VDO.Ninja (OBS.Ninja) Screen Relay and Interview-Support Web Services

Devices that reached two or more of the services, or sent a screenshare push URL, with the services seen and the newest hit first.

let Services = dynamic([
    // optional: widely used for ordinary business, the weakest entries of the cluster
    "ip.me", "toffeeshare.com", "sendgb.com", "codeshare.io",
    "vdo.ninja", "obs.ninja", "mictests.com", "webcammictest.com", "onlinemictest.com"
]);
DeviceNetworkEvents
| where Timestamp > ago(90d)
| where RemoteUrl has_any (Services)
| mv-apply Service = Services to typeof(string) on (where RemoteUrl has Service)
| summarize Services = make_set(Service), ServiceCount = dcount(Service),
            // optional: counts VDO.Ninja or OBS.Ninja URLs carrying push= and screenshare; needs telemetry that keeps the query string
            ScreenPush = countif(Service endswith ".ninja" and RemoteUrl has "push=" and RemoteUrl has "screenshare"),
            LastSeen = max(Timestamp)
        by DeviceName, InitiatingProcessAccountName
| where ServiceCount >= 2 or ScreenPush > 0
| sort by LastSeen desc

Devices and users that reached two or more of the services in proxy or DNS data, or sent a screenshare push URL.

```sourcetype placeholders: index=proxy (url, src_ip, user) and index=dns or sysmon (query, dest, user); field names follow the CIM Web and Network_Resolution models```
(index=proxy OR index=dns OR index=sysmon) (url=* OR query=*) earliest=-90d
| eval target=lower(coalesce(url, query))
```optional: the last four names are widely used for ordinary business; delete them from the pattern to drop them```
| rex field=target "(?:^|[./@])(?<service>vdo\.ninja|obs\.ninja|mictests\.com|webcammictest\.com|onlinemictest\.com|ip\.me|toffeeshare\.com|sendgb\.com|codeshare\.io)(?:[:/?#]|$)"
| where isnotnull(service)
| eval device=coalesce(dest, src_ip)
```optional: counts VDO.Ninja or OBS.Ninja URLs carrying push= and screenshare; needs a source that keeps the query string```
| eval screen_push=if(like(service, "%.ninja") AND like(target, "%push=%") AND like(target, "%screenshare%"), 1, 0)
| stats dc(service) AS service_count values(service) AS services sum(screen_push) AS screen_push_urls max(_time) AS last_seen BY device, user
| where service_count>=2 OR screen_push_urls>0
| sort 0 - last_seen
| convert ctime(last_seen)

A single DNS lookup of one of the services, which is low severity alone and is meant to be counted per device by the SIEM.

title: Lookup of a Screen-Relay or Interview-Support Web Service
id: 5f3c1d52-8a4e-4c1b-9d0a-6b7e2f4a9c31
status: experimental
description: >
  Detects a DNS lookup of VDO.Ninja (formerly OBS.Ninja), the microphone and
  webcam test sites, the ip.me address checker or the Toffeeshare, SendGB and
  Codeshare services that Huntress recovered from the laptop of a suspected
  DPRK remote worker. One lookup is unremarkable; report devices that reach
  two or more of the services.
references:
  - https://www.huntress.com/blog/huntress-dprk-remote-worker-investigation
  - https://github.com/steveseguin/vdo.ninja
logsource:
  category: dns_query
detection:
  selection_exact:
    QueryName:
      - 'vdo.ninja'
      - 'obs.ninja'
      - 'mictests.com'
      - 'webcammictest.com'
      - 'onlinemictest.com'
      # optional: widely used for ordinary business, the weakest entries of the cluster
      - 'ip.me'
      - 'toffeeshare.com'
      - 'sendgb.com'
      - 'codeshare.io'
  selection_subdomain:
    QueryName|endswith:
      - '.vdo.ninja'
      - '.obs.ninja'
      - '.mictests.com'
      - '.webcammictest.com'
      - '.onlinemictest.com'
      # optional: widely used for ordinary business, the weakest entries of the cluster
      - '.ip.me'
      - '.toffeeshare.com'
      - '.sendgb.com'
      - '.codeshare.io'
  condition: selection_exact or selection_subdomain
falsepositives:
  - Media production, streaming and broadcast staff using VDO.Ninja for its intended purpose
level: low

Hosts and users that reached two or more of the services, or sent a screenshare push URL, across DNS and URL fields.

FROM logs-*
| WHERE @timestamp > NOW() - 90 days
| EVAL target = TO_LOWER(COALESCE(url.original, dns.question.name, destination.domain))
| WHERE target IS NOT NULL
| GROK target "(?:^|[./@])(?<service>vdo\\.ninja|obs\\.ninja|mictests\\.com|webcammictest\\.com|onlinemictest\\.com|ip\\.me|toffeeshare\\.com|sendgb\\.com|codeshare\\.io)(?:[:/?#]|$)"
| WHERE service IS NOT NULL
| EVAL screen_push = CASE(service LIKE "*.ninja" AND target LIKE "*push=*" AND target LIKE "*screenshare*", 1, 0)
| STATS service_count = COUNT_DISTINCT(service), services = VALUES(service), screen_push_urls = SUM(screen_push), last_seen = MAX(@timestamp) BY host.name, user.name
| WHERE service_count >= 2 OR screen_push_urls > 0
| SORT last_seen DESC
| LIMIT 200

Devices that looked up two or more of the services in Falcon DNS events.

// Falcon DNS lookups carry the host name only, so the screenshare URL check is not available here.
#event_simpleName=DnsRequest
// optional: the last four names are widely used for ordinary business; delete them from the pattern to drop them
| DomainName=/(?:^|\.)(?<service>vdo\.ninja|obs\.ninja|mictests\.com|webcammictest\.com|onlinemictest\.com|ip\.me|toffeeshare\.com|sendgb\.com|codeshare\.io)$/i
| lower(field=service, as=service)
| groupBy([aid, ComputerName], function=[count(service, distinct=true, as=service_count), collect(service), max(@timestamp, as=last_seen)])
| service_count >= 2
| sort(last_seen, order=desc)

Hosts and users that looked up two or more of the services in Cortex network events.

// Cortex DNS lookups carry the host name only, so the screenshare URL check is not available here.
dataset = xdr_data
| filter event_type = ENUM.NETWORK and dns_query_name != null
// optional: the last four names are widely used for ordinary business; delete them from the pattern to drop them
| alter service = arrayindex(regextract(lowercase(dns_query_name), "(?:^|\.)(vdo\.ninja|obs\.ninja|mictests\.com|webcammictest\.com|onlinemictest\.com|ip\.me|toffeeshare\.com|sendgb\.com|codeshare\.io)$"), 0)
| filter service != null
| comp count_distinct(service) as service_count, values(service) as services, max(_time) as last_seen by agent_hostname, actor_effective_username
| filter service_count >= 2
| sort desc last_seen