DFIR Ryuk's Return October 2020

Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. Wizard Spider has also used AdFind, nltest/dclist, and PowerShell script Get-DataInfo.ps1 to enumerate domain computers, including the domain controller.

Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement.

Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.

Bazar can execute a WMI query to gather information about the installed antivirus engine.

Wizard Spider has exfiltrated victim information using FTP.

Wizard Spider has used `cmd.exe` to execute commands on a victim's machine.

Wizard Spider has used Systeminfo and similar commands to acquire detailed configuration information of a victim's machine. Wizard Spider has also utilized the PowerShell cmdlet `Get-ADComputer` to collect DNS hostnames, last logon dates, and operating system information from Active Directory.

Bazar has the ability to identify domain administrator accounts.

Wizard Spider has identified domain admins through the use of `net group "Domain admins" /DOMAIN`. Wizard Spider has also leveraged the PowerShell cmdlet `Get-ADComputer` to collect account names from Active Directory data.

Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.

Rubeus can gather information about domain trusts.

Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.

Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine.

Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.

Rubeus can reveal the credentials of accounts that have Kerberos pre-authentication disabled through AS-REP roasting.

Wizard Spider has used `services.exe` to execute scripts and executables during lateral movement within a victim's network. Wizard Spider has also used batch scripts that leverage PsExec to execute a previously transferred ransomware payload on a victim's network.

Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.