00:00:00.208-->00:00:07.042 >> So, um, fun fact about this picture here, this was actually the IBM Toronto Downtown Data 00:00:07.042-->00:00:12.042 Center in 1963. Um, but, but now it's a sushi lounge I think... [Laughter] So, who am I, uh, my 00:00:16.333-->00:00:22.000 name is Chris Thompson, I'm the Red team and opps lead for IBM X-Force Red, or X-Force Rouge as 00:00:22.000-->00:00:28.833 we call it in Canada. Uh, my job involves conducting red teaming ops against defense contractors 00:00:28.833-->00:00:34.292 and some of North America's largest banks. Uh, Im also on the newly formed CREST USA Board 00:00:34.292-->00:00:40.458 that just launched with smart folks like Chris Nickerson, and Tom Brennan. Um, and, I, uh- I 00:00:40.458-->00:00:45.458 also teach network and mobile penn testing at, at a college. So, why am I talking about 00:00:48.875-->00:00:54.250 Microsoft? Well, uh, they're coming out with two new products, or, or they’ve kinda 00:00:54.250-->00:00:58.833 released them in trial mode right now. Uh, one's known as Microsoft Advanced Threat 00:00:58.833-->00:01:04.917 Analytics, and the other is Advanced Threat Protection. Um, so when you're dealing with, in 00:01:04.917-->00:01:09.792 red teaming, when you're dealing with really large fortune-fifties, um, many of 00:01:09.792-->00:01:14.000 these blue teams that we are up against, not so surprisingly, have their Sh*t together. Um, 00:01:14.000-->00:01:19.708 I've come up against some really good detection strategies actually uh at clients recently 00:01:19.708-->00:01:26.000 that have integrated tools like Sysmon and App Blocker, and ENet, and Event Log Forwarding. 00:01:26.000-->00:01:31.583 Um and they've put in place products like crowdstrike for host behavior analytics, they've 00:01:31.583-->00:01:36.583 put in tools like rapid 7 user insights for domain behavior and user behavior analytics. Um, and 00:01:39.208-->00:01:44.208 so I've spent a lot of time coming up against these, um, trying to figure out how to 00:01:44.208-->00:01:51.083 bypass or evade them at- as a whole. So, aside from being a horrible f*cking talk title that 00:01:51.083-->00:01:57.750 drunk me thought up and thought sounded funny on uh CFP submission night, I think of 00:01:57.750-->00:02:04.083 tactical nukes because they are intended to be strategically used uh forcing adversaries to 00:02:04.083-->00:02:09.000 rapidly react and change their tactics. And that's what I think Microsoft is arming the Blue 00:02:09.000-->00:02:14.292 team with, uh, with these 2 new products. So when I saw that they were coming out with the 00:02:14.292-->00:02:19.125 host and domain based behavior analytics and that advanced threat protection was being 00:02:19.125-->00:02:25.292 built directly into Windows 10 enterprise, uh, I knew this was going to be an area that as red 00:02:25.292-->00:02:29.833 teamers, everyone is going to come up against soon. So I knew it was an area we needed some 00:02:29.833-->00:02:34.833 more focus. Uh, especially when ATA and ATP are gonna be integrated together this fall. 00:02:37.333-->00:02:44.333 Um, so this is the uh first talk I'm aware of on actually evading or bypassing ATP and only the 00:02:44.333-->00:02:49.333 second on ATA. Uh, Nick Hail did a talk on ATA just on Thursday at Black Hat. Uh, and so because 00:02:53.458-->00:02:57.792 we're pretty early in the history of these products, uh, I've withheld a few techniques 00:02:57.792-->00:03:02.833 that I wanna cover later at Wild West Hacking Fest. So there's still tickets available, you 00:03:02.833-->00:03:08.833 guys should definitely get on that bandwagon and come party in uh South Dakota. Um, but there's 00:03:08.833-->00:03:14.875 also probably a sh*tload of techniques that I didn't think of or test or don’t- can't even 00:03:14.875-->00:03:20.625 fathom in my limited brain, so, hopefully this inspires you to try to rip these technologies 00:03:20.625-->00:03:25.625 apart yourself. So, Uh, to set the stage, when I developed uh, IBM X-Force reds, uh, tactics, 00:03:28.583-->00:03:35.500 techniques, and procedures or RTTP uh, for Red teaming, I put a huge emphasis on host and 00:03:35.500-->00:03:41.083 internal recon uh, as being very distinct phases. A lot of people, they get a shell in a 00:03:41.083-->00:03:45.875 box and they immediately start trying for lateral movement an- and gathering information about 00:03:45.875-->00:03:50.875 the domain and all that sort of sh*t, but, what they’re not considering is um, what IOCs 00:03:55.125-->00:04:01.292 their leaving on the host itself and what detection technologies might be on the host beyond, you 00:04:01.292-->00:04:04.958 know, sh*tty antivirus that you probably run into all the time and you don't really care about 00:04:04.958-->00:04:09.917 it catching you because the worst that happens is your, your powershell stager doesn't launch 00:04:09.917-->00:04:15.000 and you just have to try it again or something. So, uh, to become better red teamers and 00:04:15.000-->00:04:19.708 operate against these more mature blue teams that we’re coming up against at these 00:04:19.708-->00:04:24.292 larger, larger companies, we need to gain a better understanding of what IOCs and 00:04:24.292-->00:04:28.042 tools and techniques we're leaving behind. So, what commands might be caught by 00:04:28.042-->00:04:32.833 different script logging, and what's flaggable by Sysmon, uh, what's being forwarded by 00:04:32.833-->00:04:39.000 Windows event forwarding and importantly, how can we use different techniques to avoid 00:04:39.000-->00:04:44.000 user behavior analytics. So, uh, with, with AI coming out and more behavioural learning being 00:04:48.042-->00:04:54.750 applied to uh, IOCs, companies are getting a lot better with actually detecting malicious 00:04:54.750-->00:05:01.458 user behaviour instead of just getting spammed in your SIM so you turn your SIM off. Um, So 00:05:01.458-->00:05:07.750 we, we're going to see a huge rise in this in the future. So, here's Microsoft's Kill chain as 00:05:07.750-->00:05:14.708 relates to you ATA and ATP, um not shown on the graphic to the left is Office 365 ATP which is 00:05:14.708-->00:05:20.167 a separate product, it's focused on pre breach, Dave Kennedy ripped the, ripped it apart and 00:05:20.167-->00:05:24.542 showed some easy bypasses on their email send box. These 2 products are completely 00:05:24.542-->00:05:29.542 separate. Um, so we're focused only on post breach and Microsoft approach with these 00:05:34.667-->00:05:36.667 two products. So Advanced Threat Protection and Advanced Threat Ana- Analytics. So, for 00:05:36.667-->00:05:43.250 simplification purposes, you can think of ATP like crowdstrike and ATA like