SlideShare a Scribd company logo

Fileless Malware Infections

•
•
Ramon
Ramon

Fileless malware infections are possible without dropping files by storing malicious code in non-file locations or executing it remotely from memory. A fileless pentest operation should aim to infect systems without files, install fileless backdoors, and achieve fileless persistence using small artifacts hidden in the registry, alternate data streams, environment variables or other unconventional locations. Real world examples of fileless malware include worms that spread entirely in memory as well as advanced persistent threats that used techniques like Windows Management Instrumentation events and process hollowing to avoid writing to disk.

Software
1 of 40
Download to read offline
FileLess Malware Infections Malware tricks for Pentesters Ramon Pinuaga Bsides Lisbon 2017
2 1) Presentation 2) Real world examples 3) Process • Infection • Persistence 4) Conclusions Index
PRESENTATION
4 • Pentester for many, many years. • Current position: Cybersecurity Audit Manager at PROSEGUR Spain. • I prefer the offensive side of security. Who are you?
5 • Malicious code that doesn't need to create or drop regular files on the system. • Move away from the traditional monolithic malware or pentesting framework. • For persistence we usually need to leave at least something on the system but we can hide it and make it very small. What is FileLess Malware?
7 • We have 2 main ways to achieve an infection without files: • Not using malware (or code) at all. E.G. planting a configuration only backdoor on a system. That way we don’t control the system all the time but we can access it later. • Using code that never touches disk. In his clear form. For persistence we always need a way to keep at least the first stage of the code on the system. FileLess or MalwareLess?
8 • Evading Antivirus detection: No file, No scan, No VirusTotal upload.  • Leaving a smaller forensic trail: Less artifacts. • Difficult environments (hard to upload things). • Helps in bypassing Application Whitelisting (SRP, Applocker, etc.) Why FileLess in pentesting?
10 • Long-term persistence. • Kernel-level access. • High level hiding. • Quickness and simplicity: Only userland, No rootkits, No NSA like implants. Pentest vs APT
DEMO: RDP + Sethc • Enable remote desktop • Hijack sethc.exe • Change RDP port • Open windows firewall
13 • Keeping all in memory. (Problem: no persistence) • Storing the code in non-file or non-regular storage (classics): • Outside the filesystem: UEFI, HDD Firmware, Hidden disk areas, $EA, etc. (We are not going that far, remember; only userland) • Network / External systems. • Alternate Data Streams (ADS). • Registry. How to keep code without files?
14 • WMI (subscriptions). • Windows events (.evt). • Inside Documents (.doc, .xls, .pdf). • File/Directory names (0-day). • Environment variables (more 0-day). Novel non-regular storage
DEMO: Code in filenames • Stage 1: Run key • Stage 2: Environment • Stage 3: Dir names
17 • Remote injection in memory -> Remote call or exploit. • Load of remote binaries (EXEs, DLLs) -> Via SMB, WebDAV, etc. • Scripting languages -> Loaded remotely or from the command line. • PowerShell (Powershell.exe) • Javascript/Vbscript (Cscript.exe, Wscript.exe, Mshta.exe, Rundll32.exe, Regsvr32.exe). • .Net assemblies (InstallUtil.exe, IEExec.exe, RegAsm.exe). How to execute code without files?
18 • Tools already installed on the system (no new files). • Tools that allow receiving external input (via command line or via the network). • Bonus: Tools signed by Microsoft. Our FileLess pentest framework
REAL WORLD EXAMPLES
20 • Worms (memory only): • Slammer. • Poweliks. • WMIGhost. • Empire. • Duqu 2.0 (Kaspersky). Real world examples
21 • Worm that infected thousands of computers and impacted general Internet traffic in some areas. • The worm exploited a buffer overflow vulnerability in Microsoft SQL Server resolution service (1434/UDP). • Only 376 bytes and fitted into a single UDP packet. Slammer (2003)
22 • Infection via Word macro (No FileLess). • Persistence via Autostart registry key (HKLMSoftwareMicrosoftWindowsCurrentVersion Run). • Minimal first stage: Uses clever rundll32 trick to run Javascript code. • Next stages also stored in the registry (encoded). Runs PowerShell code. • PowerShell injects a DLL in another process memory, without touching disk. Poweliks (2014)
23 Poweliks – Rundll32 trick
24 • Infection via Word macro. • Dropper and UAC bypass binaries touch disk (not fully FileLess). • Then it register the permanent and necessary WMI classes: event definition, event filter and event consumer. • It uses Javascript for payload code in the event consumer active script. WMIghost (2014)
25 • PowerShell based RAT. • It tries to be as FileLess as possible. • Mostly working from memory only. • Various options for persistent storage: Registry, ADS, Eventlog and of course WMI subscriptions. Empire (2015)
26 • Unknown infection vector. • Only a few selected hosts were used for on-disk persistence. • These hosts injected the malware remotely into other systems memory. • For this task the malware gained domain administrator privileges and then it deployed MSI packages (via a new service or a scheduled task). Duqu 2.0 (2015)
28 • First stage: Minimal. Usually a small vbs or js (not directly PowerShell). • Second Stage: Main script based on PowerShell. More complex and powerful logic that injects a binary into another process. • Third stage: Binary. Usually a PE DLL payload. More similar to traditional malware, but never touches disk. Common FileLess behavior
PROCESS
30 • An ideal FileLess pentest operation should cover the following phases: 1. FileLess Infection. 2. Installation of FileLess Backdoors. 3. Gain FileLess Persistence. Operation Process
31 • Infection without sending any files. • Not common. Even known FileLess APT operations use some kind of files in this stage. • Preferably, we need to deliver the exploit before the application layer. • Inside a stream. • At the lower network layers (e.g. SMB or SSL exploits). • Open network services (e.g. Eternalblue). FileLess Infection
32 • Configuration only backdoors (no code). • Some popular: • Create user + Remote exec (Psexec/Sc, WMI, SchTasks, WinRM, PSRemoting). • Binary Image Hijack + Remote Desktop. • Silver/Golden tickets. • Proxy + Decrease security. FileLess Backdoors
34 • First stage: Registry Autostart entries. • Run entries. • Scheduled tasks. • Image hijacks. • WMI. • Services (not very elegant). • Usually too noisy! For a human analyst but harder to detect with automated tools because we are not using any files. FileLess persistence
CONCLUSIONS
36 • Full pentest operations are possible without using any files (or almost). • We need some “resident” artifacts on the system, but these can be very small and can be easily hidden. Conclusions
37 • Questions? Comments? • https://twitter.com/rpinuaga Thanks
38 • A lot of ideas taken from: • Casey Smith: https://twitter.com/subtee • Didier Stevens: https://twitter.com/DidierStevens • Alex Abramov: https://twitter.com/codereversing • Rob Fuller: https://twitter.com/mubix • Cneelis: https://twitter.com/Cneelis • Matt Nelson: https://twitter.com/enigma0x3 • Matt Graeber: https://twitter.com/mattifestation • James Foreshaw - https://twitter.com/tiraniddo Previous research
www.prosegur.com
DEMO: Proxy + Authenticode • Convince the user to execute a .REG file • Configure Proxy • Disable Authenticode validation • Wait for EXE download

