Using IIS logs for fun and malware profit!

On an intrusion I was investigating last year, I was given access to IIS logs of a public facing web server that was comrpomised via sql injection and that sql injection was used as a pivot point for the intruder (more on this in another post)

I wanted to start reviewing the IIS logs so the first thing I did because the logs had a lot of encoded traffic was to run the logs through this simple python script to unqote all the logs to make it a little easier to investigate:

#!/usr/bin/env python
import urllib
log = open("/home/investigate/case111/weblogs//iislogs.txt","rb")
log_unquoted = open("/home/investigate/case111/weblogs/iislogs_unquoted.txt","wb")
for line in log:

While manually  reviewing the unquoted logs I saw a entry that contained the following:
exec master.dbo.xp_cmdshell ‘echo gg=^”4D5A … ^”_>> C:\dir\fg.vbs’;exec …

First you might see a xp_cmdshell – yup this host was vulnerable to sql injection and xp_cmdshell was enabled (yes, I know its bad but hey I was the responder don’t shoot the messenger)
You might notice that 4D5A is the hex header for the magic number of DOS Executables. To me this looked like the attacker was uploading a exe through the webserver. I wondered if we would be able to extract through the logs what the attacker uploaded.

I decided to grep for any line in the file that contained fg.vbs and write it to a text file
cat iislogs_unquoted.txt| grep “fg.vbs” > fg.vbs.txt
I then used awk to show me the 11th field of the logs which had the hex data for the exe they were attempting to upload.

cat fg.vbs.txt | awk ‘{print $11}’ > fg.txt

I then used a global search and replace in vi  to remove the following characters ^” from the begining and ^”_ from the end.
This gave me a text file full of hex, I then copied the hex and pasted it into a hex editor and saved the results as fg.exe.

I then copied fg.exe over to a vm I use for testing suspicious files. I then ran the following fg.exe /?

fg.exe usage

fg.exe usage

Looks like a password dumper lets run it with out any switches:

Results of fg.exe

Results of fg.exe

After seeing this was successful I looked for any other entries in the logs that looked like the attackers where uploaded an executable. I was able to also recover a 32 bit and 64 bit version of windows credential editor.

Being able to carve these files out of IIS logs was very helpful and eye opening and allowed us to confirm what the attacker was able to run.  Who would have known that IIS logs could be used to carve malware and not be used generally for web site usage statistics.

As always happy hunting!


Hunting: Recent news and your proxy logs

If you have been reading any of the blog posts or the twitter verse the past few months you might have seen reference to some Adobe Flash and Microsoft 0-days being used and maybe wondering if you have been a victim. Using nuggets of open source  intelligence like info from these posts by ShadowServer and  Sophos you just might have enough  data to search your proxy logs and see if you have experienced any of these attacks. You do have your web traffic going through a proxy don’t you? If you don’t you should start doing it and start collecting the logs. The logs are a treasure trove of information if you want to go hunting.

So let’s go on a hunt.

For this hunt like previous onces I will be using ArcSight Logger because that is what I have access to. I will also be leveraging websense for the proxy logs as well.

Indicators from the ShadowServer and Sophos blogs:


Logger Query:

deviceVendor = “Websense” AND  ( ( ( requestUrlFileName CONTAINS “deploy.html” )  OR  ( requestUrlFileName CONTAINS “deployJava.js” )  OR  ( requestUrlFileName CONTAINS “movie.swf” )  OR  ( requestUrlFileName CONTAINS “BrightBalls.swf” )  OR  ( requestUrlQuery CONTAINS “Elderwood=” )  OR  ( requestUrlQuery CONTAINS “apple=” ) ) )

Now this isn’t the most efficient query because of the CONTAINS operators but there is a trade off when doing searches like this and you just have to be prepared for it. There could also be some false positives as well espically around faq.htm so be prepared to use a  little excel foo. Or you can leave the faq.htm off I will leave that up to you. I did a quick hunt and went back 2 weeks and got the following hits:

Notice the swf file is different but the query was for Elderwood.  If I had just put  BrightBalls.swf?Elderwood as a search parameter I would have missed it. Good thing the bad guys used the same query string.  So do some experimenting you might find slicing and dicing on key terms will get you more data and more places to keep hunting.

Now for me this showed a sign I needed to do more digging and going for some packets to review if you have them and perhaps another search this time adding Geoffrey.swf as a search parameter to see if there is anything additional there.

As always happy hunting!

Hunting: Finding lateral movement using Snare and ArcSight Logger

Once again I received  inspiration for this post from the Mandiant M-Trends 2012: An Evolving Threat report and reflecting on a previous work engagement where the attackers leveraged lateral movement  to move around and  deeper into the network. On page 12 the report highlights the attackers leveraging at.exe (task scheduler) to install malware and take control of systems. This post hopefully will help you get an idea of what your current scheduled tasks look like and get you thinking about ways to find badness when it occurs. Yes it will occur!

In the M-Trends example the attacker creates a a NetBios session first  and then runs the at.exe command which to schedule the malware they previously uploaded over the NetBios session. This two steps should create some events in the Windows event logs, assuming auditing is turned on. For the NetBios connection an event id of 540 for XP and Server 2003 systems should be created and an event id of 4624 for Vista and Server 2008 systems.  For the at.exe an event id of 602 for XP and Server 2003 systems  and an event id of 4702  for Vista and Server 2008 systems.

To get to the point where you can actually hunt for at.exe events you must do a little leg work.