Rapid7's user 00:05:43.250-->00:05:50.125 insider, another kinda like domain user behaviour analytics. So, my labs set up real quick, 00:05:50.125-->00:05:56.792 it's not running on a Compaq Presario,uh, it's running, uh, with multiple 2016 84s, lots of 00:05:56.792-->00:06:01.792 subdomains, lots of dozens of member servers and Windows 10, Uh, 1703 workstations which is 00:06:03.875-->00:06:07.417 the- the new creators update that just came out, and that's important. So keep that in mind 00:06:07.417-->00:06:12.333 in a second. Uh, I ran all these commands against multiple hosts and domains and ASTA instances 00:06:12.333-->00:06:16.708 so to try and make sure everything I'm reporting on is accurate. That said it is a test 00:06:16.708-->00:06:22.333 environment so it's hard to replicate real-life, prod user behavior analytics. Like it's 00:06:22.333-->00:06:27.125 one thing for me d*****g around in my lab versus a huge corporate network where there is 00:06:27.125-->00:06:32.125 real people using specific resources. Uhm, so a quick A, overview of ATP - uh, it's 00:06:48.583-->00:06:50.583 currently, uh, installed on more than two million devices - I think most of those are at 00:06:50.583-->00:06:52.583 Microsoft. [laughter] But, uh, it's a, uh, you know, it's quite prevalent for how, uh, its 00:06:52.583-->00:06:54.583 install base. Uhm, so, uh, this is the, uh, I should point that out, so basically you have your 00:06:54.583-->00:06:59.833 behavioral sensors on the left and they send, uh telementry data and, and, you know, 00:06:59.833-->00:07:04.667 different data gathered, gathered off the host from registry keys that were created; 00:07:04.667-->00:07:10.083 services that created. You know, weird, weird commands that you might be running and they send 00:07:10.083-->00:07:15.083 all that raw data to the cloud; or, or the portal. And, uh, once it hits this portal it's starts 00:07:17.167-->00:07:23.500 to analyze that and if it's a very easily detectable type of attack you might get an alert 00:07:23.500-->00:07:28.917 within five minutes. If it's a very complex attack where you're using, you know, uhm, different 00:07:28.917-->00:07:34.000 obfuscated PowerShell cradles and launchers. You might take; uh, it might even take, it might 00:07:34.000-->00:07:39.000 even take up to a full day to get an alert. Uhm, these sensors are actually embedded in Windows 00:07:42.250-->00:07:49.250 10 Pro and Enterprise already. To activate them is just, uh, like a five line activation 00:07:49.250-->00:07:54.250 script. So, uhm, in 1703 that just came out - that was pared with ATP Release 2 and in the 00:07:58.917-->00:08:05.000 fall with the upcoming fall, uh, update - that's going to be ATP Release 3 on Windows 10 1709. 00:08:05.000-->00:08:10.000 So, uhm... Because there's a delay in that detection period, if you, if, if you are going for 00:08:15.125-->00:08:21.375 a quick smash-and-grab against a less mature organisation, sure you could probably get in, uh, 00:08:21.375-->00:08:24.875 you know, grab whatever you're after and get out before they even got the alert. But we're 00:08:24.875-->00:08:30.125 not talking about those Swiss cheese organisations - we're talking about actual mature 00:08:30.125-->00:08:34.833 companies that have their s**t together and they've mostly patched and hardened all their 00:08:34.833-->00:08:40.875 systems and, you know, they've made it a lot more difficult for red-teamers. So, uh, in ATP, in 00:08:40.875-->00:08:45.958 addition to that prompt tool where you can see, you know, different, uh, execution, uh, 00:08:45.958-->00:08:50.625 attacks that are found; different machines reporting malware and stuff like that. You 00:08:50.625-->00:08:56.292 can see the process tree - so there's empire being launched - it's showing the obfuscated 00:08:56.292-->00:09:03.000 commands to that kind of stuff. Uhm, you can follow the attack path so if somebody opened it in 00:09:03.000-->00:09:07.250 one process and then launched another malicious command in another process or laterally 00:09:07.250-->00:09:12.250 moved around the network you can kind of track that. Uhm, if you want to quarantine a file that 00:09:16.208-->00:09:20.042 you've seen on more than a couple of boxes it's really simple to do. Just point and 00:09:20.042-->00:09:26.333 click; uh, same with if you wanna isolate a Windows 10 box off your corporate network. It's 00:09:26.333-->00:09:32.958 just a matter of hitting actions and hitting disable and then you can tell them, you know, uh, you 00:09:32.958-->00:09:39.792 shouldn't have opened that phishing email or what have you. So, in Release 3, that, again, 00:09:39.792-->00:09:45.333 is coming this fall, uh, is the fall creator's update or the autumn creators' update if 00:09:45.333-->00:09:50.333 you're from the Europe, the Europer, uhm... [laughter] Uh, the, uh, defender brand has been 00:09:53.292-->00:09:58.708 expanded and, you know, I, I can't say, you know, I'm a marketing genius but I wouldn't 00:09:58.708-->00:10:03.417 picked 'Defender' as a brand to, kind of expand and go behind but, anyways... [laughter] That 00:10:03.417-->00:10:08.417 aside... You've got, uh, Windows Defender anti-virus that we all love. Uhm, and that's their 00:10:10.583-->00:10:15.583 traditional AV. You've now got advance threat protection or 'ATP'. Uhm, emit, or emit, is 00:10:17.750-->00:10:22.750 coming back, uh, as 'Windows Defender exploit guard'. And emit is actually a really good 00:10:25.125-->00:10:30.042 tool. Uh, you've got app-guard coming under the windows defender brand; Device guard, 00:10:30.042-->00:10:36.750 firewall and credential guard. And interestingly enough, they're going to start 00:10:36.750-->00:10:43.125 supporting more operating systems. So, in the fall I believe, uh, twenty-twelve and 00:10:43.125-->00:10:49.208 twenty-sixteen server are gonna support, uhm, ATP. It's not a full implementation yet, I think 00:10:49.208-->00:10:53.750 in the spring update that's coming out it'll be more ingrained into the operating 00:10:53.750-->00:10:58.750 system. Uhm, and iteration with ETA is also coming in Release 3. Uh, as well as better 00:11:01.042-->00:11:06.250 correlation of the activities run across multiple processes and sorts of stuff that they 00:11:06.250-->00:11:10.958 tell me and I look forward to putting that to the test ripping it to s**t - but we'll see, 00:11:10.958-->00:11:16.875 we'll see how it goes in the fall. So, a little different about the Release 3 dashboard 00:11:16.875-->00:11:21.958 than the dashboard you saw before was that you could see all those unique security 00:11:21.958-->00:11:27.417 technologies that I talked about like exploit guard and credential guard being reported, 00:11:27.417-->00:11:34.042 uh, at the bottom right. You can see the operating system's bottom left - all sort of, uh, 00:11:34.042-->00:11:39.750 improvements that bring all of these distinct security technologies that we're just 00:11:39.750-->00:11:44.750 being deployed by a group policy or SCOM or C, SCCM, and, and not really reporting into anything. 