it's almost curious it's not domains, right?
And that's another good point is with TrickBot,
I've seen it use very few DNS lookups.
Honestly,
the only things that I've ever seen the network traffic from
TrickBot do a DNS lookup for is when it first starts,
it will often go to one of these sites like whatismyip.com or IP,
apiinfo, things like that.
A site that will tell you what IP address you're at.
And it's likely doing that first to make sure that it has internet access,
and second,
it's probably comparing those IP addresses to known
security researchers like antivirus companies,
EDR companies,
things like that to make sure that it's not on a computer
that's actually at some security company.
(Aaron) Right, because just like, you know,
the blue team and your security operations team has
blacklists for malware domains,
malware authors have blacklists for security research.
(Tyler) Exactly.
And that's another really great indicator to look for on your network.
There are going to be legitimate programs and websites that do these IP lookups.
But, so you will get false positives, but if you're looking for those,
that is a great way to find any compromised systems on your network.
(Aaron) Yeah, absolutely.
And then if we're looking at host detections,
we can use things like osquery or any sort of agent-based search.
Even if you have sysmod running,
that's going to recognize that those files are being written.
We can use searches like, I don't know if you're familiar with the Sigma Project?
We can use that in our SIEMS to identify that file location being accessed.
So that AppData/Roaming, being accessed with new files,
that can be not necessarily a 100% indicator,
but if that's being updated with something new that's
generally only done upon a software installation,
and so if that's something new and interesting,
you can compare that to see if there's, you can use glob filters to identify hey,
am I getting these modules?
Especially, you said the module names are the same.
(Tyler) Yeah, the module names are normally always the same,
or very similar at least, so you could write a signature around those.
Because you're probably not going to have a file just appear on
your system called pwgrab64 and it be legitimate.
If it is, it's probably, you know, very few false positives for that.
(Aaron) Right, and the hashes will change,
but we can go based just off that string of the name for the modules.
(Tyler) Exactly.
(Aaron) Well, we'll upload some of those detections.
I'll throw some osquery searches you can use,
as well as a Sigma file, we'll upload that to the demo content as well.
We'll probably upload it to the Sigma Project for this new TrickBot instance.
(Tyler) Yeah,
and we did record the traffic that was going out
when the system was compromised.
And I think you had gone in and you were going to do some analysis on that,
right?
(Aaron) Yeah, absolutely.
So let's get into that next.
(Tyler) All right, sounds good.