1
00:00:18,630 --> 00:00:23,970
Presenting the Detecting the Not PowerShell Gang with Tez.

2
00:00:23,970 --> 00:00:26,950
And with that, I will let Tez take it away.

3
00:00:28,130 --> 00:00:30,050
All right, thank you so much.

4
00:00:30,430 --> 00:00:31,570
Hello, everyone.

5
00:00:31,570 --> 00:00:36,450
Welcome to this talk titled Detecting the Not PowerShell Gang.

6
00:00:37,590 --> 00:00:39,430
It's by me, Tez.

7
00:00:39,430 --> 00:00:42,570
You can find me on Twitter, anywhere else, TezManager.

8
00:00:42,970 --> 00:00:45,930
All right, let's get to know me for a little bit.

9
00:00:45,930 --> 00:00:51,590
I'm a Threat Hunter working for a major Canadian communication company.

10
00:00:51,590 --> 00:00:56,510
We also do MSP, MSSP, ISP, whatever you can think of.

11
00:00:56,510 --> 00:01:07,950
So my main tasks in this company is to do threat hunting, a lot of involvement with threat intelligence also, and a lot of automation, which is programming, coding, etc.

12
00:01:07,990 --> 00:01:14,410
I have some previous experience in application security, and also some security auditing slash legal.

13
00:01:14,410 --> 00:01:19,410
I graduated from Sheridan College, so I am based in Toronto, Canada.

14
00:01:19,610 --> 00:01:27,770
So if you're around, you know, like if you're a company around Canada and you're looking for good talents, you can definitely look into that school.

15
00:01:28,190 --> 00:01:38,630
So yeah, so that's pretty much me with my medium, small security budget, fighting the bad people one lock at a time.

16
00:01:39,430 --> 00:01:42,790
All right, so if you ask, like, you just do work?

17
00:01:42,790 --> 00:01:44,190
No, I do play a lot.

18
00:01:44,190 --> 00:01:46,650
I like to do fun security stuff, CTF.

19
00:01:46,650 --> 00:01:49,250
I like presenting, attending conferences.

20
00:01:49,450 --> 00:01:55,050
I also love to do photography, specifically astrophotography, some landscape photography.

21
00:01:55,050 --> 00:01:59,270
Also, I do have a drone and just taking pictures and videos.

22
00:01:59,410 --> 00:02:03,770
I play guitar at times, and I love to go to festivals and concerts.

23
00:02:03,770 --> 00:02:09,370
And of course, like everyone else, gaming, it's something that it's always fun to do.

24
00:02:09,770 --> 00:02:18,950
Just some pictures of me doing stuff, taking picture of stuff, just to show that I'm not working all the time.

25
00:02:18,950 --> 00:02:21,290
All right, first of all, let's start with disclaimer.

26
00:02:21,310 --> 00:02:30,270
All the opinions are my own, and this doesn't reflect any views of my employer.

27
00:02:30,470 --> 00:02:33,770
So with that in mind, let's move forward.

28
00:02:33,770 --> 00:02:41,170
So also note, this presentation, it's actually a compressed version of similar presentation that I did in HackFest last year.

29
00:02:41,170 --> 00:02:48,150
So if you would like to see more about the tools, demonstration, et cetera, you can go watch it on HackFest YouTube channel.

30
00:02:48,150 --> 00:02:49,350
The link is there.

31
00:02:49,650 --> 00:02:52,830
The slides, also the extended version, are available on my GitHub.

32
00:02:53,910 --> 00:02:57,510
Okay, so let's talk about the content.

33
00:02:57,610 --> 00:03:00,270
We just, you know, talking about me.

34
00:03:00,610 --> 00:03:02,670
So we got three major parts.

35
00:03:02,670 --> 00:03:05,990
We'll have some introduction about the gang itself.

36
00:03:06,370 --> 00:03:09,230
How do we detect each member of the gangs?

37
00:03:09,230 --> 00:03:10,670
There's some bonus detection.

38
00:03:10,670 --> 00:03:12,950
There's some bonus members of the gang.

39
00:03:12,950 --> 00:03:17,830
And we close everything with some outro and a Q&A at the end.

40
00:03:18,590 --> 00:03:26,250
Yeah, so in this section, we'll get the basic understanding of what is exactly not PowerShell gang, not PowerShell tools.

41
00:03:26,890 --> 00:03:33,250
So I did this research roughly like one to two years ago.

42
00:03:33,690 --> 00:03:46,610
And I see a bunch of, we actually see a bunch of tools that acting the same way, that act to try to avoid PowerShell security logging and mechanism, but they achieve it with different ways.

43
00:03:46,610 --> 00:03:49,890
So this is really interesting to me.

44
00:03:49,890 --> 00:03:59,770
So I just pretty much bundled them together and then, yeah, build detection for all of them and then see the unique way each one of the tools doing.

45
00:04:00,030 --> 00:04:04,630
So one question you're going to ask, like, why these tools even exist?