Recommended

The Rising Threat of Fileless Malware
The Rising Threat of Fileless MalwareThe Rising Threat of Fileless Malware
The Rising Threat of Fileless Malware
Chelsea Sisson
 
Fileless Malware [Cyber Security]
Fileless Malware [Cyber Security]Fileless Malware [Cyber Security]
Fileless Malware [Cyber Security]
sumit saurav
 
Understanding Fileless (or Non-Malware) Attacks and How to Stop Them
Understanding Fileless (or Non-Malware) Attacks and How to Stop ThemUnderstanding Fileless (or Non-Malware) Attacks and How to Stop Them
Understanding Fileless (or Non-Malware) Attacks and How to Stop Them
CrowdStrike
 
Catching fileless attacks
Catching fileless attacksCatching fileless attacks
Catching fileless attacks
Balaji Rajasekaran
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
Teymur Kheirkhabarov
 
What is keylogger
What is keyloggerWhat is keylogger
What is keylogger
hilarypark97
 
Brute force attack
Brute force attackBrute force attack
Brute force attackjoycruiser
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
GIBIN JOHN
 

Recommended

The Rising Threat of Fileless Malware
The Rising Threat of Fileless MalwareThe Rising Threat of Fileless Malware
The Rising Threat of Fileless Malware
Chelsea Sisson
 
Fileless Malware [Cyber Security]
Fileless Malware [Cyber Security]Fileless Malware [Cyber Security]
Fileless Malware [Cyber Security]
sumit saurav
 
Understanding Fileless (or Non-Malware) Attacks and How to Stop Them
Understanding Fileless (or Non-Malware) Attacks and How to Stop ThemUnderstanding Fileless (or Non-Malware) Attacks and How to Stop Them
Understanding Fileless (or Non-Malware) Attacks and How to Stop Them
CrowdStrike
 
Catching fileless attacks
Catching fileless attacksCatching fileless attacks
Catching fileless attacks
Balaji Rajasekaran
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
Teymur Kheirkhabarov
 
What is keylogger
What is keyloggerWhat is keylogger
What is keylogger
hilarypark97
 
Brute force attack
Brute force attackBrute force attack
Brute force attackjoycruiser
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
GIBIN JOHN
 
OWASP Top 10 2021 Presentation (Jul 2022)
OWASP Top 10 2021 Presentation (Jul 2022)OWASP Top 10 2021 Presentation (Jul 2022)
OWASP Top 10 2021 Presentation (Jul 2022)
TzahiArabov
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
Sergey Soldatov
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
Ben Boyd
 
Windows attacks - AT is the new black
Windows attacks - AT is the new blackWindows attacks - AT is the new black
Windows attacks - AT is the new black
Chris Gates
 
DDoS - Distributed Denial of Service
DDoS - Distributed Denial of ServiceDDoS - Distributed Denial of Service
DDoS - Distributed Denial of Service
Er. Shiva K. Shrestha
 
Living off the land and fileless attack techniques
Living off the land and fileless attack techniquesLiving off the land and fileless attack techniques
Living off the land and fileless attack techniques
Symantec Security Response
 
Web application security
Web application securityWeb application security
Web application security
Akhil Raj
 
Ethical hacking : Its methodologies and tools
Ethical hacking : Its methodologies and toolsEthical hacking : Its methodologies and tools
Ethical hacking : Its methodologies and tools
chrizjohn896
 
Detecting WMI Exploitation v1.1
Detecting WMI Exploitation v1.1Detecting WMI Exploitation v1.1
Detecting WMI Exploitation v1.1
Michael Gough
 
Metasploit seminar
Metasploit seminarMetasploit seminar
Metasploit seminar
henelpj
 
Ethical hacking
Ethical hackingEthical hacking
Ethical hacking
A Raheem Ansari
 
Password Cracking
Password Cracking Password Cracking
Password Cracking
Sina Manavi
 
Hunting fileless malware
Hunting fileless malwareHunting fileless malware
Hunting fileless malware
Olha Pasko
 
Windows privilege escalation by Dhruv Shah
Windows privilege escalation by Dhruv ShahWindows privilege escalation by Dhruv Shah
Windows privilege escalation by Dhruv Shah
OWASP Delhi
 
Malicious software and software security
Malicious software and software securityMalicious software and software security
Malicious software and software security
G Prachi
 
Password cracking and brute force
Password cracking and brute forcePassword cracking and brute force
Password cracking and brute force
vishalgohel12195
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
Andrew McNicol
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
Teymur Kheirkhabarov
 
Jhon the ripper
Jhon the ripper Jhon the ripper
Jhon the ripper
Merve Karabudağ
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
Sunny Neo
 
unit 2 confinement techniques.pdf
unit 2 confinement techniques.pdfunit 2 confinement techniques.pdf
unit 2 confinement techniques.pdf
RohitGautam261127
 
Botnets Attacks.pptx
Botnets Attacks.pptxBotnets Attacks.pptx
Botnets Attacks.pptx
MuhammadRehan856177
 

More Related Content

What's hot

OWASP Top 10 2021 Presentation (Jul 2022)
OWASP Top 10 2021 Presentation (Jul 2022)OWASP Top 10 2021 Presentation (Jul 2022)
OWASP Top 10 2021 Presentation (Jul 2022)
TzahiArabov
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
Sergey Soldatov
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
Ben Boyd
 
Windows attacks - AT is the new black
Windows attacks - AT is the new blackWindows attacks - AT is the new black
Windows attacks - AT is the new black
Chris Gates
 
DDoS - Distributed Denial of Service
DDoS - Distributed Denial of ServiceDDoS - Distributed Denial of Service
DDoS - Distributed Denial of Service
Er. Shiva K. Shrestha
 
Living off the land and fileless attack techniques
Living off the land and fileless attack techniquesLiving off the land and fileless attack techniques
Living off the land and fileless attack techniques
Symantec Security Response
 
Web application security
Web application securityWeb application security
Web application security
Akhil Raj
 
Ethical hacking : Its methodologies and tools
Ethical hacking : Its methodologies and toolsEthical hacking : Its methodologies and tools
Ethical hacking : Its methodologies and tools
chrizjohn896
 
Detecting WMI Exploitation v1.1
Detecting WMI Exploitation v1.1Detecting WMI Exploitation v1.1
Detecting WMI Exploitation v1.1
Michael Gough
 
Metasploit seminar
Metasploit seminarMetasploit seminar
Metasploit seminar
henelpj
 
Ethical hacking
Ethical hackingEthical hacking
Ethical hacking
A Raheem Ansari
 
Password Cracking
Password Cracking Password Cracking
Password Cracking
Sina Manavi
 
Hunting fileless malware
Hunting fileless malwareHunting fileless malware
Hunting fileless malware
Olha Pasko
 
Windows privilege escalation by Dhruv Shah
Windows privilege escalation by Dhruv ShahWindows privilege escalation by Dhruv Shah
Windows privilege escalation by Dhruv Shah
OWASP Delhi
 
Malicious software and software security
Malicious software and software securityMalicious software and software security
Malicious software and software security
G Prachi
 
Password cracking and brute force
Password cracking and brute forcePassword cracking and brute force
Password cracking and brute force
vishalgohel12195
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
Andrew McNicol
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
Teymur Kheirkhabarov
 
Jhon the ripper
Jhon the ripper Jhon the ripper
Jhon the ripper
Merve Karabudağ
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
Sunny Neo
 

What's hot (20)

OWASP Top 10 2021 Presentation (Jul 2022)
OWASP Top 10 2021 Presentation (Jul 2022)OWASP Top 10 2021 Presentation (Jul 2022)
OWASP Top 10 2021 Presentation (Jul 2022)
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
 
Windows attacks - AT is the new black
Windows attacks - AT is the new blackWindows attacks - AT is the new black
Windows attacks - AT is the new black
 
DDoS - Distributed Denial of Service
DDoS - Distributed Denial of ServiceDDoS - Distributed Denial of Service
DDoS - Distributed Denial of Service
 
Living off the land and fileless attack techniques
Living off the land and fileless attack techniquesLiving off the land and fileless attack techniques
Living off the land and fileless attack techniques
 
Web application security
Web application securityWeb application security
Web application security
 
Ethical hacking : Its methodologies and tools
Ethical hacking : Its methodologies and toolsEthical hacking : Its methodologies and tools
Ethical hacking : Its methodologies and tools
 
Detecting WMI Exploitation v1.1
Detecting WMI Exploitation v1.1Detecting WMI Exploitation v1.1
Detecting WMI Exploitation v1.1
 
Metasploit seminar
Metasploit seminarMetasploit seminar
Metasploit seminar
 
Ethical hacking
Ethical hackingEthical hacking
Ethical hacking
 
Password Cracking
Password Cracking Password Cracking
Password Cracking
 
Hunting fileless malware
Hunting fileless malwareHunting fileless malware
Hunting fileless malware
 
Windows privilege escalation by Dhruv Shah
Windows privilege escalation by Dhruv ShahWindows privilege escalation by Dhruv Shah
Windows privilege escalation by Dhruv Shah
 
Malicious software and software security
Malicious software and software securityMalicious software and software security
Malicious software and software security
 
Password cracking and brute force
Password cracking and brute forcePassword cracking and brute force
Password cracking and brute force
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
 
Jhon the ripper
Jhon the ripper Jhon the ripper
Jhon the ripper
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
 

Similar to Fileless Malware Infections

unit 2 confinement techniques.pdf
unit 2 confinement techniques.pdfunit 2 confinement techniques.pdf
unit 2 confinement techniques.pdf
RohitGautam261127
 
Botnets Attacks.pptx
Botnets Attacks.pptxBotnets Attacks.pptx
Botnets Attacks.pptx
MuhammadRehan856177
 
On non existent 0-days, stable binary exploits and
On non existent 0-days, stable binary exploits andOn non existent 0-days, stable binary exploits and
On non existent 0-days, stable binary exploits and
Alisa Esage Шевченко
 
Esage on non-existent 0-days, stable binary exploits and user interaction
Esage on non-existent 0-days, stable binary exploits and user interactionEsage on non-existent 0-days, stable binary exploits and user interaction
Esage on non-existent 0-days, stable binary exploits and user interactionDefconRussia
 
Lecture 12 malicious software
Lecture 12 malicious software Lecture 12 malicious software
Lecture 12 malicious software
rajakhurram
 
CNIT 126 Ch 11: Malware Behavior
CNIT 126 Ch 11: Malware BehaviorCNIT 126 Ch 11: Malware Behavior
CNIT 126 Ch 11: Malware Behavior
Sam Bowne
 
Dealing with legacy code
Dealing with legacy codeDealing with legacy code
Dealing with legacy code
G Prachi
 
CISSP Week 14
CISSP Week 14CISSP Week 14
CISSP Week 14jemtallon
 
Project Malware AnalysisCS 6262 Project 3Agenda.docx
Project Malware AnalysisCS 6262 Project 3Agenda.docxProject Malware AnalysisCS 6262 Project 3Agenda.docx
Project Malware AnalysisCS 6262 Project 3Agenda.docx
briancrawford30935
 
CNIT 126 11. Malware Behavior
CNIT 126 11. Malware BehaviorCNIT 126 11. Malware Behavior
CNIT 126 11. Malware Behavior
Sam Bowne
 
Piratng Avs to bypass exploit mitigation
Piratng Avs to bypass exploit mitigationPiratng Avs to bypass exploit mitigation
Piratng Avs to bypass exploit mitigation
Priyanka Aash
 
Captain Hook: Pirating AVs to Bypass Exploit Mitigations
Captain Hook: Pirating AVs to Bypass Exploit MitigationsCaptain Hook: Pirating AVs to Bypass Exploit Mitigations
Captain Hook: Pirating AVs to Bypass Exploit Mitigations
enSilo
 
Hacking Highly Secured Enterprise Environments by Zoltan Balazs
Hacking Highly Secured Enterprise Environments by Zoltan BalazsHacking Highly Secured Enterprise Environments by Zoltan Balazs
Hacking Highly Secured Enterprise Environments by Zoltan Balazs
Shakacon
 
Threats, Vulnerabilities & Security measures in Linux
Threats, Vulnerabilities & Security measures in LinuxThreats, Vulnerabilities & Security measures in Linux
Threats, Vulnerabilities & Security measures in Linux
Amitesh Bharti
 
Practical Malware Analysis: Ch 11: Malware Behavior
Practical Malware Analysis: Ch 11: Malware BehaviorPractical Malware Analysis: Ch 11: Malware Behavior
Practical Malware Analysis: Ch 11: Malware Behavior
Sam Bowne
 
Building next gen malware behavioural analysis environment
Building next gen malware behavioural analysis environment Building next gen malware behavioural analysis environment
Building next gen malware behavioural analysis environment
isc2-hellenic
 
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
midnite_runr
 

Similar to Fileless Malware Infections (20)

unit 2 confinement techniques.pdf
unit 2 confinement techniques.pdfunit 2 confinement techniques.pdf
unit 2 confinement techniques.pdf
 
Botnets Attacks.pptx
Botnets Attacks.pptxBotnets Attacks.pptx
Botnets Attacks.pptx
 
Dll injection
Dll injectionDll injection
Dll injection
 
On non existent 0-days, stable binary exploits and
On non existent 0-days, stable binary exploits andOn non existent 0-days, stable binary exploits and
On non existent 0-days, stable binary exploits and
 
Esage on non-existent 0-days, stable binary exploits and user interaction
Esage on non-existent 0-days, stable binary exploits and user interactionEsage on non-existent 0-days, stable binary exploits and user interaction
Esage on non-existent 0-days, stable binary exploits and user interaction
 
Spo2 t19 spo2-t19
Spo2 t19 spo2-t19Spo2 t19 spo2-t19
Spo2 t19 spo2-t19
 
Lecture 12 malicious software
Lecture 12 malicious software Lecture 12 malicious software
Lecture 12 malicious software
 
CNIT 126 Ch 11: Malware Behavior
CNIT 126 Ch 11: Malware BehaviorCNIT 126 Ch 11: Malware Behavior
CNIT 126 Ch 11: Malware Behavior
 
Dealing with legacy code
Dealing with legacy codeDealing with legacy code
Dealing with legacy code
 
CISSP Week 14
CISSP Week 14CISSP Week 14
CISSP Week 14
 
Project Malware AnalysisCS 6262 Project 3Agenda.docx
Project Malware AnalysisCS 6262 Project 3Agenda.docxProject Malware AnalysisCS 6262 Project 3Agenda.docx
Project Malware AnalysisCS 6262 Project 3Agenda.docx
 
CNIT 126 11. Malware Behavior
CNIT 126 11. Malware BehaviorCNIT 126 11. Malware Behavior
CNIT 126 11. Malware Behavior
 
Piratng Avs to bypass exploit mitigation
Piratng Avs to bypass exploit mitigationPiratng Avs to bypass exploit mitigation
Piratng Avs to bypass exploit mitigation
 
Captain Hook: Pirating AVs to Bypass Exploit Mitigations
Captain Hook: Pirating AVs to Bypass Exploit MitigationsCaptain Hook: Pirating AVs to Bypass Exploit Mitigations
Captain Hook: Pirating AVs to Bypass Exploit Mitigations
 
Hacking Highly Secured Enterprise Environments by Zoltan Balazs
Hacking Highly Secured Enterprise Environments by Zoltan BalazsHacking Highly Secured Enterprise Environments by Zoltan Balazs
Hacking Highly Secured Enterprise Environments by Zoltan Balazs
 
Threats, Vulnerabilities & Security measures in Linux
Threats, Vulnerabilities & Security measures in LinuxThreats, Vulnerabilities & Security measures in Linux
Threats, Vulnerabilities & Security measures in Linux
 
Practical Malware Analysis: Ch 11: Malware Behavior
Practical Malware Analysis: Ch 11: Malware BehaviorPractical Malware Analysis: Ch 11: Malware Behavior
Practical Malware Analysis: Ch 11: Malware Behavior
 
Isys20261 lecture 05
Isys20261 lecture 05Isys20261 lecture 05
Isys20261 lecture 05
 
Building next gen malware behavioural analysis environment
Building next gen malware behavioural analysis environment Building next gen malware behavioural analysis environment
Building next gen malware behavioural analysis environment
 
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
 

Recently uploaded

Field Employee Tracking System| MiTrack App| Best Employee Tracking Solution|...
Field Employee Tracking System| MiTrack App| Best Employee Tracking Solution|...Field Employee Tracking System| MiTrack App| Best Employee Tracking Solution|...
Field Employee Tracking System| MiTrack App| Best Employee Tracking Solution|...
informapgpstrackings
 
A Sighting of filterA in Typelevel Rite of Passage
A Sighting of filterA in Typelevel Rite of PassageA Sighting of filterA in Typelevel Rite of Passage
A Sighting of filterA in Typelevel Rite of Passage
Philip Schwarz
 
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoamOpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
takuyayamamoto1800
 
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Anthony Dahanne
 
Cracking the code review at SpringIO 2024
Cracking the code review at SpringIO 2024Cracking the code review at SpringIO 2024
Cracking the code review at SpringIO 2024
Paco van Beckhoven
 
Globus Compute Introduction - GlobusWorld 2024
Globus Compute Introduction - GlobusWorld 2024Globus Compute Introduction - GlobusWorld 2024
Globus Compute Introduction - GlobusWorld 2024
Globus
 
Into the Box 2024 - Keynote Day 2 Slides.pdf
Into the Box 2024 - Keynote Day 2 Slides.pdfInto the Box 2024 - Keynote Day 2 Slides.pdf
Into the Box 2024 - Keynote Day 2 Slides.pdf
Ortus Solutions, Corp
 
SOCRadar Research Team: Latest Activities of IntelBroker
SOCRadar Research Team: Latest Activities of IntelBrokerSOCRadar Research Team: Latest Activities of IntelBroker
SOCRadar Research Team: Latest Activities of IntelBroker
SOCRadar
 
May Marketo Masterclass, London MUG May 22 2024.pdf
May Marketo Masterclass, London MUG May 22 2024.pdfMay Marketo Masterclass, London MUG May 22 2024.pdf
May Marketo Masterclass, London MUG May 22 2024.pdf
Adele Miller
 
Quarkus Hidden and Forbidden Extensions
Quarkus Hidden and Forbidden ExtensionsQuarkus Hidden and Forbidden Extensions
Quarkus Hidden and Forbidden Extensions
Max Andersen
 
Globus Compute wth IRI Workflows - GlobusWorld 2024
Globus Compute wth IRI Workflows - GlobusWorld 2024Globus Compute wth IRI Workflows - GlobusWorld 2024
Globus Compute wth IRI Workflows - GlobusWorld 2024
Globus
 
Lecture 1 Introduction to games development
Lecture 1 Introduction to games developmentLecture 1 Introduction to games development
Lecture 1 Introduction to games development
abdulrafaychaudhry
 
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...
Juraj Vysvader
 
TROUBLESHOOTING 9 TYPES OF OUTOFMEMORYERROR
TROUBLESHOOTING 9 TYPES OF OUTOFMEMORYERRORTROUBLESHOOTING 9 TYPES OF OUTOFMEMORYERROR
TROUBLESHOOTING 9 TYPES OF OUTOFMEMORYERROR
Tier1 app
 
AI Pilot Review: The World’s First Virtual Assistant Marketing Suite
AI Pilot Review: The World’s First Virtual Assistant Marketing SuiteAI Pilot Review: The World’s First Virtual Assistant Marketing Suite
AI Pilot Review: The World’s First Virtual Assistant Marketing Suite
Google
 
Large Language Models and the End of Programming
Large Language Models and the End of ProgrammingLarge Language Models and the End of Programming
Large Language Models and the End of Programming
Matt Welsh
 
How to Position Your Globus Data Portal for Success Ten Good Practices
How to Position Your Globus Data Portal for Success Ten Good PracticesHow to Position Your Globus Data Portal for Success Ten Good Practices
How to Position Your Globus Data Portal for Success Ten Good Practices
Globus
 
Custom Healthcare Software for Managing Chronic Conditions and Remote Patient...
Custom Healthcare Software for Managing Chronic Conditions and Remote Patient...Custom Healthcare Software for Managing Chronic Conditions and Remote Patient...
Custom Healthcare Software for Managing Chronic Conditions and Remote Patient...
Mind IT Systems
 
Globus Connect Server Deep Dive - GlobusWorld 2024
Globus Connect Server Deep Dive - GlobusWorld 2024Globus Connect Server Deep Dive - GlobusWorld 2024
Globus Connect Server Deep Dive - GlobusWorld 2024
Globus
 
Vitthal Shirke Microservices Resume Montevideo
Vitthal Shirke Microservices Resume MontevideoVitthal Shirke Microservices Resume Montevideo
Vitthal Shirke Microservices Resume Montevideo
Vitthal Shirke
 

Recently uploaded (20)

Field Employee Tracking System| MiTrack App| Best Employee Tracking Solution|...
Field Employee Tracking System| MiTrack App| Best Employee Tracking Solution|...Field Employee Tracking System| MiTrack App| Best Employee Tracking Solution|...
Field Employee Tracking System| MiTrack App| Best Employee Tracking Solution|...
 
A Sighting of filterA in Typelevel Rite of Passage
A Sighting of filterA in Typelevel Rite of PassageA Sighting of filterA in Typelevel Rite of Passage
A Sighting of filterA in Typelevel Rite of Passage
 
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoamOpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
 
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
 
Cracking the code review at SpringIO 2024
Cracking the code review at SpringIO 2024Cracking the code review at SpringIO 2024
Cracking the code review at SpringIO 2024
 
Globus Compute Introduction - GlobusWorld 2024
Globus Compute Introduction - GlobusWorld 2024Globus Compute Introduction - GlobusWorld 2024
Globus Compute Introduction - GlobusWorld 2024
 
Into the Box 2024 - Keynote Day 2 Slides.pdf
Into the Box 2024 - Keynote Day 2 Slides.pdfInto the Box 2024 - Keynote Day 2 Slides.pdf
Into the Box 2024 - Keynote Day 2 Slides.pdf
 
