WEBVTT 00:18.630 --> 00:23.970 Presenting the Detecting the Not PowerShell Gang with Tez. 00:23.970 --> 00:26.950 And with that, I will let Tez take it away. 00:28.130 --> 00:30.050 All right, thank you so much. 00:30.430 --> 00:31.570 Hello, everyone. 00:31.570 --> 00:36.450 Welcome to this talk titled Detecting the Not PowerShell Gang. 00:37.590 --> 00:39.430 It's by me, Tez. 00:39.430 --> 00:42.570 You can find me on Twitter, anywhere else, TezManager. 00:42.970 --> 00:45.930 All right, let's get to know me for a little bit. 00:45.930 --> 00:51.590 I'm a Threat Hunter working for a major Canadian communication company. 00:51.590 --> 00:56.510 We also do MSP, MSSP, ISP, whatever you can think of. 00:56.510 --> 01:07.950 So my main tasks in this company is to do threat hunting, a lot of involvement with threat intelligence also, and a lot of automation, which is programming, coding, etc. 01:07.990 --> 01:14.410 I have some previous experience in application security, and also some security auditing slash legal. 01:14.410 --> 01:19.410 I graduated from Sheridan College, so I am based in Toronto, Canada. 01:19.610 --> 01:27.770 So if you're around, you know, like if you're a company around Canada and you're looking for good talents, you can definitely look into that school. 01:28.190 --> 01:38.630 So yeah, so that's pretty much me with my medium, small security budget, fighting the bad people one lock at a time. 01:39.430 --> 01:42.790 All right, so if you ask, like, you just do work? 01:42.790 --> 01:44.190 No, I do play a lot. 01:44.190 --> 01:46.650 I like to do fun security stuff, CTF. 01:46.650 --> 01:49.250 I like presenting, attending conferences. 01:49.450 --> 01:55.050 I also love to do photography, specifically astrophotography, some landscape photography. 01:55.050 --> 01:59.270 Also, I do have a drone and just taking pictures and videos. 01:59.410 --> 02:03.770 I play guitar at times, and I love to go to festivals and concerts. 02:03.770 --> 02:09.370 And of course, like everyone else, gaming, it's something that it's always fun to do. 02:09.770 --> 02:18.950 Just some pictures of me doing stuff, taking picture of stuff, just to show that I'm not working all the time. 02:18.950 --> 02:21.290 All right, first of all, let's start with disclaimer. 02:21.310 --> 02:30.270 All the opinions are my own, and this doesn't reflect any views of my employer. 02:30.470 --> 02:33.770 So with that in mind, let's move forward. 02:33.770 --> 02:41.170 So also note, this presentation, it's actually a compressed version of similar presentation that I did in HackFest last year. 02:41.170 --> 02:48.150 So if you would like to see more about the tools, demonstration, et cetera, you can go watch it on HackFest YouTube channel. 02:48.150 --> 02:49.350 The link is there. 02:49.650 --> 02:52.830 The slides, also the extended version, are available on my GitHub. 02:53.910 --> 02:57.510 Okay, so let's talk about the content. 02:57.610 --> 03:00.270 We just, you know, talking about me. 03:00.610 --> 03:02.670 So we got three major parts. 03:02.670 --> 03:05.990 We'll have some introduction about the gang itself. 03:06.370 --> 03:09.230 How do we detect each member of the gangs? 03:09.230 --> 03:10.670 There's some bonus detection. 03:10.670 --> 03:12.950 There's some bonus members of the gang. 03:12.950 --> 03:17.830 And we close everything with some outro and a Q&A at the end. 03:18.590 --> 03:26.250 Yeah, so in this section, we'll get the basic understanding of what is exactly not PowerShell gang, not PowerShell tools. 03:26.890 --> 03:33.250 So I did this research roughly like one to two years ago. 03:33.690 --> 03:46.610 And I see a bunch of, we actually see a bunch of tools that acting the same way, that act to try to avoid PowerShell security logging and mechanism, but they achieve it with different ways. 03:46.610 --> 03:49.890 So this is really interesting to me. 03:49.890 --> 03:59.770 So I just pretty much bundled them together and then, yeah, build detection for all of them and then see the unique way each one of the tools doing. 04:00.030 --> 04:04.630 So one question you're going to ask, like, why these tools even exist? 