Splunk BOTS: Dragos Write-Up

Dragos is an industrial (Industrial Control System/Operational Technology/Industrial Internet of Things) cybersecurity company on a mission to safeguard civilization.

Adding the Dragos Platform to Splunk provides defenders with the necessary tools to quickly prioritize, investigate, and respond to industrial threats which can also help compliance requirements across both IT and OT environments.

Host 192.168.97.6 got notified when 1756-L61/B LOGIX5561 card has undergone a PLC status change.

PLC stands for “Programmable Logic Controller”. It is like a small industrial computer brain that controls machines processes. It is like a reliable programmable switchboard, so instead of a person flipping switches, the PLC automatically makes the decisions.

A PLC has three main jobs. First, it takes in signals from sensors (like reading the room temperature). Second, it runs a program to decide what to do (like checking the program: “Is the room temperature below 16 degrees Celcius?”). And third, it sends out signals to control devices (like changing the thermostat state ON/OFF based on its input and program).

Determining if a PLC state change is legitimate or malicious is critical. A legitimate change must match the rules in the PLC’s actual program. It must be physically possible, occurring at the expected time, and following the correct sequence. It must also be initiated by authorised personnel or process. The bottom line is don’t trust the PLC alone.

The manufacturer for the PLC Processor Module is Allen-Bradley. Identifying the manufacturer, part number, model, and product/technical description of the hardware can help a user to know the hardware or firmware vulnerabilities. Moreover, knowing the built-in ports (e.g. RS-232) can also help with system upgrades and compatibilities.

The destination IP address of the TCP reverse shell that was detected was 10.0.0.131.

Most basic PLCs are “dumb” industrial devices. They have limited memory and processing power. They also run on specialised firmware, not operating systems like Linux or Windows. Hence, there is no ability to run Metasploit payloads directly on a PLC.

The most common and possible paths to attack the PLCs are through:

• Workstation (computer used to program the PLC)
• HMI (Human-Machine Interface computer)
• SCADA system (Supervisory Control and Data Acquisition)

The bottom line is while PLC chip itself might not run a reverse shell, the computer controlling it absolutely can. That is how most industrial attacks begin and modern PLCs are at higher risk.

SMB Command Shell Activity Using Comspec Environmental Variable

This alert is a red flag that someone is using legitimate Windows administration features for malicious purposes.

SMB stands for Server Message Block and it is used for file/print sharing between computers. Admins use it for remote management. Comspec Environment Variable on the other hand is a Windows system variable that points to cmd.exe or aka Command Prompt. An attacker can sneakily run commands through this legitimate channel and bypass some security tools and jump from one computer to another.

Pylogix is a tool written in python that allows users to read/write tag values in different types of PLCs (Rockwell Automation ControlLogix, CompactLogix, and Micro8xx PLCs). Pylogix also allows a user to route traffic through other devices. It is also useful for enumeration. Enumerating PLCs and ICS assets can show vulnerabilities if it is done by a threat actor.

Metasploit Detected: windows/speak_pwned

Metasploit is a penetration testing tool suite that is commonly used for testing security vulnerabilities in systems and applications.

PowerShell is a powerful tool for automation and system administration, and are also commonly leveraged for offensive capabilities. An example of an offensive PowerShell tool is the PowerShell Empire. It steals passwords and credentials, move laterally to other computers, install backdoor for future access, run ransomware or wipers, and exfiltrate data.

MS17–010 SMB1 Response STATUS_NOT_IMPLEMENTED — Possible NotPetya, EternalBlue, EternalRocks or WannaCry

EternalBlue targets SMBv1 for all versions of Windows operating systems. The targeted system has a mac address of F8:DB:88:3E:83:A0.

CIP Modify Control Logic Host 192.168.1.100 attempted to modify the control logic on host 192.168.1.6 by writing to the Usermemory object.

Host 192.168.1.100 attempted to modify the Usermemory object on the host 192.168.1.6 more than once.

Identifying which objects, fields, or values are being changed can indicate possible malicious intent, especially if those objects are not normally changed by different systems or devices.

CIP Error (Service Not Supported) Indicating Unauthorized Command Message Host 192.168.1.200 received CIP error code 8 extended error code N/A (Service Not Supported) from host 192.168.1.6 after issuing a Get Attribute List request to class Identity. This may indicate a device misconfiguration or an adversary attempting to interact with a controller.

CIP (Common Industrial Protocol) is a communication protocol used in industrial automation. It is used by devices like PLCs (Programmable Logic Controllers), HMIs (Human Machine Interfaces), and other industrial control system (ICS) devices to talk to each other.

In CIP, devices have objects with attributes. The “Get Attribute List” is a request to read multiple attributes from an object. In this case, the request was made to the “Identity” object. The Identity object typically contains information about the device, such as manufacturer, product name, serial number, etc.

Error code 8 in CIP means “Service Not Supported”. This means that a device (192.168.1.200) sent a requested service (Get Attribute List) for the “Identity” object that is not supported by the target device (192.168.1.6).

One possible reason for this error is an adversary attempt. An attacker might be trying to enumerate information about the device by sending a Get Attribute List request. However, if the device doesn’t support this service, it returns an error. This could be a sign of a misconfigured application or an attacker who is not fully aware of the target’s capabilities. This type of attack falls under Reconnaissance.

The hostname “factory-talk-vi” is where the scanner originated.

Port scans is a classic reconnaissance behaviour. Probably an attacker might be performing reconnaissance to map the network and discover services — like a burglar checking which doors/windows are unlocked. Obviously this is done by an automated tool because 15 unique ports were scanned in 0m0s (0 minute 0 second). From the ports that was enumerated, this suggests that the scanner is looking for both IT and OT systems. A major red flag is that industrial systems (e.g. MODBUS 502 Port) shouldn’t be scanned by random devices. This means the attacker is after control systems.

Within 1hr, host 192.168.2.2 (65) was logged into and received a file from the same source host 192.168.193.12 (67). Access technique: None Logon. File Transfer technique: Remote File Copy Remote File Copy.

The target host (192.168.2.2) was logged into and received a file from the source host (192.168.193.12).

Access technique: “None Logon”

This is unusual. Typically, a logon event would have a logon type (like interactive, network, etc.). “None” might indicate that the logon was not done through standard authentication methods. This could be due to a backdoor, a vulnerability that allows access without authentication, or the use of stolen credentials hashes that are not being logged properly.

File Transfer technique: “Remote File Copy Remote File Copy”

This suggests that a file was copied from the source to the target using some remote file copy protocol. It could be done via commands like scp, ftp, or using Windows file sharing (SMB). The repetition of “Remote File Copy” might be a formatting issue or it could indicate two separate file copy events.

The numbers (65) and (67) are Windows Event IDs. Both IDs help in identifying successful authentications and tracking user activities.

The alert is triggered because within one hour, the same source host both logged into the target and transferred a file to it.

There was a Metasploit reverse TCP shell detected, started from 10.0.0.128 and it was connecting to 10.0.0.131.

IP address 192.168.212.229 uses pycomm3 the most. Pycomm3 is an open source python library for communicating with Allen-Bradley PLCs using Ethernet/IP. Aside from reading files in different PLCs, it can also write changes.

The protocol Ethernet/IP is used to read and write tag values. Reading data from PLCs is used for checking values, settings, and configurations.

Any type of data can be used with the “request_data” command. There are multiple drivers in pycomm3 — CIPDriver, LogixDriver, SLCDriver. Allen-Bradley and Rockwell Automation PLCs can be used with Pycomm3.

Honeywell DSA Primary CPU Change

Searching for and Identifying asset information within the monitoring solutions is important to be able to verify vulnerabilities and exploit attempts.

Host on 10.0.0.128 attempted to execute commands on remote host on 10.0.0.131 using xp_cmdshell

MSSQL (Microsoft SQL Server) is a database server that stores and manages data. It often contains sensitive data. An “xp_cmdshell” is a built-in MSSQL feature that allows running Windows command prompt directly from the database. This is dangerous because SQL Server usually runs as privileged Windows account and this allows a remote control to the Windows operating system. The attacker is using “xp_cmdshell” to establish full control of the database server.

The command “sp_configure” is used to enable “xp_cmdshell”. It is disabled by default. Mitigation of some vulnerabilities is as simple as turning off some commands that may be turned on by default. If it is not needed for operational use, then it must be turned off.

Workstation Compromise followed by Action on Objective Workstation Compromise notification alerted which indicates asset 21151 may be compromised. Asset 21146 response function or process control may be impacted. The following list of notifications were related to this asset: PLC Date/Time Change and potentially concercing asset characteristic(s)

Given the above, the alert is indicating a multi-stage attack. The workstation (asset 21151) is compromised. The attacker uses the workstation to access the industrial network and target the PLC (asset 21146). Then the attacker performs actions on the PLC, such as changing its date/time, which could be a sign to more harmful actions. This is a severe alert because the attacker/s have compromised a workstation and are now actively manipulating the industrial control systems — possibly to cause physical damage or disruption.

.jar file download request

One of the hosts on the network is used for running certain pieces of Siemens software. It looks like the host was attempting to download a file multiple times. The Siemens host machine was trying to download the “.jar” file from the destination IP address 192.168.192.74.

RDP Port Mismatch Host on 192.168.208.1 negotiated a Remote Desktop Protocol session with host on 192.168.97.2 over port 55555. RDP typically uses port 3389. This tactic is consistent with techniques designed to evade detection.

RDP is a protocol used for remote access to Windows systems. The standard port for RDP is 3389 (TCP). Security tools often monitor this port for brute force attacks, unauthorised access, and whatnot. In this alert, an RDP session is being established on port 55555. This is a non-standard port for RDP and the attacker (192.168.208.1) is using this non-standard port to evade security monitoring and bypass firewall rules on the target server (192.168.97.2). This in an evasion technique.

Indicator Forwarder RDP Negotiation Request — nonstandard dst port

“Forwarded RDP Negotiation Request” likely means that the RDP traffic is being forwarded (possibly through a tunnel or a proxy) and the destination port is non-standard. The destination host is named “rshistorian”, which sounds like a historian server (a system used to collect and store logs or process data from SCADA or similar devices). This mean an attacker is using a sophisticated RDP tunneling technique to stealthily access the critical industrial historian server and most likely to steal or manipulate operational data.

New Nmap Scanner New Nmap Scanner detected at asset: 7834 at 192.168.192.74

Nmap is an open-source enumeration tool to scan networks for hosts. It is a professional hacker reconnaissance tool. The same attacker machine (192.168.208.1) that was doing RDP tunneling and targeting the historian is now actively scanning and mapping your network using Nmap. The fact that the same IP is involved in RDP tunneling, port scanning, and now Nmap scanning suggests a multi-stage attack where the attacker is moving laterally through the network, escalating privileges, and mapping out systems for further exploitation.