46
00:04:04,630 --> 00:04:06,370
Why don't they just use PowerShell?

47
00:04:06,510 --> 00:04:09,290
Well, because the PowerShell love Blue Team.

48
00:04:09,290 --> 00:04:14,950
This is a blog post that they posted back in 2015 when they released version 5 of PowerShell.

49
00:04:15,690 --> 00:04:20,690
They released a lot of security feature and it is actually really bad for Red Team.

50
00:04:20,690 --> 00:04:23,990
So pretty much friendship ended with the Red Team.

51
00:04:23,990 --> 00:04:26,950
Now Blue Team is Microsoft's best friend.

52
00:04:27,650 --> 00:04:29,830
So is it that bad?

53
00:04:29,930 --> 00:04:31,550
Actually, it is.

54
00:04:31,930 --> 00:04:33,670
You get protected logging.

55
00:04:34,410 --> 00:04:38,550
So whenever you type anything, PowerShell will be locked.

56
00:04:38,550 --> 00:04:41,930
Whenever you enter a script and you enter commands, it will be locked.

57
00:04:41,930 --> 00:04:44,870
If the Blue Team have centralized theme, that's it.

58
00:04:44,870 --> 00:04:46,870
That's the end for the defender.

59
00:04:46,870 --> 00:04:49,190
Sorry, for the attacker, right?

60
00:04:49,410 --> 00:04:53,710
Also, I'm saying integration, which is anti-malware mechanism.

61
00:04:53,790 --> 00:05:02,090
So there's a lot of bypass being released, but this is pretty much a never-ending race between Microsoft and then the Red Team slash offensive tool makers.

62
00:05:02,090 --> 00:05:03,790
So they bypass the patch.

63
00:05:03,790 --> 00:05:04,710
They bypass the patch.

64
00:05:04,710 --> 00:05:06,350
It's just never-ending.

65
00:05:06,570 --> 00:05:19,290
And lastly, we got the Constraint Language Mode, CLM, that able to limit the capability in the sensitive environment, for example, in your PCI DSS server, in your production server.

66
00:05:19,290 --> 00:05:22,030
You can limit things to do with PowerShell.

67
00:05:22,030 --> 00:05:24,110
So that's not really good, actually.

68
00:05:25,870 --> 00:05:37,190
Five years later, so there was this EMA, Ask Me Anything, event going on in one of the Slack channel of one of the big security company in the US.

69
00:05:37,190 --> 00:05:43,490
So I just jump in and ask the question, from your recent engagement, do you still use PowerShell at all?

70
00:05:43,490 --> 00:05:46,730
And then most of the answer is like, not really.

71
00:05:46,730 --> 00:05:47,830
We just drop it.

72
00:05:47,830 --> 00:05:49,130
We don't really use it.

73
00:05:49,130 --> 00:05:51,970
So that's the idea how bad it is.

74
00:05:51,970 --> 00:05:56,270
Even five years later, people just start forgetting PowerShell at all.

75
00:05:56,550 --> 00:05:59,490
And that's why we have the whole game.

76
00:06:00,010 --> 00:06:03,990
So now we understand what's not PowerShell.

77
00:06:04,330 --> 00:06:10,370
And then let's move forward and just get some understanding about the detection.

78
00:06:10,430 --> 00:06:22,510
Make sure that you have these requirements ready if you're trying to deploy this detection, because this is the environment that I have, that we have, when we tested it.

79
00:06:23,310 --> 00:06:29,870
And then, yeah, pretty much the whole goal of this presentation is to utilize your locks.

80
00:06:29,990 --> 00:06:33,970
So you can use whatever same solution you want, Splunk, Elk, ArcSight.

81
00:06:33,970 --> 00:06:38,230
I can keep going on and on, but you get the idea.

82
00:06:38,230 --> 00:06:39,310
So, yeah.

83
00:06:39,310 --> 00:06:42,870
So there's two types of detection that I will be sharing.

84
00:06:43,290 --> 00:06:49,330
The first one will be the low-hanging fruits, the easy detection that's easy to create and easy to bypass.

85
00:06:49,330 --> 00:06:56,660
The next one is a more complicated detection, the advanced detection based on TTP or behavior of the tools.

86
00:06:57,770 --> 00:07:04,290
It's really kind of hard to make, but also kind of hard to bypass by the attacker.

87
00:07:04,290 --> 00:07:06,430
So we'll see.

88
00:07:06,430 --> 00:07:12,390
So the first tool, we call it InFishyShell, not we call it, the maker call it InFishyShell.

89
00:07:12,590 --> 00:07:22,890
The tagline is like, sure, we can hook it, because the people from Javelin Networks, when they make this, all they do in the tools is just hooking, hooking, hooking.

90
00:07:22,890 --> 00:07:27,630
They hook the SystemManagementAutomation.dll, the library of PowerShell.

91
00:07:27,630 --> 00:07:35,630
They hook the SystemCorner.dll to bypass the logging mechanism, and then they hook the anti-malware mechanism.