04:04.630 --> 04:06.370 Why don't they just use PowerShell? 04:06.510 --> 04:09.290 Well, because the PowerShell love Blue Team. 04:09.290 --> 04:14.950 This is a blog post that they posted back in 2015 when they released version 5 of PowerShell. 04:15.690 --> 04:20.690 They released a lot of security feature and it is actually really bad for Red Team. 04:20.690 --> 04:23.990 So pretty much friendship ended with the Red Team. 04:23.990 --> 04:26.950 Now Blue Team is Microsoft's best friend. 04:27.650 --> 04:29.830 So is it that bad? 04:29.930 --> 04:31.550 Actually, it is. 04:31.930 --> 04:33.670 You get protected logging. 04:34.410 --> 04:38.550 So whenever you type anything, PowerShell will be locked. 04:38.550 --> 04:41.930 Whenever you enter a script and you enter commands, it will be locked. 04:41.930 --> 04:44.870 If the Blue Team have centralized theme, that's it. 04:44.870 --> 04:46.870 That's the end for the defender. 04:46.870 --> 04:49.190 Sorry, for the attacker, right? 04:49.410 --> 04:53.710 Also, I'm saying integration, which is anti-malware mechanism. 04:53.790 --> 05:02.090 So there's a lot of bypass being released, but this is pretty much a never-ending race between Microsoft and then the Red Team slash offensive tool makers. 05:02.090 --> 05:03.790 So they bypass the patch. 05:03.790 --> 05:04.710 They bypass the patch. 05:04.710 --> 05:06.350 It's just never-ending. 05:06.570 --> 05:19.290 And lastly, we got the Constraint Language Mode, CLM, that able to limit the capability in the sensitive environment, for example, in your PCI DSS server, in your production server. 05:19.290 --> 05:22.030 You can limit things to do with PowerShell. 05:22.030 --> 05:24.110 So that's not really good, actually. 05:25.870 --> 05:37.190 Five years later, so there was this EMA, Ask Me Anything, event going on in one of the Slack channel of one of the big security company in the US. 05:37.190 --> 05:43.490 So I just jump in and ask the question, from your recent engagement, do you still use PowerShell at all? 05:43.490 --> 05:46.730 And then most of the answer is like, not really. 05:46.730 --> 05:47.830 We just drop it. 05:47.830 --> 05:49.130 We don't really use it. 05:49.130 --> 05:51.970 So that's the idea how bad it is. 05:51.970 --> 05:56.270 Even five years later, people just start forgetting PowerShell at all. 05:56.550 --> 05:59.490 And that's why we have the whole game. 06:00.010 --> 06:03.990 So now we understand what's not PowerShell. 06:04.330 --> 06:10.370 And then let's move forward and just get some understanding about the detection. 06:10.430 --> 06:22.510 Make sure that you have these requirements ready if you're trying to deploy this detection, because this is the environment that I have, that we have, when we tested it. 06:23.310 --> 06:29.870 And then, yeah, pretty much the whole goal of this presentation is to utilize your locks. 06:29.990 --> 06:33.970 So you can use whatever same solution you want, Splunk, Elk, ArcSight. 06:33.970 --> 06:38.230 I can keep going on and on, but you get the idea. 06:38.230 --> 06:39.310 So, yeah. 06:39.310 --> 06:42.870 So there's two types of detection that I will be sharing. 06:43.290 --> 06:49.330 The first one will be the low-hanging fruits, the easy detection that's easy to create and easy to bypass. 06:49.330 --> 06:56.660 The next one is a more complicated detection, the advanced detection based on TTP or behavior of the tools. 06:57.770 --> 07:04.290 It's really kind of hard to make, but also kind of hard to bypass by the attacker. 07:04.290 --> 07:06.430 So we'll see. 07:06.430 --> 07:12.390 So the first tool, we call it InFishyShell, not we call it, the maker call it InFishyShell. 07:12.590 --> 07:22.890 The tagline is like, sure, we can hook it, because the people from Javelin Networks, when they make this, all they do in the tools is just hooking, hooking, hooking. 07:22.890 --> 07:27.630 They hook the SystemManagementAutomation.dll, the library of PowerShell. 07:27.630 --> 07:35.630 They hook the SystemCorner.dll to bypass the logging mechanism, and then they hook the anti-malware mechanism. 07:35.810 --> 07:37.630 They just hook everything. 