SOCRadar Research Team: Latest Activities of IntelBroker
SOCRadar Research Team: Latest Activities of IntelBrokerSOCRadar Research Team: Latest Activities of IntelBroker
SOCRadar Research Team: Latest Activities of IntelBroker
 
May Marketo Masterclass, London MUG May 22 2024.pdf
May Marketo Masterclass, London MUG May 22 2024.pdfMay Marketo Masterclass, London MUG May 22 2024.pdf
May Marketo Masterclass, London MUG May 22 2024.pdf
 
Quarkus Hidden and Forbidden Extensions
Quarkus Hidden and Forbidden ExtensionsQuarkus Hidden and Forbidden Extensions
Quarkus Hidden and Forbidden Extensions
 
Globus Compute wth IRI Workflows - GlobusWorld 2024
Globus Compute wth IRI Workflows - GlobusWorld 2024Globus Compute wth IRI Workflows - GlobusWorld 2024
Globus Compute wth IRI Workflows - GlobusWorld 2024
 
Lecture 1 Introduction to games development
Lecture 1 Introduction to games developmentLecture 1 Introduction to games development
Lecture 1 Introduction to games development
 
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...
 
TROUBLESHOOTING 9 TYPES OF OUTOFMEMORYERROR
TROUBLESHOOTING 9 TYPES OF OUTOFMEMORYERRORTROUBLESHOOTING 9 TYPES OF OUTOFMEMORYERROR
TROUBLESHOOTING 9 TYPES OF OUTOFMEMORYERROR
 
AI Pilot Review: The World’s First Virtual Assistant Marketing Suite
AI Pilot Review: The World’s First Virtual Assistant Marketing SuiteAI Pilot Review: The World’s First Virtual Assistant Marketing Suite
AI Pilot Review: The World’s First Virtual Assistant Marketing Suite
 
Large Language Models and the End of Programming
Large Language Models and the End of ProgrammingLarge Language Models and the End of Programming
Large Language Models and the End of Programming
 
How to Position Your Globus Data Portal for Success Ten Good Practices
How to Position Your Globus Data Portal for Success Ten Good PracticesHow to Position Your Globus Data Portal for Success Ten Good Practices
How to Position Your Globus Data Portal for Success Ten Good Practices
 
Custom Healthcare Software for Managing Chronic Conditions and Remote Patient...
Custom Healthcare Software for Managing Chronic Conditions and Remote Patient...Custom Healthcare Software for Managing Chronic Conditions and Remote Patient...
Custom Healthcare Software for Managing Chronic Conditions and Remote Patient...
 
Globus Connect Server Deep Dive - GlobusWorld 2024
Globus Connect Server Deep Dive - GlobusWorld 2024Globus Connect Server Deep Dive - GlobusWorld 2024
Globus Connect Server Deep Dive - GlobusWorld 2024
 
Vitthal Shirke Microservices Resume Montevideo
Vitthal Shirke Microservices Resume MontevideoVitthal Shirke Microservices Resume Montevideo
Vitthal Shirke Microservices Resume Montevideo
 