92
00:07:35,810 --> 00:07:37,630
They just hook everything.

93
00:07:37,630 --> 00:07:48,110
But it works perfectly fine, because when they hook it, and then they override the input length for those attributes, the three attribute buff, into zero length.

94
00:07:48,110 --> 00:07:55,990
So it's pretty much non-existent, which equals to not functioning PowerShell detection, which is great for them.

95
00:07:57,390 --> 00:07:59,650
So we have five detection here.

96
00:07:59,730 --> 00:08:02,590
We got the first one is low-hanging fruits.

97
00:08:02,590 --> 00:08:12,910
So as you can see there, there is a dll called InFishyShellProfiler.dll, and then there's a bat file that run with pat as admin.

98
00:08:12,910 --> 00:08:16,050
So this file are pre-compiled already, so it's available on the GitHub.

99
00:08:16,050 --> 00:08:19,190
So when people run it as is, you can detect it.

100
00:08:19,190 --> 00:08:21,210
That's the goal of low-hanging fruits.

101
00:08:21,210 --> 00:08:27,290
You detect it by using sysmoniv-97 and sysmoniv-91, and you deploy the role in your scene.

102
00:08:28,030 --> 00:08:33,930
When you run the tools the first time, you will see this unique trace on sysmoniv-91.

103
00:08:34,050 --> 00:08:42,710
You will see a PowerShell in the command line section, in the command line field, just PowerShell, no exe, no parameters, etc.

104
00:08:42,970 --> 00:08:49,470
And then the parent command line will uniquely be exe that is calling a bat file.

105
00:08:49,890 --> 00:08:52,290
You get the idea.

106
00:08:52,290 --> 00:08:55,010
So there's exe and a bat file in the same parent command line.

107
00:08:55,010 --> 00:09:01,130
So we can combine these two information and then make a detection out of it, which is what we do, what I do.

108
00:09:01,730 --> 00:09:09,850
And then the next one, this tool is actually able to do some privilege escalation by adding some entries in the registry key.

109
00:09:10,450 --> 00:09:15,450
So we need to watch when they do this using rec.exe, for example.

110
00:09:15,470 --> 00:09:23,230
And then there's a certain value, specifically inproc surfer32, and those flags that you can see.

111
00:09:24,370 --> 00:09:30,310
The parent command line will be the same parent command line as the previous one.

112
00:09:30,310 --> 00:09:33,390
So you will have the .exe and then the .bat.

113
00:09:33,990 --> 00:09:43,010
Again, if you combine that and then you combine additionally the rec.exe tools, you pretty much have pretty strong detection there.

114
00:09:43,010 --> 00:09:49,490
The next one, it's the inproc surfer32 registry key changes, or additional, to say.

115
00:09:50,250 --> 00:09:56,650
So if you see here, you can see the target object is the inproc surfer32.

116
00:09:56,970 --> 00:10:01,430
But they're trying to load the malicious... not malicious, like the...

117
00:10:01,430 --> 00:10:06,650
not PowerShell DLLs that they are using, which is the InfoShellProfiler.dll.

118
00:10:06,690 --> 00:10:17,110
So you can watch for anything that is not system32 being loaded to this particular target object, because that's kind of fishy.

119
00:10:18,090 --> 00:10:24,890
And again, you will be using Sysmon, specifically event ID 13 of the registry value set.

120
00:10:26,890 --> 00:10:40,030
The last detection for this tool, it's actually watching the DLL being loaded to the legitimate PowerShell, because again, it will hook the PowerShell library.

121
00:10:40,030 --> 00:10:44,850
So there will be... you need to load the module from the DLL to the exe.

122
00:10:44,850 --> 00:10:51,430
But the thing is, usually PowerShell will load stuff from Microsoft, because it's a Microsoft tools.

123
00:10:51,570 --> 00:10:56,630
And then you can also see the signature status, it's false and also unavailable.

124
00:10:56,630 --> 00:10:58,290
So that's kind of questionable.

125
00:10:58,290 --> 00:11:09,130
We can combine this... what do you call it... interesting thing, combine it together, and you can make a row out of it and start building detection on it.

126
00:11:09,870 --> 00:11:13,270
And the next tool is PowerShell DLL.

127
00:11:13,270 --> 00:11:16,090
So it's not PowerShell, it's PowerShell DLL.

128
00:11:16,450 --> 00:11:21,730
And the tagline for this, yeah, we got DLL for that, because it's on the name already.

129
00:11:21,730 --> 00:11:29,830
So Penta pretty much created... this is also one of the tools that is having a lot of stars in GitHub.

130
00:11:30,390 --> 00:11:32,130
So this tool actually has two modes.

131
00:11:32,130 --> 00:11:35,870
You can use the DLL mode and then the exe mode.

132
00:11:35,870 --> 00:11:39,770
For the DLL mode, you need to use the DLL loader.

133
00:11:39,770 --> 00:11:43,470
So this is a low bus component that will be used.

134
00:11:43,730 --> 00:11:47,430
And you'll load the particular DLL that you feed.

