00:00:00.083-->00:00:05.542 >>And my name is Daniel Bohannon uh I’m a a consultant [inaudible] I’ve been doing 00:00:05.542-->00:00:11.000 instant response [mic quits working] been doing instant response consulting with 00:00:11.000-->00:00:14.875 Manidant for the past 2 years and uh actually recently switched over to a uh senior 00:00:14.875-->00:00:19.250 applied security research position. um so getting to do a lot of this stuff more which is 00:00:19.250-->00:00:23.750 really exciting I’m also the author of the Invoke-Obfuscation and Invoke-CradleCrafter um 00:00:23.750-->00:00:28.292 powershell obfuscation frameworks. >>Thanks, D Bo! [applause] Alright so to kind of 00:00:28.292-->00:00:33.292 just hit the stage here we’re gonna talk a little bit about a treatise on blue team follies. 00:00:38.458-->00:00:42.917 So as it stands today you know the the majority of people use just regular command line 00:00:42.917-->00:00:49.250 logging, they look for processes for example powershell launching with malicious encoded commands. 00:00:49.250-->00:00:53.458 What we’re gonna do is we’re gonna go down some of the depths of how that can be dangerous, 00:00:53.458-->00:00:59.917 especially when you’ve got some bad assumptions going on. What we’ll do here though, of course, 00:00:59.917-->00:01:04.125 you can’t get any of this intelligence unless you’ve got logging enabled. So for sure 00:01:04.125-->00:01:08.958 make sure that you’ve got command line logging enabled that’s 4688 you can also get it 00:01:08.958-->00:01:14.750 from Sysmon, and then also that you’ve you got the PowerShell scriptblock loggings enabled 00:01:14.750-->00:01:20.708 because powershell version 5 has brought in tons and tons of awesome security stuff and uh 00:01:20.708-->00:01:25.125 attackers aren’t in the habit of enabling this stuff for you, so if you care about it you might 00:01:25.125-->00:01:30.125 as well do it first. So let's talk about what people do when they’re actually trying to do a 00:01:32.625-->00:01:37.333 sort of detection sort of based on malicious powershell. So you’ll see here maybe they’re 00:01:37.333-->00:01:41.792 gonna look at whenever I see powershell dash command I’m gonna take a look at those 00:01:41.792-->00:01:48.667 encoded arguments and try to figure out and write some detections based on those. Well 00:01:48.667-->00:01:54.500 powershell help, much like everything else is the best in the business. Turns out that you 00:01:54.500-->00:02:00.833 don’t only have to use direct input to the powershell dash command. You can also send in 00:02:00.833-->00:02:06.375 the those commands through standard input like many other automation tools you’re used to. 00:02:06.375-->00:02:13.083 So here’s an example of using this technique if you do this, if I’m taking some powershell 00:02:13.083-->00:02:18.500 commands and I’m dumping them in through powershell standard input if all you’re looking at 00:02:18.500-->00:02:23.458 is the content in the powershell command lines you’re gonna miss the stuff that went in there. 00:02:26.917-->00:02:31.208 However we’re a little bit ok so this is what it looks like when you look at the 8th command line 00:02:31.208-->00:02:37.083 logs for powershell itself. You don’t see the actual command that was run, I have one little 00:02:37.083-->00:02:41.417 note here this little blue shield this is stuff that will still show up in your powershell 00:02:41.417-->00:02:46.417 logs so while this won't show up in the 4688 this will show up in the powershell logs. However 00:02:49.750-->00:02:54.250 that looks like it’s kind of bad but what you do see here is if you look at the parent process 00:02:54.250-->00:02:58.750 command line the cmd itself you’ll see that somebody was trying to jack a bunch of input 00:02:58.750-->00:03:03.500 into powershell and so maybe you might start thinking about doing some detections based on that. 00:03:07.250-->00:03:13.625 So here’s a question do we start to maybe key anytime that cmd is calling powershell, that might 00:03:13.625-->00:03:18.625 be useful. But here's the thing, cmd you can also declare in an environment variable what 00:03:20.875-->00:03:26.125 process it should call. So here’s an example of setting powershell as chunks of two 00:03:26.125-->00:03:32.250 environment variables and then having cmd call that. So you can do all kinds of obfuscation with 00:03:32.250-->00:03:38.167 environment variables so just doing detections based on cmd that way, you’re at some kind of 00:03:38.167-->00:03:43.167 risk there for sure. This is an example from FIN8 a financially motivated attacker, doing a 00:03:47.250-->00:03:54.167 bunch of this stuff here with an embedded in a VB script VBA ring a bell? Yes, absolutely that’s 00:03:54.167-->00:03:59.125 what you just saw. They’re using late bound command piping into powershell to get their stuff 00:03:59.125-->00:04:04.125 done to avoid this command line detection. But you don’t only have to send things in through 00:04:07.583-->00:04:12.167 standard input, here’s an example at the bottom here of just using an environment 00:04:12.167-->00:04:17.458 variable directly in having powershell invoke the content of that environment variable. 00:04:17.458-->00:04:21.542 Kovter uses this as well so if you’re only looking at powershell command line that 00:04:21.542-->00:04:26.542 means you’re kind of screwed. Where will the clipboard? Here’s a good example of just using the 00:04:28.750-->00:04:35.458 clipboard as a information passing mechanism. You do see these things in the command 00:04:35.458-->00:04:41.833 lines but this is start starting to get really really really tough. So you might say here 00:04:41.833-->00:04:47.125 what happens if we just start applying detection for whenever a cmd is calling powershell 00:04:47.125-->00:04:51.250 maybe what I’ll do is I’m going to start doing detections based on that process chain, that’s 00:04:51.250-->00:04:56.250 the kind of thing that you see a lot of times in hids and that kind of thing. But here’s the 00:04:58.833-->00:05:05.792 thing when I run this sort of launch technique and dump anything into into powershell, 00:05:05.792-->00:05:10.792 what if an apparent cmd I set an environment variable I tell uh a child cmd to run the thing that 00:05:13.875-->00:05:19.833 was in the environment variable and that thing is the thing that actually calls powershell so if 00:05:19.833-->00:05:25.917 you’re doing anything that was just cmd calling powershell yeah you’re gonna miss that so this 00:05:25.917-->00:05:32.458 would be kinda cool if that works. Nah not quite, nearly but unfortunately we’re not gonna 00:05:32.458-->00:05:37.458 get there. However with the magic of cmd escaping all I need to do is escape that one last 00:05:40.125-->00:05:45.125 pipeline so that that initial cmd stops interpreting it. There we go! Yeah! Cmd that second cmd 00:05:50.583-->00:05:54.083 you can’t tell what it’s doing and then finally somehow powershell is getting involved. 