Presenting the Detecting the Not PowerShell Gang with Tez. And with that, I will let Tez take it away.
All right, thank you so much. Hello, everyone. Welcome to this talk titled Detecting the Not
PowerShell Gang. It's by me, Tez. You can find me on Twitter, anywhere else, TezManager.
All right, let's get to know me for a little bit. I'm a Threat Hunter working for
a major Canadian communication company. We also do MSP, MSSP, ISP, whatever you can think of.
So my main tasks in this company is to do threat hunting, a lot of involvement with
threat intelligence also, and a lot of automation, which is programming, coding, etc. I have some
previous experience in application security, and also some security auditing slash legal.
I graduated from Sheridan College, so I am based in Toronto, Canada. So if you're around,
you know, like if you're a company around Canada and you're looking for good talents,
you can definitely look into that school. So yeah, so that's pretty much me with my
medium, small security budget, fighting the bad people one lock at a time.
All right, so if you ask, like, you just do work? No, I do play a lot. I like to do fun security
stuff, CTF. I like presenting, attending conferences. I also love to do photography,
specifically astrophotography, some landscape photography. Also, I do have a drone and just
taking pictures and videos. I play guitar at times, and I love to go to festivals and concerts.
And of course, like everyone else, gaming, it's something that it's always fun to do.
Just some pictures of me doing stuff, taking picture of stuff, just to show that I'm not
working all the time. All right, first of all, let's start with disclaimer. All the opinions
are my own, and this doesn't reflect any views of my employer. So with that in mind, let's move
forward. So also note, this presentation, it's actually a compressed version of similar
presentation that I did in HackFest last year. So if you would like to see more about the tools,
demonstration, et cetera, you can go watch it on HackFest YouTube channel. The link is there.
The slides, also the extended version, are available on my GitHub.
Okay, so let's talk about the content. We just, you know, talking about me. So we got
three major parts. We'll have some introduction about the gang itself. How do we detect each
member of the gangs? There's some bonus detection. There's some bonus members of the gang. And we
close everything with some outro and a Q&A at the end. Yeah, so in this section, we'll get the basic
understanding of what is exactly not PowerShell gang, not PowerShell tools. So I did this research
roughly like one to two years ago. And I see a bunch of, we actually see a bunch of tools that
acting the same way, that act to try to avoid PowerShell security logging and mechanism,
but they achieve it with different ways. So this is really interesting to me. So I just pretty much
bundled them together and then, yeah, build detection for all of them and then see the
unique way each one of the tools doing. So one question you're going to ask, like, why these
tools even exist? Why don't they just use PowerShell? Well, because the PowerShell love
Blue Team. This is a blog post that they posted back in 2015 when they released version 5 of
PowerShell. They released a lot of security feature and it is actually really bad for Red Team. So
pretty much friendship ended with the Red Team. Now Blue Team is Microsoft's best friend.
So is it that bad? Actually, it is. You get protected logging. So whenever you type anything,
PowerShell will be locked. Whenever you enter a script and you enter commands, it will be locked.
If the Blue Team have centralized theme, that's it. That's the end for the defender.
Sorry, for the attacker, right? Also, I'm saying integration, which is anti-malware
mechanism. So there's a lot of bypass being released, but this is pretty much a never-ending
race between Microsoft and then the Red Team slash offensive tool makers. So they bypass the patch.
They bypass the patch. It's just never-ending. And lastly, we got the Constraint Language Mode,
CLM, that able to limit the capability in the sensitive environment, for example,
in your PCI DSS server, in your production server. You can limit
things to do with PowerShell. So that's not really good, actually.
Five years later, so there was this EMA, Ask Me Anything, event going on in one of the
Slack channel of one of the big security company in the US. So I just jump in and ask the question,
from your recent engagement, do you still use PowerShell at all? And then most of the answer
is like, not really. We just drop it. We don't really use it. So that's the idea how bad it is.
Even five years later, people just start forgetting PowerShell at all. And that's
why we have the whole game. So now we understand what's not PowerShell. And then let's move forward
and just get some understanding about the detection. Make sure that you have these
requirements ready if you're trying to deploy this detection, because this is
the environment that I have, that we have, when we tested it. And then, yeah, pretty much
the whole goal of this presentation is to utilize your locks. So you can use whatever
same solution you want, Splunk, Elk, ArcSight. I can keep going on and on, but you get the idea.