135
00:11:47,430 --> 00:11:50,290
Or you can use a pre-compiled exe.

136
00:11:50,290 --> 00:11:54,730
So you just run the double-click exe and it will just do the job.

137
00:11:55,070 --> 00:12:04,630
So you'll use... there's options of five different DLL loader thing or proxy execution exe that you can use.

138
00:12:04,630 --> 00:12:06,570
So this binary is signed by Microsoft.

139
00:12:06,570 --> 00:12:12,490
So sometimes it's not... it's normal when people whitelisted it.

140
00:12:12,490 --> 00:12:17,350
So make sure you pay attention in this particular area.

141
00:12:17,590 --> 00:12:23,770
And then moving forward for the exe mode, it will load the exe itself.

142
00:12:23,770 --> 00:12:30,170
It loads 57 PowerShell automation DLLs and other supporting DLLs for the operation.

143
00:12:30,170 --> 00:12:36,750
So all the lists... all the 57 DLLs are listed on the appendix at the end of the presentation.

144
00:12:37,930 --> 00:12:40,510
For the detection, we get four things here.

145
00:12:40,510 --> 00:12:51,010
We get the low-hanging fruits, which is simple thing like description field, product field, even the image, so the file name itself.

146
00:12:51,370 --> 00:12:52,870
So you can definitely use that.

147
00:12:52,870 --> 00:12:55,650
Again, this is a low-hanging fruit detection.

148
00:12:56,310 --> 00:13:01,050
Just a tip, if you want to change it, you can just go to the code before you compile it.

149
00:13:01,270 --> 00:13:07,050
And then those are the information by default, the PowerShell DLL, copyright 2016.

150
00:13:07,050 --> 00:13:09,450
You can easily change it to anything.

151
00:13:09,490 --> 00:13:13,050
But again, low-hanging fruits detection is supposed to be easy detection.

152
00:13:13,590 --> 00:13:16,850
The next one, PowerShell DLL loading DLLs.

153
00:13:16,850 --> 00:13:23,910
To be precise, PowerShell DLL loading the PowerShell DLLs, so the real PowerShell DLLs.

154
00:13:23,910 --> 00:13:27,090
So this is applicable for the DLL mode.

155
00:13:27,090 --> 00:13:31,050
For example, you're running it using the runDll32.exe.

156
00:13:31,530 --> 00:13:37,170
And then runDll32.exe is loading a bunch of PowerShell-related DLLs.

157
00:13:37,510 --> 00:13:42,210
It's like they're trying to do something related to PowerShell, right?

158
00:13:42,230 --> 00:13:44,530
So yeah, that's what they're trying to do.

159
00:13:44,530 --> 00:13:47,630
So we can watch them, again, with the system 1.97.

160
00:13:48,690 --> 00:13:52,950
And then more general to that, we can actually watching what the loaders do.

161
00:13:52,950 --> 00:14:01,370
So whenever they are loading unsigned DLLs or the DLLs that doesn't have any signature, we can create an alert on that.

162
00:14:01,590 --> 00:14:04,510
But the problem with this, it's actually quite noisy.

163
00:14:04,790 --> 00:14:09,350
There's some application, third-party application that do this.

164
00:14:09,850 --> 00:14:12,770
On the top of my head, I can say notepad++ do that.

165
00:14:12,770 --> 00:14:17,630
So that's the first thing that triggers the role when we deploy it in the production.

166
00:14:17,630 --> 00:14:18,770
I'm like, okay.

167
00:14:18,890 --> 00:14:21,130
But yeah, you can whitelist it for sure.

168
00:14:22,330 --> 00:14:27,810
The next one is when the exe mode loading 57 different DLLs.

169
00:14:27,810 --> 00:14:30,930
So this will happen in a millisecond, just like that.

170
00:14:31,070 --> 00:14:34,430
Just instantly load 57 DLLs.

171
00:14:34,450 --> 00:14:42,290
And you can see all of this from system 1.97, but make sure you add those DLLs into the system 1.config.

172
00:14:42,290 --> 00:14:47,110
Just make sure you modify the config to watch for those specific DLLs.

173
00:14:47,930 --> 00:14:54,290
For this, to make it easier or to make it detection better, you can use correlation or cardinality.

174
00:14:56,030 --> 00:15:08,690
So whenever one DLL is being loaded, the rule itself will look for the other 56 DLLs if it's being loaded around maybe like in the last one minute or like in the last 50 seconds, et cetera.

175
00:15:08,690 --> 00:15:16,490
So you can just see if at the end, like as a bigger picture, if all of them being loaded at the same time.

176
00:15:16,710 --> 00:15:20,530
So some examples of correlation on the same that you can do is elastic search.

177
00:15:20,530 --> 00:15:22,430
I think they have cardinality rules.

178
00:15:23,030 --> 00:15:25,270
ArcSight correlation engine for sure.

179
00:15:25,790 --> 00:15:28,910
And then Splunk, you can combine multiple indicators.