00:11:47.708-->00:11:52.708 Uh, and now everything's talking together and everything's being reported to the cloud. So, uhm, 00:11:56.208-->00:12:01.458 again, with this being built into Windows 10 it's comes bundled if you grab the new E, 00:12:01.458-->00:12:06.458 E5 license or the new Microsoft 365 for enterprise. So, this isn't some obscure license that 00:12:09.083-->00:12:15.875 nobody's gonna bother to grab; it's actually a, a pretty mature, uhm, integration into 00:12:15.875-->00:12:20.667 the Windows uh, you know, whatever you wanna call it - the, the total Windows suite. 00:12:20.667-->00:12:25.833 So, it's very easy for enterprises to get this in place so, as red-teamers we're gonna 00:12:25.833-->00:12:32.542 start to see it everywhere, uh, in a few months' time, I'd imagine. So, let's actually look 00:12:32.542-->00:12:37.542 at ATP in play. So, uhm, if we start with Powershell - ATP will detect, uh, PowerShell download 00:12:40.625-->00:12:45.792 cradles and launchers gen, generated, uhm, by empire and Cobalt - all the, all the 00:12:45.792-->00:12:51.458 default launchers. Uhm, it'll also detect heavily obfuscated PowerShell commands and download 00:12:51.458-->00:12:56.458 cradles such as that custom, uh, cradle with, uh, Cobalt reverse DNS payload or, uhm, quite a lot 00:13:00.167-->00:13:07.000 of the payloads that are created by the obfuscated empire project. Specific to PowerShell 00:13:07.000-->00:13:12.000 are, uhm, are also caught. Uhm, then the reason for this is, like, Microsoft gave us an 00:13:14.125-->00:13:19.125 amazing attack tool with PowerShell, uh, and we've been favouring using PowerShell .exe 00:13:21.208-->00:13:25.750 or PowerShell core and the underlying windows management framework, for several years, 00:13:25.750-->00:13:31.208 due to how flexible it is as a language and as a framework and how easy it is to use. Uh, and 00:13:31.208-->00:13:37.000 as attackers we seen emit some amazing tools come out. So, we've seen Empire, Powerup, 00:13:37.000-->00:13:41.167 unmanaged PowerShell , nopPowerShell , Nishang, Powerview, UserHunter and 00:13:41.167-->00:13:46.167 Bloodhound. Uhm, but now they're gonna take away our shiny new PowerShell tools, uh, by 00:13:48.458-->00:13:55.250 building this post-exploitation tool that leverages all those security improvements that are 00:13:55.250-->00:14:00.458 kind of built into Windows management framework five PowerShell version five. Uh, to 00:14:00.458-->00:14:06.750 detect these tools in use. So, ATP is leveraging all of those technologies you see there 00:14:06.750-->00:14:11.458 before you. Uh, due to time constraints, I won't cover these in detail. If you're already on 00:14:11.458-->00:14:16.042 red or blue team - chances are you've, you've heard about this being talked for the last couple 00:14:16.042-->00:14:21.750 of years. Uhm, but now you're gonna actually see it, you know, in a lot, leveraged a lot more, 00:14:21.750-->00:14:26.750 uhm, by Microsoft. So, you've got script-blocked login; transcription-login; if you use 00:14:29.583-->00:14:35.958 a suspicious string that's built right into PowerShell version five there's now constrained 00:14:35.958-->00:14:42.292 language mode - uhm, which is, uh, activated automatically when you use app-blocker. Uh, there's 00:14:42.292-->00:14:49.000 support for J, uh, JEA or 'Just Enough Administration'. There's also AMSI or the 'Anti-malware 00:14:49.000-->00:14:54.542 Scan Interface' which cover PowerShell , vbscript and jscript. A lot of the attacker 00:14:54.542-->00:14:59.542 tools that are common for getting an initial payload - on a box. Uhm, and a, a typical way 00:15:03.042-->00:15:07.708 to bypass these up to now is just been to, you know, load PowerShell version two. Uhm, 00:15:07.708-->00:15:12.708 cause it doesn't support any of those. But, uhm, dot net two in, in Windows 1703 or the creators 00:15:15.125-->00:15:21.333 of that isn't, uh, enabled by default because it uses dot net 2.0, so, that's not there. Uhm, 00:15:21.333-->00:15:26.792 and it's not supported - PowerShell version two is gone altogether coming the, uh, fall 00:15:26.792-->00:15:32.167 update in Windows 10. Uhm, so, we can't use that technique to get around all that, uhm, 00:15:32.167-->00:15:37.000 there's going to be some more persistent wide transcripts, uh, common techniques leveraging 00:15:37.000-->00:15:42.667 double script shells are also caught, uh, you know, saying those if you use nopPowerShell - 00:15:42.667-->00:15:48.542 like Ben Ten's tool, uh, or those that directly call system management automation dot DLL - 00:15:48.542-->00:15:53.375 because they're forced to use Windows management five. So, they're, you're not getting 00:15:53.375-->00:15:58.042 around it by just blocking PowerShell exe. All of these are built into the framework core. 00:15:58.042-->00:16:03.042 Uhm, and we've seen bypasses for a lot of these as individual technologies but as red-teamers, 00:16:05.167-->00:16:08.750 you know, obviously we need to get better at streamlining those techniques and chaining those 00:16:08.750-->00:16:12.958 techniques and chaining them together and now also taking into consideration, uh, ATP. 00:16:12.958-->00:16:18.292 Uhm, so, as a result of these improvements what I found that, we kinda have to go back to 00:16:18.292-->00:16:23.000 living off the land - uh, selectively running PowerShell when we're confident we've 00:16:23.000-->00:16:29.000 disabled or can silently evade these new security, uh, capabilities that are, that are 00:16:29.000-->00:16:34.000 kind of standard in Windows 10 now. Uhm, so ATP is also pretty good at detecting, uhm, using 00:16:36.333-->00:16:41.792 like signed binaries to launch malicious executables based on, uh, normal behaviours. So, if 00:16:41.792-->00:16:46.083 you launch something and all of a sudden it's calling out over HTTP, or TOR, uh, using vbscript 00:16:46.083-->00:16:52.375 in a macro-enabled document or something like that it's going to be flagged. Uhm, you can see 00:16:52.375-->00:16:58.125 based on some of those alert examples that many of the initial, kind of host, uh, recon 00:16:58.125-->00:17:03.042 or initial execution or privilege escalation activities are gonna be flagged due to the 00:17:03.042-->00:17:08.042 common underlying techniques that are used. Uhm, so, Tavis has been doing some amazing