Splunk Boss of the SOCについて（その６　Weaponization）

[Boss of the SOC (BOTS) Investigation Workshop for Splunk](https://www.splunk.com/blog/2018/05/25/boss-of-the-soc-bots-investigation-workshop-for-splunk.html)のbotv1を使用してScenario #1_APTを順繰りやっていく６回目。:sweat:長いな


サイバーキルチェーンは[ここ](https://www.macnica.net/solution/security_apt.html/)を参照。
[初回](https://qiita.com/toshikawa/items/403aaf0901e778629e6d)が偵察（reconnaissance）で、[第２回](https://qiita.com/toshikawa/items/f3ede7ccc40ea68a0412)が攻撃(exploitation)、[第３回](https://qiita.com/toshikawa/items/d17eeecef180a441e41f)が設置（Installation）、[前前回](https://qiita.com/toshikawa/items/e5157b10d947822c301b)が目的に対する行動（Actions on Objective）、[前回](https://qiita.com/toshikawa/items/c549c65bfc3b3a048c49)が遠隔操作(Command & Control)、今回が武器化（Weaponization）

##Using OSINT to Identify Attacker Infrastructure
####robtex domain
```
https://www.robtex.com/dns-lookup/prankglassinebracket.jumpingcrab.com
```
のように、`htttps://www.robtex.com/dns-lookup/`の次にドメイン名
####robtex ip
```
https://www.robtex.com/ip-lookup/23.22.63.114
```
のように、`htttps://www.robtex.com/ip-lookup/`の次にＩＰアドレス
####ThreatCrowd ip
```
https://threatcrowd.org/ip.php?ip=23.22.63.114
```
のように、`https://threatcrowd.org/ip.php?ip=`の次にＩＰアドレス
####VirusTotal ip
```
https://www.virustotal.com/#/ip-address/23.22.63.114
```
のように、`https://www.virustotal.com/#/ip-address/`の次にＩＰアドレス
####VirusTotal domain
```
https://www.virustotal.com/#/domain/wynecorpinc.com
```
のように、`https://www.virustotal.com/#/domain/`の次にドメイン名
####DomainTools domain
```
http://whois.domaintools.com/po1s0n1vy.com
```
のように、`http://whois.domaintools.com/`の次にドメイン名
####

今だとwhois情報でemailアドレスとかでるのが稀なので、関連性の確認やホスティング先の確認などに使う。
有料アカウント欲しいな・・・・

##Using OSINT to Find Clues Pertaining to the Adversary
####VirusTotal - Analysis
```
https://www.virustotal.com/en/file/9709473ab351387aab9e816eff3910b9f28a7a70202e250ed46dba8f820f34a8/analysis/
```
SysmonのログからわかったハッシュはVirustotalで検索
![qiira4.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/130729/55025dbf-d1a1-61a1-f53d-476b5b9be34c.png)
####VirusTotal - File Detail
![qiita5.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/130729/8b262d77-38eb-d666-fbe3-8c3fd5322dee.png)
[googleでファイル名検索](https://www.google.com/search?q=MirandaTateScreensaver.scr.exe&oq=MirandaTateScreensaver.scr.exe&aqs=chrome..69i57&sourceid=chrome&ie=UTF-8)すると、動的解析結果もいっぱいでる。

####VirusTotal - Comments
```
53 74 65 76 65 20 42 72 61 6e 74 27 73 20 42 65 61 72 64 20 69 73 20 61 20 70 6f 77 65 72 66 75 6c 20 74 68 69 6e 67 2e 20 46 69 6e 64 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 61 73 6b 20 68 69 6d 20 74 6f 20 62 75 79 20 79 6f 75 20 61 20 62 65 65 72 21 21 21
```
Ａｐｐｓが[HEX Converter](http://www.rapidtables.com/convert/number/hex-to-ascii.htm)を使用してるので今回は[CyberChef](https://gchq.github.io/CyberChef/#recipe=From_Hex('Auto')&input=NTMgNzQgNjUgNzYgNjUgMjAgNDIgNzIgNjEgNmUgNzQgMjcgNzMgMjAgNDIgNjUgNjEgNzIgNjQgMjAgNjkgNzMgMjAgNjEgMjAgNzAgNmYgNzcgNjUgNzIgNjYgNzUgNmMgMjAgNzQgNjggNjkgNmUgNjcgMmUgMjAgNDYgNjkgNmUgNjQgMjAgNzQgNjggNjkgNzMgMjAgNmQgNjUgNzMgNzMgNjEgNjcgNjUgMjAgNjEgNmUgNjQgMjAgNjEgNzMgNmIgMjAgNjggNjkgNmQgMjAgNzQgNmYgMjAgNjIgNzUgNzkgMjAgNzkgNmYgNzUgMjAgNjEgMjAgNjIgNjUgNjUgNzIgMjEgMjEgMjE)で
![qiita7.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/130729/747dba1d-c714-f83c-f74d-d3b88812481c.png)


Weaponizationはここまで。キリがいいのでこれで終わります。