180
00:15:29,170 --> 00:15:31,630
So you will have 57 indicators.

181
00:15:31,910 --> 00:15:36,270
And then when everything trigger at the same time, you create a rule out of it.

182
00:15:36,510 --> 00:15:44,070
And then you can also use elastic Kibana heat map if you want your analysts to do that just to look into stuff.

183
00:15:44,310 --> 00:15:49,590
And you can do it over Python for sure because, yeah, what Python cannot do, right?

184
00:15:50,530 --> 00:15:56,530
Powerless shell, the next tools, the tagline is don't worry, we got Lullabas here because Mr.

185
00:15:56,530 --> 00:16:01,130
Unicoder, I think he's in Montreal, local Canada also.

186
00:16:02,370 --> 00:16:08,270
So yeah, so what in his mind when making this tool is just to use a lot of Lullabas.

187
00:16:09,570 --> 00:16:20,870
There's two Lullabas specifically being used here, the msbuild.exe that will be used to compile a payload that you send from the outside from attacker machine to the target machine.

188
00:16:21,090 --> 00:16:25,210
So it relies on the msbuild.exe for execution.

189
00:16:25,450 --> 00:16:31,810
So it will provide a script, either PowerShell or whatever, and then it will compile it for you.

190
00:16:31,810 --> 00:16:35,410
But the unique thing is they are not using the one that is already in the machine.

191
00:16:35,410 --> 00:16:41,130
So they bring the whole exe from the outside and then rename it to something else.

192
00:16:41,130 --> 00:16:48,650
It can be something random, it can be to a known process name, for example, cog.exe or cnd.exe.

193
00:16:49,110 --> 00:16:57,070
And then from there, it will get the instruction from the script file, from the PowerShell script or whatever script you provided.

194
00:16:57,070 --> 00:17:05,790
It will encode the command using certutil, another Lullabas, and then they'll perform some kind of obfuscation, make it confusing for the analyst, for the blue team.

195
00:17:05,790 --> 00:17:10,090
So you can see here the function and variable names is just like mumbo-jumbo.

196
00:17:10,090 --> 00:17:11,750
You don't understand what it is.

197
00:17:12,430 --> 00:17:27,510
The last component, not the last component, it's the component that is sitting on the upside on the attacker machine to generate all of those stuff are a PowerShell.py, which is like a Python code that pretty much the engine of the tool will create everything.

198
00:17:27,510 --> 00:17:31,630
And then you can ship those three files to the victim machine.

199
00:17:33,410 --> 00:17:45,110
For the detection for the low-hanging fruits, we will have a creation of the... remember that they will rename the msbuild.exe.

200
00:17:45,110 --> 00:17:52,150
So you can check on the .NET Framework folder if there's any new exe file being created.

201
00:17:52,250 --> 00:17:59,330
For example, if you see cnd.exe created in the .NET Framework folder, that will be so suspicious.

202
00:17:59,670 --> 00:18:03,410
You'll be using SysModify11 for that.

203
00:18:04,250 --> 00:18:11,590
PowerShell logging, well, it's because this tool is not really evading the PowerShell detection.

204
00:18:11,590 --> 00:18:19,370
It is still recording the output of the PowerShell script being deobfuscated.

205
00:18:19,370 --> 00:18:24,050
So after all the encoding, you can still see the final content of the code.

206
00:18:24,050 --> 00:18:27,310
You can detect more PowerShell payload, etc.

207
00:18:27,310 --> 00:18:35,970
using the Event ID 4104 from the Microsoft App, if I'm not mistaken.

208
00:18:36,730 --> 00:18:40,330
Moving on, detecting the low-bass.

209
00:18:40,330 --> 00:18:43,690
The first component 3A is CircUtil.

210
00:18:44,050 --> 00:18:50,470
So because they encode the thing, the payload, they need to decode it in the victim machines.

211
00:18:50,470 --> 00:18:53,750
So they use CircUtil to decode the hex.

212
00:18:53,750 --> 00:19:00,510
So you can watch for any CircUtil doing decode hex function, because it's actually really rare in the production.

213
00:19:01,130 --> 00:19:03,330
You can use SysModify11 for that.

214
00:19:03,750 --> 00:19:09,650
And then the next part of it, the second half, it's msbuild.exe, the renamed one.

215
00:19:09,650 --> 00:19:26,550
So not really msbuild as the name, but it is from the description field, you know it's msbuild, because the only way you can change the description field is to reverse engineer the whole application and then change the value, which is like too much work for just evading this stuff,

216
00:19:26,550 --> 00:19:26,950
right?

217
00:19:26,950 --> 00:19:35,770
So the msbuild.exe will be combined with the random 5 to 25 upper and lower characters.

218
00:19:35,870 --> 00:19:41,330
So you can watch on that combination, SysModify11 again.

219
00:19:41,430 --> 00:19:49,350
Process masquerading, this pretty much can cover not only these tools, but pretty much any masquerading, which is always suspicious.

