Nov. 7, 2023
Introduction
DISCLAMER: This post was done in collaboration with Devid Lana. You can find his blog here: https://her0ness.github.io
In this third and last part of this series, we will dig deeper in the EDR’s update process and uncover some logic flaws that, ultimately, led us to the complete disarmament of the solution. Additionally, as an unexpected treat for our effort, a new ‘LOLBin’ was also discovered along the way. This part will be a bit more code-heavy, we will try to minimize the unnecessary bloat but the reader might need to pivot through some additional references to get the most out of this.
Sep. 14, 2023
Introduction - Where we left off
DISCLAMER: This post was done in collaboration with Devid Lana. You can find his blog here: her0ness - Attacking an EDR Part 2
Continuing from our last research, we pursued the exploration of the attack surface of the EDR solution under our scrutiny, STRANGETRINITY. Last time we focused on identifying exclusions within the EDR’s configuration that allowed us to perform actions that would not be possible otherwise. This time around, our focus will be on the communication channel between the EDR agent and its tenant.
Aug. 3, 2023
Introduction
DISCLAMER: This post was done in collaboration with Devid Lana. You can find his blog here: https://her0ness.github.io
This post is the first of what - we hope - will be a long series of articles detailing some common flaws that can be found on modern EDR products. By no means this will be a complete reference, but will hopefully provide some practical tools to analyze these gargantuesque products and attempt to understand their functionalities from a black box perspective.
Jul. 31, 2023
Mockingjay - What is old is new again
There has been quite a lot of rumor recently around the release of a piece of research that discuss a new (?) process injection technique that evades EDRs (what does that even mean?). For reference, these are the blog post I am referring to:
Jan. 25, 2021
Introduction
Reading FireEye’s UNC2452 writeup , I started to think about how to emulate them in purple teaming exercises. Despite the supply-chain bit is still a bit out of my reach, I noticed an interesting lateral movement vector that was used as part of that operation.
Quoting directly FireEye’s post (because I am lazy AF):
Oct. 10, 2020
Intro
To deal with some rainy Sunday depression I decided to investigate how Donut operates in memory and to see what traces it leaves (if any). I’ve been using Donut for quite some time, and I find it extremely useful from an operator’s perspective as it gives a lot of flexibility.
For those who don’t know what Donut is, we could define it as a software that allows the conversion from PE/.NET assemblies/scripts into position independent code (PIC, or shellcode). When I first read the initial release paper, it sounded like black magic to me; but after some time and experience I started realising how it works (at an high level, 90% still magic) it made more sense.
Aug. 8, 2020
Introduction
During a recent presentation I examined various ways of persisting within Active Directory (AD) and how every technique can be detected, using both intrinsic IoC of the specific technique or tooling default behaviour. One of the analysed attacks was the skeleton key implant.
At an high level, skeleton key is an attack where an adversary deploys some code in a Domain Controller that alters the normal Kerberos/NTLM authentication process. Doing so, the attackers would have the ability to use a secondary and arbitrary password to impersonate any user within the domain, but without the operational risk of changing the actual password of the user. This attack is particularly effective because the victim user will still be able to use its password and therefore the set of changes in term of the AD structure is minimal if not non-existent.
May. 10, 2020
Introduction
During an attack, lateral movement is crucial in order to achieve the operation’s objectives. Primarly, two main strategies exist that would allow an attacker to execute code or exfiltrate data from other hosts after obtaining a foothold within an environment:
- Operate from the compromised endpoint/s
- Pivot and use their tooling to access other targets
Operating from a compromised endpoint has its risks, every action you take as an attacker gives the blue team a detection opportunity (line totally stolen from Raphael Mudge from his videos ).
Mar. 21, 2020
Introduction
Nowadays, we see a continuous increase of the adoption of the Elasticsearch Logstash Kibana (ELK) stack for security monitoring purposes.
The functionalities of the ELK stack fit nicely the purpose of a SIEM; in fact, within few minutes it is possible to spin up a cluster and deploy the data collectors on the endpoints.
Considering the open source nature of the Elastic project and the presence of ingestors like Winlogbeat , its increase in popularity is not surprising.
