Isolating the Ghost in the Machine: Unveiling Post Exploitation Th...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Rotem Salinas
Isolating the Ghost in the Machine:
Unveiling Post Exploitation Threats
HTA-R11...

#RSAC
Houston We Have a Problem
2
Agentless/non malware attacks is a rapidly growing threat
Attackers are implementing ste...

#RSAC
Research Goals
3
Goals
Find a way to assess a script’s “maliciousness” automatically
Do it without the potential har...

#RSAC
The “Imaginary Engine”
4
How can we develop such 1337 imaginary engine
Problem solving in 3 basic steps
Analyze
Brai...

#RSAC
The First Step – Malware Analyst Standpoint
5
Determine
Execution
Flow
Deobfuscate
Find
Suspicious
Activity
Traditio...

#RSAC
Perception Test – What Attackers Do?
6

#RSAC
The First Step – Understanding The Attacker’s Mindset
7

#RSAC
The First Step – Understanding The Attacker’s Mindset
8

#RSAC
The First Step – The Attacker’s Main Objectives
9
Objectives Indicators
Code execution Prerequisite, Spawning New
Pr...

#RSAC
Case Study – Dridex Campaign
10
Peaked during 2015-2016
Used Macro in Office Documents to deploy Dridex variants
Tar...

#RSAC
Case Study – Dridex Campaign
11

#RSAC
Case Study 1 – Dridex Campaign
12
Entrypoint – This is where the code starts its execution
Non-Linear Code Execution...

#RSAC
Case Study 1 – Dridex Campaign
13
COM Object Creation

#RSAC
Case Study 1 – Dridex Campaign
14
URL De-Obfuscation + Http Request Creation

#RSAC
Case Study 1 – Dridex Campaign
15
Sending GET request
Initializing ADODB object to write file to disk

#RSAC
Case Study 1 – Dridex Campaign
16
Writing Response Body Data to disk

#RSAC
Case Study 1 – Dridex Campaign
17
Executing Downloaded File

#RSAC
Case Study – Anunak/Carbanak
18
Financial APT
Only 1 submission to VT
Attributed to Anunak Cybergang
Final payload
V...

#RSAC
The Second Step – Brainstorming
19
Common approaches pros and cons
Hooking
— Use available source code or patch exis...

#RSAC
We Have a Winner!
20
Symbolic Execution
Pros
— Cannot harm the machine in any way (even if we missed
something)
— We...

#RSAC
Symbolic Execution: Double Sweep Method
21
First sweep
Global context
— Global variables
— Code
Function declaration...

#RSAC
Symbolic Execution: Double Sweep Method
22
Second sweep
Function code - starts with Entrypoint
Follows execution flo...

#RSAC
Implementation Details
23
Python
PyParsing
Dave Beazley’s (Python guru) PLY – Python Lex Yacc
— Lex – lexical analys...

#RSAC
Lexical Analyzer (Tokenizer)
24
Tokens
Language keywords
Immediate values
— Strings
— Integer/numeric values
— Float...

#RSAC
Syntax Analyzer (Parser)
25
Parses a language syntax according to the tokenized output from the
lexer
The language s...

#RSAC
PLY Lex Example
26
* Diagram courtesy of David Beazley

#RSAC
PLY Lex Example
27
* Diagram courtesy of David Beazley

#RSAC
PLY Lex Example
28
* Diagram courtesy of David Beazley

#RSAC
PLY Lex Example
29
* Diagram courtesy of David Beazley

#RSAC
PLY Lex Example
30
* Diagram courtesy of David Beazley

#RSAC
PLY Lex Example
31
* Diagram courtesy of David Beazley

#RSAC
PLY Lex Example
32
* Diagram courtesy of David Beazley

#RSAC
PLY Lex Example
33
* Diagram courtesy of David Beazley

#RSAC
Tokenizer Demo
34

#RSAC
PLY Yacc Example
35
* Diagram courtesy of David Beazley

#RSAC
PLY Yacc Example
36
* Diagram courtesy of David Beazley

#RSAC
PLY Yacc Example
37
* Diagram courtesy of David Beazley

#RSAC
PLY Yacc Example
38
* Diagram courtesy of David Beazley

#RSAC
PLY Yacc Example
39
* Diagram courtesy of David Beazley

#RSAC
Engine Design Overview
40
Scoring
Blacklist (score++)
Whitelist (score--)
A higher score -> more malicious
If score ...

#RSAC
Obfuscation As Heuristics
41
Obfuscation can be a strong indicator for malicious behavior
Examples
Object returned f...

#RSAC
Obfuscation As Heuristics – More Examples
42
More Examples
Self modifying code (during runtime)
Data read from contr...

#RSAC
Demo The Engine
43

#RSAC
The Age Old Question of FP vs. FN
44
False positives
False negatives
Decide what works best for you!

#RSAC
Lessons Learned
45
Challenges
Condition evaluation
Recursion limit
Lessons
When in doubt bruteforce!
Use the languag...

#RSAC
Apply
46
DIY 1: Develop It Yourself
DIY 2: Deploy In Your Organization
Network
Endpoint
Use for your investigations

#RSAC
Q&A
Rotem Salinas Uri Fleyder-Kotler
 Uri.Fleyder@rsa.com
 @ufleyder
 Rotem.Salinas@rsa.com
 @rotemsalinas

#RSAC
VBA Indicators of Suspicious Activity
48
File System Operations
COM Objects: Scripting.FileSystemObject, ADODB.Strea...

#RSAC
VBA Indicators of Suspicious Activity
49
Enumeration
WMI Objects
Cmd – net share/net use/ipconfig/environment variab...

#RSAC
VBA Indicators of Suspicious Activity
50
COM Object Creation
WMI Objects Creation
Self Modifying Code
Eval
CodeModul...