220
00:19:49,490 --> 00:20:01,070
So the file msbuild.exe being renamed to smss.exe, or on the right side, you can see it's a random name, can't even pronounce it.

221
00:20:01,250 --> 00:20:03,750
Again, SysModify11 for both.

222
00:20:04,310 --> 00:20:07,590
And then we have number five, the .NET DLL loading.

223
00:20:07,590 --> 00:20:12,010
So you see here in the image, it's smss.exe.

224
00:20:12,010 --> 00:20:24,690
We already know it's not sms, but we can see why does sms.exe is loading Microsoft build or msbuild.tas.dll.

225
00:20:24,690 --> 00:20:28,490
So that's definitely suspicious, so you can build detection on this.

226
00:20:28,510 --> 00:20:30,210
SysModify11 again.

227
00:20:30,810 --> 00:20:39,350
And lastly, PowerShell DLL loading, that is always visible via process access.

228
00:20:39,350 --> 00:20:58,650
So again, our .exe, smss.exe, can be seen making some access trying to touch poking systemmanagementautomation.dll, which is again, it's a PowerShell engine.

229
00:20:58,650 --> 00:21:02,370
Why would smss.exe doing that?

230
00:21:02,370 --> 00:21:04,770
Are they trying to get some functionality out of it?

231
00:21:04,770 --> 00:21:05,890
Probably is.

232
00:21:05,890 --> 00:21:08,430
So you can use SysModify11 to build that.

233
00:21:08,430 --> 00:21:10,770
You can combine all this information together.

234
00:21:11,390 --> 00:21:14,250
Tools number four, no PowerShell.

235
00:21:14,350 --> 00:21:16,610
The tagline is, can you C-sharp?

236
00:21:16,610 --> 00:21:22,550
Because bits.admin create this tool implemented in C-sharp.

237
00:21:23,690 --> 00:21:25,970
And this is really popular these days.

238
00:21:25,970 --> 00:21:33,130
If you look for offensive researcher, they start using more C-sharp, C-sharp, C-sharp.

239
00:21:34,210 --> 00:21:40,070
Because it's hard to detect C-sharp operation because it's not using PowerShell.

240
00:21:40,070 --> 00:21:42,170
It's not using PowerShell DLLs.

241
00:21:42,170 --> 00:21:46,110
It's just go straight to the native.net library.

242
00:21:46,570 --> 00:21:49,410
And this tool, it's actually trying to mimic PowerShell.

243
00:21:49,410 --> 00:21:51,690
So you get the same cmdlets.

244
00:21:51,970 --> 00:21:59,650
For example, you have things like get process, get user, et cetera.

245
00:21:59,650 --> 00:22:00,510
There's two modes.

246
00:22:00,510 --> 00:22:06,570
You can run it by using rundll32, again, similar to PowerShell DLL.

247
00:22:07,070 --> 00:22:09,430
Or you can run it using CobaltStrike.

248
00:22:10,130 --> 00:22:11,730
There's two components.

249
00:22:11,730 --> 00:22:17,410
For CobaltStrike, you get the exe file, and then you get the cmi, the CobaltStrike file.

250
00:22:17,570 --> 00:22:22,430
For the DLL, there's two options that you can do, depending on your target machine.

251
00:22:22,430 --> 00:22:27,450
You can use the 32-bit DLL or the 64-bit DLL.

252
00:22:27,450 --> 00:22:30,510
And then you will need to load it using rundll32.

253
00:22:30,510 --> 00:22:34,350
But I suspect you can use the other DLL loader.

254
00:22:34,990 --> 00:22:40,250
And it's exactly acting like PowerShell DLL mode.

255
00:22:40,250 --> 00:22:42,250
We get forward detection for this.

256
00:22:42,850 --> 00:22:48,270
Low hanging fruits, again, because it's written in C Sharp, based on .NET.

257
00:22:49,130 --> 00:22:55,710
Just look for a description product, just in case the user forget to change it.

258
00:22:55,910 --> 00:23:02,510
Because it is always true, true positive when this value showing up in your logs.

259
00:23:02,510 --> 00:23:04,310
This is not false negative.

260
00:23:04,310 --> 00:23:06,730
This is true positive always.

261
00:23:07,870 --> 00:23:15,350
So for the CobaltStrike mode detection, well, unfortunately, our team doesn't have access to CobaltStrike yet.

262
00:23:15,350 --> 00:23:20,790
If we can find some CobaltStrike people after this talk, maybe we can build detection on it.

263
00:23:21,370 --> 00:23:27,690
Yeah, but thanks to Olaf Hartog, we get detection.

264
00:23:27,690 --> 00:23:35,230
He created detection on this particular mode by using Event ID 8 from Sysmon.

265
00:23:35,230 --> 00:23:40,790
So you will see there the event description of create remote thread.

266
00:23:41,010 --> 00:23:44,130
The process name will contain PowerShell.exe.

267
00:23:44,130 --> 00:23:54,750
But the unique thing here, you will see that target process address will always end with 0B80, which is really unique.