07:37.630 --> 07:48.110 But it works perfectly fine, because when they hook it, and then they override the input length for those attributes, the three attribute buff, into zero length. 07:48.110 --> 07:55.990 So it's pretty much non-existent, which equals to not functioning PowerShell detection, which is great for them. 07:57.390 --> 07:59.650 So we have five detection here. 07:59.730 --> 08:02.590 We got the first one is low-hanging fruits. 08:02.590 --> 08:12.910 So as you can see there, there is a dll called InFishyShellProfiler.dll, and then there's a bat file that run with pat as admin. 08:12.910 --> 08:16.050 So this file are pre-compiled already, so it's available on the GitHub. 08:16.050 --> 08:19.190 So when people run it as is, you can detect it. 08:19.190 --> 08:21.210 That's the goal of low-hanging fruits. 08:21.210 --> 08:27.290 You detect it by using sysmoniv-97 and sysmoniv-91, and you deploy the role in your scene. 08:28.030 --> 08:33.930 When you run the tools the first time, you will see this unique trace on sysmoniv-91. 08:34.050 --> 08:42.710 You will see a PowerShell in the command line section, in the command line field, just PowerShell, no exe, no parameters, etc. 08:42.970 --> 08:49.470 And then the parent command line will uniquely be exe that is calling a bat file. 08:49.890 --> 08:52.290 You get the idea. 08:52.290 --> 08:55.010 So there's exe and a bat file in the same parent command line. 08:55.010 --> 09:01.130 So we can combine these two information and then make a detection out of it, which is what we do, what I do. 09:01.730 --> 09:09.850 And then the next one, this tool is actually able to do some privilege escalation by adding some entries in the registry key. 09:10.450 --> 09:15.450 So we need to watch when they do this using rec.exe, for example. 09:15.470 --> 09:23.230 And then there's a certain value, specifically inproc surfer32, and those flags that you can see. 09:24.370 --> 09:30.310 The parent command line will be the same parent command line as the previous one. 09:30.310 --> 09:33.390 So you will have the .exe and then the .bat. 09:33.990 --> 09:43.010 Again, if you combine that and then you combine additionally the rec.exe tools, you pretty much have pretty strong detection there. 09:43.010 --> 09:49.490 The next one, it's the inproc surfer32 registry key changes, or additional, to say. 09:50.250 --> 09:56.650 So if you see here, you can see the target object is the inproc surfer32. 09:56.970 --> 10:01.430 But they're trying to load the malicious... not malicious, like the... 10:01.430 --> 10:06.650 not PowerShell DLLs that they are using, which is the InfoShellProfiler.dll. 10:06.690 --> 10:17.110 So you can watch for anything that is not system32 being loaded to this particular target object, because that's kind of fishy. 10:18.090 --> 10:24.890 And again, you will be using Sysmon, specifically event ID 13 of the registry value set. 10:26.890 --> 10:40.030 The last detection for this tool, it's actually watching the DLL being loaded to the legitimate PowerShell, because again, it will hook the PowerShell library. 10:40.030 --> 10:44.850 So there will be... you need to load the module from the DLL to the exe. 10:44.850 --> 10:51.430 But the thing is, usually PowerShell will load stuff from Microsoft, because it's a Microsoft tools. 10:51.570 --> 10:56.630 And then you can also see the signature status, it's false and also unavailable. 10:56.630 --> 10:58.290 So that's kind of questionable. 10:58.290 --> 11:09.130 We can combine this... what do you call it... interesting thing, combine it together, and you can make a row out of it and start building detection on it. 11:09.870 --> 11:13.270 And the next tool is PowerShell DLL. 11:13.270 --> 11:16.090 So it's not PowerShell, it's PowerShell DLL. 11:16.450 --> 11:21.730 And the tagline for this, yeah, we got DLL for that, because it's on the name already. 11:21.730 --> 11:29.830 So Penta pretty much created... this is also one of the tools that is having a lot of stars in GitHub. 11:30.390 --> 11:32.130 So this tool actually has two modes. 11:32.130 --> 11:35.870 You can use the DLL mode and then the exe mode. 11:35.870 --> 11:39.770 For the DLL mode, you need to use the DLL loader. 