Skip to content

Commit acf9f6b

Browse files
Cyb3rWard0gCyb3rWard0g
committed
Mordor 0.0.2
1 parent f5c5cfb commit acf9f6b

File tree

124 files changed

+4323
-953
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

124 files changed

+4323
-953
lines changed

‎CHANGELOG.md

+110
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# Changelog
2+
3+
## Verion 0.0.2
4+
----------------------------------
5+
6+
[Full Changelog](https://github.com/Cyb3rWard0g/mordor/compare/0.0.1...0.0.2)
7+
8+
### Fixed:
9+
**defense evesion**
10+
11+
* Process Injection
12+
* Empire PsInject
13+
14+
### Added:
15+
**Credential Access**
16+
17+
* Credential Dumping
18+
* Empire Mimikatz Export Master Key
19+
* Empire Mimikatz Extract Tickets
20+
* Empire Mimikatz Lsadump
21+
* Empire Powerdump
22+
23+
**Defense Evasion**
24+
25+
* Modify Registry
26+
* Empire Enable RDP
27+
* Empire Wdigest Downgrade
28+
29+
* Process Injection
30+
* Empire Dll Injection
31+
32+
* Trusted Developer Utilities
33+
* Empire Invoke Msbuild
34+
35+
**Discovery**
36+
37+
* Account Discovery
38+
* Empire Fin-LocalAdminAccess
39+
* Empire Net User Domain SPecific
40+
41+
* System Network Connections Discovery
42+
* Empire Get Session Local
43+
* Empire Get Session DC
44+
45+
* System Service Discovery
46+
* Empire Net Start
47+
* Empire Powerup All Checks
48+
49+
**Execution**
50+
51+
* PowerShell
52+
* Empire Invoke Psremoting
53+
* Service Execution
54+
* Empire Invoke Psexec
55+
* Windows Management Instrumentation
56+
* Empire Invoke wmi debugger
57+
* Empire wmic add user backdoor
58+
59+
**Lateral Movement**
60+
61+
* Distributed Component Object Model
62+
* Empire Invoke DCOM
63+
* Trusted Developer Utilities
64+
* Empire Invoke Msbuild
65+
* Windows Admin Shares
66+
* Empire Infoke Smbexec
67+
* PowerShell
68+
* Empire Invoke Psremoting
69+
* Service Execution
70+
* Empire Invoke Psexec
71+
* Windows Management Instrumentation
72+
* Empire Invoke wmi debugger
73+
* Empire wmic add user backdoor
74+
75+
**Persistence**
76+
77+
* Registry Run
78+
* Empire Elevated Registry
79+
* Scheduled Tasks
80+
* Empire Elevated Schtasks
81+
* WMI Event Subscription
82+
* Empire Elevated WMI
83+
84+
**Privilege Escalation**
85+
86+
* Access Token Manipulation
87+
* Empire Invoke Runas
88+
* Bypass UAC
89+
* Empire Ask
90+
91+
### Updated:
92+
**Execution**
93+
94+
* Windows Management Instrumentation
95+
* Empire Invoke-Wmi
96+
97+
**Credential Access**
98+
99+
* Credential Dumping
100+
* Empire Mimikatz logonpasswords
101+
102+
**Discovery**
103+
104+
* Permissions Group Discovery
105+
* Empire Net Domain Admins
106+
107+
**Execution**
108+
109+
* Scripting
110+
* Empire Launcher Vbs

‎README.md

+2-43
Original file line numberDiff line numberDiff line change
@@ -20,47 +20,6 @@ The name **Mordor** comes from the awesome book/film series "[The Lord of the Ri
2020
* Ingest known bad data samples for training and capture the flag (CTF) events.
2121
* Learn more about red team simulation exercises and technology such as Kafkacat, Kafka and Jupyter Notebooks.
2222

