keyboardcrunch keyboardcrunch

HAFNIUM WebShell IOCs

Sha256 In ("b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0","097549cf7d0f76f0d99edf8b2d91c60977fd6a96e4b8c3c94b0b1733dc026d3e","2b6f1ebb2208e93ade4a6424555d6a8341fd6d9f60c25e44afe11008f5c1aad1","65149e036fff06026d80ac9ad4d156332822dc93142cf1a122b1841ec8de34b5","511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1","4edc7770464a14f54d17f36dc9d0fe854f68b346b27b35a6f5839adf1f13f8ea","811157f9c7003ba8d17b45eb3cf09bef2cecd2701cedb675274949296a6a183d","1631a90eb5395c4e19c7dbcbf611bbe6444ff312eb7937e286e4637cb9e72944") OR 
( TgtFilePath In Contains Anycase ("web.aspx","help.aspx","document.aspx","errorEE.aspx","errorEEE.aspx","errorEW.aspx","errorFF.aspx","healthcheck.aspx","aspnet_www.aspx","aspnet_client.aspx","xx.aspx","shell.aspx","aspnet_iisstart.aspx","one.aspx")  AND 
TgtFilePath In Contains Anycase ("C:\inetpub\wwwroot\aspnet_client", "C:\inetpub\wwwroot\aspnet_client\system_web", "FrontEnd\HttpProxy\owa\auth") AND
EventType In ("File Creation","File

REvil Kaseya IOC S1QL Hunt

File/Publisher Query

SrcProcPublisher ContainsCIS "PB03 TRANSPORT LTD" OR TgtFileSha256 In AnyCase ("d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e", "8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd", "e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2") OR SrcProcCmdLine ContainsCIS "c:\kworking\agent.exe"

.com C2 Queries


	@0daydorpher
	SMBConfig
	\| summarize countif( (EnableSMB1Protocol == true) ) by Device
	\| where (countif_ > 0)


	@IoanPopovici Enabled/Disabled barchart
	SMBConfig
	\| summarize Enabled=countif(EnableSMB1Protocol == true) by Device

	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
	<html>
	<head>
	<!--[if gte mso 9]><!-->
	<meta http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge">
	<!--[if !mso]><!-->
	<!--<!-->
	<!--[if gte mso 9]><!-->
	<h1>You're viewing this in one of the following:
	<ul>

	$Installed = Get-WmiObject -Class Win32Reg_AddRemovePrograms \| Where-Object { $_.DisplayName -eq "Sentinel Agent" }

	If ( -Not $Installed ) {
	# Sentinel Agent not installed/missing.
	Return $false
	} Else {
	$Version = $Installed.Version
	$SentinelCtl = "C:\Program Files\SentinelOne\Sentinel Agent $Version\SentinelCtl.exe"
	$Status = & $SentinelCtl "status"

	$SentinelOne = Get-WmiObject -Class Win32Reg_AddRemovePrograms \| Where-Object { $_.DisplayName -eq "Sentinel Agent" }
	$Boot = Get-WmiObject -class Win32_OperatingSystem \| Select-Object __SERVER,@{label='LastRestart';expression={$_.ConvertToDateTime($_.LastBootUpTime)}}

	If ( $SentinelOne ) {
	# Quick date-time conversion
	$InstallDate = Get-Date $([Datetime]::ParseExact($SentinelOne.InstallDate, 'yyyyMMdd', $null))
	$LastRestart = Get-Date $Boot.LastRestart

	#Write-Host "Last Reboot: $LastRestart"
	#Write-Host "S1 Installed: $InstallDate"

	<#
	Update the console_address with your subdomain, change the query limit on the filters_api if you wish, and update the
	YOUR_API_TOKEN with a token that has the correct API permissions.

	$json is the pure json results off the API, but the script will convert the json and export to csv.

	You can do this within your console from the API Doc page. Just navigate to Filters > Get Deep Visibility Filters.
	Change your limit and run from console to get the json output.
	https://YOUR_CONSOLE.sentinelone.net/api-doc/api-details?category=filters&api=get-deep-visibility-filters
	#>

	<# Check installation compliance #>

	$Installed = Get-WmiObject -Class Win32Reg_AddRemovePrograms \| Where-Object { $_.DisplayName -eq "Sentinel Agent" }
	If ( -Not $Installed ) {
	# Sentinel Agent not installed/missing.
	Return $false
	} Else {
	Return $true
	}