11:39.770 --> 11:43.470 So this is a low bus component that will be used. 11:43.730 --> 11:47.430 And you'll load the particular DLL that you feed. 11:47.430 --> 11:50.290 Or you can use a pre-compiled exe. 11:50.290 --> 11:54.730 So you just run the double-click exe and it will just do the job. 11:55.070 --> 12:04.630 So you'll use... there's options of five different DLL loader thing or proxy execution exe that you can use. 12:04.630 --> 12:06.570 So this binary is signed by Microsoft. 12:06.570 --> 12:12.490 So sometimes it's not... it's normal when people whitelisted it. 12:12.490 --> 12:17.350 So make sure you pay attention in this particular area. 12:17.590 --> 12:23.770 And then moving forward for the exe mode, it will load the exe itself. 12:23.770 --> 12:30.170 It loads 57 PowerShell automation DLLs and other supporting DLLs for the operation. 12:30.170 --> 12:36.750 So all the lists... all the 57 DLLs are listed on the appendix at the end of the presentation. 12:37.930 --> 12:40.510 For the detection, we get four things here. 12:40.510 --> 12:51.010 We get the low-hanging fruits, which is simple thing like description field, product field, even the image, so the file name itself. 12:51.370 --> 12:52.870 So you can definitely use that. 12:52.870 --> 12:55.650 Again, this is a low-hanging fruit detection. 12:56.310 --> 13:01.050 Just a tip, if you want to change it, you can just go to the code before you compile it. 13:01.270 --> 13:07.050 And then those are the information by default, the PowerShell DLL, copyright 2016. 13:07.050 --> 13:09.450 You can easily change it to anything. 13:09.490 --> 13:13.050 But again, low-hanging fruits detection is supposed to be easy detection. 13:13.590 --> 13:16.850 The next one, PowerShell DLL loading DLLs. 13:16.850 --> 13:23.910 To be precise, PowerShell DLL loading the PowerShell DLLs, so the real PowerShell DLLs. 13:23.910 --> 13:27.090 So this is applicable for the DLL mode. 13:27.090 --> 13:31.050 For example, you're running it using the runDll32.exe. 13:31.530 --> 13:37.170 And then runDll32.exe is loading a bunch of PowerShell-related DLLs. 13:37.510 --> 13:42.210 It's like they're trying to do something related to PowerShell, right? 13:42.230 --> 13:44.530 So yeah, that's what they're trying to do. 13:44.530 --> 13:47.630 So we can watch them, again, with the system 1.97. 13:48.690 --> 13:52.950 And then more general to that, we can actually watching what the loaders do. 13:52.950 --> 14:01.370 So whenever they are loading unsigned DLLs or the DLLs that doesn't have any signature, we can create an alert on that. 14:01.590 --> 14:04.510 But the problem with this, it's actually quite noisy. 14:04.790 --> 14:09.350 There's some application, third-party application that do this. 14:09.850 --> 14:12.770 On the top of my head, I can say notepad++ do that. 14:12.770 --> 14:17.630 So that's the first thing that triggers the role when we deploy it in the production. 14:17.630 --> 14:18.770 I'm like, okay. 14:18.890 --> 14:21.130 But yeah, you can whitelist it for sure. 14:22.330 --> 14:27.810 The next one is when the exe mode loading 57 different DLLs. 14:27.810 --> 14:30.930 So this will happen in a millisecond, just like that. 14:31.070 --> 14:34.430 Just instantly load 57 DLLs. 14:34.450 --> 14:42.290 And you can see all of this from system 1.97, but make sure you add those DLLs into the system 1.config. 14:42.290 --> 14:47.110 Just make sure you modify the config to watch for those specific DLLs. 14:47.930 --> 14:54.290 For this, to make it easier or to make it detection better, you can use correlation or cardinality. 14:56.030 --> 15:08.690 So whenever one DLL is being loaded, the rule itself will look for the other 56 DLLs if it's being loaded around maybe like in the last one minute or like in the last 50 seconds, et cetera. 15:08.690 --> 15:16.490 So you can just see if at the end, like as a bigger picture, if all of them being loaded at the same time. 15:16.710 --> 15:20.530 So some examples of correlation on the same that you can do is elastic search. 15:20.530 --> 15:22.430 I think they have cardinality rules. 