268
00:23:55,730 --> 00:23:58,930
But there's more story if you read in the blog.

269
00:23:58,930 --> 00:24:06,210
There's some interaction between him and also the creator of the tools, and they made some changes, and then it's no longer the case.

270
00:24:06,210 --> 00:24:10,450
But still, if someone used the older version of the tools, they can still detect this.

271
00:24:11,410 --> 00:24:15,810
DLL modes, again, similar to PowerShell DLL, you need to watch the loaders.

272
00:24:15,810 --> 00:24:24,890
Whenever run DLL 32 is loading unsigned or not available signature DLLs, you create alert on that.

273
00:24:27,460 --> 00:24:30,700
And then the next one is .NET version downgrading.

274
00:24:30,700 --> 00:24:32,860
So this is actually happened by mistake.

275
00:24:32,860 --> 00:24:37,340
So I forget that this tool require a lower version of .NET.

276
00:24:37,580 --> 00:24:42,180
So I run it in the version 4 or 4.5, if I recall.

277
00:24:42,760 --> 00:24:45,560
And then it's just like, oh, I don't like this version.

278
00:24:45,560 --> 00:24:46,540
Can you bring it down?

279
00:24:46,540 --> 00:24:47,680
And it actually can.

280
00:24:47,680 --> 00:25:05,240
So it tries to call the Fondue.exe, which is, I think, an upgrade downgrade exe on the Windows server, and then ask them to enable feature the .NET FX3, which is the version for the 2.3.5.

281
00:25:05,480 --> 00:25:08,360
So you can watch that on SystemManager 91.

282
00:25:08,360 --> 00:25:15,980
But the thing is, legitimate application might do this, because, hey, who doesn't love doing backtrack using old application, right?

283
00:25:15,980 --> 00:25:18,240
So, yeah.

284
00:25:18,900 --> 00:25:22,240
Other than that, we got some bonus here.

285
00:25:22,740 --> 00:25:29,600
We got two tools that is pretty similar to PowerShell, or no PowerShell for the SharpQuick.

286
00:25:29,600 --> 00:25:31,480
So the first one will be PowerLine.

287
00:25:31,480 --> 00:25:36,760
It use MSBuild, really remind you to PowerShell, a lot of compilation stuff.

288
00:25:37,040 --> 00:25:51,140
And SharpQuick will be, this is actually a tool they use to demonstrate or test the blocking of PowerShell, and just to bypass AppLocker, because I don't think Red Teamers like AppLocker at all.

289
00:25:51,520 --> 00:25:57,400
Bonus detection IDS, Sysmon Event ID 10, process access.

290
00:25:57,400 --> 00:26:04,160
So any application that accessing PowerShell VLL, but not PowerShell, because you are not supposed to do that.

291
00:26:05,180 --> 00:26:07,800
Windows PowerShell Event ID 4103.

292
00:26:07,800 --> 00:26:09,560
So this is locked from PowerShell.

293
00:26:09,560 --> 00:26:14,860
But when the context application is not PowerShell, isn't it questionable?

294
00:26:15,480 --> 00:26:17,940
So yeah, I think we should be watching for that also.

295
00:26:18,080 --> 00:26:23,340
And lastly, you can use ETW for .NET library tools.

296
00:26:23,340 --> 00:26:30,180
So you can analyze this information using Message Analyzer and Lockman.

297
00:26:30,300 --> 00:26:32,900
But I think there's also some tools out there.

298
00:26:32,900 --> 00:26:36,020
I think Splunk have like a converter for it.

299
00:26:36,320 --> 00:26:41,620
There is a sealed ETW, Roberto Rodriguez play with it a bit.

300
00:26:41,620 --> 00:26:46,820
There's a series of blog talking about analyzing more .NET blocks.

301
00:26:46,820 --> 00:26:49,200
So I think it will be interesting for you to try.

302
00:26:50,240 --> 00:26:53,480
Well, that's pretty much the talk.

303
00:26:54,320 --> 00:26:57,860
It's pretty much, yeah, it's a compressed version, as I mentioned.

304
00:26:57,860 --> 00:27:04,640
So if you'd like to know more, you can always go to my presentation previously on Hackfest.

305
00:27:04,980 --> 00:27:08,300
Just some messages for red team, blue team.

306
00:27:08,300 --> 00:27:10,120
So just do all of this stuff.

307
00:27:10,280 --> 00:27:14,460
Use PowerShell, update PowerShell over blue team, et cetera, et cetera.

308
00:27:14,640 --> 00:27:16,880
And lastly, of course, be nice to each other.

309
00:27:16,880 --> 00:27:19,340
If you're a purple team, you can take both sides.

310
00:27:20,280 --> 00:27:26,020
Yeah, at the end of the day, we need to be nice for each other because we are in the same boat.

311
00:27:26,020 --> 00:27:34,540
At the end of the day, we just want to be Megazord and protect our security company, not security company, our organization.

312
00:27:35,620 --> 00:27:41,000
We work together and then, yeah, we just upgrade our security posture.

