While investigating the incident, we discovered a useful artifact smb_context
More in General
- We helped Apple fix a vulnerability in the kernel of its operating systems
We helped Apple fix a vulnerability in the kernel of its operating systems PT ESC expert…
- Recovering EVTX records: carving methods
Recovering EVTX records: carving methods 🧩 When investigating incidents where attackers encrypt virtual machine images, a…
- Operation Chewbacca
At the end of June, the PT ESC team, during incident investigations, discovered a new group…
- Your Zimbra server is at risk
Recently, our PT ESC IR team encountered a new attack by ransomware groups on Zimbra mail…
- He's not your gsocket
He's not gsocket to you 😑 During the investigation of one of the incidents, PT ESC…
💻 While investigating an incident, we discovered a useful artifact, smb_context
C:\Windows\SysWOW64\smb_context.log — the SMB event log from a well-known antivirus vendor.
We have not yet fully investigated how it works, but we found that by analyzing this log, it is possible to detect command execution, in particular using the smbexec, utility, as well as file access on disk.
The log may contain the following events:
PDMSmbFileAccessed
PDMSmbCreateFile
PDMSmbRenameFileExample:
<BeginStream>
PDMSmbFileAccessed("$windir\__1715675753.48",00000011000000000010010100100000,1399528814);
PDMSmbFileAccessed("$system32\cmpspy.dll",00001011110000000010001100100001,1399106043);
PDMSmbFileAccessed("$system32\reg.bat",00001011110000000010001100100001,1399106043);
<EndStream>
<BeginStream>
PDMSmbFileAccessed("$windir\psexesvc.exe",00001010100000000010001100100001,405741904);
<EndStream>#tool #detect #hunt
@ptescalator
More from global_author
- This is Siemens...
Recently, our colleagues from the Positive Industrial Expertise Center discovered a curious Windows sample on MalwareBazaar.…
- Anti-antivirus
Recently, we came across an APK with an intriguing and trust-inspiring name: «Антивирус ФСБ.apk». After installing…
- .exe .docm .xlsm
.exe .docm .xlsm Malicious files with these extensions are most often found in corporate network traffic.…
- Chaos, shock, private keys from a not-so-private GitLab 💻
Over the past couple of months, the attacker has been distributing trojans from several npm accounts:…
- ::%16777216 — so what exactly are you?
::%16777216 — so what exactly are you? It is known that during attacks, adversaries can use…
More in General
- We helped Apple fix a vulnerability in the kernel of its operating systems
We helped Apple fix a vulnerability in the kernel of its operating systems PT ESC expert…
- Recovering EVTX records: carving methods
Recovering EVTX records: carving methods 🧩 When investigating incidents where attackers encrypt virtual machine images, a…
- Operation Chewbacca
At the end of June, the PT ESC team, during incident investigations, discovered a new group…
- Your Zimbra server is at risk
Recently, our PT ESC IR team encountered a new attack by ransomware groups on Zimbra mail…
- He's not your gsocket
He's not gsocket to you 😑 During the investigation of one of the incidents, PT ESC…