TARGET: Thread

---

info

Requirements	Limitations	Considerations
SMB+WMI (RPC) or WinRM enabled/accessbile on the target host		Suspended threads can be resumed by another process
The hostname or IP of the target host
The target Thread Id
The Thread Remediator also requires the Process Id

---

TACTIC: Suspend/Terminate Thread (262 - [🔥Volatile Info] Suspend Threads)

1 - Create the Job

1. From the Metasponse web UI, navigate to Job -> +New Job from the top pane

2. Name: Set a unique but descriptive name for the job

2 - Configure the Job

1. 🚊 Transports - Select the following transport plugin(s):

   • WMI Transport
   • SMB Transport

2. 🔧 Remediators - Select the following remediator plugin(s):

   • 262 - [🔥Volatile Info] Suspend Threads

3. 🔍 Analyzers - Select the following analyzer plugin(s):

   • Elasticsearch Analyzer

4. ⛭ Authentication - Configure the following settings:

   Setting	Value
   Domain	Target authentication domain or workgroup
   Elasticsearch: Password	metasponse
   Elasticsearch: Username	Password to authenticate with Elasticsearch
   Elasticsearch: Verify SSL Certificate	UNCHECKED (False)
   Password	Target user password
   Username	Target user

   NOTE: DIP Kits configured IAW 262COS-DIP-SOP-001 already have the Elastic user metasponse pre-configured with the Kit password - otherwise you will need to manually create this user in Kibana with superuser privileges

5. ⛭ Deployment - Target the host(s):

   Setting	Value
   Network Root	\%WinDir%\Temp\262
   Physical Root	%WinDir%\Temp\262
   Target Addresses	The target hostname(s)/address(es)

   NOTE: Changing the Network Root and Physical Root folders to a path with a known unique string will aid in whitelisting alerts that spawn from Metasponse activity

6. ⛭ Remediate - Target the thread ID(s):

   Setting	Value
   262 - Suspend Threads: Force	OPTIONAL - Force action against a thread, even if it is not detected to be injected.
   262 - Suspend Threads: Terminate	OPTIONAL - Terminate the thread instead of Suspending it.
   262 - Suspend Threads: Thread IDs	The specific Thread IDs to Suspend/Terminate, only if it is found to be injected.

3 - Execute the Job

1. Click the ⭮ Check button on the left-hand to verify the job settings

2. Click the ⯈ Schedule button on the left-hand column to execute the job

4 - Verify the response results

1. Monitor the Job status until the 🗏 Analysis button appears, then click it to be taken to the Data Collections screen

2. Within the 262 Volatile Info section, click on the 262_injected_threads data collection

NOTE: If the 262_injected_threads data collection is not present, then this indicates that no processes were terminated

3. Verify that the list of processes matches your intended targets

---

TACTIC: Terminate Thread (Thread Remediator)

1 - Create the Job

1. From the Metasponse web UI, navigate to Job -> +New Job from the top pane

2. Name: Set a unique but descriptive name for the job

2 - Configure the Job

1. 🚊 Transports - Select the following transport plugin(s):

   • WMI Transport
   • SMB Transport

2. 🔧 Remediators - Select the following remediator plugin(s):

   • Thread Remediator

3. 🔍 Analyzers - Select the following analyzer plugin(s):

   • Elasticsearch Analyzer

4. ⛭ Authentication - Configure the following settings:

   Setting	Value
   Domain	Target authentication domain or workgroup
   Elasticsearch: Password	metasponse
   Elasticsearch: Username	Password to authenticate with Elasticsearch
   Elasticsearch: Verify SSL Certificate	UNCHECKED (False)
   Password	Target user password
   Username	Target user

   NOTE: DIP Kits configured IAW 262COS-DIP-SOP-001 already have the Elastic user metasponse pre-configured with the Kit password - otherwise you will need to manually create this user in Kibana with superuser privileges

5. ⛭ Deployment - Target the host(s):

   Setting	Value
   Network Root	\%WinDir%\Temp\262
   Physical Root	%WinDir%\Temp\262
   Target Addresses	The target hostname(s)/address(es)

   NOTE: Changing the Network Root and Physical Root folders to a path with a known unique string will aid in whitelisting alerts that spawn from Metasponse activity

6. ⛭ Remediate - Target the process(es):

   Setting	Value
   Remediate: Process ID	The process ids to be targeted
   Remediate: Thread ID	The thread ids to target

3 - Execute the Job

1. Click the ⭮ Check button on the left-hand to verify the job settings

2. Click the ⯈ Schedule button on the left-hand column to execute the job

4 - Verify the response results

1. Monitor the Job status until the 🗏 Analysis button appears, then click it to be taken to the Data Collections screen

2. Within the Remediation section, click on the remediate_thread data collection

3. Verify that the WasSuccessful field is true

---