Cyware Situational Awareness Platform

import time
import base64
import hashlib
import hmac
expires = int(time.time()) + 10
to_sign = "%s\n%i" % (access_id, expires)
signature = base64.b64encode(hmac.new(secret_key.encode("utf-8"), to_sign.encode("utf-8"), hashlib.sha1).digest())

If you are using Postman, you can use the following Pre-Request Script to create an authentication signature. Ensure you enter the accessID and secretKey that are sent to you in the invitation mail:

CryptoJS = require('crypto-js');
const querystring = require('querystring');

const accessID = '8xxxxxxc-cxxc-4xx5-9xx4-7xxxxxxxxxx5';
const secretKey = 'axxxxxxc-9xx9-4xxa-9xx3-0xxxxxxxxxxa';



function signature(expires) {
    const toSign = `${accessID}\n${expires}`;
    const hmac = CryptoJS.HmacSHA1(toSign, secretKey).toString();
    console.log(hmac)
    const buffer = Buffer.from(hmac, 'hex');
    return buffer.toString('base64');
}

const expires = Math.floor((Date.now() + 300 * 1000) / 1000);

var params = {
    AccessID: accessID,
    Expires: expires,
    Signature: signature(expires)
};

var requestUrl = pm.request.url.toString();
requestUrl += "?" + querystring.stringify(params);
pm.request.url = requestUrl;



pm.collectionVariables.set("AccessID", accessID)
pm.collectionVariables.set("Expires", expires)

Use the following field information while creating alerts using API:

*Mandatory fields

The following sample is of a basic alert that uses the mandatory fields only (title and description):

{
  "title": "Multi-stage PowerShell based attack targets the finance industry (Sample Alert)",
  "description": "An alarming new cyber threat has emerged, targeting the finance industry with a sophisticated multi-stage PowerShell-based attack. The attack was first flagged by an advanced anti-malware software, which detected a series of intricate tactics utilized to deploy the notorious Cobalt Strike malware. This multi-pronged attach leverages a document lure, drawing victims into a carefully orchestrated sequence of PowerShell scripts."
}

If you want to create an alert with additional details such as TLP, tags, severity, and other details, you can use the following sample:

{
  "title": "Multi-stage PowerShell based attack targets the finance industry (Sample Alert)",
  "description": "An alarming new cyber threat has emerged, targeting the finance industry with a sophisticated multi-stage PowerShell-based attack. The attack was first flagged by an advanced anti-malware software, which detected a series of intricate tactics utilized to deploy the notorious Cobalt Strike malware. This multi-pronged attach leverages a document lure, drawing victims into a carefully orchestrated sequence of PowerShell scripts.",
  "tlp": "WHITE",
  "tags": [
    "MalwareBytes",
    "cobaltstrike"
  ],
  "source": "Research",
  "recommended_action": "The embedded lnk file is obfuscated and after de-obfuscation it's observed that it used cmd.exe to call PowerShell to download and execute the first stage of the attack from the Github account",
  "additional_info": "<h4> Attack Process </h4><br> The attack commences with the execution of an obfuscated lnk file, which is concealed. Upon de-obfuscation, the lnk file employs cmd.exe to invoke PowerShell, initiating a complex series of techniques designed to infiltrate the victim's environment. Among the tactics employed are privilege escalation and the establishment of persistence through an autorun registry key. The attack leaves behind a trail of indicators, each offering insight into the methods and tools employed by the malicious actors.",
  "indicators": [
    {
      "type": "ip",
      "value": [
        "188.165.148.241"
      ]
    },
    {
      "type": "sha256",
      "value": [
        "026fcb13e9a4ea6c1348a14a5087713dd9e5",
        "08f096134ac934ec7b4f33a246d61"
      ]
    },
    {
      "type": "domain",
      "value": [
        "security-center.com"
      ]
    },
    {
      "type": "email",
      "value": [
        "joe@security-center.com"
      ]
    },
    {
      "type": "url",
      "value": [
        "center.com"
      ]
    },
    {
      "type": "md5",
      "value": [
        "bd08ba3c982eaad768602536fb8e1184"
      ]
    },
    {
      "type": "sha1",
      "value": [
        "18AF819125B70879D36378431C4E8D9BFA6A2599"
      ]
    },
    {
      "type": "cve",
      "value": [
        "CVE-2021-1332"
      ]
    },
    {
      "type": "ipv4_cidr",
      "value": [
        "10.0.0.0/24"
      ]
    }
  ],
  "severity": "medium",
  "exploitability": "The Cobalt Strike ShellCode is base64 encoded and XOR encrypted using 35 key. After decoding and decrypting the ShellCode it allocates it into memory using VirtualAlloc and finally execute it by calling Invoke function.",
  "impacted_product": [
    "PowerShell"
  ],
  "impacted_version": "Powershell 2.0, Powershell 2.5",
  "cvss_score": "7.8",
  "workarounds": "No workarounds known",
  "resolution": "On careful analysis, it is evident that the obfuscated lnk file serves as a crucial pivot point in the attack chain. De-obfuscation reveals the use of cmd.exe, acting as a conduit to invoke PowerShell. This in turn facilitates the download and execution of the initial attack stage, sourced from a GitHub account. The emergence of this multi-stage PowerShell-based attack underscores the evolving nature of cyber threats, particularly those targeting critical sectors like finance. Organizations are urged to be vigilant, bolstering their defenses to thwart such complex and insidious assaults.",
  "objective": "Other than their GitHub profile, we do not have much information on the threat actor or their exact intention with this attack. However, monitoring and espionage are a likely motive.",
  "industries_targeted": "Finance"
}