Empire Shell Net Domain Admins
Contents
Empire Shell Net Domain Admins#
Metadata#
Contributors |
Roberto Rodriguez @Cyb3rWard0g |
Creation Date |
2019/05/18 |
Modification Date |
2020/09/20 |
Tactics |
|
Techniques |
|
Tags |
Domain Groups Enumeration,RPC SAMR SamrQueryInformationGroup |
Dataset Description#
This dataset represents adversaries enumerating members of domain groups (i.e. Domain Admins) via RPC SAMR interface over SMB. Some of the main RPC methods captured over the network are SamrLookupNamesInDomain (Opnum 17) and SamrQueryInformationGroup (Opnum 20) where there are indicators about the specific group name enumerated.
Datasets Downloads#
Type |
Link |
|---|---|
Host |
|
network |
Adversary View#
(Empire: stager/multi/launcher) >
[*] Sending POWERSHELL stager (stage 1) to 172.18.39.6
[*] New agent GM4LN8V9 checked in
[+] Initial agent GM4LN8V9 from 172.18.39.6 now active (Slack)
[*] Sending agent (stage 2) to GM4LN8V9 at 172.18.39.6
agents
[*] Active agents:
Name La Internal IP Machine Name Username Process PID Delay Last Seen Listener
---- -- ----------- ------------ -------- ------- --- ----- --------- ----------------
A7BWPR32 ps 172.18.39.5 WORKSTATION5 *THESHIRE\pgustavo powershell 5904 5/0.0 2020-09-18 18:29:36 http
HBEW9G1D ps 172.18.39.6 WORKSTATION6 THESHIRE\sbeavers powershell 6036 5/0.0 2020-09-18 18:15:39 http
UF5MYK42 ps 172.18.39.5 WORKSTATION5 *THESHIRE\pgustavo powershell 6404 5/0.0 2020-09-20 21:28:07 http
GM4LN8V9 ps 172.18.39.6 WORKSTATION6 THESHIRE\sbeavers powershell 5724 5/0.0 2020-09-21 08:05:25 http
(Empire: agents) > interact GM4LN8V9
(Empire: GM4LN8V9) > shell net group "Domain Admins" /domain
[*] Tasked GM4LN8V9 to run TASK_SHELL
[*] Agent GM4LN8V9 tasked with task ID 1
(Empire: GM4LN8V9) >
The request will be processed at a domain controller for domain theshire.local.
Group name Domain Admins
Comment Designated administrators of the domain
Members
-------------------------------------------------------------------------------
mscott pgustavo wardog
The command completed successfully.
..Command execution completed.
(Empire: GM4LN8V9) >
Explore Datasets#
Download & Decompress Dataset#
import requests
from zipfile import ZipFile
from io import BytesIO
url = https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/discovery/host/empire_shell_rpc_samr_smb_group_domain_admins_standard_user.zip
zipFileRequest = requests.get(url)
zipFile = ZipFile(BytesIO(zipFileRequest.content))
datasetJSONPath = zipFile.extract(zipFile.namelist()[0])
Read JSON File#
from pandas.io import json
df = json.read_json(path_or_buf=datasetJSONPath, lines=True)
Access Security Events#
df.groupby(['Channel']).size().sort_values(ascending=False)