15:23.030 --> 15:25.270 ArcSight correlation engine for sure. 15:25.790 --> 15:28.910 And then Splunk, you can combine multiple indicators. 15:29.170 --> 15:31.630 So you will have 57 indicators. 15:31.910 --> 15:36.270 And then when everything trigger at the same time, you create a rule out of it. 15:36.510 --> 15:44.070 And then you can also use elastic Kibana heat map if you want your analysts to do that just to look into stuff. 15:44.310 --> 15:49.590 And you can do it over Python for sure because, yeah, what Python cannot do, right? 15:50.530 --> 15:56.530 Powerless shell, the next tools, the tagline is don't worry, we got Lullabas here because Mr. 15:56.530 --> 16:01.130 Unicoder, I think he's in Montreal, local Canada also. 16:02.370 --> 16:08.270 So yeah, so what in his mind when making this tool is just to use a lot of Lullabas. 16:09.570 --> 16:20.870 There's two Lullabas specifically being used here, the msbuild.exe that will be used to compile a payload that you send from the outside from attacker machine to the target machine. 16:21.090 --> 16:25.210 So it relies on the msbuild.exe for execution. 16:25.450 --> 16:31.810 So it will provide a script, either PowerShell or whatever, and then it will compile it for you. 16:31.810 --> 16:35.410 But the unique thing is they are not using the one that is already in the machine. 16:35.410 --> 16:41.130 So they bring the whole exe from the outside and then rename it to something else. 16:41.130 --> 16:48.650 It can be something random, it can be to a known process name, for example, cog.exe or cnd.exe. 16:49.110 --> 16:57.070 And then from there, it will get the instruction from the script file, from the PowerShell script or whatever script you provided. 16:57.070 --> 17:05.790 It will encode the command using certutil, another Lullabas, and then they'll perform some kind of obfuscation, make it confusing for the analyst, for the blue team. 17:05.790 --> 17:10.090 So you can see here the function and variable names is just like mumbo-jumbo. 17:10.090 --> 17:11.750 You don't understand what it is. 17:12.430 --> 17:27.510 The last component, not the last component, it's the component that is sitting on the upside on the attacker machine to generate all of those stuff are a PowerShell.py, which is like a Python code that pretty much the engine of the tool will create everything. 17:27.510 --> 17:31.630 And then you can ship those three files to the victim machine. 17:33.410 --> 17:45.110 For the detection for the low-hanging fruits, we will have a creation of the... remember that they will rename the msbuild.exe. 17:45.110 --> 17:52.150 So you can check on the .NET Framework folder if there's any new exe file being created. 17:52.250 --> 17:59.330 For example, if you see cnd.exe created in the .NET Framework folder, that will be so suspicious. 17:59.670 --> 18:03.410 You'll be using SysModify11 for that. 18:04.250 --> 18:11.590 PowerShell logging, well, it's because this tool is not really evading the PowerShell detection. 18:11.590 --> 18:19.370 It is still recording the output of the PowerShell script being deobfuscated. 18:19.370 --> 18:24.050 So after all the encoding, you can still see the final content of the code. 18:24.050 --> 18:27.310 You can detect more PowerShell payload, etc. 18:27.310 --> 18:35.970 using the Event ID 4104 from the Microsoft App, if I'm not mistaken. 18:36.730 --> 18:40.330 Moving on, detecting the low-bass. 18:40.330 --> 18:43.690 The first component 3A is CircUtil. 18:44.050 --> 18:50.470 So because they encode the thing, the payload, they need to decode it in the victim machines. 18:50.470 --> 18:53.750 So they use CircUtil to decode the hex. 18:53.750 --> 19:00.510 So you can watch for any CircUtil doing decode hex function, because it's actually really rare in the production. 19:01.130 --> 19:03.330 You can use SysModify11 for that. 19:03.750 --> 19:09.650 And then the next part of it, the second half, it's msbuild.exe, the renamed one. 19:09.650 --> 19:26.550 So not really msbuild as the name, but it is from the description field, you know it's msbuild, because the only way you can change the description field is to reverse engineer the whole application and then change the value, which is like too much work for just evading this stuff, 19:26.550 --> 19:26.950 right? 