PyramidMalware
According to its author, Pyramid is a post exploitation framework written in Python, capable of executing offensive tooling from a signed binary (e.g. python.exe) by importing their dependencies in memory. It was created to demonstrate a bypass strategy against EDRs based on some blind-spots assumptions.From MISP Galaxy
Last reported 18 days ago, by Group-IB8 reports
ATT&CK techniques
6 of 19 · each with the sentence it comes from- T1055Process Injection
“On August 31, 2021, Elastic observed process injection telemetry that shared techniques with the Jupyter Infostealer as reported by Morphisec, Binary Defense, and security researcher Squibydoo [1] [2] [3] [4] [5].”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information - Indicator Removal from Tools”
- T1053.005Scheduled Task
“A scheduled task is used to establish persistence for the PARALLAX RAT.”
- T1559.001Component Object Model
“If the first string of ( cs16.cfg ) points to a hosted file, it uses the IBackgroundCopyManager Component Object Model (COM) interface to download a PNG file and store it on disk ( paper.png in our example).”
- T1003.001LSASS Memory
“They might use Mimikatz, comsvcs.dll, direct access to LSASS memory, a custom utility or another implementation entirely.”
- T1027.005Indicator Removal from Tools
“Obfuscated Files or Information - Indicator Removal from Tools”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
From Detonation to Detection: The Sandbox Now Writes the Rules“Pyramid of pain, now covered by detonation and rule generation in full”
-
The Fine Art of Frustrating the Adversary“…&CK provides a useful taxonomy of adversary techniques, while projects such as MITRE Center for Threat-Informed Defense’s Summiting the Pyramid, SpecterOps’ work on capability abstraction, Splunk SURGe’s Macro ATT&CK, and Cisco Foundation AI’s LUCID explore different parts of thi…”
-
Should you care about an “AI slowdown?”“If you see me, don’t be shy about asking for a Pyramid of Pain sticker or button!”
-
Detecting Malicious Security Product Bypass Techniques“When considering how to approach detecting any threat, it is important to consider data sources and layers of abstraction, as well as Pyramid of Pain levels, to optimize the methods”
-
Misbehaving Modalities: Detecting Tools, Not Techniques“Summiting the Pyramid (STP) is a related analytic scoring methodology from MITRE.”
-
Exploring the Value of Indicators In Small Business Defense“In his influential “Pyramid of Pain” blog, Bianco emphasizes how “simple” indicators (hash values, IP addresses, domain names) are trivially changed and highly ephemeral in adversary operations.”
-
Exploring the REF2731 Intrusion Set“The Pyramid of Pain”
-
Going Coast to Coast - Climbing the Pyramid with the Deimos Implant“Going Coast to Coast - Climbing the Pyramid with the Deimos Implant”
Indicators in its reports
named in the reports above- 9f1f11a708d393e0…06f18ffcc507in 1 report
- 2915b3f8b703eb744fc54c81f4a9c67fin 1 report
- w32.9f1f11a708-100.sbx[.]tgin 1 report
- 9896a6fcb9bb5ac1…66decd6a4a7fin 1 report
- 38de5b216c33833af710e88f7f64fc98in 1 report
- 38d053135ddceaef…eecec4ba8f55in 1 report
- 41444d7018601b599beac0c60ed1bf83in 1 report
- w32.38d053135d-95.sbx[.]tgin 1 report
- c4dd71e347a076ba…942ba2ab16b2in 1 report
- 9a47c4d379998ade2f8f99e23a630c06in 1 report
- w32.c4dd71e347-95.sbx[.]tgin 1 report
- fed979f93bcaf4e7…c50ce509ad2fin 1 report
- 207d9d891ac756b2bfad88aba5682c65in 1 report
- w32.fed979f93b-95.sbx[.]tgin 1 report
- protonmail[.]comin 1 report
- hxxps://blog.es3n1n[.]eu/posts/how-i-ruined-my-vacation/in 1 report
- blog.es3n1n[.]euin 1 report
- hxxps://github[.]com/es3n1n/defendnotin 1 report
- hxxps://github[.]com/es3n1n/no-defenderin 1 report
- process.ext.api.parameters[.]protectionin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.