Set the audit policy:

At a minimum you need to have a few things turned on in the Local Security Policy for the Auditing Policy. You will want to enable Success and Failures audits for the following audit policies.

  • Audit account logon events
  • Audit logon events
  • Audit Object Access

It should be noted if possible you should turn on as many of the available audit policies as you can for your environment where you can. Having these logs helps find not only badness but misconfiguration and other issues that might creep up. They are easy to setup and push out via Group Policy Objects (GPO) but just make sure you watch changes to the GPO in your logs. Some attackers have been known to modify GPO’s and turn settings off.

Now that you have your Auditing Policy in place you need to enable logging.

Enabling Logging:

For central windows logging that should work with almost any commercial or open source central log collection tool  I recommend using Snare as your agent for getting the logs from your windows systems to what ever central log system you have. You do have one right?

The install for Snare is pretty straight forward and is covered pretty well in their documentation, and so is adding a remote Syslog host so I won’t cover that here. What I will cover is one minor addition that I have found that needs to be made to capture and send  at.exe related event logs. Start by logging in to the Snare Configuration page and select Objectives Configuration on the left hand side. When editing the auditing configuration here is what I have used in my testing to get the logs I am interested in for this hunting trip:

Sample Snare Config

After adding the configuration above go to the left navigation bar and select Apply the Latest Audit Configuration. Now you may want to test and try and create a at.exe event on the system you just applied this configuration to. To test it you will need to either be a domain admin or a local admin of the system. A sample test you could use from the command prompt is:

at.exe \\srv1 07:30 cmd /c ping.exe

Change srv1 with your host name and change what is after the cmd /c to something you want the system to execute. The command above will create a task to run at 7:30 in the morning and will execute a ping to

Now go back to your Snare Configuration and look at the Latest Events and you should see near the top the scheduled task you just created.

Hunting with Logger

Now that you have configured the audit policy and you have configured Snare. Its time to go hunting for the logs. In this hunt we are using the free version of  ArcSight Logger (in future posts I will explore using Snare, ELSA and maybe a few other tools). I am going to assume your logger instance is already setup and you have a smart connector in place to receive logs from Snare.

Quick Initial Search

A quick and dirty search for looking for scheudled tasks is as simple as the filter below and hitting Go!:

Logger Search Filter

Search: (externalId=620 or externalId=4702)

Now if you have any hits you might get output similar to this:

Logger Search Results

Now that you have results you should probably go make and do a search for network logon events (event id 540 or 4624) around those times to see where the commands originated from. This will help you find lateral movement.

What to do after your initial search?

We have found our initial search and hopefully all of your events are ones that were planned and not ones done by someone on your network. Perhaps you don’t want to run this query every day or so or maybe you don’t want to login every day to run it. You could quickly turn this into a report and have it run for a set interval and email you the results. I will quickly cover how to create the query and report that is needed on logger below.

Creating the Query:

Let’s create a quick and dirty query and report that can be touched up later if needed 🙂

Under the Reports Function tab on the left had side of Logger. Go to Design and select Queries then click Add New at the top. Give it a name and you could start by using a query similar to this:

select events.arc_endTime AS ‘Time’,events.arc_name AS ‘Name’,events.arc_destinationUserName As ‘Dest. User Name’, events.arc_destinationHostName AS ‘Dest. Host Name’, events.arc_message AS ‘Message’ from events where ( events.arc_externalId = 602 OR events.arc_externalId = 4702) group by events.arc_endTime

Below is what my quick Query Object looks like:

Logger Query

After creating the query you will need to create the report simply give it a name, select the query you just created and then select the fields you want displayed. Save the report and run it. Here is what my quick and dirty report design looks like.

Logger Report

Depending on your Report Start and End Times you might get data similar to your quick logger search above.

Report output

You should now have a way to hopefully find badness if there was any (assuming you have historical logs) or this can help put you on a way to monitor and find badness and respond faster.

If you have other suggestions or maybe tricks you use for these types of searches I would love to see them. We are all one big community lets help each other out where we can.

As always Happy Hunting!

Hunting: Internal DNS Logs using ArcSight Logger

If you have read the latest Mandiant M-Trends 2012: An Evolving Threat report you might have noticed on page 10 this statement:

The ZIP archive contained several benign files and an executable disguised as a PDF document via a modified resources section. When executed, the malware beaconed to a domain that contained the organization’s specific name as the third level of the address (such as “”).

Then later in the report the Mandiant Folks call out the need for having your internal DNS logs as a way to combat these type of attacks. This got me thinking of how I could go hunting through my organizations internal DNS logs. Thankfully, we have these logs and they are  being forwarded to an ArcSight Logger so for this post I am going to leverage Logger for searching internal dns logs.

Let’s assume for this exercise your organization name is LMN Widget Maker Inc and you are customarily known as lmnwidgets and in the Mandiant example above the malware would have beaconed to

For this exercise I am using BIND DNS for the logs so your queries might have to change for Microsoft DNS but you should get the idea. For the sake of it as well I will show the results with a limited field set so you only see the important data for this exercise.

You will need to search query events and you will want to exclude queries for your organizations domain From there you will have to leverage the capabilities of ArcSight and do a CONTAINS operator in the search for lmnwidgets. Your search filter would look something like this:

Logger Search for lmnwidget

And for those of you used to creating filters in ESM it would look like this:

LMNWidget Search ESM

This hopefully would not result in any events but in this exercise it did.

LMNWIDGET Search Results

Now that you have found you have some interesting results from your searches you can dig a little deeper and take it from there.

Happy Hunting!!!!