: all of them } private rule exaramel_strings_report { meta: author = "FR/ANSSI/SDO" description = "Misc strings coming from report file name" TLP = "White" strings: $ = "systemdupdate.rep" $ = "upstartupdate.rep" $ = "remove.rep" condition: all of them } rule exaramel_strings { meta: author = "FR/ANSSI/SDO" description = "Misc strings including URLs, typos, supported startup systems and report file names" TLP = "White" condition: exaramel_strings_typo or (exaramel_strings_url and exaramel_strings_persistence) or (exaramel_strings_persistence and exaramel_strings_report) or (exaramel_strings_url and exaramel_strings_report) }
• rule PAS_webshell { meta: author = "FR/ANSSI/SDO" description = "Detects P.A.S. PHP webshell - Based on DHS/FBI JAR-16-2029 (Grizzly Steppe)" TLP = "White" strings: $php = "<?php" $base64decode = /='base'\.\(\d+(\*|\/)\d+\)\.'_de'\.'code'/ $strreplace = "(str_replace(" $md5 = ".substr(md5(strrev($" nocase $gzinflate = "gzinflate" $cookie = "_COOKIE" $isset = "isset" condition: (filesize > 20KB and filesize < 200KB) and #cookie == 2 and #isset == 3 and all of them }
• rule PAS_webshell_PerlNetworkScript { meta: author = "FR/ANSSI/SDO" description = "Detects PERL scripts created by P.A.S. webshell to supports network functionnalities" TLP = "White" strings: $pl_start = "#!/usr/bin/perl\n$SIG{'CHLD'}='IGNORE'; use IO::Socket; use FileHandle;" $pl_status = "$o=\" [OK]\";$e=\" Error: \"" $pl_socket = "socket(SOCKET, PF_INET, SOCK_STREAM,$tcp) or die print \"$l$e$!$l" $msg1 = "print \"$l OK! I\\'m successful connected.$l\"" $msg2 = "print \"$l OK! I\\'m accept connection.$l\"" condition: filesize < 6000 and ($pl_start at 0 and all of ($pl*)) or any of ($msg*) }
• rule PAS_webshell_SQLDumpFile { meta: author = "FR/ANSSI/SDO" description = "Detects SQL dump file created by P.A.S. webshell" TLP = "White" strings: $ = "-- [ SQL Dump created by P.A.S. ] --" condition: all of them }
• rule PAS_webshell_ZIPArchiveFile { meta: author = "FR/ANSSI/SDO" description = "Detects an archive file created by P.A.S. for download operation" TLP = "White" strings: $ = /Archive created by P\.A\.S\. v.{1,30}\nHost: : .{1,200}\nDate : [0-9]{1,2}-[0-9]{1,2}-[0-9]{4}/ condition: all of them }

• https://www.cert.ssi.gouv.fr/ioc/CERTFR-2021-IOC-002/
• https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-004/