Fileless Malware Infections

  • 1. FileLess Malware Infections Malware tricks for Pentesters Ramon Pinuaga Bsides Lisbon 2017
  • 2. 2 1) Presentation 2) Real world examples 3) Process • Infection • Persistence 4) Conclusions Index
  • 4. 4 • Pentester for many, many years. • Current position: Cybersecurity Audit Manager at PROSEGUR Spain. • I prefer the offensive side of security. Who are you?
  • 5. 5 • Malicious code that doesn't need to create or drop regular files on the system. • Move away from the traditional monolithic malware or pentesting framework. • For persistence we usually need to leave at least something on the system but we can hide it and make it very small. What is FileLess Malware?
  • 6.
  • 7. 7 • We have 2 main ways to achieve an infection without files: • Not using malware (or code) at all. E.G. planting a configuration only backdoor on a system. That way we don’t control the system all the time but we can access it later. • Using code that never touches disk. In his clear form. For persistence we always need a way to keep at least the first stage of the code on the system. FileLess or MalwareLess?
  • 8. 8 • Evading Antivirus detection: No file, No scan, No VirusTotal upload.  • Leaving a smaller forensic trail: Less artifacts. • Difficult environments (hard to upload things). • Helps in bypassing Application Whitelisting (SRP, Applocker, etc.) Why FileLess in pentesting?
  • 9.
  • 10. 10 • Long-term persistence. • Kernel-level access. • High level hiding. • Quickness and simplicity: Only userland, No rootkits, No NSA like implants. Pentest vs APT
  • 11. DEMO: RDP + Sethc • Enable remote desktop • Hijack sethc.exe • Change RDP port • Open windows firewall
  • 12.
  • 13. 13 • Keeping all in memory. (Problem: no persistence) • Storing the code in non-file or non-regular storage (classics): • Outside the filesystem: UEFI, HDD Firmware, Hidden disk areas, $EA, etc. (We are not going that far, remember; only userland) • Network / External systems. • Alternate Data Streams (ADS). • Registry. How to keep code without files?
  • 14. 14 • WMI (subscriptions). • Windows events (.evt). • Inside Documents (.doc, .xls, .pdf). • File/Directory names (0-day). • Environment variables (more 0-day). Novel non-regular storage
  • 15. DEMO: Code in filenames • Stage 1: Run key • Stage 2: Environment • Stage 3: Dir names
  • 16.
  • 17. 17 • Remote injection in memory -> Remote call or exploit. • Load of remote binaries (EXEs, DLLs) -> Via SMB, WebDAV, etc. • Scripting languages -> Loaded remotely or from the command line. • PowerShell (Powershell.exe) • Javascript/Vbscript (Cscript.exe, Wscript.exe, Mshta.exe, Rundll32.exe, Regsvr32.exe). • .Net assemblies (InstallUtil.exe, IEExec.exe, RegAsm.exe). How to execute code without files?
  • 18. 18 • Tools already installed on the system (no new files). • Tools that allow receiving external input (via command line or via the network). • Bonus: Tools signed by Microsoft. Our FileLess pentest framework
  • 20. 20 • Worms (memory only): • Slammer. • Poweliks. • WMIGhost. • Empire. • Duqu 2.0 (Kaspersky). Real world examples
  • 21. 21 • Worm that infected thousands of computers and impacted general Internet traffic in some areas. • The worm exploited a buffer overflow vulnerability in Microsoft SQL Server resolution service (1434/UDP). • Only 376 bytes and fitted into a single UDP packet. Slammer (2003)
  • 22. 22 • Infection via Word macro (No FileLess). • Persistence via Autostart registry key (HKLMSoftwareMicrosoftWindowsCurrentVersion Run). • Minimal first stage: Uses clever rundll32 trick to run Javascript code. • Next stages also stored in the registry (encoded). Runs PowerShell code. • PowerShell injects a DLL in another process memory, without touching disk. Poweliks (2014)
  • 24. 24 • Infection via Word macro. • Dropper and UAC bypass binaries touch disk (not fully FileLess). • Then it register the permanent and necessary WMI classes: event definition, event filter and event consumer. • It uses Javascript for payload code in the event consumer active script. WMIghost (2014)
  • 25. 25 • PowerShell based RAT. • It tries to be as FileLess as possible. • Mostly working from memory only. • Various options for persistent storage: Registry, ADS, Eventlog and of course WMI subscriptions. Empire (2015)
  • 26. 26 • Unknown infection vector. • Only a few selected hosts were used for on-disk persistence. • These hosts injected the malware remotely into other systems memory. • For this task the malware gained domain administrator privileges and then it deployed MSI packages (via a new service or a scheduled task). Duqu 2.0 (2015)
  • 27.
  • 28. 28 • First stage: Minimal. Usually a small vbs or js (not directly PowerShell). • Second Stage: Main script based on PowerShell. More complex and powerful logic that injects a binary into another process. • Third stage: Binary. Usually a PE DLL payload. More similar to traditional malware, but never touches disk. Common FileLess behavior
  • 30. 30 • An ideal FileLess pentest operation should cover the following phases: 1. FileLess Infection. 2. Installation of FileLess Backdoors. 3. Gain FileLess Persistence. Operation Process
  • 31. 31 • Infection without sending any files. • Not common. Even known FileLess APT operations use some kind of files in this stage. • Preferably, we need to deliver the exploit before the application layer. • Inside a stream. • At the lower network layers (e.g. SMB or SSL exploits). • Open network services (e.g. Eternalblue). FileLess Infection
  • 32. 32 • Configuration only backdoors (no code). • Some popular: • Create user + Remote exec (Psexec/Sc, WMI, SchTasks, WinRM, PSRemoting). • Binary Image Hijack + Remote Desktop. • Silver/Golden tickets. • Proxy + Decrease security. FileLess Backdoors
  • 33.
  • 34. 34 • First stage: Registry Autostart entries. • Run entries. • Scheduled tasks. • Image hijacks. • WMI. • Services (not very elegant). • Usually too noisy! For a human analyst but harder to detect with automated tools because we are not using any files. FileLess persistence
  • 36. 36 • Full pentest operations are possible without using any files (or almost). • We need some “resident” artifacts on the system, but these can be very small and can be easily hidden. Conclusions
  • 37. 37 • Questions? Comments? • https://twitter.com/rpinuaga Thanks
  • 38. 38 • A lot of ideas taken from: • Casey Smith: https://twitter.com/subtee • Didier Stevens: https://twitter.com/DidierStevens • Alex Abramov: https://twitter.com/codereversing • Rob Fuller: https://twitter.com/mubix • Cneelis: https://twitter.com/Cneelis • Matt Nelson: https://twitter.com/enigma0x3 • Matt Graeber: https://twitter.com/mattifestation • James Foreshaw - https://twitter.com/tiraniddo Previous research
  • 40. DEMO: Proxy + Authenticode • Convince the user to execute a .REG file • Configure Proxy • Disable Authenticode validation • Wait for EXE download