19:26.950 --> 19:35.770 So the msbuild.exe will be combined with the random 5 to 25 upper and lower characters. 19:35.870 --> 19:41.330 So you can watch on that combination, SysModify11 again. 19:41.430 --> 19:49.350 Process masquerading, this pretty much can cover not only these tools, but pretty much any masquerading, which is always suspicious. 19:49.490 --> 20:01.070 So the file msbuild.exe being renamed to smss.exe, or on the right side, you can see it's a random name, can't even pronounce it. 20:01.250 --> 20:03.750 Again, SysModify11 for both. 20:04.310 --> 20:07.590 And then we have number five, the .NET DLL loading. 20:07.590 --> 20:12.010 So you see here in the image, it's smss.exe. 20:12.010 --> 20:24.690 We already know it's not sms, but we can see why does sms.exe is loading Microsoft build or msbuild.tas.dll. 20:24.690 --> 20:28.490 So that's definitely suspicious, so you can build detection on this. 20:28.510 --> 20:30.210 SysModify11 again. 20:30.810 --> 20:39.350 And lastly, PowerShell DLL loading, that is always visible via process access. 20:39.350 --> 20:58.650 So again, our .exe, smss.exe, can be seen making some access trying to touch poking systemmanagementautomation.dll, which is again, it's a PowerShell engine. 20:58.650 --> 21:02.370 Why would smss.exe doing that? 21:02.370 --> 21:04.770 Are they trying to get some functionality out of it? 21:04.770 --> 21:05.890 Probably is. 21:05.890 --> 21:08.430 So you can use SysModify11 to build that. 21:08.430 --> 21:10.770 You can combine all this information together. 21:11.390 --> 21:14.250 Tools number four, no PowerShell. 21:14.350 --> 21:16.610 The tagline is, can you C-sharp? 21:16.610 --> 21:22.550 Because bits.admin create this tool implemented in C-sharp. 21:23.690 --> 21:25.970 And this is really popular these days. 21:25.970 --> 21:33.130 If you look for offensive researcher, they start using more C-sharp, C-sharp, C-sharp. 21:34.210 --> 21:40.070 Because it's hard to detect C-sharp operation because it's not using PowerShell. 21:40.070 --> 21:42.170 It's not using PowerShell DLLs. 21:42.170 --> 21:46.110 It's just go straight to the native.net library. 21:46.570 --> 21:49.410 And this tool, it's actually trying to mimic PowerShell. 21:49.410 --> 21:51.690 So you get the same cmdlets. 21:51.970 --> 21:59.650 For example, you have things like get process, get user, et cetera. 21:59.650 --> 22:00.510 There's two modes. 22:00.510 --> 22:06.570 You can run it by using rundll32, again, similar to PowerShell DLL. 22:07.070 --> 22:09.430 Or you can run it using CobaltStrike. 22:10.130 --> 22:11.730 There's two components. 22:11.730 --> 22:17.410 For CobaltStrike, you get the exe file, and then you get the cmi, the CobaltStrike file. 22:17.570 --> 22:22.430 For the DLL, there's two options that you can do, depending on your target machine. 22:22.430 --> 22:27.450 You can use the 32-bit DLL or the 64-bit DLL. 22:27.450 --> 22:30.510 And then you will need to load it using rundll32. 22:30.510 --> 22:34.350 But I suspect you can use the other DLL loader. 22:34.990 --> 22:40.250 And it's exactly acting like PowerShell DLL mode. 22:40.250 --> 22:42.250 We get forward detection for this. 22:42.850 --> 22:48.270 Low hanging fruits, again, because it's written in C Sharp, based on .NET. 22:49.130 --> 22:55.710 Just look for a description product, just in case the user forget to change it. 22:55.910 --> 23:02.510 Because it is always true, true positive when this value showing up in your logs. 23:02.510 --> 23:04.310 This is not false negative. 23:04.310 --> 23:06.730 This is true positive always. 23:07.870 --> 23:15.350 So for the CobaltStrike mode detection, well, unfortunately, our team doesn't have access to CobaltStrike yet. 23:15.350 --> 23:20.790 If we can find some CobaltStrike people after this talk, maybe we can build detection on it. 23:21.370 --> 23:27.690 Yeah, but thanks to Olaf Hartog, we get detection. 23:27.690 --> 23:35.230 He created detection on this particular mode by using Event ID 8 from Sysmon. 23:35.230 --> 23:40.790 So you will see there the event description of create remote thread. 