diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 00000000..13fdfa73 --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1 @@ +github: [ION28] diff --git a/.github/workflows/cloud-web.yml b/.github/workflows/cloud-web.yml deleted file mode 100644 index 61a5806a..00000000 --- a/.github/workflows/cloud-web.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Deploy Project Website to bluespawn.cloud -on: - push: - branches: - - master - - develop - pull_request: - branches: - - master - - develop - -jobs: - build: - name: Update Project site - runs-on: ubuntu-latest - steps: - - name: SSH into server and update - uses: appleboy/ssh-action@master - with: - host: bluespawn.cloud - username: ubuntu - key: ${{ secrets.PRIVATE_KEY }} - port: 22 - script: | - cd ~/BLUESPAWN - git fetch --all - git checkout ${{ github.ref }} - git pull origin ${{ github.ref }} - source ~/venv/bin/activate - cd docs - pip install -r requirements.txt - python3 manage.py makemigrations - python3 manage.py migrate - sudo service uwsgi restart - sudo /etc/init.d/nginx restart - if: github.event_name == 'push' - - - name: SSH into server and update - uses: appleboy/ssh-action@master - with: - host: bluespawn.cloud - username: ubuntu - key: ${{ secrets.PRIVATE_KEY }} - port: 22 - script: | - cd ~/BLUESPAWN - git fetch --all - git checkout ${{ github.head_ref }} - git pull origin ${{ github.head_ref }} - source ~/venv/bin/activate - cd docs - pip install -r requirements.txt - python3 manage.py makemigrations - python3 manage.py migrate - sudo service uwsgi restart - sudo /etc/init.d/nginx restart - if: github.event_name == 'pull_request' diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 45781c6c..3059119b 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -25,12 +25,10 @@ jobs: - name: Update submodules run: git submodule update --init --recursive - - name: Restore from cache, and install vcpkg and project dependencies - uses: lukka/run-vcpkg@v6 + - name: Setup vcpkg environment + uses: lukka/run-vcpkg@v11 with: - vcpkgArguments: '@../vcpkg_response_file.txt' - vcpkgDirectory: 'vcpkg' - appendedCacheKey: ${{ hashFiles(env.vcpkgResponseFile) }} + vcpkgDirectory: '${{ github.workspace }}/vcpkg' - name: Integrate vcpkg packages shell: powershell @@ -39,10 +37,12 @@ jobs: .\vcpkg.exe integrate install cd .. + - name: Setup MSBuild + uses: microsoft/setup-msbuild@v2 + - name: Build BLUESPAWN-client - run: | - "%ProgramFiles(x86)%\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin\MSBuild.exe" BLUESPAWN.sln /p:Configuration=${{ matrix.buildtype }} /p:Platform=${{ matrix.buildarch }} shell: cmd + run: msbuild BLUESPAWN.sln /p:Configuration=${{ matrix.buildtype }} /p:Platform=${{ matrix.buildarch }} /p:VcpkgEnableManifest=true /p:VcpkgManifestDir=${{ github.workspace }} - name: Set PowerShell Execution Policy run: powershell set-executionpolicy Unrestricted diff --git a/BLUESPAWN-win-client/BLUESPAWN-client.vcxproj b/BLUESPAWN-win-client/BLUESPAWN-client.vcxproj index 9d1221f0..fe2be8ed 100644 --- a/BLUESPAWN-win-client/BLUESPAWN-client.vcxproj +++ b/BLUESPAWN-win-client/BLUESPAWN-client.vcxproj @@ -287,7 +287,7 @@ Application - v142 + v143 diff --git a/BLUESPAWN-win-client/headers/hunt/hunts/HuntT1484.h b/BLUESPAWN-win-client/headers/hunt/hunts/HuntT1484.h index