00:05:57.167-->00:06:02.250 So obviously what we’re gonna do here is recursively check all the way up this parent process 00:06:02.250-->00:06:06.667 tree, combine all of those command line arguments, get rid of all that obfuscation and 00:06:06.667-->00:06:09.583 figure it out, like that’s the natural thing we’re gonna do and then we’re gonna save the day 00:06:09.583-->00:06:14.583 and be good. Unfortunately not, there is a ton of ways to give input to powershell that do not 00:06:19.000-->00:06:24.792 involve any source of parent process chain. What if you set, for example, you launch one 00:06:24.792-->00:06:29.667 window and set the commands in the window title, launch another window to scrape that window 00:06:29.667-->00:06:35.542 title as a kind of a sibling. You can use files, you can use reg keys, any sort of 00:06:35.542-->00:06:40.500 information passing mechanism that you can imagine that’s not just environment variables 00:06:40.500-->00:06:45.500 that’s gonna blow through any sort of parent process tree detection. So the good news as 00:06:48.667-->00:06:53.750 we kind of mentioned back there was the scriptblock logging and powershell will catch all these 00:06:53.750-->00:06:58.750 shenanigans but if you’re in an environment where the defenders are only looking at the command 00:06:58.750-->00:07:05.500 line logs you’re done. However there’s another thing we’ve just been talking about at this point 00:07:05.500-->00:07:10.208 we’ve just been talking about looking at process command chains. We haven’t even talked a 00:07:10.208-->00:07:16.875 little bit about the powershell content itself and it weighs through that. >>Yes, let's uh 00:07:16.875-->00:07:20.792 let's look at this content, itself so again we’ll see you’re really um on top of things 00:07:20.792-->00:07:24.125 you’re looking at all process command lines you’re also taking into account powershell 00:07:24.125-->00:07:28.542 scriptblock logging um are there any pitfalls that we might need to be aware of as defenders and 00:07:28.542-->00:07:32.875 are there any uh tools that you can use as redquimer to evade any evasion that you’re going up 00:07:32.875-->00:07:37.875 against. So we’re going to take a quick example uh a very rapid fire example looking at what we 00:07:37.875-->00:07:42.583 call the remote download cradle. Now the top here this remote download cradle is basically uh 00:07:42.583-->00:07:46.375 it’s copy and pasted everywhere it’s in all the major frameworks that you can think of attackers 00:07:46.375-->00:07:50.833 love this stuff it’s a one liner that will remotely - it will download a remote script in 00:07:50.833-->00:07:55.167 memory and then pass it to that invoke expression or iex which is basically like powershell’s 00:07:55.167-->00:08:00.792 eval statement if you will. So what what let’s play a little red team, blue team here we have 00:08:00.792-->00:08:06.042 our attacker command on the top this remote download cradle and as a defender, if we if we what 00:08:06.042-->00:08:11.958 if we say okay I’m interested when I see invoke-expression new object system dot net dot 00:08:11.958-->00:08:17.333 webclient and download stream http would this catch this command? Um it it will catch 00:08:17.333-->00:08:21.708 that command right here but lets lets go through a little obfuscation exercise and see 00:08:21.708-->00:08:26.625 what pitfalls are out there. So first whatever we see system dot that’s really not necessary in 00:08:26.625-->00:08:30.750 powershell. Um powershell will automatically pre pin that system dot for the dot net um h 00:08:30.750-->00:08:35.875 class so if an attacker doesn't have to have it in their command then as a defender uh we 00:08:35.875-->00:08:39.667 definitely don’t want to make that assumption in our um in our trigger terms down here so we’re 00:08:39.667-->00:08:45.917 gonna remove that from both. Um next, the URL this is uh this is the string so you can do stuff 00:08:45.917-->00:08:51.417 like I don’t know [inaudible] you’re also not to double quotes you can use single quotes you 00:08:51.417-->00:08:54.708 can put whitespace there you can also set it as a variable elsewhere there’s a lot of 00:08:54.708-->00:08:59.083 things you can do here so we’re just gonna remove that http part from the download string portion 00:08:59.083-->00:09:05.833 of the detection. So let’s keep going, download string. Um so download string is actually one 00:09:05.833-->00:09:09.667 of many methods in the net dot web client class and it’s the most common one that we see 00:09:09.667-->00:09:14.417 attacker's using but it’s definitely not the only one. This is just part of the list 00:09:14.417-->00:09:19.167 download string, download file, download data returning in obviously different formats, um 00:09:19.167-->00:09:24.625 an expression, a file on disk, download data is bitarray, um so maybe as a defender we say okay 00:09:24.625-->00:09:28.083 let’s just shorten it to dot download and make sure that we capture all these options up 00:09:28.083-->00:09:34.500 here. So that’s what we’ll do. Um also uh this parenthese isn’t really necessary we can start to 00:09:34.500-->00:09:38.875 chop up this powershell command and set pieces of it in variables so for example from 00:09:38.875-->00:09:42.250 frameworks out there will will say new object net dot web client let me put that in a 00:09:42.250-->00:09:46.500 variable typically called wc for web client, and then you just have variable name dot download 00:09:46.500-->00:09:49.625 string so let's remove that parentheses from the dot downloand portion of the 00:09:49.625-->00:09:55.542 trigger. So now from a powershell perspective um why why would this dot be 00:09:55.542-->00:09:59.875 problematic? Why how could an attacker get around that dot download to evade this detection 00:09:59.875-->00:10:06.042 that we have um well download string from a powershell token perspective um is actually a a 00:10:06.042-->00:10:11.000 member um and so somethings that we can do with member tokens in a powershell command so we can 00:10:11.000-->00:10:16.000 just throw single quotes around it we can also throw double quotes around it and if you look 00:10:16.000-->00:10:20.625 really closely at download string I promise this next slide works, but what we can do is 00:10:20.625-->00:10:25.792 just add a tick mark and that still runs now why the tick mark? What is this? Well the 00:10:25.792-->00:10:29.625 tick mark is the escape character or the grave accent character I like to think of it 00:10:29.625-->00:10:33.458 as a grave of a lot of grave defensive ideas I thought were really good ended up that they 00:10:33.458-->00:10:38.583 get broken by this. So we can actually put these uh in front of any character that has no 00:10:38.583-->00:10:45.000 escapable meaning um and you see the the 8 characters here um again like ‘0 is null ‘n for new 00:10:45.000-->00:10:48.250 line that sort of thing but as long as we place the ‘ before something that’s not one of 00:10:48.250-->00:10:52.667 those characters then we’re good. If you’re like me and you’re really OCD and you really 00:10:52.667-->00:10:56.333 wanna put a ‘ in front of those characters all you have to do just uppercase them and it 00:10:56.333-->00:11:00.125 totally works so now we can put tics in front of any character that we want in the method as 00:11:00.125-->00:11:05.375 long as we have double quotes, now here’s the scary part is that those tics are in the 00:11:05.375-->00:11:10.292 command line logs if you have some real time agent they’re in the command line uh the argument 00:11:10.292-->00:11:16.083 details itself and they actually persist all the way into powershell script block logs, 00:11:16.083-->00:11:20.625 now uh the place where uh this obfuscation doesn’t have any effect is in powershell module 00:11:20.625-->00:11:25.625 logs so the 4303 uh or 4103 EID so powershell’s log is really really robust um sometimes you 00:11:28.208-->00:11:33.583 just have to look in a lot of different places but all the all the evidence is there. So as a 00:11:33.583-->00:11:37.417 defender we can try to RegEx all this stuff to catch all these tic marks or maybe we should 00:11:37.417-->00:11:41.167 just give up on this, I don’t know, if you’re really brave and wanna do a RegEx make