So, yeah. So there's two types of detection that I will be sharing. The first one will be
the low-hanging fruits, the easy detection that's easy to create and easy to bypass. The next one
is a more complicated detection, the advanced detection based on TTP or behavior of the tools.
It's really kind of hard to make, but also kind of hard to bypass by the attacker. So we'll see.
So the first tool, we call it InFishyShell, not we call it,
the maker call it InFishyShell. The tagline is like, sure, we can hook it, because
the people from Javelin Networks, when they make this, all they do in the tools is just hooking,
hooking, hooking. They hook the SystemManagementAutomation.dll, the library of PowerShell.
They hook the SystemCorner.dll to bypass the logging mechanism, and then they hook the
anti-malware mechanism. They just hook everything. But it works perfectly fine,
because when they hook it, and then they override the input length for those attributes, the three
attribute buff, into zero length. So it's pretty much non-existent, which equals to
not functioning PowerShell detection, which is great for them.
So we have five detection here. We got the first one is low-hanging fruits.
So as you can see there, there is a dll called InFishyShellProfiler.dll, and then there's a
bat file that run with pat as admin. So this file are pre-compiled already, so it's available on
the GitHub. So when people run it as is, you can detect it. That's the goal of low-hanging fruits.
You detect it by using sysmoniv-97 and sysmoniv-91, and you deploy the role in your scene.
When you run the tools the first time, you will see this unique trace on sysmoniv-91.
You will see a PowerShell in the command line section, in the command line field,
just PowerShell, no exe, no parameters, etc. And then the parent command line will uniquely be
exe that is calling a bat file. You get the idea. So there's exe and a bat file in the same
parent command line. So we can combine these two information and then make a detection out of it,
which is what we do, what I do. And then the next one, this tool is actually able to do some
privilege escalation by adding some entries in the registry key. So we need to watch when they
do this using rec.exe, for example. And then there's a certain value, specifically inproc
surfer32, and those flags that you can see. The parent command line will be the same
parent command line as the previous one. So you will have the .exe and then the .bat.
Again, if you combine that and then you combine additionally the rec.exe tools,
you pretty much have pretty strong detection there. The next one, it's the inproc surfer32
registry key changes, or additional, to say. So if you see here, you can see the target object
is the inproc surfer32. But they're trying to load the malicious... not malicious, like the...
not PowerShell DLLs that they are using, which is the InfoShellProfiler.dll. So you can watch
for anything that is not system32 being loaded to this particular target object,
because that's kind of fishy. And again, you will be using Sysmon,
specifically event ID 13 of the registry value set.
The last detection for this tool, it's actually watching the DLL being loaded
to the legitimate PowerShell, because again, it will hook the PowerShell library. So there will
be... you need to load the module from the DLL to the exe. But the thing is, usually PowerShell
will load stuff from Microsoft, because it's a Microsoft tools. And then you can also see
the signature status, it's false and also unavailable. So that's kind of questionable.
We can combine this... what do you call it... interesting thing, combine it together,
and you can make a row out of it and start building detection on it.
And the next tool is PowerShell DLL. So it's not PowerShell, it's PowerShell DLL.
And the tagline for this, yeah, we got DLL for that, because it's on the name already.
So Penta pretty much created... this is also one of the tools that is having a lot of stars in
GitHub. So this tool actually has two modes. You can use the DLL mode and then the exe mode.
For the DLL mode, you need to use the DLL loader. So this is a low bus component that will be used.
And you'll load the particular DLL that you feed. Or you can use a pre-compiled exe. So you just
run the double-click exe and it will just do the job. So you'll use... there's options of five
different DLL loader thing or proxy execution exe that you can use. So this binary is signed
by Microsoft. So sometimes it's not... it's normal when people whitelisted it. So make sure you pay
attention in this particular area. And then moving forward for the exe mode, it will load
the exe itself. It loads 57 PowerShell automation DLLs and other supporting DLLs for the operation.
So all the lists... all the 57 DLLs are listed on the appendix at the end of the presentation.