23-
# Why Mordor?
24-
25-
Think about an attack that you want to test in your lab environment.
26-
Let's say we want to emulate an adversary using a non-domain-controller-account abusing the use of Active Directory replication services to optain the NTLM hash of user.
27-
What do we do if we want to automate and expedite the emulation process? Usually the following might happen:
28-
29-
* Google for "DCSync" to look for the right script or red team simulation toolkit/project to execute the attack.
30-
* Find that it can be done via several programming languages and several tools out there.
31-
* Pick a "variant". In this case let's say we pick the Invoke-Mimikatz script from Powershell Empire.
32-
* Test the adversarial technique.
33-
* Document relevant data sources. At the endpoint level, the main behavior produces specific Windows Security events (Event ID 4662).
34-
* Consider other variants and try another way to accomplish the main adversarial objective.
35-
* Test another basic variant via another atomic red teaming toolkit. At the endpoint level, the main behavior produces the same Windows Security events (Events ID 4662).
36-
* Learn and test new ways to execute the adversarial technique (i.e .NET) and run it again.
37-
* At the endpoint level, the main behavior produces again the same Windows Security events (Events ID 4662).
38-
39-
In my basic DCSync test I was using a user with replication permissions to initiate an ad replication operation.
40-
The user name was ``Mmidge``.
41-
I was getting one of the following events:
42-
43-
<img src="docs/source/_static/event-log-dcsync-one.png" width="500" height="" />
44-
45-
## What is going on here?
46-
47-
Most of the time, depending on the detection goal, it does not matter what tool or programming language I use to emulate the adversarial technique or how many times I execute the attack, I still get the same event logic, pattern or relevant data.
48-
49-
From my basic example, I ask myself these question:
50-
51-
* What is my main goal?
52-
* Do I want to primarily detect .NET behavior or the behavior of a non-domain-controller account abusing ad replication services?.
53-
54-
Do not get me wrong, the extra context of the execution method or the technique enabler is also valuable.
55-
However, I believe that we can expedite the emulation of an adversarial technique by giving you the relevant data and pattern directly and go straight to the analysis phase of your threat detection strategy.
56-
57-
## Do I ONLY get the events related to the adversarial techniques?
58-
59-
* You get the potential relevant events and the extra context produced by other security events that get created during the time window of the log collection.
60-
* This is valuable if you want to explore other ways to enrich your data analytic and use extra context from events from different data sources.
61-
* For example, you also get events of the command and control communication from the endpoint which can then be mapped to the specific adversarial technique you are analyzing.
62-
* In addition, depending on the type of dataset you use, you get more context. Learn more about them in our [documentation here](https://mordor.readthedocs.io/en/latest/mordor_categorization.html)
63-
6423
# Getting Started
6524

6625
* Mordor Environments
@@ -100,7 +59,7 @@ There are a few things that we would like to accomplish with this repo as shown
10059
- [ ] Share Terraform & Packer config files to deploy the same environment in the cloud
10160
- [ ] Add a Bro sensor
10261
- [ ] Multiple custom network setup for contributions
103-
- [ ] Prepare Large Dataset ;)
104-
- [ ] Logo
62+
- [X] Prepare Large Dataset ;)
63+
- [X] Logo
10564

10665
More coming soon...

‎docs/source/_static/empire_ask.png

215 KB
Loading

‎docs/source/_static/empire_launcher_vbs.png

1.53 KB
Loading

‎docs/source/network_shire.rst

+17-17
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,23 @@ Network Design
1515
:alt: The Shire Design
1616
:scale: 35%
1717

18-
+-----------+-------------+---------------+-----------+---------------+---------------+
19-
| Platform | Version | Purpose | Name | IP Address | Main User |
20-
+===========+=============+===============+===========+===============+===============+
21-
| Windows | Win 2016 | DC | HFDC1 | 172.18.39.5 | Administrator |
22-
+-----------+-------------+---------------+-----------+---------------+---------------+
23-
| Windows | Win 10 | Client | HR001 | 172.18.39.106 | nmartha |
24-
+-----------+-------------+---------------+-----------+---------------+---------------+
25-
| Windows | Win 10 | Client | IT001 | 172.18.39.105 | pgustavo |
26-
+-----------+-------------+---------------+-----------+---------------+---------------+
27-
| Windows | Win 10 | Client | ACCT001 | 172.18.39.100 | lrodriguez |
28-
+-----------+-------------+---------------+-----------+---------------+---------------+
29-
| Windows | Win 2016 | Win Collector | WECServer | 172.18.39.102 | wecserver |
30-
+-----------+-------------+---------------+-----------+---------------+---------------+
31-
| Linux | HELK 0.1.7 | Log Collector | helk | 10.0.10.102 | helk |
32-
+-----------+-------------+---------------+-----------+---------------+---------------+
33-
| Linux | Kali 2018.4 | Red Team C2 | kali | 10.0.10.106 | wardog |
34-
+-----------+-------------+---------------+-----------+---------------+---------------+
18+
+-----------+-------------+---------------+---------------------+---------------+---------------+
19+
| Platform | Version | Purpose | FQDN | IP Address | Main User |
20+
+===========+=============+===============+=====================+===============+===============+
21+
| Windows | Win 2016 | DC | HFDC1.shire.com | 172.18.39.5 | Administrator |
22+
+-----------+-------------+---------------+---------------------+---------------+---------------+
23+
| Windows | Win 10 | Client | HR001.shire.com | 172.18.39.106 | nmartha |
24+
+-----------+-------------+---------------+---------------------+---------------+---------------+
25+
| Windows | Win 10 | Client | IT001.shire.com | 172.18.39.105 | pgustavo |
26+
+-----------+-------------+---------------+---------------------+---------------+---------------+
27+
| Windows | Win 10 | Client | ACCT001.shire.com | 172.18.39.100 | lrodriguez |
28+
+-----------+-------------+---------------+---------------------+---------------+---------------+
29+
| Windows | Win 2016 | Log Collector | WECServer.shire.com | 172.18.39.102 | wecserver |
30+
+-----------+-------------+---------------+---------------------+---------------+---------------+
31+
| Linux | HELK 0.1.7 | Data Analysis | helk | 10.0.10.102 | helk |
32+
+-----------+-------------+---------------+---------------------+---------------+---------------+
33+
| Linux | Kali 2018.4 | Red Team C2 | kali | 10.0.10.106 | wardog |
34+
+-----------+-------------+---------------+---------------------+---------------+---------------+
3535

3636
Data Sources Collected
3737
######################

‎small_datasets/windows/credential_access/credential_dumping_T1003/credentials_from_ad/README.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@ An adversary with enough permissions can abuse active directory services to acce
44

55
## Technique Variations Table
66

7-
| RT Platform | Network | Dataset | Updated |
8-
| ----------- | ------- | --------- | ------- |
9-
| empire | shire | [empire_dcsync](./empire_dcsync.md) | 2019-03-01174830 |
7+
| Network | Dataset | Updated |
8+
| ------- | --------- | ------- |
9+
| shire | [empire_dcsync](./empire_dcsync.md) | 2019-03-01174830 |

‎small_datasets/windows/credential_access/credential_dumping_T1003/credentials_from_ad/empire_dcsync.md

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
# Empire DCSync
32

43
An adversary with replication permissions (default in Domain Admins) can use the active directory replication apis to pull the NTLM hash of any user in the network.
@@ -78,7 +77,7 @@ Shire
7877
| Microsoft-Windows-PowerShell/Operational | Microsoft-Windows-PowerShell | Executing Pipeline | 2325 |
7978
| Microsoft-Windows-Bits-Client/Operational | Microsoft-Windows-Bits-Client | na | 6 |
8079

81-
## Empire Activity
80+
## Attacker Activity
8281

8382
```
8483
usemodule credentials/mimikatz/dcsync

‎small_datasets/windows/credential_access/credential_dumping_T1003/credentials_from_memory/README.md

+5-3
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ An adversary can grab credentials from the memory contents of processes such as
44

55
## Technique Variations Table
66

7-
| RT Platform | Network | Dataset | Updated |
8-
| ----------- | ------- | --------- | ------- |
9-
| empire | shire | [empire_mimikatz_logonpasswords](./empire_mimikatz_logonpasswords.md) | 019-03-19130532 |
7+
| Network | Dataset | Updated |
8+
| ------- | --------- | ------- |
9+
| shire | [empire_mimikatz_logonpasswords](./empire_mimikatz_logonpasswords.md) | 2019-05-18202151 |
10+
| shire | [empire_mimikatz_extract_tickets](./empire_mimikatz_extract_tickets.md) | 2019-05-18230752 |
11+
| shire | [empire_mimikatz_export_master_keys](./empire_mimikatz_export_master_key.md) | 2019-05-18235535 |

0 commit comments

Comments
 (0)