cd6cae3f..861737e4 100644 --- a/BLUESPAWN-win-client/headers/hunt/hunts/HuntT1484.h +++ b/BLUESPAWN-win-client/headers/hunt/hunts/HuntT1484.h @@ -12,6 +12,8 @@ namespace Hunts { public: HuntT1484(); + void Subtechnique001(IN CONST Scope& scope, OUT std::vector>& detections); + virtual std::vector> RunHunt(const Scope& scope) override; virtual std::vector, Scope>> GetMonitoringEvents() override; }; diff --git a/BLUESPAWN-win-client/headers/monitor/EventListener.h b/BLUESPAWN-win-client/headers/monitor/EventListener.h index 54681d04..544f46fd 100644 --- a/BLUESPAWN-win-client/headers/monitor/EventListener.h +++ b/BLUESPAWN-win-client/headers/monitor/EventListener.h @@ -5,6 +5,7 @@ #include #include #include +#include #include "util/wrappers.hpp" diff --git a/BLUESPAWN-win-client/libpeconv.vcxproj b/BLUESPAWN-win-client/libpeconv.vcxproj index 1d9056fe..8ff738c7 100644 --- a/BLUESPAWN-win-client/libpeconv.vcxproj +++ b/BLUESPAWN-win-client/libpeconv.vcxproj @@ -53,7 +53,7 @@ StaticLibrary - v142 + v143 diff --git a/BLUESPAWN-win-client/pe-sieve.vcxproj b/BLUESPAWN-win-client/pe-sieve.vcxproj index 8ed4e0ee..dea65abf 100644 --- a/BLUESPAWN-win-client/pe-sieve.vcxproj +++ b/BLUESPAWN-win-client/pe-sieve.vcxproj @@ -1,142 +1,142 @@ - - - - - Debug - x64 - - - Release - x64 - - - Debug - Win32 - - - Release - Win32 - - - - {BEC01F8E-5892-3F6F-A741-5BBD1D0F4EF9} - pe-sieve - - - - $(SolutionDir)build\$(PlatformTarget)\$(Configuration)\$(MSBuildProjectName).log - - - $(SolutionDir)BLUESPAWN-win-client\external\pe-sieve\include;$(SolutionDir)BLUESPAWN-win-client\external\pe-sieve\libpeconv\libpeconv\include;%(AdditionalIncludeDirectories) - UNICODE - - - Secur32.lib;DbgHelp.lib;Wintrust.lib;%(AdditionalDependencies) - - - - - StaticLibrary - v142 - - - MultiByte - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - {C9D09618-1DE6-3323-AED8-9B885AC8D9F3} - libpeconv - - + + + + + Debug + x64 + + + Release + x64 + + + Debug + Win32 + + + Release + Win32 + + + + {BEC01F8E-5892-3F6F-A741-5BBD1D0F4EF9} + pe-sieve + + + + $(SolutionDir)build\$(PlatformTarget)\$(Configuration)\$(MSBuildProjectName).log + + + $(SolutionDir)BLUESPAWN-win-client\external\pe-sieve\include;$(SolutionDir)BLUESPAWN-win-client\external\pe-sieve\libpeconv\libpeconv\include;%(AdditionalIncludeDirectories) + UNICODE + + + Secur32.lib;DbgHelp.lib;Wintrust.lib;%(AdditionalDependencies) + + + + + StaticLibrary + v143 + + + MultiByte + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + {C9D09618-1DE6-3323-AED8-9B885AC8D9F3} + libpeconv + + \ No newline at end of file diff --git a/BLUESPAWN-win-client/src/hunt/hunts/HuntT1036.cpp b/BLUESPAWN-win-client/src/hunt/hunts/HuntT1036.cpp index e40852e4..7c54c51d 100644 --- a/BLUESPAWN-win-client/src/hunt/hunts/HuntT1036.cpp +++ b/BLUESPAWN-win-client/src/hunt/hunts/HuntT1036.cpp @@ -17,7 +17,7 @@ namespace Hunts { } void HuntT1036::Subtechnique005(IN CONST Scope& scope, OUT std::vector>& detections) { - SUBTECHNIQUE_INIT(005, Match Legitimate Name or Location); + SUBTECHNIQUE_INIT(005, Match Legitimate Resource Name or Location); SUBSECTION_INIT(SEARCH_WRITABLE, Intensive); for(auto folder : writableFolders) { diff --git a/BLUESPAWN-win-client/src/hunt/hunts/HuntT1070.cpp b/BLUESPAWN-win-client/src/hunt/hunts/HuntT1070.cpp index d846ddb8..cf453ee9 100644 --- a/BLUESPAWN-win-client/src/hunt/hunts/HuntT1070.cpp +++ b/BLUESPAWN-win-client/src/hunt/hunts/HuntT1070.cpp @@ -12,7 +12,7 @@ namespace Hunts { - HuntT1070::HuntT1070() : Hunt(L"T1070 - Indicator Removal on Host") { + HuntT1070::HuntT1070() : Hunt(L"T1070 - Indicator Removal") { dwCategoriesAffected = (DWORD) Category::Files | (DWORD) Category::Processes; dwSourcesInvolved = (DWORD) DataSource::EventLogs; dwTacticsUsed = (DWORD) Tactic::DefenseEvasion; diff --git a/BLUESPAWN-win-client/src/hunt/hunts/HuntT1484.cpp b/BLUESPAWN-win-client/src/hunt/hunts/HuntT1484.cpp index cfea9483..f74c7c41 100644 --- a/BLUESPAWN-win-client/src/hunt/hunts/HuntT1484.cpp +++ b/BLUESPAWN-win-client/src/hunt/hunts/HuntT1484.cpp @@ -9,15 +9,15 @@ namespace Hunts { - HuntT1484::HuntT1484() : Hunt(L"T1484 - Group Policy Modification") { + HuntT1484::HuntT1484() : Hunt(L"T1484 - Domain or Tenant Policy Modification") { dwCategoriesAffected = (DWORD) Category::Files; dwSourcesInvolved = (DWORD) DataSource::FileSystem | (DWORD) DataSource::GPO; dwTacticsUsed = (DWORD) Tactic::DefenseEvasion; } - std::vector> HuntT1484::RunHunt(const Scope& scope) { - HUNT_INIT(); - + void HuntT1484::Subtechnique001(IN CONST Scope& scope, OUT std::vector>& detections) { + SUBTECHNIQUE_INIT(001, Group Policy Modification); + SUBSECTION_INIT(NTUSER_MAN, Normal) auto userFolders = FileSystem::Folder(L"C:\\Users").GetSubdirectories(1); for(auto userFolder : userFolders) { @@ -28,6 +28,14 @@ namespace Hunts { } SUBSECTION_END(); + SUBTECHNIQUE_END(); + } + + std::vector> HuntT1484::RunHunt(const Scope& scope) { + HUNT_INIT(); + + Subtechnique001(scope, detections); + HUNT_END(); } diff --git a/BLUESPAWN-win-client/src/hunt/hunts/HuntT1569.cpp b/BLUESPAWN-win-client/src/hunt/hunts/HuntT1569.cpp index 1dca6a76..e455dbab 100644 --- a/BLUESPAWN-win-client/src/hunt/hunts/HuntT1569.cpp +++ b/BLUESPAWN-win-client/src/hunt/hunts/HuntT1569.cpp @@ -17,7 +17,7 @@ using namespace Registry; #define REGISTRY_SERVICES 0 namespace Hunts { - HuntT1569::HuntT1569() : Hunt(L"T1569 - Service Execution") { + HuntT1569::HuntT1569() : Hunt(L"T1569 - System Services") { dwCategoriesAffected = (DWORD) Category::Configurations | (DWORD) Category::Files | (DWORD) Category::Processes; dwSourcesInvolved = (DWORD) DataSource::Registry | (DWORD) DataSource::FileSystem; dwTacticsUsed = (DWORD) Tactic::Execution; diff --git a/BLUESPAWN-win-client/src/user/BLUESPAWN.cpp b/BLUESPAWN-win-client/src/user/BLUESPAWN.cpp index 91e43bec..f9d77de1 100644 --- a/BLUESPAWN-win-client/src/user/BLUESPAWN.cpp +++ b/BLUESPAWN-win-client/src/user/BLUESPAWN.cpp @@ -538,7 +538,7 @@ int main(int argc, char* argv[]) { } bluespawn.Run(); - } catch(cxxopts::OptionParseException e1) { + } catch(const cxxopts::exceptions::exception& e1) { Bluespawn::io.InformUser(StringToWidestring(options.help())); LOG_ERROR(e1.what()); } diff --git a/BLUESPAWN-win-client/src/util/eventlogs/EventLogs.cpp b/BLUESPAWN-win-client/src/util/eventlogs/EventLogs.cpp index 4bcaceae..549a8109 100644 --- a/BLUESPAWN-win-client/src/util/eventlogs/EventLogs.cpp +++ b/BLUESPAWN-win-client/src/util/eventlogs/EventLogs.cpp @@ -224,7 +224,7 @@ namespace EventLogs { // Open the channel config EventWrapper hChannel{ EvtOpenChannelConfig(NULL, channel.c_str(), 0) }; - if(NULL == hChannel) { + if(hChannel == nullptr) { LOG_ERROR(L"EventLogs::IsChannelOpen: EvtOpenChannelConfig failed with " + std::to_wstring(GetLastError()) + L" for channel " + channel); return false; @@ -257,10 +257,13 @@ namespace EventLogs { return false; } } - if(pProperty) + bool isEnabled = false; + if(pProperty) { + isEnabled = pProperty->BooleanVal; free(pProperty); + } - return pProperty->BooleanVal; + return isEnabled; } bool OpenChannel(const std::wstring& channel) { diff --git a/BLUESPAWN-win-client/yarac.vcxproj b/BLUESPAWN-win-client/yarac.vcxproj index b6646ea7..6054920e 100644 --- a/BLUESPAWN-win-client/yarac.vcxproj +++ b/BLUESPAWN-win-client/yarac.vcxproj @@ -1,184 +1,184 @@ - - - - - Debug - Win32 - - - Debug - x64 - - - Release - Win32 - - - Release - x64 - - - - {7C72350B-AA5B-41AD-8957-CE3924A7F11B} - Win32Proj - yarac - 10.0 - x86-windows-static - x64-windows-static - - - - Application - true - Unicode - v142 - - - Application - true - Unicode - v142 - - - Application - false - true - Unicode - v142 - - - Application - false - true - Unicode - v142 - - - - - - - - - - - - - - - - - - - - - - - false - - - false - - - false - - - false - - - - del "$(ProjectDir)resources\severe" && del "$(ProjectDir)resources\severe2" && del "$(ProjectDir)resources\indicators" - - + + + + + Debug + Win32 + + + Debug + x64 + + + Release + Win32 + + + Release + x64 + + + + {7C72350B-AA5B-41AD-8957-CE3924A7F11B} + Win32Proj + yarac + 10.0 + x86-windows-static + x64-windows-static + + + + Application + true + Unicode + v143 + + + Application + true + Unicode + v143 + + + Application + false + true + Unicode + v143 + + + Application + false + true + Unicode + v143 + + + + + + + + + + + + + + + + + + + + + + + false + + + false + + + false + + + false + + + + del "$(ProjectDir)resources\severe" && del "$(ProjectDir)resources\severe2" && del "$(ProjectDir)resources\indicators" + + cmd /c " "$(SolutionDir)artifacts\$(PlatformTarget)\$(Configuration)\yarac.exe" "$(ProjectDir)resources\severe.yar" "$(ProjectDir)resources\severe" & "$(SolutionDir)artifacts\$(PlatformTarget)\$(Configuration)\yarac.exe" "$(ProjectDir)resources\severe2.yar" "$(ProjectDir)resources\severe2" & "$(SolutionDir)artifacts\$(PlatformTarget)\$(Configuration)\yarac.exe" "$(ProjectDir)resources\indicators.yar" "$(ProjectDir)resources\indicators" & exit 0 -" - - - - - Level3 - NotUsing - Disabled - _DEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) - %(AdditionalIncludeDirectories) - false - CompileAsCpp - ProgramDatabase - MultiThreadedDebug - - - Console - true - ws2_32.lib;crypt32.lib;%(AdditionalDependencies) - false - - - - - Level3 - NotUsing - Disabled - _DEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) - %(AdditionalIncludeDirectories) - CompileAsCpp - ProgramDatabase - MultiThreadedDebug - - - Console - true - ws2_32.lib;crypt32.lib;%(AdditionalDependencies) - false - - - - - Level3 - NotUsing - MaxSpeed - true - NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) - CompileAsCpp - ProgramDatabase - MultiThreaded - - - Console - No - true - true - ws2_32.lib;crypt32.lib;%(AdditionalDependencies) - false - - - - - Level3 - NotUsing - MaxSpeed - true - NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) - CompileAsCpp - ProgramDatabase - MultiThreaded - - - Console - No - true - true - ws2_32.lib;crypt32.lib;%(AdditionalDependencies) - false - - - - - - - - +" + + + + + Level3 + NotUsing + Disabled + _DEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + %(AdditionalIncludeDirectories) + false + CompileAsCpp + ProgramDatabase + MultiThreadedDebug + + + Console + true + ws2_32.lib;crypt32.lib;%(AdditionalDependencies) + false + + + + + Level3 + NotUsing + Disabled + _DEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + %(AdditionalIncludeDirectories) + CompileAsCpp + ProgramDatabase + MultiThreadedDebug + + + Console + true + ws2_32.lib;crypt32.lib;%(AdditionalDependencies) + false + + + + + Level3 + NotUsing + MaxSpeed + true + NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + CompileAsCpp + ProgramDatabase + MultiThreaded + + + Console + No + true + true + ws2_32.lib;crypt32.lib;%(AdditionalDependencies) + false + + + + + Level3 + NotUsing + MaxSpeed + true + NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + CompileAsCpp + ProgramDatabase + MultiThreaded + + + Console + No + true + true + ws2_32.lib;crypt32.lib;%(AdditionalDependencies) + false + + + + + + + + \ No newline at end of file diff --git a/testing/run-atomic-tests.ps1 b/testing/run-atomic-tests.ps1 index 277ee5a7..e5991fc1 100644 --- a/testing/run-atomic-tests.ps1 +++ b/testing/run-atomic-tests.ps1 @@ -22,8 +22,8 @@ Invoke-AtomicTest T1546.007 -ExecutionLogPath 'd:\a\BLUESPAWN\BLUESPAWN\AtomicTe Invoke-AtomicTest T1546.008 -ExecutionLogPath 'd:\a\BLUESPAWN\BLUESPAWN\AtomicTestsResults.csv' Invoke-AtomicTest T1546.010 -ExecutionLogPath 'd:\a\BLUESPAWN\BLUESPAWN\AtomicTestsResults.csv' -InputArgs $T1546010Args Invoke-AtomicTest T1546.011 -ExecutionLogPath 'd:\a\BLUESPAWN\BLUESPAWN\AtomicTestsResults.csv' -Invoke-AtomicTest T1546.012 -ExecutionLogPath 'd:\a\BLUESPAWN\BLUESPAWN\AtomicTestsResults.csv' -Invoke-AtomicTest T1546.015 -ExecutionLogPath 'd:\a\BLUESPAWN\BLUESPAWN\AtomicTestsResults.csv' +#Invoke-AtomicTest T1546.012 -ExecutionLogPath 'd:\a\BLUESPAWN\BLUESPAWN\AtomicTestsResults.csv' +#Invoke-AtomicTest T1546.015 -ExecutionLogPath 'd:\a\BLUESPAWN\BLUESPAWN\AtomicTestsResults.csv' Invoke-AtomicTest T1547.001 -ExecutionLogPath 'd:\a\BLUESPAWN\BLUESPAWN\AtomicTestsResults.csv' Invoke-AtomicTest T1547.004 -ExecutionLogPath 'd:\a\BLUESPAWN\BLUESPAWN\AtomicTestsResults.csv' Invoke-AtomicTest T1547.005 -ExecutionLogPath 'd:\a\BLUESPAWN\BLUESPAWN\AtomicTestsResults.csv' diff --git a/vcpkg b/vcpkg index 0cbc579e..c4de8d6f 160000 --- a/vcpkg +++ b/vcpkg @@ -1 +1 @@ -Subproject commit 0cbc579e1ee21fa4ad0974a9ed926f60c6ed1a4a +Subproject commit c4de8d6f4d5f317eab30ab5d42de4a6bc3a5e290 diff --git a/vcpkg.json b/vcpkg.json new file mode 100644 index 00000000..f1153205 --- /dev/null +++ b/vcpkg.json @@ -0,0 +1,10 @@ +{ + "name": "bluespawn", + "version-string": "1.0.0", + "dependencies": [ + "cxxopts", + "yara", + "libzip", + "nlohmann-json" + ] +} diff --git a/vcpkg_response_file.txt b/vcpkg_response_file.txt deleted file mode 100644 index 30bc44c5..00000000 --- a/vcpkg_response_file.txt +++ /dev/null @@ -1,8 +0,0 @@ -cxxopts:x64-windows-static -cxxopts:x86-windows-static -yara:x64-windows-static -yara:x86-windows-static -libzip:x64-windows-static -libzip:x86-windows-static -nlohmann-json:x64-windows-static -nlohmann-json:x86-windows-static