sure you 00:11:41.167-->00:11:45.708 keep in mind this open read method um which will return as a byte stream instead of a byte 00:11:45.708-->00:11:49.958 array or an expression um however I wouldn’t recommend doing a regex because if you 00:11:49.958-->00:11:53.500 throw parentheses around this you can then treat it as a legit string and start to do 00:11:53.500-->00:11:58.292 concatenations, set a chunk of variables, reverse to do whatever you want. Um and this 00:11:58.292-->00:12:02.667 dot invoke that you’ll see in these two examples that’s only required for powershell 2, um 00:12:02.667-->00:12:06.750 it’s not required for powershell 3 or later so as a defender if you look at invoke obfuscation 00:12:06.750-->00:12:11.583 it uses that dot invoke to make it um work on powershell 2 or later but you actually don’t 00:12:11.583-->00:12:15.958 have to have that, so make sure as a defender you’re not basing your defenses on that dot invoke 00:12:15.958-->00:12:21.292 portion. So let's just remove that uh from our indicators. So net dot web client, really 00:12:21.292-->00:12:25.833 briefly this is um from a powershell token perspective it’s an argument the new object 00:12:25.833-->00:12:29.958 command let we can do double quote tic marks we can put parentheses and catenate it, 00:12:29.958-->00:12:34.792 chunk it in variables, tons of options we’ll just go with the first one. There we go. New 00:12:34.792-->00:12:39.042 object now powershell is super inviting um to newcomers to learn the language because there 00:12:39.042-->00:12:42.625 is so many aliases so for example if you wanna list the files in the directory you can 00:12:42.625-->00:12:48.000 use powershell’s get shells atom if you’re lazy you can just say GCI or if you come from a 00:12:48.000-->00:12:52.000 windows background you can type der if you from a lenox background you can type ls and 00:12:52.000-->00:12:55.708 it all works so as a defender we have to be really careful to make sure that we’re 00:12:55.708-->00:12:59.125 understanding the the all the options that are available in powershell just from a pure 00:12:59.125-->00:13:04.708 syntax perspective regardless of any kind of obfuscation the nice thing is that new object has 0 00:13:04.708-->00:13:10.250 aliases so initially I thought hey this is gonna be a really solid indicator as a defender, 00:13:10.250-->00:13:15.417 however uh powershell uh is really good at helping you find stuff that you know is out there 00:13:15.417-->00:13:19.250 but you can’t remember the name of so for example, if I’m looking for a command that’s new 00:13:19.250-->00:13:24.667 dash p something, I can just type get command new dash p wildcard and it will return in 00:13:24.667-->00:13:29.958 power shell objects all the commands. So, if I return just a single object, then I can 00:13:29.958-->00:13:33.583 actually pass to invoke expression, um and that will automatically convert that 00:13:33.583-->00:13:38.792 command name to a string and then invoke it. However, uh as an attacker, we could be a 00:13:38.792-->00:13:42.583 little more creative than this. Instead of that invoke expression, why don’t we use a 00:13:42.583-->00:13:47.083 dot or an ampersand? And what are these guys? They’re invocation operators, and when 00:13:47.083-->00:13:50.708 this happens, it’s actually taking the powershell object return from get command and 00:13:50.708-->00:13:57.625 invoking it. However, we can get even more fun. So, remember those wild cards? That is new 00:13:57.625-->00:14:04.083 object, as is that, and as many combinations as you can think of, as long as that get command 00:14:04.083-->00:14:08.625 is returning just new object, that suckers gonna run and as a defender you’re not seeing new 00:14:08.625-->00:14:13.667 object anywhere in command line or in script block logging, pretty crazy right? Actually, 00:14:13.667-->00:14:19.458 doesn’t stop there cause get command has an alias of GCM and it also has, if you promise not 00:14:19.458-->00:14:25.250 to tell anyone there’s actually an undocumented um alias here for get command and that is 00:14:25.250-->00:14:28.625 command, because powershell again, it’s like it’s your best friend, it’s really, really 00:14:28.625-->00:14:32.333 helpful, it doesn’t want to make you look silly, so if you just type command, it’s just gonna 00:14:32.333-->00:14:36.625 check hey is there a get dash command? There is? Solid, that’s what you were looking for and 00:14:36.625-->00:14:41.000 that works. So, anytime you’re running defenses based on get dash something, make sure you 00:14:41.000-->00:14:45.250 don’t count on that get dash being there because it absolutely doesn’t have to be. 00:14:45.250-->00:14:49.375 Um, in addition, forget command if you don’t wanna use wildcards you can set the command lm into 00:14:49.375-->00:14:54.750 uh variables like this, powershell 1 dot oh syntax. If you’re a defender and you’re not 00:14:54.750-->00:14:59.792 looking for this automatic variable of execution context, you absolutely want to be 00:14:59.792-->00:15:03.500 because it is really, really awesome. And, if you’re a red teamer, you definitely want to 00:15:03.500-->00:15:06.958 check this out. Here’s just a couple of ways, you can basically call get command or 00:15:06.958-->00:15:12.708 some of its similar counterparts using this 1 dot oh syntax. In addition to all the get command 00:15:12.708-->00:15:18.333 stuff we just said, you can do the exact same thing with get alias, GAL, or get alias’ alias 00:15:18.333-->00:15:23.208 which is called alias. Uh you can use that against the alias name instead of the commandlet 00:15:23.208-->00:15:28.250 name. So, there’s a lot going on there, why don’t we just choose this GCM w dash o example, right 00:15:28.250-->00:15:34.875 there. Um, so, it’s getting a little crazy, um, in addition to all these things, we can throw 00:15:34.875-->00:15:38.167 tic marks in front of them because they’re a commandlet and that’s something that’s 00:15:38.167-->00:15:42.708 available there. Um, you could also just use the indication operators against the string new 00:15:42.708-->00:15:47.250 object, and can catenate it or use what’s called a dash f format operator to literally 00:15:47.250-->00:15:50.833 reverse or not reverse, to literally reorder um the substrings that you just chalked 00:15:50.833-->00:15:55.042 up, so some people well, I’ll just remove all special characters from command uh from 00:15:55.042-->00:15:59.500 event logs and that new, new object can catenate it if I remove the quotes and remove the 00:15:59.500-->00:16:04.250 pluses,the new object will come back together. However, that’s not foolproof because these 00:16:04.250-->00:16:09.500 reordering techniques, you’ll never see that string new object come back together. So we can 00:16:09.500-->00:16:13.375 try to regex all the things, or just give up. So, I’m wanna be a realist here and just go ahead 00:16:13.375-->00:16:19.042 and pass on this one. So, we’re left with invoke expression, which is a freaking awesome 00:16:19.042-->00:16:23.167 indicator, especially on the command line. IE turn invoke expression, you definitely want 00:16:23.167-->00:16:27.583 to be looking at this. What are some things we need to keep in mind with that? Well, uh it has 00:16:27.583-->00:16:31.750 an alias of IEX which is typically what you see. Um, the ordering doesn’t matter, you can 00:16:31.750-->00:16:34.958 say invoke expression expression, or pipe an expression into invoke 00:16:34.958-->00:16:40.667 expression. You can throw tick marks because it's a commandlet, uh you can use the invocation 00:16:40.667-->00:16:46.042 