313
00:27:42,080 --> 00:27:45,060
And all right, that's pretty much it.

314
00:27:45,260 --> 00:27:53,260
Don't forget to grab some Sigma rules on your way up because I made a lot of Sigma rules just for this presentation in the past week.

315
00:27:53,980 --> 00:28:01,080
I actually never wrote Sigma rules before, but I definitely know what is Sigma rules now.

316
00:28:01,080 --> 00:28:04,080
So make sure you grab that.

317
00:28:04,160 --> 00:28:12,280
You can convert the Sigma rules to any other same QRadar, Splunk, Elastic, ArcSight, whatever you want.

318
00:28:12,580 --> 00:28:17,780
You can use either Encoder.io or Sigmac, but I tested it on Encoder.io.

319
00:28:17,780 --> 00:28:22,560
So all the Sigma should be able to be converted to the other type.

320
00:28:22,560 --> 00:28:28,580
If you use Encoder.io, but Sigmac, it's also an option if you like to do like CLI kind of thing.

321
00:28:29,980 --> 00:28:38,540
So I'm so sorry that I didn't mention MatterAttack right from the start because I'm a threat hunter, but yeah, I need to mention that.

322
00:28:38,540 --> 00:28:45,560
All the rules, all 20 rules that I've made for the four tools are mapped to the closest attack TTPs.

323
00:28:45,580 --> 00:28:49,800
It is also using the newest version of the TTPs.

324
00:28:49,800 --> 00:28:50,940
They're using sub techniques.

325
00:28:51,300 --> 00:28:53,560
So I try my best to map it.

326
00:28:53,560 --> 00:28:55,060
So if it's not, it's not perfect.

327
00:28:55,060 --> 00:28:57,580
And if you want to change it for sure, you can do it.

328
00:28:58,260 --> 00:28:58,980
Yeah.

329
00:28:58,980 --> 00:29:08,900
So this is the slide that you want to take a picture of, that you want to scan, that you want to send it to your, I don't know, like subordinates.

330
00:29:09,260 --> 00:29:10,820
So yeah, make sure you grab it.

331
00:29:10,820 --> 00:29:12,080
It's going to take you through my GitHub.

332
00:29:15,780 --> 00:29:16,580
It's special.

333
00:29:16,580 --> 00:29:24,520
Thanks to my employer, of course, for supporting me to do this understanding, taking me, taking sometimes to do the research.

334
00:29:24,940 --> 00:29:33,720
ScoobyMTL, you should have attended his workshop earlier today in the bootcamp village because it is great.

335
00:29:33,800 --> 00:29:38,320
And also my friend Avneet, 13Avneet for inspiration, guide, and feedback.

336
00:29:38,320 --> 00:29:44,680
My coworkers at work literally making me understand PowerShell from zero to hero.

337
00:29:44,880 --> 00:29:45,840
And also .NET.

338
00:29:45,840 --> 00:29:47,780
I don't really like .NET.

339
00:29:47,780 --> 00:29:56,840
Amazing not PowerShell tools creators, like making us the blue teamers need to spin our head around, do a lot of research.

340
00:29:56,840 --> 00:30:03,380
And lastly, not lastly, in Fawcett community, Olaf Hartongs for the detection, and he will be speaking later tonight.

341
00:30:03,380 --> 00:30:05,260
So make sure you check that.

342
00:30:05,440 --> 00:30:12,280
Sigma team, because it's a really useful tool.

343
00:30:12,680 --> 00:30:26,140
And please, the last and not the least, DEF CON, thank you so much for accepting my talks, for the volunteers, for your time, and all the attendees for the talk right now.

344
00:30:26,140 --> 00:30:27,200
Thank you so much.

345
00:30:27,320 --> 00:30:30,540
If you'd like to connect with me and my team, you can.

346
00:30:30,540 --> 00:30:36,100
You can find me on Twitter, on GitHub, on LinkedIn, if you'd like to be more professional.

347
00:30:36,100 --> 00:30:43,000
Or you can check out a blog for my team, Threat Hunting Team on Medium, and Hunting Threat on Twitter.

348
00:30:43,000 --> 00:30:46,500
We posted stuff sometimes.

349
00:30:46,840 --> 00:30:54,260
And yeah, if you scan this barcode, it will take you to my GitHub page, pretty much where all my presentation is.

350
00:30:54,560 --> 00:30:56,860
So yeah, that's pretty much my presentation.

351
00:30:56,860 --> 00:30:57,980
Thank you so much.

352
00:30:59,200 --> 00:31:03,700
Thank you very much, Tez, for the wonderful presentation.

353
00:31:03,840 --> 00:31:14,740
As always, we encourage you guys to join our Blue Team Village Discord server and ask questions in text talk track one.

354
00:31:15,220 --> 00:31:26,240
And yeah, if there's no questions, which I do not see at the moment, I think we are set.

355
00:31:26,240 --> 00:31:31,600
And the presenter will be around for a little bit to answer questions, otherwise.