ap-northeast-1.compute.internal.anondns.net

everlost.anondns.net

silentbob.anondns.net

everfound.anondns.net

user.sh

clean.sh

run.sh

permiso.io

credentials.db

last_update_check.json

azure.json

upload.php

in.php

postgresuser.txt

awsaccesskey.txt

gscat.php

metadata.php

filezilla.xml

queue.sql

28165d28693ca807fb3d4568624c5ba9

d9ecceda32f6fa8a7720e1bf9425374f

f7df739f865448ac82da01b3b1a97041

99f0102d673423c920af1abc22f66d4e

92d6cc158608bcec74cf9856ab6c94e5

7044a31e9cd7fdbf10e6beba08c78c6b

f60b75ddeaf9703277bb2dc36c0f114b

c2465e78a5d11afd74097734350755a4

87c8423e0815d6467656093bff9aa193

203fe39ff0e59d683b36d056ad64277b

dafac2bc01806db8bf19ae569d85deae

45.9.148.108

https://blog.aquasec.com/threat-alert-anatomy-of-silentbobs-cloud-attack

http://everlost.anondns.net/upload.php

http://silentbob.anondns.net/bin/chattr

http://silentbob.anondns.net/cmd/grab.sh

http://silentbob.anondns.net/cmd/aws.sh

http://silentbob.anondns.net/bin/sysfix/curl.full

http://silentbob.anondns.net/insert/tmate.php

http://ap-northeast-1.compute.internal.anondns.net/insert/keys.php

http://everlost.anondns.net/bin/a

http://silentbob.anondns.net/insert/metadata.php

rule P0_Hunting_AWS_EnvVarNames_1 {
	meta:
		description = "Detecting presence of scripts searching for numerous environment variables containing sensitive AWS credential information. Explicitly excluding LinPEAS (and its variants) to remove noise since it is already well-detected."
		author = "daniel.bohannon@permiso.io (@danielhbohannon)"
		date = "2023-07-12"
		reference = "https://permiso.io/blog/s/agile-approach-to-mass-cloud-cred-harvesting-and-cryptomining/"
		md5_01 = "3e2cddf76334529a14076c3659a68d92"
		md5_02 = "b9113ccc0856e5d44bab8d3374362a06"
		md5_03 = "d9ecceda32f6fa8a7720e1bf9425374f"
		md5_04 = "28165d28693ca807fb3d4568624c5ba9"
		md5_05 = "0855b8697c6ebc88591d15b954bcd15a"
		md5_06 = "f7df739f865448ac82da01b3b1a97041"
		md5_07 = "1a37f2ef14db460e5723f3c0b7a14d23"
		md5_08 = "99f0102d673423c920af1abc22f66d4e"
		md5_09 = "99f0102d673423c920af1abc22f66d4e"
		md5_10 = "5daace86b5e947e8b87d8a00a11bc3c5"
	strings:
		$shellHeader_01 = "#!/bin/sh"
		$shellHeader_02 = "#!/bin/bash"
		$envVarAWSPrefixSyntax_01 = " $AWS_ "
		$envVarAWSPrefixSyntax_02 = " ${AWS_"
		$envVarAWS_01 = "AWS_ACCESS_KEY_ID"
		$envVarAWS_02 = "AWS_SECRET_ACCESS_KEY"
		$envVarAWS_03 = "AWS_SESSION_TOKEN"
		$envVarAWS_04 = "AWS_SHARED_CREDENTIALS_FILE"
		$envVarAWS_05 = "AWS_CONFIG_FILE"
		$envVarAWS_06 = "AWS_DEFAULT_REGION"
		$envVarAWS_07 = "AWS_REGION"
		$envVarAWS_08 = "AWS_EC2_METADATA_DISABLED"
		$envVarEcho = "then echo "
		$linPEAS_01 = "#-------) Checks pre-everything (---------#"
		$linPEAS_02 = "--) FAST - Do not check 1min of procceses and su brute"
	condition:
		(any of ($shellHeader*)) and (1 of ($envVarAWSPrefixSyntax*)) and (4 of ($envVarAWS*)) and (#envVarEcho >= 4) and not (all of ($linPEAS*))
}