Feb. 6, 2020
This series of posts was inspired by porterhau5’s work that can be found here: Extending BloodHound: Track and Visualize Your Compromise .
1. The Problem
In a standard Active Directory assessment, a fundamental phase is the analysis of Group Policy Objects (GPOs). Usually, this activity is aimed at identifying the following:
- Opportunities for lateral movement via misconfigurations of remote access policies and UAC;
- Misconfigurations that could allow further compromise, such as lack of SMB signing;
- Password policies;
- Privilege Assignment;
- Local group membership.
…and much more.
The process of parsing GPOs is often tedious and very time consuming. Tools like Grouper2 can drastically reduce the required time, but the volume of the output is still quite considerable.
Dec. 16, 2019
Introduction
In today’s post we’re going to create detections and hunt for the usage of the recent lateral movement technique called SCShell .
In a nutshell, the SCShell technique is born from the limitation of lateral movement attacks like remote service creation that required the attacker to drop files on the remote filesystem. Raphael Mudge’s post Covert Lateral Movement with High-Latency C&C explains how it is possible to create remote services to execute cobaltstrike’s beacon after transferring it to the target’s host.
The aforementioned technique leaves considerable traces on the target host:
Dec. 8, 2019
Introduction
As a penetration tester, I often rely on BloodHound to assist me in Active Directory engagements.
However, after a few of them it was clear that I was repeating the same actions (hence the same queries) over and over again. I felt that doing this initial process manually was not just time consuming but also introduced the possibility to make mistakes and miss some low-hanging fruits, this is especially true while analysing a considerable number of domains in a restricted amount of time.
Nov. 8, 2019
Introduction
BloodHound was a revolution for evaluating Active Directory (AD) security and identifying unintended paths that could lead to the compromise of sensitive groups such as Domain Admins. The community has been using it successfully in many engagements and against highly secure environments.
For those who’ve been living in a cave for the past couple of years, in a nutshell BloodHound is a tool that can be used by both defenders and attackers to identify hidden and unintended relationships between AD principals. It’s heavily based on the work published by Microsoft’s researchers: Heat-ray: Combating Identity Snowball Attacks Using Machine Learning, Combinatorial Optimization and Attack Graphs . Although BloodHound does not rely on machine learning yet, the data model is pretty similar to the proposed one.
Oct. 19, 2019
Today’s post will cover some of my experiments while practicing threat hunting. Specifically today we will cover hunting for malicious usage of msbuild.exe used by Covenant.
I literally started last week, so forgive me if I’m not following logging best practices or some detections are very unreliable!
It must be noted that this specific case will fall under the class of tools default behaviours. For example, using similar techniques it would be possible to hunt for cobaltstrike’s default spawn process rundll32.exe.
Oct. 19, 2019
Intro
This is another post to document my journey of learning Threat Hunting. In today’s post we’re going to perform threat hunting activities with the aim of hunting for AD domain enumeration.
We’re going to heavily rely on FireEye’s SilkETW and we’ll search for suspicious LDAP queries generated by our endpoints.
SilkETW is a handy wrapper for Event Tracing for Windows (ETW) that will allow us to perform searches and ship to centralised logging platforms like ElasticSearch. ETW is defined by Microsoft as:
Oct. 4, 2019
Introduction
Lateral movement is defined by MITRE as:
Sep. 28, 2019
This is going to be a quick walkthrough of how I would set up a Command and Control (C2) infrastructure using the following technologies:
The aim of this post is mainly practicing building reliable and reusable C2 infrastructures for red team engagements. I won’t be covering the installation of the various tools but we’ll go straight to the design of the infrastructure. I will also assume some familiarity with terraform, the introduction guide (https://learn.hashicorp.com/terraform?track=getting-started#getting-started ) will be enough for most of the stuff you’ll see here.
I decided to use Covenant instead of Cobalt Strike mainly because I don’t have enough money for buying a personal license ¯\_(ツ)_/¯ but also because they have very similar functionalities and in the next few months it may be possible to use Covenant reliably during operations.