operators and use catenation reordering. Um and fun fact, um in part of our research we’ll 00:16:46.042-->00:16:50.833 talk about here in just a second, we assembled a massive powershell corpus uh just a lot 00:16:50.833-->00:16:53.875 of scripts, we’ll get into the numbers in a second. But, basically only 3 percent of the 00:16:53.875-->00:16:59.375 scripts actually contained IEX or invoke expression, pretty interesting. But, one thing we 00:16:59.375-->00:17:02.625 have to keep in mind is that invoke expression has a cousin that is called invoke command 00:17:02.625-->00:17:07.125 which is quite interesting. So, invoke expression is expecting an expression and invoke command 00:17:07.125-->00:17:11.250 expects a script block, and typically it’s used to run a command on a remote system, but 00:17:11.250-->00:17:15.375 if you never specify a computer name for that remote system it runs locally. So what does that 00:17:15.375-->00:17:18.583 mean from a defenders perspective? Well, with invoke command, we have the alias of 00:17:18.583-->00:17:23.042 ICM the dot and ampersand indication operators also work, and then you have things, you 00:17:23.042-->00:17:27.833 have methods like dot invoke, invoke return as is, invoke with context, uh etcetera. A lot of 00:17:27.833-->00:17:32.583 options there, but typically you’ll see script blocks in curly places like we see here. 00:17:32.583-->00:17:36.208 Um, in addition powershell 1 dot oh syntax, there’s that execution context thing I was 00:17:36.208-->00:17:40.167 telling you about earlier right? Um, it has an invoke script method which can handle both 00:17:40.167-->00:17:45.250 expression and script blocks. So, let’s add in tick marks to all of these because there 00:17:45.250-->00:17:49.458 commandlets, but how in the world as a defender can we start keying off of an ampersand or a 00:17:49.458-->00:17:53.375 dot? That seems like it’s uh really be bound for false positives. So what if we say 00:17:53.375-->00:17:57.167 okay I’m only interested if there’s a dot or ampersand and there’s also a curly braces 00:17:57.167-->00:18:02.583 because curly braces are the only way you can denote a script block in powershell. If only it 00:18:02.583-->00:18:06.833 were that simple. Because, you can convert an expression to a script block, and here’s two 00:18:06.833-->00:18:11.042 examples of that using the script block class and create method or again execution 00:18:11.042-->00:18:16.000 context powershell 1 dot oh syntax for the new script block method, and you can obfuscate 00:18:16.000-->00:18:19.375 all of these just like we’ve been doing all along. So, every single layer can be obfuscated 00:18:19.375-->00:18:23.958 to the extreme and it sticks, the obfuscation is there and the command line arguments and also 00:18:23.958-->00:18:30.542 inscript lock logs. Um, in uh invoke cradle crafter a tool I released a couple of months ago- 00:18:30.542-->00:18:34.500 >>Thanks, D-Bo >>hahah, sorry Lee, um, I have to deal with it myself actually so we’re in the 00:18:34.500-->00:18:39.375 same boat there. Um, but uh it actually has over 10 different indication options, so there’s a 00:18:39.375-->00:18:44.792 lot of cool stuff there. >>[sigh] that is brutal, can you imagine trying to defend against 00:18:44.792-->00:18:49.833 that? God. Well, now that you’re done with that let’s [phew] that’s brutal >>yeah, 00:18:49.833-->00:18:54.292 fortunately, that’s really the extent of what you can do with powershell obfuscation. Nah, I’m 00:18:54.292-->00:18:59.292 totally kidding, there’s way more. [laughter][applause] What if we just take that. So, after 00:19:03.458-->00:19:08.542 all of that what if we then say hey totally screwed up, f’d up uh powershell command, why don’t 00:19:08.542-->00:19:13.250 we make you a string and then just reverse you on the command line and be reversed in memory. 00:19:13.250-->00:19:18.208 Here’s some examples of that. Um,we can also put garbage delimiters in the command and 00:19:18.208-->00:19:22.708 then split, basically split and join removing those. We can use replace uh methods to basically 00:19:22.708-->00:19:29.042 remove and replace those garbage delimiters. We can do any kind of decatenation that we want. Um 00:19:29.042-->00:19:33.958 and wouldn’t suck if there’s a tool out there that did all this by default. [laughter] Horrible, 00:19:33.958-->00:19:40.458 horrible ha. So, uh anyways, invoke obfuscation may or may not do that. So let’s take the 00:19:40.458-->00:19:44.125 same uh download credit we started with, and instead of going through this I don’t know 00:19:44.125-->00:19:47.167 10 minute example of all these different things, we can literally at the click of a 00:19:47.167-->00:19:51.125 button say yeah just randomly obfuscate all the tokens in there, produce something like 00:19:51.125-->00:19:55.167 this. You could then say, if you’re really twisted, let me take this and then do some 00:19:55.167-->00:19:59.500 string obfuscation like that reordering right there. Fun fact, I spent a lot of time 00:19:59.500-->00:20:03.292 recently decoding this stuff because APT32 uh a nice uh Vietnamese uh APT group also 00:20:03.292-->00:20:08.708 known as OceanLotus happens to like this combo quite a bit. They’ll do one layer of string 00:20:08.708-->00:20:14.042 token all and then they’ll do like literally 5 or 6 layers of this string stuff. So, uh, I’v, 00:20:14.042-->00:20:18.250 I’ve gotten a lot of practice Lee, um- >>You make your bed you lay in it man >>I’m telling you 00:20:18.250-->00:20:22.625 man, I’m telling you. Um, invoke cradle craft or how might obfuscation with this look 00:20:22.625-->00:20:27.083 different. Um, in invoke cradle- >>Thanks D-Bo >>[laughter] Invoke cradle crafter actually 00:20:27.083-->00:20:32.917 doesn’t use any tick marks, um it will use uh substitutions, uh it will basically say instead of 00:20:32.917-->00:20:36.500 if we have download string instead of catenating it or using tick marks, let me 00:20:36.500-->00:20:40.167 actually enumerate all the methods available to new object net that web client and maybe 00:20:40.167-->00:20:44.667 like the 37th uh one actually half resolves to the string download string and so it using 00:20:44.667-->00:20:49.667 all that kind of substitution there. So, wouldn’t it be terrible if there was actually 00:20:49.667-->00:20:54.167 new and worse obfuscation techniques that just hit the market like three days ago. 00:20:54.167-->00:20:59.333 >>Thanks D-Bo >>[laughter] Sorry, uh I’ve been sitting on this one for like 6 months so 00:20:59.333-->00:21:04.792 I’ve gotta get it out there, what if it’s all special characters? [laughter] 00:21:04.792-->00:21:09.792 [applause] Now, I-I have to say up front, kudos, this was not my original idea, uh um a Japanese 00:21:13.458-->00:21:18.208 security researcher back in twenty ten wrote hello world using this technique entirely in 00:21:18.208-->00:21:22.583 special characters named uh mutaguchi so props to them, this is really, really freakin cool. 00:21:22.583-->00:21:26.417 Um, but all these, it’s basically just alot of different variables, definitely really 00:21:26.417-->00:21:29.958 interesting to read his blog post of how he came up with this, um those variable names 00:21:29.958-->00:21:35.417 could also just be different amounts of white space. [laughter] And then I was 00:21:35.417-->00:21:39.042 chatting with Casie Smith, our sub tee and he said oh well that looks kind of similar to like 00:21:39.042-->00:21:44.417 white space encoding. And I said, say what? He said, yeah, you know whitespace tab 00:21:44.417-->00:21:48.333 encoding. And I was like, that