For the detection, we get four things here. We get the low-hanging fruits, which is
simple thing like description field, product field, even the image, so the file name itself.
So you can definitely use that. Again, this is a low-hanging fruit detection.
Just a tip, if you want to change it, you can just go to the code before you compile it. And then
those are the information by default, the PowerShell DLL, copyright 2016. You can easily
change it to anything. But again, low-hanging fruits detection is supposed to be easy detection.
The next one, PowerShell DLL loading DLLs. To be precise, PowerShell DLL loading the PowerShell
DLLs, so the real PowerShell DLLs. So this is applicable for the DLL mode. For example,
you're running it using the runDll32.exe. And then runDll32.exe is loading a bunch of
PowerShell-related DLLs. It's like they're trying to do something related to PowerShell, right?
So yeah, that's what they're trying to do. So we can watch them, again, with the system 1.97.
And then more general to that, we can actually watching what the loaders do. So whenever they
are loading unsigned DLLs or the DLLs that doesn't have any signature, we can create an
alert on that. But the problem with this, it's actually quite noisy. There's some application,
third-party application that do this. On the top of my head, I can say notepad++ do that.
So that's the first thing that triggers the role when we deploy it in the production. I'm like,
okay. But yeah, you can whitelist it for sure. The next one is when the exe mode loading 57
different DLLs. So this will happen in a millisecond, just like that. Just instantly
load 57 DLLs. And you can see all of this from system 1.97, but make sure you add those DLLs
into the system 1.config. Just make sure you modify the config to watch for those specific DLLs.
For this, to make it easier or to make it detection better, you can use correlation
or cardinality. So whenever one DLL is being loaded, the rule itself will look for the other
56 DLLs if it's being loaded around maybe like in the last one minute or like in the last 50 seconds,
et cetera. So you can just see if at the end, like as a bigger picture, if all of them being
loaded at the same time. So some examples of correlation on the same that you can do is elastic
search. I think they have cardinality rules. ArcSight correlation engine for sure. And then
Splunk, you can combine multiple indicators. So you will have 57 indicators. And then when
everything trigger at the same time, you create a rule out of it. And then you can also use elastic
Kibana heat map if you want your analysts to do that just to look into stuff. And you can do it
over Python for sure because, yeah, what Python cannot do, right? Powerless shell, the next tools,
the tagline is don't worry, we got Lullabas here because Mr. Unicoder, I think he's in Montreal,
local Canada also. So yeah, so what in his mind when making this tool is just to use a lot of
Lullabas. There's two Lullabas specifically being used here, the msbuild.exe that will be used to
compile a payload that you send from the outside from attacker machine to the target machine.
So it relies on the msbuild.exe for execution. So it will provide a script, either PowerShell
or whatever, and then it will compile it for you. But the unique thing is they are not using the
one that is already in the machine. So they bring the whole exe from the outside and then rename it
to something else. It can be something random, it can be to a known process name, for example,
cog.exe or cnd.exe. And then from there, it will get the instruction from the script file,
from the PowerShell script or whatever script you provided. It will encode the command using
certutil, another Lullabas, and then they'll perform some kind of obfuscation, make it
confusing for the analyst, for the blue team. So you can see here the function and variable names
is just like mumbo-jumbo. You don't understand what it is. The last component, not the last
component, it's the component that is sitting on the upside on the attacker machine to generate
all of those stuff are a PowerShell.py, which is like a Python code that pretty much the engine
of the tool will create everything. And then you can ship those three files to the victim machine.
For the detection for the low-hanging fruits, we will have a creation of the... remember that
they will rename the msbuild.exe. So you can check on the .NET Framework folder if there's
any new exe file being created. For example, if you see cnd.exe created in the .NET Framework
folder, that will be so suspicious. You'll be using SysModify11 for that. PowerShell logging,
well, it's because this tool is not really evading the PowerShell detection.
It is still recording the output of the PowerShell script being deobfuscated. So after
all the encoding, you can still see the final content of the code. You can detect more PowerShell
payload, etc. using the Event ID 4104 from the Microsoft App, if I'm not mistaken.
Moving on, detecting the low-bass. The first component 3A is CircUtil. So because they
encode the thing, the payload, they need to decode it in the victim machines.
