きみのキーボードを誰かが、次にネットワーク全体を。ClickFix、Potemkin、RMMProject、EtherRATからのお知らせ

"graph TB %% Class Definitions classDef initial_access fill:#f96,stroke:#333,stroke-width:2px classDef execution fill:#3498db,stroke:#333,stroke-width:2px classDef defense_evasion fill:#9b59b6,stroke:#333,stroke-width:2px classDef persistence fill:#2ecc71,stroke:#333,stroke-width:2px classDef c2 fill:#e74c3c,stroke:#333,stroke-width:2px classDef credential_access fill:#f1c40f,stroke:#333,stroke-width:2px classDef lateral_movement fill:#1abc9c,stroke:#333,stroke-width:2px classDef defense_impairment fill:#34495e,stroke:#333,stroke-width:2px %% Initial Access and Execution Phase action_clickfix["<b>Action</b> – <b>T1204.004 User Execution: Malicious Copy and Paste</b><br/>Description: User is tricked via ClickFix social engineering to paste and run a command in the Windows Run Dialog.<br/><b/>Artifacts: cmd /min /c pcalua.exe -a mshta.exe…"] class action_clickfix initial_access exec_mshta["<b/>Action</b> – <b>T1218.005 System Binary Proxy Execution: Mshta</b><br/>Description: Abuses pcalua.exe to proxy mshta.exe execution to fetch remote HTA payload.<br/><b/>Artifacts: hte.hta payload, pcalua.exe"] class exec_mshta execution exec_msiexec["<b/>Action</b> – <b>T1218.007 System Binary Proxy Execution: Msiexec</b><br/>Description: Malicious MSI package is silently installed using msiexec.<br/><b/>Artifacts: inst24.msi, msiexec /qn"] class exec_msiexec execution %% Persistence and Loader Phase persist_netsh["<b/>Action</b> – <b>T1546.007 Event Triggered Execution: Netsh Helper DLL</b><br/>Description: Persistence established via an MSI AutostartRegistry component.<br/><b/>Artifacts: Potemkin loader, RunSearch.exe in %LOCALAPPDATA%MicrosoftRunSearch"] class persist_netsh persistence %% Command and Control Phase c2_dga["<b/>Action</b> – <b>T1568 Dynamic Resolution</b><br/>Description: Potemkin loader uses a Domain Generation Algorithm to find C2 servers.<br/><b/>Artifacts: Potemkin DGA"] class c2_dga c2 c2_ether["<b/>Action</b> – <b>T1568 Dynamic Resolution</b><br/>Description: EtherRAT resolves its C2 address from the Ethereum blockchain via EtherHiding.<br/><b/>Artifacts: EtherRAT"] class c2_ether c2 %% Credential Access Phase cred_steal["<b/>Action</b> – <b>T1539 Steal Web Session Cookie</b><br/>Description: RMMProject RAT targets browsers to steal cookies and credentials via DLL injection to bypass Chrome App-Bound Encryption.<br/><b/>Artifacts: RMMProject, browser SQLite databases"] class cred_steal credential_access %% Lateral Movement Phase lat_move["<b/>Action</b> – <b>T1210 Exploitation of Remote Services</b><br/>Description: Attacker moves laterally using WMIExec and SMBExec to spread the MSI installer.<br/><b/>Artifacts: WMIExec, SMBExec, msiexec /i <IP>ADMIN$Temp…"] class lat_move lateral_movement %% Defense Impairment Phase def_impair["<b/>Action</b> – <b>T1687 Exploitation for Defense Impairment</b><br/>Description: Fighting Windows Defender by patching AMSI, writing registry policies, and killing the service.<br/><b/>Artifacts: DisableAntiSpyware registry keys, Stop-Service WinDefend, AMSI patching"] class def_impair defense_impairment %% C2 Tunneling Phase c2_tunnel["<b/>Action</b> – <b>T1572 Protocol Tunneling</b><br/>Description: Using Chisel to establish reverse SOCKS tunnels and Cloudflare tunnels to expose internal services.<br/><b/>Artifacts: Chisel, cloudflared renamed to svchost.exe"] class c2_tunnel c2 %% Connections %% Flow from initial access to execution action_clickfix –>|leads_to| exec_mshta action_clickfix –>|leads_to| exec_msiexec %% Execution leads to persistence exec_msiexec –>|installs| persist_netsh %% Persistence leads to C2 and Loader deployment persist_netsh –>|deploys| c2_dga persist_netsh –>|deploys| c2_ether %% C2 activities lead to credential access c2_dga –>|executes| cred_steal c2_ether –>|executes| cred_steal %% Lateral movement spreads the attack cred_steal –>|enables| lat_move lat_move –>|deploys_to_new_hosts| exec_msiexec %% Defense impairment protects the attacker exec_mshta –>|used_to_patch| def_impair def_impair –>|facilitates| c2_tunnel "

アタックフロー