sounds amazing, let's do that right now, so that’s the second 00:21:48.333-->00:21:54.250 one I released [laughter]. So, the entire command is either white spaces and tab delimited 00:21:54.250-->00:21:57.917 or its tabs and whitespace delimited and they have this nice little stub decoder at the 00:21:57.917-->00:22:04.375 end. Um so, that that’s out there now. And this is pretty much what defenders feel like 00:22:04.375-->00:22:09.917 right? [laughter] an, and I am a defender, this is my job to come up against this stuff but uh, 00:22:09.917-->00:22:15.750 >>as you can tell he’s a noted blue teamer. >>hahaha [laughter] >>you're a masochist 00:22:15.750-->00:22:20.500 >>[laughter] So, uh, I feel really bad now, I feel a guilt trip, like is there anything we 00:22:20.500-->00:22:26.333 can do for defenders out there? >>I guess not, we’re uh, hold on, we’re just getting into this 00:22:26.333-->00:22:31.333 presentation, I think there’s some stuff we can do. So you might think, hey like, how in 00:22:33.708-->00:22:40.625 the world as a defender looking at your logs are you EVER going to find any of that stuff? Hands 00:22:40.625-->00:22:45.042 up, you're kind of screwed. So, we decided to dabble a little bit. We’re not data scientists, 00:22:45.042-->00:22:51.375 nothing like that, we just decided to play around a little bit. Here’s a core point though, 00:22:51.375-->00:22:56.917 you don’t need to detect all the stuff in there. All you need to know is that it exists. All of 00:22:56.917-->00:23:02.792 us looking, we take a look at that, and it’s obvious that that’s not normal stuff at all. 00:23:02.792-->00:23:07.792 What, what attackers are using as this amazing cloak of invisibility, we can do some 00:23:07.792-->00:23:12.458 smart stuff and turn that into like a shining laser. If you see stuff like this in your 00:23:12.458-->00:23:17.333 networks, your screwed, you should take a look, you don’t need to have the logging tools 00:23:17.333-->00:23:20.958 or the rajaxes telling you what it’s doing, just apply a bit of wet ware and you’re going to be 00:23:20.958-->00:23:25.958 in good shape. Now, how can we do that thought? That sounds simple. One of the cool things 00:23:28.000-->00:23:33.042 you could do is simple character frequencies. So, as we were talking about the uh big 00:23:33.042-->00:23:37.417 powershell corpus we made, so here’s an example in the right hand side where we did some 00:23:37.417-->00:23:43.250 character frequency analysis against all of the scripts in posh code which is a popular 00:23:43.250-->00:23:48.375 powershell script sharing repository. It looks kind of like English if you’ve ever done 00:23:48.375-->00:23:53.958 any simple crypto or anything, you kind of recognize those character frequencies. On the 00:23:53.958-->00:23:59.708 left hand side, you see some of the obfuscated values of the scripts that we just showed. 00:23:59.708-->00:24:03.333 Very, very, very clearly different right? You’ve got a bunch of backticks and square 00:24:03.333-->00:24:10.125 brackets, this really, really stands out. So the question is, like okay, yeah it’s a list of 00:24:10.125-->00:24:16.542 numbers, how am I supposed to figure out how similar those list of numbers are? There’s a 00:24:16.542-->00:24:21.208 tool out there! There’s a whole community in the world called information retrieval, and they 00:24:21.208-->00:24:26.500 do things like search engines, where they’ll go off and analyze things like web pages and 00:24:26.500-->00:24:30.792 documents, and they’ll figure out different features and different numbers, and then what 00:24:30.792-->00:24:35.083 they’ll do is they’ll compare those big lists of numbers together, to find lists of 00:24:35.083-->00:24:39.458 numbers that are similar. So, we’re used to this from high school and stuff and graph 00:24:39.458-->00:24:44.042 paper, you’ve got two numbers that represent a line, another two numbers that represent 00:24:44.042-->00:24:48.375 another line, and then the angle between those is the cosine and then you could do some little 00:24:48.375-->00:24:52.750 math here on the right, it makes us look smart so we’ve got it up there and I’m pretty proud of 00:24:52.750-->00:24:57.458 that, um so you could do some comparison on that, those lines to figure out how similar they 00:24:57.458-->00:25:03.208 are using the cosine. Turns out that the information retrieval guys like to do this for more 00:25:03.208-->00:25:08.083 than two numbers, so more than two dimensions, more than three dimensions, maybe like a 00:25:08.083-->00:25:12.250 thousand or two thousand dimensions. And at that point you’re talking about kind of 00:25:12.250-->00:25:17.042 like the angle between a three thousand dimensional line. I’m having a hard time picturing it, 00:25:17.042-->00:25:23.333 but it’s possible, it gives you a number. So, here’s an example of actually running that. You 00:25:23.333-->00:25:26.917 don’t need to read all of the powershell, it’s just powershell, but, what you can 00:25:26.917-->00:25:32.500 see here is we’ve got a huge grouping near the top, most of these things have a a very 00:25:32.500-->00:25:37.833 similar cosine similarity. But then you also have these obfuscated ones are sticking 00:25:37.833-->00:25:42.833 right out, 0 point 157, 0 point 379, this is an atomic bomb. Take a look at the average 00:25:48.083-->00:25:53.500 similarity among all of posh code, there’s a massive grouping up here. If you take a look at 00:25:53.500-->00:25:59.042 everything below 0 point 8 and then we did, these things are almost all obfuscated. And when 00:25:59.042-->00:26:03.500 they weren’t intentionally obfuscated, there were things like a code golf competition, 00:26:03.500-->00:26:10.167 where you know people just do garbage anyways. So, if we could somehow automate this cosine 00:26:10.167-->00:26:15.250 similarity, like problem solved. Run this on your logs, run this on your network and you’re good 00:26:15.250-->00:26:20.250 to go. >>So, these data points are generated again from all the scripts on posh code which is 00:26:22.375-->00:26:28.000 what 3 point 4 thousand I believe, uh so we really wanted more data and microsoft has been 00:26:28.000-->00:26:31.750 thinking about this for a while and so even looking last spring, they ran a little contest called 00:26:31.750-->00:26:36.250 underhanded powershell where they uh invited the red team community to basically submit uh 00:26:36.250-->00:26:40.458 obfuscated and underhanded powershell commands to perform a very specific task, that got 00:26:40.458-->00:26:46.542 around uh the certain script analyzer um detection rules that were in place. Um, so that was 00:26:46.542-->00:26:51.583 kind of neat. Um and then on top of that data there’s a lot of powershell script out there in 00:26:51.583-->00:26:57.000 the community that we wanted to gather. Um, we created a ginormous powershell corpus. 00:26:57.000-->00:27:02.875 >>ginormous >>but, since we’re both gentleman, we did it politely. Now, what do I mean by 00:27:02.875-->00:27:06.958 that? Well, this is a code that Lee wrote to actually scrape github for example, and if 00:27:06.958-->00:27:11.000 you’ll see those little blue portions, that’s the code that actually downloads the script. 