So they use CircUtil to decode the hex. So you can watch for any CircUtil doing
decode hex function, because it's actually really rare in the production. You can use
SysModify11 for that. And then the next part of it, the second half, it's msbuild.exe,
the renamed one. So not really msbuild as the name, but it is from the description field,
you know it's msbuild, because the only way you can change the description field is to
reverse engineer the whole application and then change the value, which is like too much work for
just evading this stuff, right? So the msbuild.exe will be combined with the random 5 to 25 upper
and lower characters. So you can watch on that combination, SysModify11 again.
Process masquerading, this pretty much can cover not only these tools, but pretty much any
masquerading, which is always suspicious. So the file msbuild.exe being renamed to smss.exe,
or on the right side, you can see it's a random name, can't even pronounce it.
Again, SysModify11 for both. And then we have number five, the .NET DLL loading. So you see
here in the image, it's smss.exe. We already know it's not sms, but we can see why does sms.exe is
loading Microsoft build or msbuild.tas.dll. So that's definitely suspicious, so you can build
detection on this. SysModify11 again. And lastly, PowerShell DLL loading,
that is always visible via process access. So again, our .exe, smss.exe, can be seen
making some access trying to touch poking systemmanagementautomation.dll, which is again,
it's a PowerShell engine. Why would smss.exe doing that? Are they trying to get some functionality
out of it? Probably is. So you can use SysModify11 to build that. You can combine all this information
together. Tools number four, no PowerShell. The tagline is, can you C-sharp? Because
bits.admin create this tool implemented in C-sharp. And this is really popular these days.
If you look for offensive researcher, they start using more C-sharp, C-sharp, C-sharp.
Because it's hard to detect C-sharp operation because it's not using PowerShell. It's not
using PowerShell DLLs. It's just go straight to the native.net library. And this tool,
it's actually trying to mimic PowerShell. So you get the same cmdlets. For example,
you have things like get process, get user, et cetera. There's two modes. You can run it by using
rundll32, again, similar to PowerShell DLL. Or you can run it using CobaltStrike.
There's two components. For CobaltStrike, you get the exe file, and then you get the cmi,
the CobaltStrike file. For the DLL, there's two options that you can do, depending on your target
machine. You can use the 32-bit DLL or the 64-bit DLL. And then you will need to load it using
rundll32. But I suspect you can use the other DLL loader. And it's exactly acting like
PowerShell DLL mode. We get forward detection for this. Low hanging fruits,
again, because it's written in C Sharp, based on .NET. Just look for a description product,
just in case the user forget to change it. Because it is always true, true positive
when this value showing up in your logs. This is not false negative. This is true positive always.
So for the CobaltStrike mode detection, well, unfortunately, our team doesn't have access to
CobaltStrike yet. If we can find some CobaltStrike people after this talk, maybe we can build
detection on it. Yeah, but thanks to Olaf Hartog, we get detection. He created detection
on this particular mode by using Event ID 8 from Sysmon. So you will see there the event
description of create remote thread. The process name will contain PowerShell.exe.
But the unique thing here, you will see that target process address will always end
with 0B80, which is really unique. But there's more story if you read in the blog. There's some
interaction between him and also the creator of the tools, and they made some changes, and then
it's no longer the case. But still, if someone used the older version of the tools, they can
still detect this. DLL modes, again, similar to PowerShell DLL, you need to watch the loaders.
Whenever run DLL 32 is loading unsigned or not available signature DLLs, you create alert on that.
And then the next one is .NET version downgrading. So this is actually happened by mistake. So I
forget that this tool require a lower version of .NET. So I run it in the version 4 or 4.5,
if I recall. And then it's just like, oh, I don't like this version. Can you bring it down?
And it actually can. So it tries to call the Fondue.exe, which is, I think, an upgrade downgrade
exe on the Windows server, and then ask them to enable feature the .NET FX3, which is the
version for the 2.3.5. So you can watch that on SystemManager 91. But the thing is,
legitimate application might do this, because, hey, who doesn't love doing backtrack using old
application, right? So, yeah. Other than that, we got some bonus here.
We got two tools that is pretty similar to PowerShell, or no PowerShell for the
SharpQuick. So the first one will be PowerLine. It use MSBuild, really remind you to PowerShell,
a lot of compilation stuff. And SharpQuick will be, this is actually a tool they use to demonstrate
or test the blocking of PowerShell, and just to bypass AppLocker, because I don't think
Red Teamers like AppLocker at all. Bonus detection IDS, Sysmon Event ID 10,
process access. So any application that accessing PowerShell VLL, but not PowerShell, because you
are not supposed to do that. Windows PowerShell Event ID 4103. So this is locked from PowerShell.
But when the context application is not PowerShell, isn't it questionable? So yeah,
I think we should be watching for that also. And lastly, you can use ETW for .NET library tools.
So you can analyze this information using Message Analyzer and Lockman. But I think there's also
some tools out there. I think Splunk have like a converter for it. There is a sealed ETW,
Roberto Rodriguez play with it a bit. There's a series of blog talking about
analyzing more .NET blocks. So I think it will be interesting for you to try.
Well, that's pretty much the talk. It's pretty much, yeah, it's a compressed version,
as I mentioned. So if you'd like to know more, you can always go to my presentation previously
on Hackfest. Just some messages for red team, blue team. So just do all of this stuff. Use
PowerShell, update PowerShell over blue team, et cetera, et cetera. And lastly, of course,
be nice to each other. If you're a purple team, you can take both sides. Yeah, at the end of the
day, we need to be nice for each other because we are in the same boat. At the end of the day,
we just want to be Megazord and protect our security company, not security company,
our organization. We work together and then, yeah, we just upgrade our security posture.
And all right, that's pretty much it. Don't forget to grab some Sigma rules on your way up
because I made a lot of Sigma rules just for this presentation in the past week.
I actually never wrote Sigma rules before, but I definitely know what is Sigma rules now. So
make sure you grab that. You can convert the Sigma rules to any other same QRadar, Splunk,
Elastic, ArcSight, whatever you want. You can use either Encoder.io or Sigmac,
but I tested it on Encoder.io. So all the Sigma should be able to be converted to the other type.
If you use Encoder.io, but Sigmac, it's also an option if you like to do like CLI kind of thing.
So I'm so sorry that I didn't mention MatterAttack right from the start because I'm a threat hunter,
but yeah, I need to mention that. All the rules, all 20 rules that I've made for the four tools
are mapped to the closest attack TTPs. It is also using the newest version of the
TTPs. They're using sub techniques. So I try my best to map it. So if it's not, it's not perfect.
And if you want to change it for sure, you can do it. Yeah. So this is the slide that you want
to take a picture of, that you want to scan, that you want to send it to your, I don't know,
like subordinates. So yeah, make sure you grab it. It's going to take you through my GitHub. It's
special. Thanks to my employer, of course, for supporting me to do this understanding,
taking me, taking sometimes to do the research. ScoobyMTL, you should have attended his
workshop earlier today in the bootcamp village because it is great. And also my friend Avneet,
13Avneet for inspiration, guide, and feedback. My coworkers at work literally making me
understand PowerShell from zero to hero. And also .NET. I don't really like .NET.
Amazing not PowerShell tools creators, like making us the blue teamers need to spin our head around,
do a lot of research. And lastly, not lastly, in Fawcett community, Olaf Hartongs for the
detection, and he will be speaking later tonight. So make sure you check that. Sigma team,
because it's a really useful tool. And please, the last and not the least,
DEF CON, thank you so much for accepting my talks, for the volunteers, for your time,
and all the attendees for the talk right now. Thank you so much. If you'd like to connect with
me and my team, you can. You can find me on Twitter, on GitHub, on LinkedIn, if you'd like
to be more professional. Or you can check out a blog for my team, Threat Hunting Team on Medium,
and Hunting Threat on Twitter. We posted stuff sometimes. And yeah, if you scan this barcode,
it will take you to my GitHub page, pretty much where all my presentation is.
So yeah, that's pretty much my presentation. Thank you so much.
Thank you very much, Tez, for the wonderful presentation. As always, we encourage you guys
to join our Blue Team Village Discord server and ask questions in text talk track one.
And yeah, if there's no questions, which I do not see at the moment, I think we are set.
And the presenter will be around for a little bit to answer questions, otherwise.