work 00:17:10.208-->00:17:15.208 ripping traditional defender anti-virus to s**t lately. Uhm, and a lot of that is due to 00:17:17.208-->00:17:22.708 defender running as localsystem. So, ATP is also running as local system because it's embedded 00:17:22.708-->00:17:27.708 into Windows 10. But the problem with this is that because defender auto-updates - by the 00:17:31.458-->00:17:35.625 time any of you guys saw his tweets, probably your defender instances were already 00:17:35.625-->00:17:42.500 auto-patched. So, uhm, if a vuln is responsibly, dis, disclosed - we're not going to be able to 00:17:42.500-->00:17:47.500 use it a week later cause most of the organisations that were vulnerable to it already 00:17:47.500-->00:17:52.750 patched. So, do similar bugs exist in ATP? More than likely but who's really burning their 00:17:52.750-->00:17:57.917 0-days? And if somebody does it's just get it patched and, you know, the rest of us script 00:17:57.917-->00:18:02.917 kiddies won't get to use it. [laughter] So... Well, you can get on the box initially using 00:18:05.667-->00:18:11.083 all those, uh you know, cradles, the name of the game is to not get caught. You don't wanna, you 00:18:11.083-->00:18:15.542 know 'Oh, yea, we got a shell, oh yea, we, we kicked you off the box immediately - good, good 00:18:15.542-->00:18:20.708 for you.' Good red-teaming, right? It's, it's about not getting caught so early - so, we 00:18:20.708-->00:18:27.458 want to get on this box initially undetected and a couple of ways I found to do 00:18:27.458-->00:18:32.458 that, uhm, so, uh, Vincent put out a cactus torch - doesn't call the Kernel32 api directly 00:18:36.458-->00:18:43.333 and as a result, uhm, it's not, it's not detected. Uhm, using signed executables to load like 00:18:43.333-->00:18:48.333 a Cobalt stage-less, stageless DNS, uh, based reversed payload. So, uh, it will catch, uh, HTTP 00:18:50.542-->00:18:56.583 but, but not DNS at this time. Uh, or executables that use ATP by, by tech, bypass techniques 00:18:56.583-->00:19:01.583 created with, like, veil, uh, using Go or shelter. Uhm, as long as they're not, like, 00:19:10.125-->00:19:12.125 connecting out to newly registered domains or, or connecting out to tort. Uhm, so, 00:19:12.125-->00:19:15.125 the, the challenge doesn't stop, again by, by getting on the box undetected initially - that's 00:19:15.125-->00:19:20.917 the easy part. The problem with, uh, the problem is detection of the activities that we perform 00:19:20.917-->00:19:24.500 or the commands that we run after we get out initial foothold. So, you know, creating 00:19:24.500-->00:19:30.667 new processes, doing host recon in the environmental settings or local groups and attempts to 00:19:30.667-->00:19:34.833 bypass all those kind of security controls that we're talking about. Or trying to do 00:19:34.833-->00:19:40.083 local privilege escalation; or trying to go out and, and innumerate information about the 00:19:40.083-->00:19:45.958 domain - that's what we're we're worried about getting caught on. So, those commands should 00:19:45.958-->00:19:51.667 probably be pretty, uhm, standard to most red-teamers, uhm, they're all a lot of like 00:19:51.667-->00:19:56.417 miners attack framework in jscripts laws and stuff. Uhm, they're pretty much all caught 00:19:56.417-->00:20:01.917 if they're issued in the same 24-hour period. So, uhm, depending on the method you use 00:20:01.917-->00:20:07.333 to create new processes, to run these commands individually that might also be flagged. So, 00:20:07.333-->00:20:12.875 instead of waiting 24-hours to put these commands in, we need a faster way to collect info. At 00:20:12.875-->00:20:17.875 this point in time, WMI is not detected, uhm, though it reportedly in Release 3 and, uh, 00:20:22.292-->00:20:28.333 a lot more in Release 4 - they, they should be, uh, because WMI logging - while it's not enabled 00:20:28.333-->00:20:33.708 by default, uhm, it's really easy to enable and start to do the same sort of detection on 00:20:33.708-->00:20:38.708 it. Uhm, so, you, you, you can, you know, use wmic or you can use command let or you can, you 00:20:41.083-->00:20:46.083 know use a lot of different techniques with WMI. Uh, preferred method is, is to use, 00:20:48.208-->00:20:53.917 uh, directly use the Windows APIs - so, going back kind of living off the land and not 00:20:53.917-->00:20:58.917 relying on empire and other scripts immediately, uhm, you can, uh, if you use Metasploit 00:21:03.708-->00:21:08.500 modules you wanna make sure they're only doing local APIs through railgun. Uh, you don't 00:21:08.500-->00:21:14.333 wanna use, uh, different models like local admin search which uses command exact and, and 00:21:14.333-->00:21:19.250 communicates with DCs and what not. And Cobalt's got a lot of stuff that's API only as, as 00:21:19.250-->00:21:25.375 well. So, if you look at more common, uh, bypass techniques - most of these won't work. As an 00:21:25.375-->00:21:31.250 admin you could modify the registry and disable the service which is called 'sense' - but it 00:21:31.250-->00:21:37.083 won't take effect until the next reboot. Uhm, you could probably also modify file permissions on 00:21:37.083-->00:21:43.542 the executables or, or folders but that's really noisy. Uhm, unlike crowdstrike, you can't 00:21:43.542-->00:21:48.542 just uninstall it as an elevated admin. You need a SHA 256 uh, assigned key, uh, with, that's 00:21:51.250-->00:21:57.208 unique to your organisation and the certificate to uninstall it. Uh, and the opcoding scripts are 00:21:57.208-->00:22:02.333 only valid ten days - so, if you find an opcoding script on a Windows share, uh, chances are 00:22:02.333-->00:22:08.750 you won't be able to use it. The reason for this is because of protective process light - so, 00:22:08.750-->00:22:14.208 you'll see that there's an additional value in that certificate called, uh, 'PPL 00:22:14.208-->00:22:20.708 verification', uh, that means that, uh, many of the, the security restrictions that were 00:22:20.708-->00:22:26.667 applied to the system process can now be applied to user-mode processes. It's, uh, basically 00:22:26.667-->00:22:33.417 binary signing and verification with, uh, Windows cert. Uhm, after the services launch is 00:22:33.417-->00:22:38.417 protected you, uh, can't, kind of, uhm, decode injection into it or from other admin processes 00:22:40.625-->00:22:46.792 or even if you're running as 'system' - you can't read or inject into a PPL process. Uh, 00:22:46.792-->00:22:51.792 even if you have debug privileges enabled. Uhm, Windows defender AV started using, uh, 00:22:54.333-->00:23:00.792 anti-malware PPL which is a lower version. Uhm, so you can use trusted