#RSAC
VBA – COM Object Creation – Network Activity
51
Rule of thumb - If your Office Documents are communicating you are
i...

#RSAC
VBA – COM Object Creation – Network Activity
52
Microsoft.XMLHTTP
WinHttp.WinHttpRequest.5.1

#RSAC
VBA – COM Object Creation – File System Activity
53
Scripting.FileSystemObject
ADODB.Stream

#RSAC
VBA – COM Object Creation – Command Execution
54
WScript.Shell
Shell.Application

#RSAC
VBA – COM Object Creation – Obfuscation
55
XStandard.Base64
MSXML2.DOMDocument.3.0
MSXML2.DOMDocument

#RSAC
VBA – Built-In Functions
56
CreateObject – Create COM object by String Object Name
GetObject – Create WMI/COM object...

#RSAC
VBA – WMI Object Creation
57
winmgmts:impersonationLevel=impersonate}!.rootcimv2
Examples
.
.

#RSAC
VBA – Self-Modifying Code – Code Module
58
CodeModule – Allows modifications of the VBA code

#RSAC
VBA – Self-Modifying Code – Eval
59
Eval - Evaluates an expression and executes it code
ExecuteGlobal

#RSAC
VBA – Open Built-In Function
60
Write to File with Open Built-In Function

#RSAC
VBA – Importing External DLL
61
Win32 API
Examples
.
.

#RSAC
Appendix – Case Study 1 A - Dridex
62
Entrypoint – This is where the code starts its execution
Non-Linear Code Execu...

#RSAC
Appendix – Case Study 1 A - Dridex
63
COM Object Creation

#RSAC
Appendix – Case Study 1 A - Dridex
64
URL De-Obfuscation + Http Request Creation

#RSAC
Appendix – Case Study 1 A - Dridex
65
Sending GET request
Initializing ADODB object to write file to disk

#RSAC
Appendix – Case Study 1 A - Dridex
66
Writing Response Body Data to disk

#RSAC
Appendix – Case Study 1 A - Dridex
67
Executing Downloaded File

#RSAC
Appendix – Case Study 1 B - Dridex
68
Defining Globals
Entrypoint

#RSAC
Appendix – Case Study 1 B - Dridex
69
Create obfuscated COM object

#RSAC
Appendix – Case Study 1 B - Dridex
70
Create more obfuscated COM objects

#RSAC
Appendix – Case Study 1 B - Dridex
71
Deobfuscate URL and create GET request

#RSAC
Appendix – Case Study 1 B - Dridex
72
Send GET request

#RSAC
Appendix – Case Study 1 B - Dridex
73
Receive Response Body and write to File

#RSAC
Appendix – Case Study 1 B - Dridex
74
Save To Disk
Execution

#RSAC
Appendix – Case Study 2 - Ananuk
75
Entrypoint
De-obfuscate

#RSAC
Appendix – Case Study 2 - Ananuk
76
Beacon and Deploy final Payload
De-Obfuscate

#RSAC
Appendix – Case Study 2 - Ananuk
77
Beacon Command & Control – Phase 1
Deobfuscate

#RSAC
Appendix – Case Study 2 - Ananuk
78
Beacon Command & Control – Phase 2
Deobfuscate

#RSAC
Appendix – Case Study 2 - Ananuk
79
Deploy Base64 Payload
Write Base64 Decoded Payload
to Temp Path
Execute Payload

#RSAC
Appendix – Case Study 2 - Ananuk
80
Analyzing Payload 1
Payload is an icon
Used for credibility
Attempts to gain per...

#RSAC
Appendix – Powershell Indicators of Suspicious Activity
81
.NET Objects
.NET Reflection
Add-Type
New-Object
WinAPI32...

#RSAC
Appendix – Powershell Obfuscation
82
Obfuscation Methods
Base64
SecureString
Custom Decoding Methods

#RSAC
Powershell Techniques - .NET Reflection
83
Example 1 – LoadWithPartialName
Example 2 - LoadName

#RSAC
Powershell Techniques - Add-Type .NET code injection
84
Creation of a new type/class using .NET code
Creating an ins...

#RSAC
Powershell Techniques – New-Object
85
Creating an object instance
In this example System.Net.WebClient instance is c...

#RSAC
Powershell Techniques - Invoke-WmiMethod
86
Using WMI for enumeration and system maniupulation
In this case creating...

#RSAC
Powershell Techniques - DLL loading
87
Resolving Native Win32 API functions
$module = “kernel32.dll”
API Function to...

#RSAC
Powershell Techniques - New-Object -com
88
Similarly to the COM objects in VBA
The same COM objects can be used in P...

#RSAC
Powershell Techniques Obfuscation
89
Obfuscation methods in Powershell
Adding Ticks (Escapes special characters but ...

#RSAC
Powershell Techniques Obfuscation - Base64
90
Base64 using .NET classes
CertUtil
By Executing the certutil tool as a...

#RSAC
Case Study 3 – Targeted Spear Phishing Campaign
91
Javascript outer script with obfuscated strings
Base64 encoded pa...

#RSAC
Case Study 3 – Targeted Spear Phishing Campaign
92
Deploys 3 Powershell scripts on the victims machine
Payload 1 – ....

#RSAC
Case Study 3 – Targeted Spear Phishing Campaign
93
Payload 2 – .NET code injection using Add-Type like the 1st paylo...

#RSAC
Case Study 3 – Targeted Spear Phishing Campaign
94
Payload 3 – Downloads TOR Proxifier as scheduled task

#RSAC
Case Study 4 – Powersploit + Invoke-Obfuscation
95
Open source project available on GitHub
PowerSploit includes capa...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 95 Ad

View on Slideshare

1 of 95 Ad