Investigate Mythic Agent

*Based on the tutorial by MyDFIR — Soc Analyst Challenge Day 28 *Objective: Learn how to investigate the Mythic telemtry we generated

Identifying potential C2: [Looking for Process creations, Network Creations: (Sysmon event ID: 3)]

On our Dashboard for suspicious activities, we have discovered a powershell outbound connection to the IPaddress: 149.248.56.154

Search on Kibana with the query: event.code : 3 and winlog.event_data.DestinationIp : "149.248.56.154"

Timelines: → Sep 27, 2024 @ 17:57:00.112 : — Network connection detected towards 149.248.56.154 winlog.event_data.ProcessGuid: {a40b098e-d4ec-66f6–170b-000000000600}

→ Filter for the ProcessGuid of the first Network connection event → Shows [Sep 27, 2024 @ 17:53:16.946] Process Create event

→ Scroll down to see [Sep 27, 2024 @ 17:53:17.643] File Created event (event.code: 11) [PSScriptPolicy → generated whn opening PowerShell]

→ Scrolling further down to see [Sep 27, 2024 @ 17:56:59.033] File Created event (event.code: 11) → Powershell is used to create the file svchost-MHaq.exe under the directory of C:\Users\Public\Downloads\

→ [Sep 27, 2024 @ 17:57:01.420] File Executable Detected (event.code: 29) → SHA1=DAD685527FDA963B3BAB406D1FE16DDA5C3472A5

→ [Sep 27, 2024 @ 18:10:47.337] Process Create (event.code: 1) of svchost-MHaq.exe winlog.event_data.ProcessGuid {a40b098e-d907–66f6–1b0b-000000000600}

So far, we have identified the timelines and how PowerShell was used to download the executable file svchost-MHaq.exe through monitoring the events.

Modifying the Elastic rules to push alerts into osTicket

Rules → Detection rules (SIEM) → Mythic C2-Apollo-Detected

→ Edit rule settings

→Actions → Select Webhook

Body → Same configuartion as SSH & RDP brute force alerts

<?xml version="1.0" encoding="UTF-8"?>
<ticket alert="true" autorespond="true" source="API">
    <name>Elastic RDP</name>
    <email>api@osticket.com</email>
    <subject>{{rule.name}}</subject>
    <phone>318-555-8634X123</phone>
    <message type="text/plain"><![CDATA[Please investigate the rule: {{rule.name}}
    Link: {{rule.url}}]]></message>
</ticket>

→ Save Changes

Triggering Apollo on the Windows server generates the Mythic-C2-Apollo-Detected rule and the alert is now pushed on to osTicket successfully.

This concludes investigating the Mythic telemetry. This guide follows the Youtube video created by MyDFIR, part 28 of a series of videos to help gain practical skills for beginner SOC analysts. The specific video is linked below:

[embed]