installer, uh, with, 00:23:00.792-->00:23:05.792 uh, Google's project zero's bypass to, to uninstall and delete Windows defender AV but, 00:23:08.917-->00:23:13.917 uh, RS 2 for whatever reason Microsoft started using, uh, the Windows PPL which is, uhm, makes 00:23:18.542-->00:23:23.208 the process configured as not-stoppable. So, we can't use the same technique. Uh, at least 00:23:23.208-->00:23:28.208 that I've, I've seen so far. So, uh, the ATP sensor uses Windows telemetry or DiagTrack track to 00:23:30.667-->00:23:36.000 report sensor data and communicate with the ATP cloud. Uh, unlike ATA all the 'coms' 00:23:36.000-->00:23:42.250 are directly to the cloud - there's no local ATP console orm or event log forwarding. So, 00:23:42.250-->00:23:47.375 believe it or not, that's, that's actually, uh, an advantage to us, uh, because 00:23:47.375-->00:23:52.375 these are static cloud address. So, uhm, the WIndows HTTP API which, uh, DiagTrack uses, uhm, 00:23:59.708-->00:24:04.708 can actually be configured by any user, uhm, on, on the box. And, uhm, it will statically set 00:24:07.583-->00:24:14.500 and follow any proxy settings that, that we set. So, if we, uhm. Use just these two registry 00:24:14.500-->00:24:19.500 keys to, to turn off auto-detect and then to give us an attackers, uh, auto-config file, 00:24:22.708-->00:24:27.708 uh, which is, which is there. Basically we just say, uhm, if traffic's going to any of those 00:24:29.750-->00:24:36.292 ATP dep, domains - just sinkhole them. And we turn, uh, directly onto the internet or to you 00:24:36.292-->00:24:40.750 could configure the corporate proxy there for all other traffic, so really, really easy 00:24:40.750-->00:24:46.875 way to sinkhole all that traffic. If you were using responder or uh, 24:47 [invley]? 00:24:46.875-->00:24:52.625 on the, uh, internal network you could probably serve up that WPAD file to other Windows 10 00:24:52.625-->00:24:58.750 boxes on the internal network and shut down Windows 10 across, the, the network. Uh, at least 00:24:58.750-->00:25:04.417 the local subnet before you laterally move to those boxes. Uh, I spoke with the team at 00:25:04.417-->00:25:08.625 Microsoft - they were really communicative, uh, they're actively pursuing implementing 00:25:08.625-->00:25:13.542 some backup comm channels, uh, which you can't use this technique for anymore but, uh, 00:25:13.542-->00:25:18.542 for now, uh, go nuts! [laughter] Uhm, DiagTrack or telemetry is not a protected PPl process, s, 00:25:27.125-->00:25:33.958 as an admin we can just shut it down. Uhm, so you can see that, uh, that telemetry service is 00:25:33.958-->00:25:38.958 really the Achilles heel for, uh, ATP. So, this is a quick snippet, of, a PowerShell tool 00:25:42.833-->00:25:47.833 that I'll, uhm, put on my Git. Uhm, basically it resolves the ATP cloud hosts and then uses 00:25:50.417-->00:25:54.958 Windows built-in firewall to block outbound traffic or inbound traffic to, uh, any of 00:25:54.958-->00:26:01.292 those domains. So, uhm, because this requires elevated privileges you first use the 00:26:01.292-->00:26:05.708 previous unprivileged block and then you put something more, more per, per, permanent in 00:26:05.708-->00:26:11.750 place here. Maybe you'd run, a, PowerShell tools like power up to quickly elevate your 00:26:11.750-->00:26:17.250 permissions on the box and then, uh, implement these firewall rules. Uhm, interestingly 00:26:17.250-->00:26:22.583 enough, uh, you could use the same technique to block all Windows event log forwarding 00:26:22.583-->00:26:28.458 Sysmon or what-have-you. So, if you're worried about Sysmon reporting different techniques 00:26:28.458-->00:26:32.875 running on the box - well, it relies on Windows event forwarding to send it out - so 00:26:32.875-->00:26:38.417 we can just block Windows event log forwarding now. Uh, so why would we block instead of 00:26:38.417-->00:26:43.500 disable or try to look for, uh, a one-time exploit in this? It's just, it's very quick - doesn't 00:26:43.500-->00:26:48.917 require escalating the system to modify file permissions or we don't have to find some new PPL 00:26:48.917-->00:26:53.917 bypass. Uhm, when we block coms from a Windows 10 box to the ATP cloud, it actually doesn't show 00:26:58.708-->00:27:04.958 up as an issue for like four or five days. [laughter] Because, you know, people go on vacation 00:27:04.958-->00:27:10.625 - if they started flagging that, can you imagine the amount of, of, you know, spam that, that, 00:27:10.625-->00:27:16.667 uh, blue-teamers would get? So, you know, nobody's gonna enable as soon as it does not 00:27:16.667-->00:27:21.750 communicate for five minutes - send an alert, right? So, I don't see that being, you know, 00:27:21.750-->00:27:26.708 too easily fixed. Uhm, so that gives you quite a few days to, to mess around from that box. 00:27:26.708-->00:27:31.708 Uhm... So, so now that we've blocked ATP, uhm, we can start to look at comfortably running 00:27:38.417-->00:27:45.167 commands without being flagged by that local ATP instance. Uh, so, let's have a look at 00:27:45.167-->00:27:51.875 advanced threat analytics now. Uhm, it's intended to detect typical active directory domain 00:27:51.875-->00:27:57.250 recon and credential attacks, uh, and as if this fall it's actually gonna be, uh, 00:27:57.250-->00:28:02.250 integrated with ATP. Uhm, and version 1.8 actually came out a couple of weeks ago - so then I 00:28:05.167-->00:28:12.167 had to redo all of my research. Uhm, to make sure that it's still relevant, so. I think they 00:28:12.167-->00:28:17.167 intended just to screw Killian and myself up, but... Uhm, so, if we go over ATA real quick - 00:28:19.250-->00:28:24.917 there's four main components. Uh, you've got the ATA council which is the, the UI; it's 00:28:24.917-->00:28:30.583 running on top of the ATA center. You've got ATA-gateways and those can either be full 00:28:30.583-->00:28:35.583 gateways that are grabbing, uh, mirrored poor traffic. Uhm, or you can install a lightweight 00:28:38.083-->00:28:43.042 gateway directly on a domain controller and yes, it'll grab all the events directly, uh, 00:28:43.042-->00:28:48.042 from the box. Uhm, a mongo database stores all the data., uh, from the different gateways, 00:28:51.250-->00:28:56.250 uh, on the ATA center. Uhm, and interestingly enough if you wanted to screw with ATA coms, 00:28:59.208-->00:29:06.000 while I was troubleshooting that upgrade from 1.7 to 1.8, I found that, uh, there's no roll-based 00:29:06.000-->00:29:11.000 to that mongodb. So, if you got on the ATA, uh, center, you can modify, delete events; you can 00:29:14.042-->00:29:18.167 white-list certain events so they're never flagged. Uh, and you know, you can do that all in 00:29:18.167-->00:29:22.250 the background without, you know, anyone who's monitoring the logs finding out about it. 00:29:22.250-->00:29:27.250 Uhm, you, you can also integrate it with, uh, sim, uh, wit Syslog or, maybe your VPN, uh, with 00:29:29.500-->00:29:33.917 radius so you can see different authentication events and what not from there. Uhm, lightweight 00:29:33.917-->00:29:39.833 gateway actually used, uh, event log forwarding before 1.8 which I had, had a nice little block 00:29:39.833-->00:29:45.917 for but now all those events are read locally. So, there's the, uh, ATA console - shows the 00:29:45.917-->00:29:52.542 timeline of events, uh, and alerts, uh, and there's a quick notification bar on the right so 00:29:52.542-->00:29:57.042 any new alerts popping up - you can see them if you're monitoring that console. 