Lab Instructions

For this exercise, examine and compare the legitimate sample with the malicious sample. The malicious sample is a “Ferocious Kitten” malware, which masquerades as Windows “svchost.exe”, and the legitimate sample is a real Microsoft Windows svchost.exe.


Compose one specific rule to detect the malware based on suspicious looking strings.
Compose another rule to detect the malware based on its masquerade, using the PE module’s pe.version_info.
Think of this as a generic/anomaly rule, looking for malware that is imitating svchost but not actually svchost. This rule is likely much less specific than the first rule.
Try not to use things that are “specific” to the Kasper malware, such as malicious-looking strings. Instead, try to use use PE features or non-malicious strings that are in the malware that shouldn’t be there, or look for the absense of legitimate strings that are in the goodware.

Sha256 of samples:


d723b7c150427a83d8a08dc613f68675690fa0f5b10287b078f7e8d50d1a363f (Ferocious Kitten malware)
93b2ed4004ed5f7f3039dd7ecbd22c7e4e24b6373b4d9ef8d6e45a179b13a5e8 (legitimate svchost.exe)

Zip of both samples:


lab-malwaremasquerade.zip

https://drive.google.com/file/d/1pwNDaxeO3nAWOsRnHduYSzou76_m_7qr/view?usp=share_link

Zip password: infected


Attempt this lab on your own first, and then review my walkthrough video below to see how I approached it.


Optional: submit rules for feedback

Submit your completed rules here *if* you'd like feedback/comments. Otherwise, check out some of the solutions for ideas on how to approach detection at various levels.



Lab Solutions & Walkthrough


Full Rule Solutions

import "pe"
rule TTP_VersionInfo_Svchost_Has_C_Users_String {
	meta:
		desc = "Anything with svchost in the VersionInfo with C:\\Users path"
		ref = "D723B7C150427A83D8A08DC613F68675690FA0F5B10287B078F7E8D50D1A363F"
	strings:
		$s = "C:\\Users\\"
	condition:
		(
			pe.version_info["InternalName"] icontains "svchost" or
			pe.version_info["OriginalFilename"] icontains "svchost"
		)
	and $s
}
rule TTP_VersionInfo_Svchost_Manifest_Mismatch {
	meta:
		desc = "Anything with svchost in the VersionInfo"
		ref = "D723B7C150427A83D8A08DC613F68675690FA0F5B10287B078F7E8D50D1A363F"
	strings:
		$a1 = "<!-- Copyright (c) Microsoft Corporation -->"
		$a2 = "name=\"Microsoft.Windows.Services.SvcHost\""
		$a3 = "<description>Host Process for Windows Services</description>"
	condition:
		(
			pe.version_info["InternalName"] icontains "svchost" or
			pe.version_info["OriginalFilename"] icontains "svchost"
		)
		and not any of ($a*)
}
rule TTP_VersionInfo_Svchost_Giant_Filesize {
	meta:
		desc = "Anything with svchost in the VersionInfo"
		ref = "D723B7C150427A83D8A08DC613F68675690FA0F5B10287B078F7E8D50D1A363F"
	condition:
		filesize > 2MB
		and (
			pe.version_info["InternalName"] icontains "svchost" or
			pe.version_info["OriginalFilename"] icontains "svchost"
			)
}
rule FerociousKitten_D723B7_Strings {
	meta:
		desc = "Unique strings from a sample of malware associated with the threat actor Ferocious Kitten."
		ref = "D723B7C150427A83D8A08DC613F68675690FA0F5B10287B078F7E8D50D1A363F"
	strings:
		$a0 = "bitsadmin /cancel pdj"
		$a1 = "bitsadmin /SetPriority pdj HIGH"
		$a2 = "bitsadmin /addfile pdj"
		$b1 = "i.php?u=&i=proxy ip"
		$b2 = "mklg-binder.pdb"
		$b3 = "\\mklg -binder\\Release"
		$b4 = "<mark>%s</mark>"
	condition:
		uint16be(0) == 0x4d5a and
		1 of ($a*) and 2 of ($b*)
}