00:27:11.000-->00:27:17.167 And, all those red portions, are blatant Canadian, cause Lee is Canadian and it’s very polite, 00:27:17.167-->00:27:23.083 throttling, ah it’s so nice, so kind. So, anyways, we politely scraped. Um, actually fun fact 00:27:23.083-->00:27:27.958 here, you were scraping for quite a while on github. >>Yeah, mad props to github. So, we took 00:27:27.958-->00:27:32.542 a look at all the repositories, and figured it would take about you know a month, so we, there 00:27:32.542-->00:27:37.292 was like 11 million repositories to scrape through, [clears throat] started going through a 00:27:37.292-->00:27:40.792 month straight just downloading, downloading, throttle; downloading, downloading, 00:27:40.792-->00:27:45.792 throttle. A month later it’s like, look at my repository index, 12 million, 13 million, 00:27:49.417-->00:27:54.583 doesn’t make sense. Go off and look again and I was off by order of magnitude, a hundred 00:27:54.583-->00:28:00.208 million repositories, and I was like we’ve got something to do man, we can’t be rescheduling 00:28:00.208-->00:28:06.250 this to December. So, the we reached out to the github guys, they went, zipped it all up, did 00:28:06.250-->00:28:11.542 a little bit of a back down, back end query, sent us a zip of all the powershells, so mad 00:28:11.542-->00:28:17.167 props to them. >>yeah, big thanks to them. Uh, the really big thanks though is to all of 00:28:17.167-->00:28:20.667 the contributors out there. So, if you wouldn’t mind raising your hand if you’ve ever 00:28:20.667-->00:28:25.417 contributed a powershell script, a posh code, technet, powershell gallery, github, github gifs are 00:28:25.417-->00:28:29.250 there any contributors in the house? Awesome, please give yourself a round of applause 00:28:29.250-->00:28:34.250 because you made this research possible [applause]. So, when you assemble a very large corpus 00:28:38.458-->00:28:43.833 of powershell scripts, you're impelled, compelled to look at them, and it’s very interesting 00:28:43.833-->00:28:48.750 when you start to look at all these scripts. >>I will never be the same man- >>hahaha, so some 00:28:48.750-->00:28:53.750 of the stuff we found was uh honestly, just really sad. Remove games dot ps1, um the 00:28:56.542-->00:29:01.375 author, oh wow, looks like it actually says Matt Graeber, I don’t know if that’s right, but 00:29:01.375-->00:29:06.333 basically it goes through and kills any running game processes and then, to top it off actually 00:29:06.333-->00:29:09.000 removes the directory, so I don’t know where the high scores are kept there, but that’s 00:29:09.000-->00:29:13.792 pretty cold though, kind of a buz-- >>depraved depraved man >>mmm, but no in all seriousness 00:29:13.792-->00:29:18.250 though, actually in this process, we did come across some that were, that were uh a bit 00:29:18.250-->00:29:23.292 more serious actually we came across one plot to overthrow some really interesting people 00:29:23.292-->00:29:29.458 and power and um that was this down with SOPA script. Let’s fill the US and senate servers 00:29:29.458-->00:29:36.250 with the message that we don’t want SOPA, uh stop online piracy act tends >>resist >>yes, so a 00:29:36.250-->00:29:41.167 lot of fun stuff in the corpus. So uh getting a little more serious, there’s a lot of 00:29:41.167-->00:29:47.708 scripts here. Uh 408-->000 powershell scripts, to be exact over 28-->000 authors, um actually 00:29:47.708-->00:29:53.000 identified roughly 1600 obfuscated scripts, uh um in this data set and then we 00:29:53.000-->00:29:57.958 generated about 4-->000 obfuscated scripts using uh things like invoke expression or uh sorry, 00:29:57.958-->00:30:02.833 invoke obfuscation, invoke cradle crafter and ISE steroids. Um, the important thing here is 00:30:02.833-->00:30:09.500 that uh we actually, manually looked at and manually labeled around 7-->000 scripts. >>Whoa 00:30:09.500-->00:30:13.167 >>That, that sounds pretty tedious, why would we do that Lee? >>People, people think that 00:30:13.167-->00:30:18.583 uh, hacking is amazing and fast paced, but it’s not. It’s a notepad window popping up, you 00:30:18.583-->00:30:23.417 closing it and saying “that wasn’t obfuscated.” Notepad window pops up, you close it and 00:30:23.417-->00:30:29.083 that was, and you get a big spreadsheet, so mad hacking skills. But here’s the thing, 00:30:29.083-->00:30:33.292 why do we do all of that? Remember I showed this a little bit ago? The, the similarity and 00:30:33.292-->00:30:38.292 how it kind of nailed it on the stuff below 0 point 8, Ryan Ka did a pretty good analysis 00:30:41.208-->00:30:45.917 afterwards kind of doing uh I think real scientific method of can we produce these results, 00:30:45.917-->00:30:50.500 does it show uh the kind of obfuscated stuff they were talking about. And they did find 00:30:50.500-->00:30:55.708 that hey you do have a, a kind of a balance between that that magical number 0 point 8, false 00:30:55.708-->00:31:00.708 positives, false negatives. So, mathematically, this is what it looks like. When you run that 00:31:03.000-->00:31:08.375 algorithm against the powershell corpus and all of this labeled data so you know we, I showed 00:31:08.375-->00:31:14.542 you back there, two obfuscated scripts. But, what if you know for a fact whether 7-->000 00:31:14.542-->00:31:19.208 powershell scripts are obfuscated or not? So then you can start to get some really, 00:31:19.208-->00:31:23.083 really good numbers, so the way that the uh information retrieval and data science 00:31:23.083-->00:31:27.917 community talks about this stuff, there's two main metrics here, one is precision and one 00:31:27.917-->00:31:34.500 is recall. So, prision-precision says, any time the tool says that something is obfuscated, 00:31:34.500-->00:31:39.667 how often is it correct? So, in that situation that was 89 percent. So, all of those things 00:31:39.667-->00:31:45.083 below 0 point 8, yeah, you’re pretty good, 90 percent effective at getting obfuscated 00:31:45.083-->00:31:50.458 powershell. Recall though, that’s where it takes a dive, what we didn’t analyze was all 00:31:50.458-->00:31:56.000 the stuff above 0 point 8. Turns out that was hiding a lot of stuff that later you would 00:31:56.000-->00:32:00.917 consider obfuscated, and that’s reflected in kind of a merged score that people talk about is 00:32:00.917-->00:32:07.458 the F1 score, just kind of averages the precision and recall. So, some super powerful 00:32:07.458-->00:32:12.458 stuff, unobfuscated but it's really got some opportunity here. This is powershell though, 00:32:15.708-->00:32:20.417 the most powerful scripting language known to man, we have the power, we can do better. 00:32:23.667-->00:32:28.333 >>So, instead of just looking at the character frequency of an entire script, um powershell if 00:32:28.333-->00:32:32.417 you think about any uh any language, it has to basically interpret and see what am I 00:32:32.417-->00:32:38.250 actually looking at? So, this is an example here of uh powershell tokenizing the command. Um and 00:32:38.250-->00:32:42.875 so basically you can see get command is a generic token, the dash name is a parameter token 00:32:42.875-->00:32:48.042 uh may the format operator string etcetera. Um, however, what we have at our fingertips 00:32:48.042-->00:32:53.917 is not just the tokenization that powershell can provide, but it’s also a tree. And this is 00:32:53.917-->00:32:58.958 called the abstract syntax tree, or AST. And not only does this identify all the tokens, it 00:32:58.958-->00:33:03.125 actually identifies the relationship with, with those tokens in the entire script so 00:33:03.125-->00:33:07.000 now you can see okay there’s a format operator buy what’s on its left, what’s on its right? 