00:29:57.042-->00:30:02.708 Obviously you, you know, can do email alerts based on security and what not. Uh, there's an 00:30:02.708-->00:30:07.500 example alert where you can see, you know, as attack, as a blue-teamer you can dive into 00:30:07.500-->00:30:13.542 some of these attacks and kind of see not only what box it's coming from but what client; 00:30:13.542-->00:30:17.875 what resources that person access with their pass-the-ticket attack. So, 00:30:17.875-->00:30:22.625 it's, you know, it's pretty, uh, pretty robust tool in that sense. Uh, you can see history 00:30:22.625-->00:30:27.500 of the user; history of the box; history of the, uh, the workstation; uhm, to see, you 00:30:27.500-->00:30:32.500 know, if there's any suspicious queries or, or commands going on. And then when, uh, ATP 00:30:34.750-->00:30:39.792 integration comes, you know, that's gonna be very useful because you can use this, this 00:30:39.792-->00:30:44.458 domain information as much as possible and then see it integrated with ATP and dive 00:30:44.458-->00:30:50.792 deeper. So, uh, ATA requires a learning period of a month for their user behavior analytics. 00:30:50.792-->00:30:56.875 Uh, and one week to detect encryptions and, and skeleton keys and vuln tickets - 00:30:56.875-->00:31:01.875 according to Microsoft. Uhm, so, just a recap, you know, testing in my lab isn't like testing in 00:31:04.708-->00:31:10.333 a real corporate, uh, network - so it's hard to accurately test, or to test user behavior 00:31:10.333-->00:31:15.333 analytics. So, uhm, I'd, I'd say whenever possible you wanna perform as much as you're 00:31:17.917-->00:31:24.458 attacks from, uh, like help desks or privileged user boxes - so target the help-desk users 00:31:24.458-->00:31:29.750 because they're often RDP-ing around and using PowerShell and you can read all their RDP 00:31:29.750-->00:31:33.958 history and session history and PowerShell history and it bookmarks and you can know where 00:31:33.958-->00:31:38.292 they're going around the network and where you'd expect their behaviour to be. Uhm, so that, 00:31:38.292-->00:31:43.875 that, that's, you know, one obvious technique to help, uh, unusual or abnormal behaviour 00:31:43.875-->00:31:48.875 from being flagged. So, uh, let's look at some the uh, uh, commands that we typically 00:31:53.417-->00:31:57.292 perform next now that we're pretty confident that, you know, we've disabled ATP and we we can 00:31:57.292-->00:32:02.042 start to look, to look around the, the network. So, typically we do some internal recon and 00:32:02.042-->00:32:08.000 id, identify subnets and v-lines we wanna go after. Uhm, you know, look at ad-recon - so 00:32:08.000-->00:32:12.500 looking at what domains and forest trusts and group memberships; what users are out 00:32:12.500-->00:32:18.167 there; what admins are out there. Uh, also look at, uh, acid recon so you wanna, you 00:32:18.167-->00:32:24.500 know, look through those cyber arch password vaults. You wanna look for sheer-point uhm, you 00:32:24.500-->00:32:29.458 know, all those targets of value, places where they have high- or intellectual property. 00:32:31.708-->00:32:38.458 You wanna discover what IPSs or web-filtering or proxies or behavior analytics or DLPs is in 00:32:38.458-->00:32:44.625 use before you start going buck-wild on the internal network. Uhm, so, uh, you know, 00:32:44.625-->00:32:51.417 often people do a lot DNS lookups you try and map out the internal network - a lot of 00:32:51.417-->00:32:55.208 these, especially if you're doing DNS brooding there're gonna be flags, so, if you're 00:32:55.208-->00:33:00.333 using a tool like Fierce and you're trying to do some zone transfers and brute force, 00:33:00.333-->00:33:05.333 internal names - a lot of that is going to be caught. Uhm, you can cut down on this by, by, you 00:33:07.500-->00:33:14.167 know, minimizing the frequency of, of how many, uhm, records you're trying to, to grab but 00:33:14.167-->00:33:20.750 there's obviously easier ways to get information about the internal network. Uhm, a lot of 00:33:20.750-->00:33:25.958 AD-recon techniques are caught because they remotely connect to the DC where a, uh, you know, 00:33:25.958-->00:33:32.375 ATA is running on. And enumerate info using the SAMR protocol. Uh, sorry, the SAM-remote 00:33:32.375-->00:33:37.375 protocol. So, commands like, uh, 'net user slash domain' to grab a list of all the main users, 00:33:39.500-->00:33:45.750 for example. Performs directories services queries and by default ask a lot of, ask for 00:33:45.750-->00:33:50.375 a lot of account properties and information that's pretty easy to flag on it if ATA is 00:33:50.375-->00:33:57.042 monitoring the, uh, the event logs. Uhm, ATA applies a learning period to this alert in 00:33:57.042-->00:34:03.125 particular to cut down on false positives, so, uhm, it;s normally in place after about a 00:34:03.125-->00:34:08.125 month. Uhm, with that being said, uh, we can use, uh, we, we can query LDAP via power group, 00:34:12.917-->00:34:19.458 uh, power, power view to grab a list of, uh, computers and group members which is pretty normal, 00:34:19.458-->00:34:24.333 uh, user traffic on a domain. It's, it's gonna be pretty hard to flag on that and, and not get 00:34:24.333-->00:34:29.333 a lot of false positives. Uhm, another, uh, technique I like to use because it doesn't 00:34:31.667-->00:34:36.667 communicate with, uh, active directory at all is to, uhm, just do, uh, WMI sim queries - 00:34:39.333-->00:34:46.042 they're run directly against the user's' local WMI namespace and ah, not communicating with the 00:34:46.042-->00:34:51.042 domain control at all. So, uh, Windows, uh, WMI command let's PowerShell and PowerShell 00:34:53.167-->00:34:58.458 version 2 plus send commandlets or PS3, PS version 3 only but they both accomplish the same 