![PROCESS ARGUMENT SPOOFING
typedef struct _RTL_USER_PROCESS_PARAMETERS {
BYTE Reserved1[16];
PVOID Reserved2[10];
UNICODE_STRING ImagePathName;
UNICODE_STRING CommandLine;
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;](https://image.slidesharecdn.com/hd-190505181422/85/Next-Generation-War-EDR-vs-RED-TEAM-14-320.jpg)
Uploaded byBGA Cyber Security
Next Generation War: EDR vs RED TEAM
This document discusses endpoint detection and response (EDR) solutions and how red teams can evade them. It provides an introduction to EDR, explaining that EDR solutions monitor endpoints for threats by collecting behavioral data using installed agents. It then discusses why EDR is used, including failures of endpoint protection platforms and enabling real-time visibility and anomaly detection. The document goes on to provide examples of how red teams can evade detection, such as hiding Windows processes, spoofing process arguments and parent processes, and using memory evasion techniques like obfuscation and behaving like a beacon.
Next Generation War: EDR vs RED TEAM
- 1. WHOAMI Halil Dalabasmaz Red TeamLeader Developer of Phant0m, wildPWN, SpookFlare C|EH, OSCP, OSWP, OSCE, eWPT, eWPTX artofpwn.com twitter: @hlldz | github: @hlldz
- 4. EDR • Endpoint Detectionand Response • This solutions are designed to continuously monitor and respond to threats. They do this by installing agents or sensors on the endpoints, which collect and send behavioral data to a central database for analysis.
- 5.
- 6. WHY EDR? • Failureof EPPs • Real Time System Watching & Visibility • Memory and Behavioral Analysis • Anomaly Detection • Empower DFIR Processes • VirusTotal Integration
- 7.
- 8. REAL LIFE -II https://redcanary.com/blog/5-common-endpoint-detection-and-response-mistakes/
- 9. Next Generation War EDRvs RED TEAM Halil Dalabasmaz
- 10. VISIBILITY OF AWINDOWS PROCESS
- 11. VISIBILITY OF AWINDOWS PROCESS
- 12. RED TEAM CASESTUDY - I
- 13. RED TEAM CASESTUDY - I powershell -nop -w 1 -enc SQBmACgAJABQAFMAVgBlAFIAcwBpAG8ATgBKLnfAaQBu
- 14. PROCESS ARGUMENT SPOOFING typedefstruct _RTL_USER_PROCESS_PARAMETERS { BYTE Reserved1[16]; PVOID Reserved2[10]; UNICODE_STRING ImagePathName; UNICODE_STRING CommandLine; } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
- 15.
- 16. RED TEAM CASESTUDY - II
- 17. WINDOWS OS BOOTSEQUENCE
- 18. PARENT PROCESS SPOOFING BOOLCreateProcessA( LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation );
- 19. PARENT PROCESS SPOOFING typedefstruct _STARTUPINFOEXA { STARTUPINFOA StartupInfo; LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList; } STARTUPINFOEXA, *LPSTARTUPINFOEXA;
- 20. DO IT THEHARD WAY • ver • systeminfo • tasklist • tasklist /M • tasklist /V • net accounts • net user • net user Administrator • net localgroup • net localgroup Administrators • net accounts /domain • net group /domain • net group "Domain Computers" /domain • net group "Domain Controllers" /domain • net group "Domain Admins" /domain • net group "Domain Policy Creator Owners" /domain • ipconfig • ipconfig /all • whoami • whoami /priv
- 21. DO IT THEHARD WAY • Netapi32.lib • Netapi32.dll • NetUserEnum() • NetUserGetInfo() • NetUserGetLocalGroups() • DsGetDcName() • Advapi32.lib • Advapi32.dll • RegGetValueA() • Activeds.lib • Activeds.dll • ADsOpenObject()
- 22. MEMORY EVASION • Obfuscation,Beacon Style • Gargoyle, https://www.youtube.com/watch?v=B8lIV_Rk5Cg