OZZY PMS Chain

Overview

이 캠페인은 외부 접근 경로, Linux 기반 JBoss/PMS 서버, Windows PMS Agent, Active Directory 도메인 컨트롤러가 연결된 기업형 운영망 침해 흐름으로 모델링된다. 핵심 전개는 hanguel-ops-pms의 업데이트 경로를 변조해 hanguel-win01에서 SYSTEM 실행을 만들고, SYSTEM 컨텍스트에서 dc_cred.xml을 발견하되 복호화 실패를 확인한 뒤, AWS control-plane의 GetPasswordData 경로로 win01 local Administrator 컨텍스트를 확보해 HANGUEL\Administrator credential object를 복호화하는 것이다. 이후 공격자는 DC의 관리 공유 및 WinRM 실행 경로를 이용해 로더와 암호화된 payload를 배치하고, 로더 실행 산출물, Windows Event Log, Amcache, ShimCache, TaskCache, USN Journal을 조합해 loader chain을 재구성할 수 있는 흔적을 남긴다.

Groups

Techniques Used

Software

Detection Plan

Detection Query Draft

campaign.id: "SB-07"
and event.action: ("pms_patch_executed" or "domain_controller_discovery" or "dc_cred_xml_discovered" or "aws_get_password_data_win01_local_admin_verified" or "win01_local_admin_context")

sequence by host.name with maxspan=30m
  [any where event.action == "pms_patch_executed"]
  [any where event.action == "domain_controller_discovery"]
  [any where event.action == "dc_cred_xml_discovered"]
  [any where event.action == "aws_get_password_data_win01_local_admin_verified"]
  [any where event.action == "win01_local_admin_context"]
  [any where event.action == "dc_cred_xml_imported"]
  [any where event.action in ("dc_winrm_whoami", "dc_c_admin_share_access")]

Observed Infrastructure

관찰된 환경은 AWS bastion, JBoss/PMS update relay, Windows client, Active Directory Domain Controller, SOC/ELK 서버로 구성된다. 공격자는 bastion을 통해 내부망을 관찰하고, PMS 업데이트 경로를 변조한 뒤 Windows 신뢰 실행 흐름을 이용해 win01 SYSTEM 컨텍스트와 DC 관리 채널로 확장할 수 있다.

Internet / Analyst
  -> hanguel-bastion
  -> hanguel-ops-pms
  -> hanguel-win01 PMS Agent
  -> hanguel-dc01
  -> hanguel-soc01 ELK

# Analyst KQL
campaign.id: "SB-07"
log.id: ("HAW-001" or "HAD-005" or "HAC-001")
hanguel.classification: ("suspicious" or "attack")

References

1. MITRE ATT&CK Campaigns. https://attack.mitre.org/campaigns/
2. MITRE ATT&CK T1133, External Remote Services. https://attack.mitre.org/techniques/T1133/
3. MITRE ATT&CK T1046, Network Service Discovery. https://attack.mitre.org/techniques/T1046/
4. MITRE ATT&CK T1190, Exploit Public-Facing Application. https://attack.mitre.org/techniques/T1190/
5. MITRE ATT&CK T1195.002, Compromise Software Supply Chain. https://attack.mitre.org/techniques/T1195/002/
6. MITRE ATT&CK T1053.005, Scheduled Task. https://attack.mitre.org/techniques/T1053/005/
7. MITRE ATT&CK T1552, Unsecured Credentials. https://attack.mitre.org/techniques/T1552/
8. MITRE ATT&CK T1078.003, Valid Accounts: Local Accounts. https://attack.mitre.org/techniques/T1078/003/
9. MITRE ATT&CK T1078.004, Valid Accounts: Cloud Accounts. https://attack.mitre.org/techniques/T1078/004/
10. MITRE ATT&CK T1021.001, Remote Desktop Protocol. https://attack.mitre.org/techniques/T1021/001/
11. MITRE ATT&CK T1021.002, SMB/Windows Admin Shares. https://attack.mitre.org/techniques/T1021/002/
12. MITRE ATT&CK T1021.006, Windows Remote Management. https://attack.mitre.org/techniques/T1021/006/
13. MITRE ATT&CK T1620, Reflective Code Loading. https://attack.mitre.org/techniques/T1620/
14. MITRE ATT&CK T1003.001, LSASS Memory. https://attack.mitre.org/techniques/T1003/001/
15. Spacebar Project local file, OZZY PMS Chain campaign profile, 2026-05-22.