00:34:58.458-->00:35:04.042 thing. You can use, use wmic if you want to do that. So, in that example, you know, we're, we're 00:35:04.042-->00:35:09.042 trying to find, uh, admin, admins within the depth of, you know, another example we're 00:35:12.792-->00:35:17.792 looking for, uh, domain group, uh, memberships, uh, or we could even identify AT in use if we 00:35:21.333-->00:35:27.708 just query for the default, uh, group name which, uh, isn't changeable at the moment. So, 00:35:27.708-->00:35:32.708 uhm, a lot of people have shifted to using UserHunter and bloodhound as, you know, the 00:35:34.708-->00:35:41.250 fancy, uh, tools which query all the servers and try to find active SMB sessions on those 00:35:41.250-->00:35:47.750 boxes to map out, you know, who's using the box; who has an active session and, uhm, you 00:35:47.750-->00:35:52.750 know, when you know the, the, uh,group members are domain admins and what not, you'll see 00:35:56.375-->00:36:01.458 how valuable these techniques are because you can quickly map out an attack path to go after, 00:36:01.458-->00:36:07.042 after domain admins by, you know, bloodhound telling you to pop box A, box B, box C - grab 00:36:07.042-->00:36:12.500 these credits in your domain admin. Uhm, by default, uh, the UserHunter first queries the 00:36:12.500-->00:36:18.500 domain controller for a list of domain member computers which obviously includes the domain 00:36:18.500-->00:36:24.125 controllers themselves so, uhm, you know, that's gonna be flagged and you'll see in the 00:36:24.125-->00:36:29.708 bottom right - if you can see, uhm, the alerts - because we communicated to the domain 00:36:29.708-->00:36:35.875 controller to get that list of, uh, computers. But we, we can easily, just, just as easily 00:36:35.875-->00:36:40.875 exclude domain controllers from this, uh, list - so, if we manually give it, uhm, a host 00:36:43.583-->00:36:48.167 target file, uh, which doesn't have any domain controllers involved we can still do all 00:36:48.167-->00:36:53.000 that SMB, uh, session enumeration and find where our admins are and where that 00:36:53.000-->00:36:58.000 privileged users are and, and find who we have to go after and attack. So, now that we've got 00:37:00.750-->00:37:06.375 info on potential targets such as privileged users let's look at lateral movement. So, you 00:37:06.375-->00:37:11.542 know. this typically involves leveraging that gathered SMB session information or SPN info 00:37:11.542-->00:37:17.667 and any group info to go start to target those privileged accounts. Uh,.and you know we 00:37:17.667-->00:37:24.083 perform several remote code execution or something to, to get on those boxes. So, ATA is 00:37:24.083-->00:37:30.000 decent at, uh, detecting PS-exec, uh, cause binaries are dropped to this and processes 00:37:30.000-->00:37:35.000 are started and WMI exec cause, uh, it's running directly against the AT - uh, sorry, 00:37:37.792-->00:37:42.333 directly against the domain controller and because ATA is monitoring the main controllers 00:37:42.333-->00:37:49.167 logs its', it's very easy to detect it. Uhm. It may be able to detect, uh, abnormal user 00:37:49.167-->00:37:55.500 behavior against all the main workstations and servers, uh, but again, that's based on user 00:37:55.500-->00:38:00.500 behavior analytics. So, if you're going after a lot of boxes that you've, you've never 00:38:00.500-->00:38:05.083 touched before from that user account it's going to see that as suspicious because you 00:38:05.083-->00:38:10.750 successfully authenticated to a lot of different boxes. Uhm, but there's definitely a gap in 00:38:10.750-->00:38:17.417 detection for lateral movement for ATA, but, uhm, I think that's going to be narrowed down 00:38:17.417-->00:38:22.417 quite a bit when the ATP integration comes down the line. Uhm, if you wanted to perform, 00:38:27.083-->00:38:32.750 uh, overpass the hash attack, so, pass the hash attacks are really feasible detected. Uhm, 00:38:32.750-->00:38:37.417 and I'll tell you why in a minute but if we want to use an over, uh, pass the, uh, hash 00:38:37.417-->00:38:42.417 technique, uhm, its flags does encryption downgrade because, uhm, we're using, uh, an NTLM 00:38:45.750-->00:38:50.750 hash and that uses, uh, des cbc MB5 and so, uh, in authentication logs it's really 00:38:53.583-->00:38:58.583 easy to see that only those, uhm, type, encryption types are being used. But if we instead 00:39:02.667-->00:39:07.667 use the, uh, AES 256 key, uhm, it's still gonna detect it because it doesn't see the right 00:39:14.000-->00:39:19.125 values in the AS rec but if we also give it the AS 128 value and the MB5 or the NTLM hash 00:39:19.125-->00:39:21.125 it's not gonna flag it as suspicious activity. Uh, it's, I I find it's really hard to get 00:39:21.125-->00:39:23.125 the AES 128 key, uh, I don't know enough about it to, to figure out why but, I look all 00:39:23.125-->00:39:25.125 through the, you know, the main mimikatz documentation and I couldn't see why, so instead I 00:39:25.125-->00:39:27.125 was like 'Well, what if I just gave it all zeros?'. Yea, it's fine... So... [laughter] You 00:39:27.125-->00:39:32.125 don't, you don't have to find AES key in, in grab it, uh, for the ticket. It, it's just, you 00:39:53.833-->00:39:59.250 throw whatever 32 characters you want in there. Uh, silver tickets aren't going to be 00:39:59.250-->00:40:05.250 detected , uh, so if you're familiar with golden tickets and silver tickets, uh, golden 00:40:05.250-->00:40:10.250 tickets arem you know, that forge Kerberos DGT, uhm, which is valid to getting access to 00:40:12.250-->00:40:18.333 anything that is running Kerberos but the silver ticket is a forged TGS. So, this means 00:40:18.333-->00:40:24.708 that the silver ticket scope is limited to whatever services is targeted on the specific server. 