rule P0_Hunting_Azure_EnvVarNames_1 {
	meta:
		description = " Detecting presence of scripts searching for numerous environment variables containing sensitive Azure credential information "
		author = " daniel.bohannon@permiso.io (@danielhbohannon) "
		date = " 2023-07-12 "
		reference = " https://permiso.io/blog/s/agile-approach-to-mass-cloud-cred-harvesting-and-cryptomining/ "
		md5_01 = " b9113ccc0856e5d44bab8d3374362a06 "
		md5_02 = " d9ecceda32f6fa8a7720e1bf9425374f "
		md5_03 = " 0855b8697c6ebc88591d15b954bcd15a "
		md5_04 = " f7df739f865448ac82da01b3b1a97041 "
		md5_05 = " 1a37f2ef14db460e5723f3c0b7a14d23 "
		md5_06 = " 99f0102d673423c920af1abc22f66d4e "
		md5_07 = " 99f0102d673423c920af1abc22f66d4e "
		md5_08 = " 5daace86b5e947e8b87d8a00a11bc3c5 "
	strings:
		$envVarAzurePrefixSyntax_01 = " $AZURE_ "
		$envVarAzurePrefixSyntax_02 = " ${AZURE_"
		$envVarAzure_01 = "AZURE_CREDENTIAL_FILE"
		$envVarAzure_02 = "AZURE_GUEST_AGENT_CONTAINER_ID"
		$envVarAzure_03 = "AZURE_CLIENT_ID"
		$envVarAzure_04 = "AZURE_CLIENT_SECRET"
		$envVarAzure_05 = "AZURE_TENANT_ID"
		$envVarAzure_06 = "AZURE_SUBSCRIPTION_ID"
		$envVarEcho = "then echo "
	condition:
		(1 of ($envVarAzurePrefixSyntax*)) and (3 of ($envVarAzure*)) and (#envVarEcho >= 3)
}

rule P0_Hunting_Common_TeamTNT_CredHarvesterOutputBanner_1 {
	meta:
		description = "Detecting presence of known credential harvester scripts (commonly used by TeamTNT) containing specific section banner output commands"
		author = "daniel.bohannon@permiso.io (@danielhbohannon)"
		date = "2023-07-12"
		reference = "https://permiso.io/blog/s/agile-approach-to-mass-cloud-cred-harvesting-and-cryptomining/"
		md5_01 = "b9113ccc0856e5d44bab8d3374362a06"
		md5_02 = "d9ecceda32f6fa8a7720e1bf9425374f"
		md5_03 = "0855b8697c6ebc88591d15b954bcd15a"
		md5_04 = "f7df739f865448ac82da01b3b1a97041"
		md5_05 = "1a37f2ef14db460e5723f3c0b7a14d23"
		md5_06 = "99f0102d673423c920af1abc22f66d4e"
		md5_07 = "99f0102d673423c920af1abc22f66d4e"
		md5_08 = "5daace86b5e947e8b87d8a00a11bc3c5"
	strings:
		$sectionBanner_01 = "-------- AWS INFO ------------------------------------------"
		$sectionBanner_02 = "-------- EC2 USERDATA -------------------------------------------"
		$sectionBanner_03 = "-------- GOOGLE DATA --------------------------------------"
		$sectionBanner_04 = "-------- AZURE DATA --------------------------------------"
		$sectionBanner_05 = "-------- IAM USERDATA -------------------------------------------"
		$sectionBanner_06 = "-------- AWS ENV DATA --------------------------------------"
		$sectionBanner_07 = "-------- PROC VARS -----------------------------------"
		$sectionBanner_08 = "-------- DOCKER CREDS -----------------------------------"
		$sectionBanner_09 = "-------- CREDS FILES -----------------------------------"
	condition:
		(5 of them)
}

rule P0_Hunting_Common_TeamTNT_CurlArgs_1 {
	meta:
		description = " Detecting presence of known credential harvester scripts (commonly used by TeamTNT) containing common curl arguments including 'Datei' (German word for 'file' ) and specific 'Send=1' arguments found in German blog post https://administrator.de/tutorial/upload-von-dateien-per-batch-curl-und-php-auf-einen-webserver-ohne-ftp-98399.html which details using curl (with these specific arguments) to upload files to upload.php "
		author = " daniel.bohannon@permiso.io (@danielhbohannon) "
		date = " 2023-07-12 "
		reference = " https://permiso.io/blog/s/agile-approach-to-mass-cloud-cred-harvesting-and-cryptomining/ "
		md5_01 = " b9113ccc0856e5d44bab8d3374362a06 "
		md5_02 = " d9ecceda32f6fa8a7720e1bf9425374f "
		md5_03 = " 0855b8697c6ebc88591d15b954bcd15a "
		md5_04 = " f7df739f865448ac82da01b3b1a97041 "
		md5_05 = " 1a37f2ef14db460e5723f3c0b7a14d23 "
		md5_06 = " 99f0102d673423c920af1abc22f66d4e "
		md5_07 = " 99f0102d673423c920af1abc22f66d4e "
		md5_08 = " 5daace86b5e947e8b87d8a00a11bc3c5 "
	strings:
		$curlFileArgGerman = " \"Datei=@\" "
		$curlArgSend = " -F \"Send=1\" "
		$curlArgUsername = " -F \"username= "
		$curlArgPassword = " -F \"password= "
	condition:
		all of them
}