23:41.010 --> 23:44.130 The process name will contain PowerShell.exe. 23:44.130 --> 23:54.750 But the unique thing here, you will see that target process address will always end with 0B80, which is really unique. 23:55.730 --> 23:58.930 But there's more story if you read in the blog. 23:58.930 --> 24:06.210 There's some interaction between him and also the creator of the tools, and they made some changes, and then it's no longer the case. 24:06.210 --> 24:10.450 But still, if someone used the older version of the tools, they can still detect this. 24:11.410 --> 24:15.810 DLL modes, again, similar to PowerShell DLL, you need to watch the loaders. 24:15.810 --> 24:24.890 Whenever run DLL 32 is loading unsigned or not available signature DLLs, you create alert on that. 24:27.460 --> 24:30.700 And then the next one is .NET version downgrading. 24:30.700 --> 24:32.860 So this is actually happened by mistake. 24:32.860 --> 24:37.340 So I forget that this tool require a lower version of .NET. 24:37.580 --> 24:42.180 So I run it in the version 4 or 4.5, if I recall. 24:42.760 --> 24:45.560 And then it's just like, oh, I don't like this version. 24:45.560 --> 24:46.540 Can you bring it down? 24:46.540 --> 24:47.680 And it actually can. 24:47.680 --> 25:05.240 So it tries to call the Fondue.exe, which is, I think, an upgrade downgrade exe on the Windows server, and then ask them to enable feature the .NET FX3, which is the version for the 2.3.5. 25:05.480 --> 25:08.360 So you can watch that on SystemManager 91. 25:08.360 --> 25:15.980 But the thing is, legitimate application might do this, because, hey, who doesn't love doing backtrack using old application, right? 25:15.980 --> 25:18.240 So, yeah. 25:18.900 --> 25:22.240 Other than that, we got some bonus here. 25:22.740 --> 25:29.600 We got two tools that is pretty similar to PowerShell, or no PowerShell for the SharpQuick. 25:29.600 --> 25:31.480 So the first one will be PowerLine. 25:31.480 --> 25:36.760 It use MSBuild, really remind you to PowerShell, a lot of compilation stuff. 25:37.040 --> 25:51.140 And SharpQuick will be, this is actually a tool they use to demonstrate or test the blocking of PowerShell, and just to bypass AppLocker, because I don't think Red Teamers like AppLocker at all. 25:51.520 --> 25:57.400 Bonus detection IDS, Sysmon Event ID 10, process access. 25:57.400 --> 26:04.160 So any application that accessing PowerShell VLL, but not PowerShell, because you are not supposed to do that. 26:05.180 --> 26:07.800 Windows PowerShell Event ID 4103. 26:07.800 --> 26:09.560 So this is locked from PowerShell. 26:09.560 --> 26:14.860 But when the context application is not PowerShell, isn't it questionable? 26:15.480 --> 26:17.940 So yeah, I think we should be watching for that also. 26:18.080 --> 26:23.340 And lastly, you can use ETW for .NET library tools. 26:23.340 --> 26:30.180 So you can analyze this information using Message Analyzer and Lockman. 26:30.300 --> 26:32.900 But I think there's also some tools out there. 26:32.900 --> 26:36.020 I think Splunk have like a converter for it. 26:36.320 --> 26:41.620 There is a sealed ETW, Roberto Rodriguez play with it a bit. 26:41.620 --> 26:46.820 There's a series of blog talking about analyzing more .NET blocks. 26:46.820 --> 26:49.200 So I think it will be interesting for you to try. 26:50.240 --> 26:53.480 Well, that's pretty much the talk. 26:54.320 --> 26:57.860 It's pretty much, yeah, it's a compressed version, as I mentioned. 26:57.860 --> 27:04.640 So if you'd like to know more, you can always go to my presentation previously on Hackfest. 27:04.980 --> 27:08.300 Just some messages for red team, blue team. 27:08.300 --> 27:10.120 So just do all of this stuff. 27:10.280 --> 27:14.460 Use PowerShell, update PowerShell over blue team, et cetera, et cetera. 27:14.640 --> 27:16.880 And lastly, of course, be nice to each other. 27:16.880 --> 27:19.340 If you're a purple team, you can take both sides. 27:20.280 --> 27:26.020 Yeah, at the end of the day, we need to be nice for each other because we are in the same boat. 27:26.020 --> 27:34.540 At the end of the day, we just want to be Megazord and protect our security company, not security company, our organization. 