00:33:07.000-->00:33:12.500 What kind of, how many objects are there? And so this allows us to get a lot of interesting um 00:33:12.500-->00:33:17.292 features, now if you want to easily view this um there’s this awesome gooey, this uh AST 00:33:17.292-->00:33:21.667 powershell explorer, which you can actually get uh um it’s hosted on the powershell 00:33:21.667-->00:33:26.500 gallery, so you can literally just type in install module show psast and start running this 00:33:26.500-->00:33:30.083 right away, it’s a really, really nice gooey interface to explore, AST. Type in any 00:33:30.083-->00:33:35.667 command on the right, check out the AST. Now, why do we do this? Well with the AST we can get 00:33:35.667-->00:33:40.333 extremely granular, so for example we can say let me just group the number of all the 00:33:40.333-->00:33:45.542 different AST types. So maybe this one script is 33 percent string and that’s all it is, or 00:33:45.542-->00:33:50.333 maybe 99 percent of the script is a massive array. We do things like looking at array size 00:33:50.333-->00:33:54.583 ranges, again if we have a 5-->000 element array, maybe that’s shellcode in there. I, I don’t 00:33:54.583-->00:33:58.958 know that’s pretty large. Uh also we can do things like look at language operators, so 00:33:58.958-->00:34:04.458 looking at assignment operators, binary, unary operators, invocation operators. And then 00:34:04.458-->00:34:09.000 for every single component that we did that grouping on, add in an additional layer of feature 00:34:09.000-->00:34:13.125 extraction, basically saying okay for all of these types, lets then do character frequency 00:34:13.125-->00:34:17.667 analys-analysis just on these types. So, for example, all commandlets in one group, all 00:34:17.667-->00:34:22.167 strings, all methods, all members and we’ll do things like looking at character frequency, 00:34:22.167-->00:34:27.167 entropy, whitespace density, the length, the maximum, minimum, median, mode, range and average 00:34:27.167-->00:34:30.417 length on top of that. And then also the percentage of character casing, you look for 00:34:30.417-->00:34:36.708 randomization and character casing. So, it actually produces quite a bit of features- >>5-->000 00:34:36.708-->00:34:41.625 that's kind of rough, I don’t know >>yeah, it is, what do we do with 5-->000 features? >>That 00:34:41.625-->00:34:45.750 is a bad realization when you’ve got 5-->000 features you know you’ve got stuff in there that’s 00:34:45.750-->00:34:50.750 awesome, what do you do with it? So, there’s a common method out there, to uh kind of classify 00:34:53.708-->00:34:57.958 data, it’s called a linear regression, that’s kind of the example there in the back, and 00:34:57.958-->00:35:03.458 the left hand side, so what you do is you kind of have a big math equation and if, if the 00:35:03.458-->00:35:07.250 number is above a certain boundary then that’s obfuscated and then if it’s below then it’s 00:35:07.250-->00:35:12.583 not. Now, the thing is these the AST features we were talking about, they really let you 00:35:12.583-->00:35:16.958 figure out a bunch of the techniques about obfuscation itself, and not just simple 00:35:16.958-->00:35:21.375 metrics. But, they kind of end up being rangy so like some of them end up being really large 00:35:21.375-->00:35:25.375 and really small, and so what you do is put them through a logit function and that 00:35:25.375-->00:35:30.167 basically scales them between zero and one. So, all those features that we extract now get 00:35:30.167-->00:35:35.750 scaled down to between 0 and 1, you combine that, and that is what is called a logistic 00:35:35.750-->00:35:39.792 regression. That’s a really, really, common thing, so for example, excel let’s you do a 00:35:39.792-->00:35:44.792 lot of these things as well. So you have all, all of the features so F1, F2, F3, and 00:35:50.208-->00:35:55.250 every them have a weight, so I’m gonna add up a feature times what the weight is going to be 00:35:55.250-->00:36:01.458 and another feature times what that weight is going to be, big, big, big, 5-->000 of these things. 00:36:01.458-->00:36:05.500 And if that result was greater than what we consider a limit, then that’s, hey that’s 00:36:05.500-->00:36:12.042 obfuscated otherwise it’s not. But here’s the big issue, like I kind of dodged the question, 00:36:12.042-->00:36:17.042 what do I do about 5-->000 features? Chris, back there in the car saw 5-->000 features, he 00:36:19.833-->00:36:25.333 didn’t know what to do, this is what you’ve got to do. This is called a gradient descent and 00:36:25.333-->00:36:32.000 the idea being that you don’t necessarily ask D-Bo, like hey D-Bo, how important do you think 00:36:32.000-->00:36:36.292 a square bracket is and he’s like oh that’s an oh point 2, like I know an oh point 2 when I 00:36:36.292-->00:36:40.833 see one. But what you don’t know there is what’s that going to do to your false positives and 00:36:40.833-->00:36:44.875 everything else, so what you’ll do with the gradient descent, remember we had all that 00:36:44.875-->00:36:51.417 labelled data. What we can start with is 5-->000 weights, and then just run a simulation and see 00:36:51.417-->00:36:57.875 how good they are with classifying and if you run a simulation and you're way off 00:36:57.875-->00:37:03.333 what you can do is feedback that error back into all of those weights. So, if you had a large 00:37:03.333-->00:37:08.000 weight, it’s going to get adjusted very appropriately, more significantly than small 00:37:08.000-->00:37:12.750 weights and if you don’t make a mistake well then those weights don’t get adjusted. And over 00:37:12.750-->00:37:17.375 thousands and thousands of times, this is kind of just automated statistics, over 00:37:17.375-->00:37:23.792 thousands and thousands of times, you end up optimizing yourself towards a an algorithm 00:37:23.792-->00:37:30.750 that’s really good based on what you measure. So here’s the question, like, you felt kind of 00:37:30.750-->00:37:37.542 like a pit of despair when you saw all that stuff, all that obfuscation and everything. Now 00:37:37.542-->00:37:41.833 when you start taking this logistic regression and gradient descent, you know you might be 00:37:41.833-->00:37:47.500 happy if that F1 score, remember we were down at like 57 percent, wouldn’t it be nice if we could 00:37:47.500-->00:37:52.500 get to like 60, 70 percent? How about 95? [applause] Using, revoke obfuscation, you can 00:38:06.917-->00:38:11.917 detect 94 percent of in the wild obfuscated powershell, with only 1 percent false positives, that 00:38:19.167-->00:38:24.167 is literally 10 times better than cosine similarity, with half the false positives. And, 00:38:30.458-->00:38:35.708 we can even do better, what about like that was in the, in the wild, obfuscated powershell 00:38:35.708-->00:38:40.250 and those kind of tend to be like everything to the wall obfuscate all the things, but 00:38:40.250-->00:38:45.417 what if you start some stuff that just feels kind of sketchy right? Where it’s like you know 00:38:45.417-->00:38:49.667 on that left you see that there’s massive, massive obfuscation, yeah absolutely 00:38:49.667-->00:38:54.875 like yeah that's an easy target, but this example on the right that’s not really obfuscated, 00:38:54.875-->00:39:01.458 it’s just kind of using unusual powershell, it’s this big uh, select object with a bunch of 00:39:01.458-->00:39:06.542 hash tables, like that’s a little bit out there, what could you do if you started applying 00:39:06.542-->00:39:11.750 revoke obfuscation to just mildly sketchy stuff, you know this is an example of you’re in 00:39:11.750-->00:39:16.750 an incident response or your suspicious you want to kind of widen the net a little bit. On 00:39:20.250-->00:39:26.250 sketchy still, it’s really really great. It’s able to return 89 percent of all