Conti Move To Remote System

Using the Jambi agent from the previous chain, discover targets on the Active Directory and then perform targeted lateral movement of the Jambi agent by first moving the agent to the desired target and then starting the agent.

2022-02-01

Professional

Authors:xanthonus, khyberspache

TTP Tuesday: Conti (Release 4)

Move to remote systems

Theme Overview

We're releasing the fourth installment of our Conti ransomware theme with new TTPs focused on Windows lateral-movement using live off the land techniques. To date, our Conti theme now contains the following kill-chains:

1. Recon and Initial Access
2. Local and Remote Discovery
3. Gain privileges and persist
4. Move to remote systems (Current Release)
5. Data collection and exfiltration
6. Deploy ransomware

Move To Remote Systems

This chain performs lateral movement within the domain. First, we check for all hosts on the domain. After selecting a target, we then enable access to the target's storage resources. We then move the agent executable from our current host to the target host. Finally, we execute the agent on the target host performing lateral movement within the domain. This chain does have a user custom fact for the target host information which you can provide in the facts section, or you can modify the TTP itself removing #{target.host} and providing the information manually.

Watch a demonstration: Conti Move to Remote Systems

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

Source: https://feed.prelude.org

Execute this chain

Download Operator (1.7.1)

Learn about Operator

TTPs

Conti list all computers in domain

Provides access to target shared resources

Conti agent lateral movement

Conti start agent remotely

User-Set Custom Variables

target.host: TARGET.domain.tld

Other chains in this theme

Conti Deploy Ransomware

2022-02-14

Deploy Conti ransomware to encrypt host files.

Conti Collect and Exfiltrate

2022-02-08

Automatically collect information and exfiltrate with rclone to a cloud service.

Conti Privilege Escalation and Persistence

2022-01-25

Use PrintNightmare & ZeroLogon exploits to gain privileges and extract the krbtgt NTLM hash from a DC.

Conti Local and Remote Discovery

2022-01-18

Using the Jambi agent from the initial access chain, discover local services, active directory objects, and check the box for PrintNightmare.

Conti Recon And Initial Access

2022-01-10

Perform recon and initial access of target environment

Conti (Discovery)

2021-09-21

Perform the initial discovery and credential access techniques used in Conti ransomware playbook.

About PreludePrelude hardens an organization's defenses by continuously “asking” it questions through the form of safe cyberattacks. These attacks respond immediately to the latest vulnerabilities and cyber events, turning complex technical descriptions into deployable “questions”.Our mission is to increase the reach, frequency and usage of advanced security for all organizations.

Follow @preludeorg on Twitter for new chains and more.

Join the Prelude Discord to discuss chains and more.

Keep up to date with code changes and community activity on Github

preludesecurity.com Careers Tactics & Techniques Attack themes

Privacy Policy support@preludesecurity.com© 2023 Prelude Research, Inc.All rights reserved. Prelude, its logo and other trademarks are trademarks of Prelude Research, Inc. and may not be used without permission.