27:35.620 --> 27:41.000 We work together and then, yeah, we just upgrade our security posture. 27:42.080 --> 27:45.060 And all right, that's pretty much it. 27:45.260 --> 27:53.260 Don't forget to grab some Sigma rules on your way up because I made a lot of Sigma rules just for this presentation in the past week. 27:53.980 --> 28:01.080 I actually never wrote Sigma rules before, but I definitely know what is Sigma rules now. 28:01.080 --> 28:04.080 So make sure you grab that. 28:04.160 --> 28:12.280 You can convert the Sigma rules to any other same QRadar, Splunk, Elastic, ArcSight, whatever you want. 28:12.580 --> 28:17.780 You can use either Encoder.io or Sigmac, but I tested it on Encoder.io. 28:17.780 --> 28:22.560 So all the Sigma should be able to be converted to the other type. 28:22.560 --> 28:28.580 If you use Encoder.io, but Sigmac, it's also an option if you like to do like CLI kind of thing. 28:29.980 --> 28:38.540 So I'm so sorry that I didn't mention MatterAttack right from the start because I'm a threat hunter, but yeah, I need to mention that. 28:38.540 --> 28:45.560 All the rules, all 20 rules that I've made for the four tools are mapped to the closest attack TTPs. 28:45.580 --> 28:49.800 It is also using the newest version of the TTPs. 28:49.800 --> 28:50.940 They're using sub techniques. 28:51.300 --> 28:53.560 So I try my best to map it. 28:53.560 --> 28:55.060 So if it's not, it's not perfect. 28:55.060 --> 28:57.580 And if you want to change it for sure, you can do it. 28:58.260 --> 28:58.980 Yeah. 28:58.980 --> 29:08.900 So this is the slide that you want to take a picture of, that you want to scan, that you want to send it to your, I don't know, like subordinates. 29:09.260 --> 29:10.820 So yeah, make sure you grab it. 29:10.820 --> 29:12.080 It's going to take you through my GitHub. 29:15.780 --> 29:16.580 It's special. 29:16.580 --> 29:24.520 Thanks to my employer, of course, for supporting me to do this understanding, taking me, taking sometimes to do the research. 29:24.940 --> 29:33.720 ScoobyMTL, you should have attended his workshop earlier today in the bootcamp village because it is great. 29:33.800 --> 29:38.320 And also my friend Avneet, 13Avneet for inspiration, guide, and feedback. 29:38.320 --> 29:44.680 My coworkers at work literally making me understand PowerShell from zero to hero. 29:44.880 --> 29:45.840 And also .NET. 29:45.840 --> 29:47.780 I don't really like .NET. 29:47.780 --> 29:56.840 Amazing not PowerShell tools creators, like making us the blue teamers need to spin our head around, do a lot of research. 29:56.840 --> 30:03.380 And lastly, not lastly, in Fawcett community, Olaf Hartongs for the detection, and he will be speaking later tonight. 30:03.380 --> 30:05.260 So make sure you check that. 30:05.440 --> 30:12.280 Sigma team, because it's a really useful tool. 30:12.680 --> 30:26.140 And please, the last and not the least, DEF CON, thank you so much for accepting my talks, for the volunteers, for your time, and all the attendees for the talk right now. 30:26.140 --> 30:27.200 Thank you so much. 30:27.320 --> 30:30.540 If you'd like to connect with me and my team, you can. 30:30.540 --> 30:36.100 You can find me on Twitter, on GitHub, on LinkedIn, if you'd like to be more professional. 30:36.100 --> 30:43.000 Or you can check out a blog for my team, Threat Hunting Team on Medium, and Hunting Threat on Twitter. 30:43.000 --> 30:46.500 We posted stuff sometimes. 30:46.840 --> 30:54.260 And yeah, if you scan this barcode, it will take you to my GitHub page, pretty much where all my presentation is. 30:54.560 --> 30:56.860 So yeah, that's pretty much my presentation. 30:56.860 --> 30:57.980 Thank you so much. 30:59.200 --> 31:03.700 Thank you very much, Tez, for the wonderful presentation. 31:03.840 --> 31:14.740 As always, we encourage you guys to join our Blue Team Village Discord server and ask questions in text talk track one. 31:15.220 --> 31:26.240 And yeah, if there's no questions, which I do not see at the moment, I think we are set. 31:26.240 --> 31:31.600 And the presenter will be around for a little bit to answer questions, otherwise.