sketchy 00:39:26.250-->00:39:31.250 stuff, so you’re 88 percent of all sketchy stuff with very very low false positives. But what’s 00:39:34.292-->00:39:39.083 even cooler is that, that bucket now, when you start talking about in the wild obfuscated 00:39:39.083-->00:39:44.083 powershell, it goes from 97 percent recall, so revoke obfuscation all by itself, 97 00:39:46.250-->00:39:51.250 percent or 94 percent of in the wild powershell, obfuscated powershell, bringing it now to 00:39:53.333-->00:39:58.333 97 percent, of in the wild obfuscated powershell. Super crazy this is a nuclear bomb 00:40:00.792-->00:40:06.292 against anybody trying to use obfuscated powershell in an engagement, a blue teamer or a 00:40:06.292-->00:40:11.292 defender, this thing has got to be in your arsenal. So logistic regression and gradient descent, 00:40:14.917-->00:40:19.250 that’s not the only thing out there, there’s other cats in the game, there’s boosted decision 00:40:19.250-->00:40:23.333 trees, there’s port vector models and all that kind of stuff. So, one of the cool 00:40:23.333-->00:40:27.625 things that we got out of doing all of this, so this was a hand implemented algorithm, in c 00:40:27.625-->00:40:34.083 sharp based on some cool stuff shared by James Mccaffrey on msdm for example. Uh, we 00:40:34.083-->00:40:38.250 compared it, we just had a big csv of all this stuff and you can actually do it, like upload 00:40:38.250-->00:40:42.458 it to as your machine learning and see how this thing performs in other algorithms. So, [clears 00:40:42.458-->00:40:44.458 throat] revoke obfuscation had very, very, basically, uh equivalent functionality to this 00:40:44.458-->00:40:46.458 same function implemented in a commercial machine learning system, but then you can apply 00:40:46.458-->00:40:48.458 to others and you know the next closest one was the boosted decision trees and those things 00:40:48.458-->00:40:50.458 had about the same accuracy, and two of the other algorithms that we messed around with had much 00:40:50.458-->00:40:57.083 less. So, what we’ve baked into revoke obfuscation is a really really top end model for you. 00:40:57.083-->00:41:02.083 >>would anyone like to see a demo? >>yeah [applause] >>yeah [applause] >>So, I’d like to 00:41:09.500-->00:41:14.500 think that revoke obfuscation is a really clean a pure commandlet approach, a lot of the tools I 00:41:20.625-->00:41:25.625 write have ASCII art like this, um so- >>console gooeys for the win >>ha, ha [applause] so 00:41:34.542-->00:41:41.292 actually what we’ll do here is the first one is me getting out all of my ASCII art in a 00:41:41.292-->00:41:45.458 completely separate function, that basically performs a nice little analysis here of the 00:41:45.458-->00:41:48.667 script at the top pulling out different features or attributes just to kind of show some of the 00:41:48.667-->00:41:52.875 levels of the stuff we’re doing here again 5-->000 features on the average less than 300 00:41:52.875-->00:41:58.417 milliseconds for extracting the features and measuring it um and here’s just a menu, this is 00:41:58.417-->00:42:03.375 completely for fun, and for lulls, there's stuff like uh a tutorial, if you like a colored 00:42:03.375-->00:42:07.375 version of the readme, basically that’s what it is. Uh, there’s a lot of fun facts, again, a lot 00:42:07.375-->00:42:11.667 of interesting stuff that we saw um in um some that we’re ashamed of, that we saw in the corpus 00:42:11.667-->00:42:14.542 there but anyways we felt like yeah we should be open and transparent so you can look at 00:42:14.542-->00:42:18.750 fun facts and see some stuff there, um you see a lot of really interesting ASCII art 00:42:18.750-->00:42:22.375 when your going through all these scripts, so, randomly see some ASCII art, uh and actually 00:42:22.375-->00:42:26.292 show you the project that it came from. Uh got some set of fun quotes and also some credits 00:42:26.292-->00:42:30.167 again, if you’ve ever contributed any powershell, um to get however other sources, 00:42:30.167-->00:42:34.500 like your name is actually in this code and if you run that enough, then you will see it. 00:42:36.542-->00:42:41.167 So, onto the stuff that you know actually does stuff, um, most people don’t have you know a 00:42:41.167-->00:42:44.917 huge uh you know directory with every single powerscript they’ve run in their environment to 00:42:44.917-->00:42:50.208 analyze here. Um, in revoke obfuscation we’ll handle both command lines and scripts um and 00:42:50.208-->00:42:54.500 so we’re trying to make this as operationally friendly and easy to implement as possible, so 00:42:54.500-->00:42:59.917 let’s say um that you just want to query your event logs using get winevent, sim sweep, I mean 00:42:59.917-->00:43:04.333 you just want to clog the raw ebtx files, that’s totally fine because we wrote a function 00:43:04.333-->00:43:09.125 called get rvo script block. Um rvo standing for revoke obfuscation, it will basically 00:43:09.125-->00:43:14.833 ex um ex, uh extract all of the uh script blocks and actually reassemble the script block that 00:43:14.833-->00:43:21.500 fall across multiple script block uh entries there. Um, so basically what’s really nice it 00:43:21.500-->00:43:26.500 you want to uh start with event logs, what you can do is say let me get all these event logs, let 00:43:28.583-->00:43:34.167 me pipe you in to get rvo script block, um let me retrieve all of the scripts from that, and then 00:43:34.167-->00:43:40.208 we can pipe it in to measure rvo obfuscation and there it is churning through them. >>Thanks 00:43:40.208-->00:43:45.208 D-Bo >>ha, ha, [applause] and as you can see, it caught our fun example of all special 00:43:51.083-->00:43:55.917 characters there, with a nice obfuscated as true and as you can see, all the script features 00:43:55.917-->00:43:59.042 are there and everything. The amount of time it took to extract the features, the 00:43:59.042-->00:44:04.667 measurement, uh and, and all that stuff, um so, the very last thing I’ll say here, is that 00:44:04.667-->00:44:10.667 again our, our desire is not just for this to be uh something uh that is used in research, but 00:44:10.667-->00:44:15.667 we want to make it accessible to any organization, we want people to be able to take this and 00:44:15.667-->00:44:18.917 literally run it like, like within minutes. Um and so to help facilitate that we actually 00:44:18.917-->00:44:24.458 have this hosted uh on on this github right here, it’s also hosted in the powershell gallery 00:44:24.458-->00:44:30.500 which literally gets you fire up powershell and run install module, revoke obfuscation, and 00:44:30.500-->00:44:35.500 it’s there, it’s locked, loaded, ready to go. And uh, and the one last thing I’ll say, is again, 00:44:38.292-->00:44:41.292 to make it operationally friendly, we’ve added several different options for white 00:44:41.292-->00:44:45.083 listing, so again if you start to set this up in an operational since in your environment, if 00:44:45.083-->00:44:48.250 you start to see uh these scripts come in that are flagged as obfuscated you can quickly 00:44:48.250-->00:44:51.917 look through and say oh no this is actually good, let me just drag this into the whitelist 00:44:51.917-->00:44:56.833 folder, maybe you can also content um string whitelisting, regiqua-, regex whitelisting 00:44:56.833-->00:45:01.208 etcetera, again, we want this to be as accessible and easy to use in an operational sense as 00:45:01.208-->00:45:06.208 possible for any defender out there. And that, is our talk. [applause] >>thank you >>thank 00:45:14.000-->00:45:16.208 you [applause]