00:40:24.708-->00:40:30.333 So, it's not, uh, when we forge a silver ticket we don't have to communicate t a domain 00:40:30.333-->00:40:35.375 controller because we're not communicating to a domain controller, uh, AT has no idea 00:40:35.375-->00:40:41.042 that, that, that this attacks is happening. Uhm, and, you know, you can read, uh, on Sean 00:40:41.042-->00:40:46.375 Metcalf's, uh, awesome ad security dot org's site about all, you know, golden tickets 00:40:46.375-->00:40:53.167 and so silver tickets. Uhm, lateral movement: the sql auth isn't detected as well because 00:40:53.167-->00:40:59.500 because it's sql auth so, uh, the domain controllers aren't monitoring, uhm, that. So, if 00:40:59.500-->00:41:05.500 you target an SA box or you can perform sql injections successfully on a sql box you 00:41:05.500-->00:41:11.375 can move between different sql servers and, uhm, and find one of those boxes that might have a 00:41:11.375-->00:41:17.583 privileged active dir, directory user logged in. You know - steal his token, steal his hash... Uh, 00:41:17.583-->00:41:24.167 impersonate that user and go from there. Nikhil, uhm, you know, demonstrate in a lot of 00:41:24.167-->00:41:29.167 those techniques, uhm, on that link if you wanna learn more. Uhm, so once you have access to 00:41:31.375-->00:41:37.750 privileged user it's time to, time to move towards actually achieving the primary goals of a 00:41:37.750-->00:41:42.250 red-team engagement. So, that, those might include, uh, gaining dominance over the network so, 00:41:42.250-->00:41:47.250 you may or may not need to grab the active directory database or the ntds dot debt, uhm, but it 00:41:49.708-->00:41:55.833 sure comes in handy and if you can do it without getting detected why not, right? Uhm, 00:41:55.833-->00:42:02.208 you might need to access sensitive information such as financial records or IP, uhm, or 00:42:02.208-->00:42:06.708 you might need to gain privileged access to certain systems that, that are in scope. 00:42:06.708-->00:42:12.958 So, uh, a common technique, uh, to grab the AD database is to use DC-sync which effectively 00:42:12.958-->00:42:18.167 impersonates a domain controller and says 'Hey, I'm a, I'm a DC as well. Send me a full 00:42:18.167-->00:42:23.417 replication of your, your, your credentials' - basically. Uhm, so as you can imagine this is 00:42:23.417-->00:42:28.417 super easy to detect on because, you know, why is a Windows 10 workstation saying that it wants 00:42:30.500-->00:42:36.833 all the creds, right? So, it's super easy to detect upon. Uhm, so if you run DC-sync, within 00:42:36.833-->00:42:41.958 the same forest it's definitely going to be detected, across forest, uh, it might not be. Uh, 00:42:41.958-->00:42:46.958 you can, you can use the WMI Windows 32 shadow copy class to dump the empty ntds dot dit via 00:42:49.417-->00:42:54.417 shadow, shadow copies and you can use that without directly calling the sys, uh, admin, Uhm, 00:42:56.417-->00:43:03.042 so it's a lot stealthier, uhm, but as of ATA one-point-eight this is now flagged a low 00:43:03.042-->00:43:08.083 severity event - not, not, you know, critical. We, we just grab all the AD creds but, but it's a 00:43:08.083-->00:43:13.833 low severity event. [laughter] Uhm, but it's not because we did volume shadow copy, it's because 00:43:13.833-->00:43:18.125 it's on a Windows 32 process create - so, that's probably an area that you can spend some 00:43:18.125-->00:43:23.125 time with and, and bypass using that all together. Uh, ATA 1.8 all, may also detect WMI exact 00:43:26.167-->00:43:31.167 methods but I, I couldn't replicate it in a lab environment. Uhm, not detected 00:43:34.333-->00:43:36.375 if you want to, uh, user powersploit and, uh, use psremoting to inject mimikatz to 00:43:36.375-->00:43:38.375 memory and do LSATS injection you can just, uh, grab the NTDS that is there. Uhm, there are 00:43:38.375-->00:43:40.375 ways to harden WMRM and ps-remoting, uh, via restricting, you know, 00:43:40.375-->00:43:45.375 ps-remoting access via groups and what not if you're a blue-teamer out there. Uhm, you 00:44:03.625-->00:44:09.708 can also use ninja copy because it does raw disc-access so instead of doing LSATS injection 00:44:09.708-->00:44:15.042 or, or doing volume shadow copy - we're just gonna directly do a raw disc access. So, you know, 00:44:15.042-->00:44:20.000 sometimes when you copy the, the NTDS dot div there a couple of areas there that you might need 00:44:20.000-->00:44:25.250 to clean up, uh, but, but it's super easy to do. Or, or you can just try and grab it again and 00:44:25.250-->00:44:32.208 get a clean file. Uhm, and if you're a blue-temaer out there, you can detect else, our raw 00:44:32.208-->00:44:36.833 disc access and LSATS injection fairly easily with sys 1 and then, you know, using Windows 00:44:36.833-->00:44:41.833 event forwarding to, to alert. Uhm, if you grabbed that NTD dot dit a while ago and you have the 00:44:44.500-->00:44:49.500 KB, KB, KRBGTD or the 'Kerberos ticket granting ticket service', uhm, and you wanna come back 00:44:53.042-->00:44:57.375 three months later, uh, to create a golden ticket... [background noise] If you use 00:44:57.375-->00:45:03.583 the MTLM hash, uh, just like in an overpass, that hash attack uhm, we're gonna get flagged, 00:45:03.583-->00:45:08.583 uh, as an encryption downgrade as we're using rc4 and, uhm, the TGS rep thinks that those, uh, 00:45:11.792-->00:45:17.208 properties should also include the AES key. Uhm, so if you just use the AES key you, you can, 00:45:17.208-->00:45:23.250 uh, generate a golden ticket no problem. You don't have to include the MTLM hash or the AES 00:45:23.250-->00:45:28.250 128 key - I don't know why but, uhm, easy enough. [laughter] So, uhm, blue-team take aways, uhm, 00:45:31.583-->00:45:36.583 how am I doing for time? I need sunglasses up here. Good? Two? Allright. Uh, take a picture. 00:45:42.500-->00:45:46.000 [chuckle] [laughter] Uh, yea, alright, I'll leave it up for a minute. So, you wanna harden sql 00:45:46.000-->00:45:51.000 boxes; forest trust; uhm, you wanna, uh, use windows event log forwarding, uhm, you wanna 00:45:53.792-->00:45:59.125 integrate all those new defender ATP tools that we talked about and roll that across to your 00:45:59.125-->00:46:04.917 different servers. Uhm, the spring update's gonna come probably with some good WMI 00:46:04.917-->00:46:10.792 detection so you gotta return, uh, to different sysmon detection techniques. Uhm, if 00:46:10.792-->00:46:15.167 you're a red-teamer you gotta go back to living off the land and directly calling those windows 00:46:15.167-->00:46:21.333 APIs. Make sure you're leveraging those awesome PowerShell tools only after 00:46:21.333-->00:46:26.917 you've disabled ATD, ATP. Uh, and make sure you're, you're running locals ones that aren't 00:46:26.917-->00:46:31.875 directly communicating with, with the DC. You wanna look at RDP and PS session history to 00:46:31.875-->00:46:38.417 help avoid user behavior analytics by also connecting to those same, uh, uh, systems and, 00:46:38.417-->00:46:44.292 and resources. Uh, you wanna look at blocking Windows event logs forwarding cause that's one 00:46:44.292-->00:46:50.250 of the biggest techniques that people are using right now - with sysmon and what not. Uhm, 00:46:50.250-->00:46:56.458 so thanks a lot for, for all your time. Uh, and thank you to all these, awesome people and 00:46:56.458-->00:47:01.458 the Microsoft ATA and ATP team. [applause] And thanks to Simon for his art. [applause] Thanks 00:47:05.500-->00:47:06.167 guys!