Oilrig / Cleaver Malicious Scheduled Task Detection

# SPDX-FileCopyrightText: 2017 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.108232");
  script_version("2024-07-23T05:05:30+0000");
  script_tag(name:"last_modification", value:"2024-07-23 05:05:30 +0000 (Tue, 23 Jul 2024)");
  script_tag(name:"creation_date", value:"2017-09-08 10:20:33 +0200 (Fri, 08 Sep 2017)");
  script_tag(name:"cvss_base", value:"10.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");

  script_tag(name:"qod_type", value:"registry");
  script_tag(name:"solution_type", value:"Mitigation");

  script_name("Oilrig / Cleaver Malicious Scheduled Task Detection");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2017 Greenbone AG");
  script_family("Malware");
  script_dependencies("smb_registry_access.nasl");
  script_require_ports(139, 445);
  script_mandatory_keys("SMB/registry_access");

  script_tag(name:"summary", value:"This script tries to detect several indicators for malicious
  tools used by Iranian APT group 'OILRIG / CLEAVER'.");

  script_tag(name:"vuldetect", value:"Enumerate the Windows registry and check for the existence of
  two scheduled tasks, namely 'GoogleUpdatesTaskMachineUI' and 'JavaUpdatesTasksHosts'.");

  script_tag(name:"insight", value:"The APT group uses social engineering attacks to deploy various
  scripts that also install tasks on the target machine.

  In order to keep a persistent control of the target system, tasks are being created and scheduled.
  The Windows registry holds a list of all created tasks.

  Therefore the infection can be validated by checking for the existence of the specific registry entries.");

  script_tag(name:"impact", value:"The affected system suffers from data exfiltration.");

  script_tag(name:"solution", value:"A whole cleanup of the infected system is recommended.");

  exit(0);
}

include("smb_nt.inc");
include("secpod_smb_func.inc");

report = 'The following suspicious tasks have been found (Registry Key:Content):\n';

foreach item (make_list("Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks", "Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tree")) {

  itemList = registry_enum_keys(key:item);

  foreach key (itemList) {
    fullKey = item + "\" + key;

    found = registry_get_sz(key:fullKey, item:"Path");

    if ("GoogleUpdatesTaskMachineUI" >< found) {
      match1 = TRUE;
      report += "HKLM\" + fullKey + ":" + found + '\n';
    }

    if ("JavaUpdatesTasksHosts" >< found) {
      match2 = TRUE;
      report += "HKLM\" + fullKey + ":" + found + '\n';
    }
  }
}

if (match1 && match2) {
  security_message(port:0, data:report);
  exit(0);
}

exit(99);