Threat-Hunting on Riccardo Ancarani

Following Donut Crumbs

Sat, 10 Oct 2020 00:00:00 +0000

Intro
Observations
- In-Memory PE
- AMSI Bypass

Intro

To deal with some rainy Sunday depression I decided to investigate how Donut operates in memory and to see what traces it leaves (if any). I’ve been using Donut for quite some time, and I find it extremely useful from an operator’s perspective as it gives a lot of flexibility.

For those who don’t know what Donut is, we could define it as a software that allows the conversion from PE/.NET assemblies/scripts into position independent code (PIC, or shellcode). When I first read the initial release paper, it sounded like black magic to me; but after some time and experience I started realising how it works (at an high level, 90% still magic) it made more sense.

Hunting for Skeleton Key Implants

Sat, 08 Aug 2020 00:00:00 +0000

Introduction
Attack Execution
Detection
Other Detections and Indicators
References

Introduction

During a recent presentation I examined various ways of persisting within Active Directory (AD) and how every technique can be detected, using both intrinsic IoC of the specific technique or tooling default behaviour. One of the analysed attacks was the skeleton key implant.

At an high level, skeleton key is an attack where an adversary deploys some code in a Domain Controller that alters the normal Kerberos/NTLM authentication process. Doing so, the attackers would have the ability to use a secondary and arbitrary password to impersonate any user within the domain, but without the operational risk of changing the actual password of the user. This attack is particularly effective because the victim user will still be able to use its password and therefore the set of changes in term of the AD structure is minimal if not non-existent.

Hunting for Impacket

Sun, 10 May 2020 00:00:00 +0000

Introduction
Tools
Final Words

Introduction

During an attack, lateral movement is crucial in order to achieve the operation’s objectives. Primarly, two main strategies exist that would allow an attacker to execute code or exfiltrate data from other hosts after obtaining a foothold within an environment:

Operate from the compromised endpoint/s
Pivot and use their tooling to access other targets

Operating from a compromised endpoint has its risks, every action you take as an attacker gives the blue team a detection opportunity (line totally stolen from Raphael Mudge from his videos ).

Hunting for SCShell Usage Using ELK

Mon, 16 Dec 2019 00:00:00 +0000

Introduction

In today’s post we’re going to create detections and hunt for the usage of the recent lateral movement technique called SCShell .

In a nutshell, the SCShell technique is born from the limitation of lateral movement attacks like remote service creation that required the attacker to drop files on the remote filesystem. Raphael Mudge’s post Covert Lateral Movement with High-Latency C&C explains how it is possible to create remote services to execute cobaltstrike’s beacon after transferring it to the target’s host. The aforementioned technique leaves considerable traces on the target host:

Hunting for Anomalous Usage of MSBuild and Covenant

Sat, 19 Oct 2019 00:00:00 +0000

Today’s post will cover some of my experiments while practicing threat hunting. Specifically today we will cover hunting for malicious usage of msbuild.exe used by Covenant.

I literally started last week, so forgive me if I’m not following logging best practices or some detections are very unreliable!

It must be noted that this specific case will fall under the class of tools default behaviours. For example, using similar techniques it would be possible to hunt for cobaltstrike’s default spawn process rundll32.exe.

Hunting for Suspicious LDAP Activity with SilkETW and Yara

Sat, 19 Oct 2019 00:00:00 +0000

Intro

This is another post to document my journey of learning Threat Hunting. In today’s post we’re going to perform threat hunting activities with the aim of hunting for AD domain enumeration.

We’re going to heavily rely on FireEye’s SilkETW and we’ll search for suspicious LDAP queries generated by our endpoints.

SilkETW is a handy wrapper for Event Tracing for Windows (ETW) that will allow us to perform searches and ship to centralised logging platforms like ElasticSearch. ETW is defined by Microsoft as: