Webinar: Learn Proactive Supply Chain Threat Hunting Techniques

MITRE Corporation Breached by Nation-State Hackers Exploiting Ivanti Flaws

OfflRouter Malware Evades Detection in Ukraine for Almost a Decade

Hackers Exploit Fortinet Flaw, Deploy ScreenConnect, Metasploit in New Campaign

U.S. Federal Agencies Ordered to Hunt for Signs of Microsoft Breach and Mitigate Risks

CL0P's Ransomware Rampage - Security Measures for 2024

U.S. Cyber Safety Board Slams Microsoft Over Breach by China-Based Hackers

China-linked Hackers Deploy New 'UNAPIMON' Malware for Stealthy Operations

Harnessing the Power of CTEM for Cloud Security

Detecting Windows-based Malware Through Better Visibility

The Golden Age of Automated Penetration Testing is Here

PyPI Halts Sign-Ups Amid Surge of Malicious Package Uploads Targeting Developers

Behind the Scenes: The Art of Safeguarding Non-Human Identities

Hackers Hijack GitHub Accounts in Supply Chain Attack Affecting Top-gg and Others

Iran-Linked MuddyWater Deploys Atera for Surveillance in Phishing Attacks

Introducing Cisco XDR Playbooks: Finding the balance in automating and guiding incident response

Security Operations is the beating heart of any organization, a united team vigilantly standing guard against cyber threats. To outsmart their adversaries, they must delve deep into the intricate… Read more on Cisco Blogs

Russia Hackers Using TinyTurla-NG to Breach European NGO's Systems

From Deepfakes to Malware: AI's Expanding Role in Cyber Attacks

LockBit Ransomware Hacker Ordered to Pay $860,000 After Guilty Plea in Canada

4 Instructive Postmortems on Data Downtime and Loss

How to Prioritize Cybersecurity Spending: A Risk-Based Strategy for the Highest ROI

How to Use Tines's SOC Automation Capability Matrix

New Malicious PyPI Packages Caught Using Covert Side-Loading Tactics

Learn How to Build an Incident Response Playbook Against Scattered Spider in Real-Time

MrHandler - Linux Incident Response Reporting

MR.Handler is a specialized tool designed for responding to security incidents on Linux systems. It connects to target systems via SSH to execute a range of diagnostic commands, gathering crucial information such as network configurations, system logs, user accounts, and running processes. At the end of its operation, the tool compiles all the gathered data into a comprehensive HTML report. This report details both the specifics of the incident response process and the current state of the system, enabling security analysts to more effectively assess and respond to incidents.

  $ pip3 install colorama
  $ pip3 install paramiko
  $ git clone https://github.com/emrekybs/BlueFish.git
  $ cd MrHandler
  $ chmod +x MrHandler.py 
  $ python3 MrHandler.py

Ivanti Vulnerability Exploited to Install 'DSLog' Backdoor on 670+ IT Infrastructures

Why Are Compromised Identities the Nightmare to IR Speed and Efficiency?

New Webinar: 5 Steps to vCISO Success for MSPs and MSSPs

Combined Security Practices Changing the Game for Risk Management

Juniper Networks Releases Urgent Junos OS Updates for High-Severity Flaws

New CherryLoader Malware Mimics CherryTree to Deploy PrivEsc Exploits

Cost of a Data Breach Report 2023: Insights, Mitigators and Best Practices

MongoDB Suffers Security Breach, Exposing Customer Data

China's MIIT Introduces Color-Coded Action Plan for Data Security Incidents

Bug or Feature? Hidden Web Application Vulnerabilities Uncovered

Building a Robust Threat Intelligence with Wazuh

Scaling Security Operations with Automation

This Free Solution Provides Essential Third-Party Risk Management for SaaS

7 Uses for Generative AI to Enhance Security Operations

6 Steps to Accelerate Cybersecurity Incident Response

Play Ransomware Goes Commercial - Now Offered as a Service to Cybercriminals

The New 80/20 Rule for SecOps: Customize Where it Matters, Automate the Rest

HelloKitty Ransomware Group Exploiting Apache ActiveMQ Vulnerability

How to Keep Your Business Running in a Contested Environment

Trawler - PowerShell Script To Help Incident Responders Discover Adversary Persistence Mechanisms

Dredging Windows for Persistence

What is it?

Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items, Binary Modifications and more.

Currently, trawler can detect most of the persistence techniques specifically called out by MITRE and Atomic Red Team with more detections being added on a regular basis.

Main Features

• Scanning Windows OS for a variety of persistence techniques (Listed below)
• CSV Output with MITRE Technique and Investigation Jumpstart Metadata
• Analysis and Remediation Guidance Documentation (https://github.com/joeavanzato/Trawler/wiki/Analysis-and-Remediation-Guidance)
• Dynamic Risk Assignment for each detection
• Built-in Allow Lists for common Windows configurations spanning Windows 10/Server 2012|2016|2019|2022 to reduce noise
• Capture persistence metadata from 'golden' enterprise image for use as a dynamic allow-list at runtime
• Analyze mounted disk images via drive re-targeting

How do I use it?

Just download and run trawler.ps1 from an Administrative PowerShell/cmd prompt - any detections will be displayed in the console as well as written to a CSV ('detections.csv') in the current working directory. The generated CSV will contain Detection Name, Source, Risk, Metadata and the relevant MITRE Technique.

Or use this one-liner from an Administrative PowerShell terminal:

iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/joeavanzato/Trawler/main/trawler.ps1'))

Certain detections have allow-lists built-in to help remove noise from default Windows configurations (10/2016/2019/2022) - expected Scheduled Tasks, Services, etc. Of course, it is always possible for attackers to hijack these directly and masquerade with great detail as a default OS process - take care to use multiple forms of analysis and detection when dealing with skillful adversaries.

If you have examples or ideas for additional detections, please feel free to submit an Issue or PR with relevant technical details/references - the code-base is a little messy right now and will be cleaned up over time.

Additionally, if you identify obvious false positives, please let me know by opening an issue or PR on GitHub! The obvious culprits for this will be non-standard COMs, Services or Tasks.

CLI Parameters

-scanoptions : Tab-through possible detections and select a sub-set using comma-delimited terms (eg. .\trawler.ps1 -scanoptions Services,Processes)
-hide : Suppress Detection output to console
-snapshot : Capture a "persistence snapshot" of the current system, defaulting to "$PSScriptRoot\snapshot.csv"
-snapshotpath : Define a custom file-path for saving snapshot output to.
-outpath : Define a custom file-path for saving detection output to (defaults to "$PSScriptRoot\detections.csv")
-loadsnapshot : Define the path for an existing snapshot file to load as an allow-list reference
-drivetarget : Define the variable for a mounted target drive (eg. .\trawler.ps1 -targetdrive "D:") - using this alone leads to an 'assumed homedrive' variable of C: for analysis purposes

What separates this from PersistenceSniper?

PersistenceSniper is an awesome tool - I've used it heavily in the past - but there are a few key points that differentiate these utilities

• trawler is (currently) a local utility - it would be pretty straight-forward to wrap it in a loop and use WinRM/PowerShell Sessions to execute it on remote hosts though
• trawler implements allow-listing for many 'noisy' detections to help remove expected detections from default configurations of Windows (10/2016/2019/2022) and these are constantly being updated
  • PersistenceSniper (for the most part) does not contain any type of allow-listing - therefore, there is more noise generated when considering items such as Services, Scheduled Tasks, general COM DLL scanning, etc.
• trawler's output is much more simplified - Name, Risk, Source, MITRE Technique and Metadata are the only items provided for each detection to help analysts jump-start their persistence hunting efforts
• Regex is used in many checks to help detect 'suspicious' keywords or patterns in various critical areas including scanned file contents, registry values, etc.
• trawler supports 'snapshotting' a system (for example, an enterprise golden image) then using the generated snapshot as an allow-list to reduce noise.
• trawler supports 'drive-retargeting' to check dead-boxes mounted to an analysis machine.

Overall, these tools are extremely similar but approach the problem from slightly different angles - PersistenceSniper provides all information back to the analyst for review while Trawler tries to limit what is returned to only results that are likely to be potential adversary persistence mechanisms. As such, there is a possibility for false-negatives with trawler if an adversary completely mimics an allow-listed item.

Tuning to your environment

Trawler supports loading an allow-list from a 'snapshot' - to do this requires two steps.

1. Run '.\trawler.ps1 -snapshot' on a "Golden Image" representing the servers in your environment - once complete, in addition to the standard 'detections.csv' a file named 'snapshots.csv' will be generated
2. This file can then be used as input to trawler when running on other hosts and the data will be loaded dynamically as an allow-list for each appropriate detection
   1. '.\trawler.ps1' -loadsnapshot "path\to\snapshot.csv"

That's it - all relevant detections will then draw from the snapshot file as an allow-list to reduce noise and identify any potential changes to the base image that may have occurred.

(Allow-listing is implemented for most of the checks but not all - still being actively implemented)

Drive ReTargeting

Often during an investigation, analysts may end up mounting a new drive that represents an imaged Windows device - Trawler now partially supports scanning these mounted drives through the use of the '-drivetarget' parameter.

At runtime, Trawler will re-target temporary script-level variables for use in checking file-based artifacts and also will attempt to load relevant Registry Hives (HKLM\SOFTWARE, HKLM\SYSTEM, NTUSER.DATs, USRCLASS.DATs) underneath HKLM/HKU and prefixed by 'ANALYSIS_'. Trawler will also attempt to unload these temporarily loaded hives upon script completion.

As an example, if you have an image mounted at a location such as 'F:\Test' which contains the NTFS file system ('F:\Test\Windows', 'F:\Test\User', etc) then you can invoke trawler like below;

.\trawler.ps1 -drivetarget "F:\Test"

Please note that since trawler attempts to load the registry hive files from the drive in question, mapping a UNC path to a live remote device will NOT work as those files will not be accessible due to system locks. I am working on an approach which will handle live remote devices, stay tuned.

What is not inspected when drive retargeting?

• Running Processes
• Network Connections
• 'Phantom' DLLs
• WMI Consumers (Being worked on)
• BITS Jobs (Being worked on)
• Certificate Parsing (Being worked on)

Most other checks will function fine because they are based entirely on reading registry hives or file-based artifacts (or can be converted to do so, such as directly reading Task XML as opposed to using built-in command-lets.)

Any limitations in checks when doing drive-retargeting will be discussed more fully in the GitHub Wiki.

Example Images 

What is inspected?

• Scheduled Tasks
• Users
• Services
• Running Processes
• Network Connections
• WMI Event Consumers (CommandLine/Script)
• Startup Item Discovery
• BITS Jobs Discovery
• Windows Accessibility Feature Modifications
• PowerShell Profile Existence
• Office Addins from Trusted Locations
• SilentProcessExit Monitoring
• Winlogon Helper DLL Hijacking
• Image File Execution Option Hijacking
• RDP Shadowing
• UAC Setting for Remote Sessions
• Print Monitor DLLs
• LSA Security and Authentication Package Hijacking
• Time Provider DLLs
• Print Processor DLLs
• Boot/Logon Active Setup
• User Initialization Logon Script Hijacking
• ScreenSaver Executable Hijacking
• Netsh DLLs
• AppCert DLLs
• AppInit DLLs
• Application Shimming
• COM Object Hijacking
• LSA Notification Hijacking
• 'Office test' Usage
• Office GlobalDotName Usage
• Terminal Services DLL Hijacking
• Autodial DLL Hijacking
• Command AutoRun Processor Abuse
• Outlook OTM Hijacking
• Trust Provider Hijacking
• LNK Target Scanning (Suspicious Terms, Multiple Extensions, Multiple EXEs)
• 'Phantom' Windows DLL Names loaded into running process (eg. un-signed WptsExtensions.dll)
• Scanning Critical OS Directories for Unsigned EXEs/DLLs
• Un-Quoted Service Path Hijacking
• PATH Binary Hijacking
• Common File Association Hijacks and Suspicious Keywords
• Suspicious Certificate Hunting
• GPO Script Discovery/Scanning
• NLP Development Platform DLL Overrides
• AeDebug/.NET/Script/Process/WER Debug Replacements
• Explorer 'Load'
• Windows Terminal startOnUserLogin Hijacks
• App Path Mismatches
• Service DLL/ImagePath Mismatches
• GPO Extension DLLs
• Potential COM Hijacks
• Non-Standard LSA Extensions
• DNSServerLevelPluginDll Presence
• Explorer\MyComputer Utility Hijack
• Terminal Services InitialProgram Check
• RDP Startup Programs
• Microsoft Telemetry Commands
• Non-Standard AMSI Providers
• Internet Settings LUI Error DLL
• PeerDist\Extension DLL
• ErrorHandler.CMD Checks
• Built-In Diagnostics DLL
• MiniDumpAuxiliary DLLs
• KnownManagedDebugger DLLs
• WOW64 Compatibility Layer DLLs
• EventViewer MSC Hijack
• Uninstall Strings Scan
• PolicyManager DLLs
• SEMgr Wallet DLL
• WER Runtime Exception Handlers
• HTML Help (.CHM)
• Remote Access Tool Artifacts (Files, Directories, Registry Keys)
• ContextMenuHandler DLL Checks
• Office AI.exe Presence
• Notepad++ Plugins
• MSDTC Registry Hijacks
• Narrator DLL Hijack (MSTTSLocEnUS.DLL)
• Suspicious File Location Checks

TODO

• Add Analysis/Remediation Guidance to each detection in the GitHub Wiki (In-Progress)
• Browser Extension Analysis (?)
• RID Hijacking [https://www.ired.team/offensive-security/persistence/rid-hijacking][https://pentestlab.blog/2020/02/12/persistence-rid-hijacking/]
• PowerAutomate Checks
• ShadowPad Indicators [https://www.secureworks.com/research/shadowpad-malware-analysis, https://www.hexacorn.com/blog/2023/02/25/beyond-good-ol-run-key-part-141/]
• OBS Startup Script Scanning [https://www.hexacorn.com/blog/2023/04/14/beyond-good-ol-run-key-part-142/]
• SQL Server Management Addins [https://www.hexacorn.com/blog/2019/09/28/beyond-good-ol-run-key-part-117/]
• AutoPlay Handler Inspection [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers]
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Pending\SPReviewEnabler
• OCSetup [https://www.hexacorn.com/blog/2019/11/09/beyond-good-ol-run-key-part-122/]
• Review https://hijacklibs.net/# for additional opportunities
• Review https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows for additional opportunities
• Review https://silentrunners.org/launchpoints.html for additional opportunities

MITRE Techniques Evaluated

Please be aware that some of these are (of course) more detected than others - for example, we are not detecting all possible registry modifications but rather inspecting certain keys for obvious changes and using the generic MITRE technique "Modify Registry" where no other technique is applicable. For other items such as COM hijacking, we are inspecting all entries in the relevant registry section, checking against 'known-good' patterns and bubbling up unknown or mismatched values, resulting in a much more complete detection surface for that particular technique.

• T1037: Boot or Logon Initialization Scripts
• T1037.001: Boot or Logon Initialization Scripts: Logon Script (Windows)
• T1037.005: Boot or Logon Initialization Scripts: Startup Items
• T1055.001: Process Injection: Dynamic-link Library Injection
• T1059: Command and Scripting Interpreter
• T1071: Application Layer Protocol
• T1098: Account Manipulation
• T1112: Modify Registry
• T1053: Scheduled Task/Job
• T1136: Create Account
• T1137.001: Office Application Office Template Macros
• T1137.002: Office Application Startup: Office Test
• T1137.006: Office Application Startup: Add-ins
• T1197: BITS Jobs
• T1505.005: Server Software Component: Terminal Services DLL
• T1543.003: Create or Modify System Process: Windows Service
• T1546: Event Triggered Execution
• T1546.001: Event Triggered Execution: Change Default File Association
• T1546.002: Event Triggered Execution: Screensaver
• T1546.003: Event Triggered Execution: Windows Management Instrumentation Event Subscription
• T1546.007: Event Triggered Execution: Netsh Helper DLL
• T1546.008: Event Triggered Execution: Accessibility Features
• T1546.009: Event Triggered Execution: AppCert DLLs
• T1546.010: Event Triggered Execution: AppInit DLLs
• T1546.011: Event Triggered Execution: Application Shimming
• T1546.012: Event Triggered Execution: Image File Execution Options Injection
• T1546.013: Event Triggered Execution: PowerShell Profile
• T1546.015: Event Triggered Execution: Component Object Model Hijacking
• T1547.002: Boot or Logon Autostart Execution: Authentication Packages
• T1547.003: Boot or Logon Autostart Execution: Time Providers
• T1547.004: Boot or Logon Autostart Execution: Winlogon Helper DLL
• T1547.005: Boot or Logon Autostart Execution: Security Support Provider
• T1547.009: Boot or Logon Autostart Execution: Shortcut Modification
• T1547.012: Boot or Logon Autostart Execution: Print Processors
• T1547.014: Boot or Logon Autostart Execution: Active Setup
• T1553: Subvert Trust Controls
• T1553.004: Subvert Trust Controls: Install Root Certificate
• T1556.002: Modify Authentication Process: Password Filter DLL
• T1574: Hijack Execution Flow
• T1574.007: Hijack Execution Flow: Path Interception by PATH Environment Variable
• T1574.009: Hijack Execution Flow: Path Interception by Unquoted Path

References

This tool would not exist without the amazing InfoSec community - the most notable references I used are provided below.

• PersistenceSniper
• MITRE ATT&CK
• Persistence Info GitHub
• Hexacorn - Persistence Series
• IRED
• PayloadsAllTheThings

More References

• https://twitter.com/Laughing_Mantis/status/1645268114966470662
• https://shellz.club/posts/a-novel-method-for-bypass-ETW/
• https://pentestlab.blog/2023/03/20/persistence-service-control-manager/
• https://ristbs.github.io/2023/02/15/hijack-explorer-context-menu-for-persistence-and-fun.html
• https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/

Bashfuscator - A Fully Configurable And Extendable Bash Obfuscation Framework

Documentation

What is Bashfuscator?

Bashfuscator is a modular and extendable Bash obfuscation framework written in Python 3. It provides numerous different ways of making Bash one-liners or scripts much more difficult to understand. It accomplishes this by generating convoluted, randomized Bash code that at runtime evaluates to the original input and executes it. Bashfuscator makes generating highly obfuscated Bash commands and scripts easy, both from the command line and as a Python library.

The purpose of this project is to give Red Team the ability to bypass static detections on a Linux system, and the knowledge and tools to write better Bash obfuscation techniques.

This framework was also developed with Blue Team in mind. With this framework, Blue Team can easily generate thousands of unique obfuscated scripts or commands to help create and test detections of Bash obfuscation.

Media/slides

This is a list of all the media (i.e. youtube videos) or links to slides about Bashfuscator.

• Bsides Charm

Payload support

Though Bashfuscator does work on UNIX systems, many of the payloads it generates will not. This is because most UNIX systems use BSD style utilities, and Bashfuscator was built to work with GNU style utilities. In the future BSD payload support may be added, but for now payloads generated with Bashfuscator should work on GNU Linux systems with Bash 4.0 or newer.

Installation & Requirements

Bashfuscator requires Python 3.6+.

On a Debian-based distro, run this command to install dependencies:

sudo apt-get update && sudo apt-get install python3 python3-pip python3-argcomplete xclip

On a RHEL-based distro, run this command to install dependencies:

sudo dnf update && sudo dnf install python3 python3-pip python3-argcomplete xclip

Then, run these commands to clone and install Bashfuscator:

git clone https://github.com/Bashfuscator/Bashfuscator
cd Bashfuscator
python3 setup.py install --user

Only Debian and RHEL based distros are supported. Bashfuscator has been tested working on some UNIX systems, but is not supported on those systems.

Example Usage

For simple usage, just pass the command you want to obfuscate with -c, or the script you want to obfuscate with -f.

$ bashfuscator -c "cat /etc/passwd"
[+] Mutators used: Token/ForCode -> Command/Reverse
[+] Payload:

   ${@/l+Jau/+<b=k } p''"r"i""n$'t\u0066'  %s  "$(      ${*%%Frf\[4?T2   }  ${*##0\!j.G }   "r"'e'v <<< '   "} ~@{$"   ")  }  j@C`\7=-k#*{$   "}   ,@{$"  ; }  ;   } ,,*{$  "}]  }   ,*{$  "}   f9deh`\>6/J-F{\,vy//@{$" niOrw$   } QhwV#@{$ [NMpHySZ{$"  s%  "f"'"'"'4700u\n9600u\r'"'"'$p  {   ;  }  ~*{$  "}  48T`\PJc}\#@{$"   1#31  "}  ,@{$"   }  D$y?U%%*{$ 0#84  *$   }   Lv:sjb/@{$   2#05   }   ~@{$   2#4   }*!{$  }   OGdx7=um/X@RA{\eA/*{$ 1001#2   }   Scnw:i/@{$  } ~~*{$  11#4   "} O#uG{\HB%@{$"   11#7 "} ^^@{$"  011#2   "}   ~~@{$" 11#3 }  L[\h3m/@{$  "}   ~@{$" 11#2 }  6u1N.b!\b%%*{$   }   YCMI##@{$   31#5 "} ,@{$" 01#7  }  (\}\;]\//*{$ }   %#6j/?pg%m/*{$   001#2  "}  6IW]\p*n%@{$"   }  ^^@{$ 21#7  } !\=jy#@{$  }   tz}\k{\v1/?o:Sn@V/*{$  11#5   ni   niOrw  rof ;   "}   ,,@{$"  } MD`\!\]\P%%*{$      )  }@{$   a   }  ogt=y%*{$ "@$" /\   }   {\nZ2^##*{$    \   *$  c  }@{$  }   h;|Yeen{\/.8oAl-RY//@{$   p  *$  "}@{$"  t   }  zB(\R//*{$  } mX=XAFz_/9QKu//*{$  e   *$  s  } ~~*{$  d   }  ,*{$   }  2tgh%X-/L=a_r#f{\//*{$   w }  {\L8h=@*##@{$   "}   W9Zw##@{$"  (=NMpHySZ    ($"  la'"'"''"'"'"v"'"'"''"'"''"'"'541\'"'"'$  } &;@0#*{$ '   "${@}" "${@%%Ij\[N   }"    ${@~~  }   )"  ${!*} |   $@  $'b\u0061'''sh   ${*//J7\{=.QH   }  

[+] Payload size: 1232 characters

You can copy the obfuscated payload to your clipboard with --clip, or write it to a file with -o.

For more advanced usage, use the --choose-mutators flag, and specify exactly what obfuscation modules, or Mutators, you want to use in what order. Use also the -s argument to control the level of obfuscation used.

bashfuscator -c "cat /etc/passwd" --choose-mutators token/special_char_only compress/bzip2 string/file_glob -s 1
[+] Payload:

"${@#b }"  "e"$'\166'"a""${@}"l "$(  ${!@}m''$'k\144'''ir -p '/tmp/wW'${*~~} ;$'\x70'"${@/AZ }"rin""tf  %s  'MxJDa0zkXG4CsclDKLmg9KW6vgcLDaMiJNkavKPNMxU0SJqlJfz5uqG4rOSimWr2A7L5pyqLPp5kGQZRdUE3xZNxAD4EN7HHDb44XmRpN2rHjdwxjotov9teuE8dAGxUAL'>  '/tmp/wW/?
??';  prin${@#K. }tf %s  'wYg0iUjRoaGhoNMgYgAJNKSp+lMGkx6pgCGRhDDRGMNDTQA0ABoAAZDQIkhCkyPNIm1DTQeppjRDTTQ8D9oqA/1A9DjGhOu1W7/t4J4Tt4fE5+isX29eKzeMb8pJsPya93'  >  '/tmp/wW/???
' "${@,, }"  &&${*}pri''\n${*,}tf %s 'RELKWCoKqqFP5VElVS5qmdRJQelAziQTBBM99bliyhIQN8VyrjiIrkd2LFQIrwLY2E9ZmiSYqay6JNmzeWAklyhFuph1mXQry8maqHmtSAKnNr17wQlIXl/ioKq4hMlx76' >'/tmp/wW/??

';"${@,  }" $'\x70'rintf  %s 'clDkczJBNsB1gAOsW2tAFoIhpWtL3K/n68vYs4Pt+tD6+2X4FILnaFw4xaWlbbaJBKjbGLouOj30tcP4cQ6vVTp0H697aeleLe4ebnG95jynuNZvbd1qiTBDwAPVLT   tCLx' >'/tmp/wW/?

?' ;  ${*/~} p""${@##vl  }ri""n''tf %s  '  pr'"'"'i'"'"'$'"'"'n\x74'"'"'f %s  "$( prin${*//N/H  }tf  '"'"'QlpoOTFBWSZTWVyUng4AA3R/gH7z/+Bd/4AfwAAAD8AAAA9QA/7rm7NzircbE1wlCTBEamT1PKekxqYIA9TNQ' >'/tmp/wW/????'  "${@%\`  }"  ;p''r""i$'\x6e'''$'\164'"f" %s 'puxuZjSK09iokSwsERuYmYxzhEOARc1UjcKZy3zsiCqG5AdYHeQACRPKqVPIqkxaQnt/RMmoLKqCiypS0FLaFtirJFqQtbJLUVFoB/qUmEWVKxVFBYjHZcIAYlVRbkgWjh'  >'/tmp/wW/?


'  ${*};"p"rin''$'\x74f' %s  'Gs02t3sw+yFjnPjcXLJSI5XTnNzNMjJnSm0ChZQfSiFbxj6xzTfngZC4YbPvaCS3jMXvYinGLUWVfmuXtJXX3dpu379mvDn917Pg7PaoCJm2877OGzLn0y3FtndddpDohg'>'/tmp/wW/?
?
' && "${@^^ }"  pr""intf  %s  'Q+kXS+VgQ9OklAYb+q+GYQQzi4xQDlAGRJBCQbaTSi1cpkRmZlhSkDjcknJUADEBeXJAIFIyESJmDEwQExXjV4+vkDaHY/iGnNFBTYfo7kDJIucUES5mATqrAJ/KIyv1UV'> '/tmp/wW/
???'  ${*^}; ${!@}  "${@%%I  }"pri""n$'\x74f' %s '1w6xQDwURXSpvdUvYXckU4UJBclJ4OA'"'"'  |""b${*/t/\(  }a\se$'"'"'6\x34'"'"' -d| bu${*/\]%}nzi'"'"'p'"'"'${!@}2  -c)"  $@  |$   {@//Y^  } \ba\s"h"  ' >  '/tmp/wW/
??
' ${@%b  } ;  pr"i"\ntf  %s  'g8oZ91rJxesUWCIaWikkYQDim3Zw341vrli0kuGMuiZ2Q5IkkgyAAJFzgqiRWXergULhLMNTjchAQSXpRWQUgklCEQLxOyAMq71cGgKMzrWWKlrlllq1SXFNRqsRBZsKUE' >  '/tmp/wW/??
?'"${@//Y  }" ;$'c\141t' '/tmp/wW'/????  ${*/m};"${@,,  }"  $'\162'\m '/tmp/wW'/????  &&${@^ }rmd\ir  '/tmp/wW'; ${@^^  }   )"  "${@}"  

[+] Payload size: 2062 characters

For more detailed usage and examples, please refer to the documentation.

Extending the Framework

Adding new obfuscation methods to the framework is simple, as Bashfuscator was built to be a modular and extendable framework. Bashfuscator's backend does all the heavy lifting so you can focus on writing robust obfuscation methods (documentation on adding modules coming soon).

Authors and Contributers

• Andrew LeFevre (capnspacehook): project lead and creator
• Charity Barker (cpbarker): team member
• Nathaniel Hatfield (343iChurch): writing the RotN Mutator
• Elijah Barker (elijah-barker): writing the Hex Hash, Folder and File Glob Mutators
• Sam Kreischer: the awesome logo

Credits

• danielbohannon, whose excellent Invoke-Obfuscation and Invoke-DOSfuscation projects gave capnspacehook the idea to start writing Bashfuscator, and insight on how to write robust obfuscation methods.
• DissectMalware, whose tweets on Bash obfuscation formed the backbone of some Mutators, and provided ideas for other obfuscation techniques.
• ConsciousHacker, whose insight and advice has helped the team greatly.
• Bash logo was originally from https://github.com/odb/official-bash-logo.

Disclaimer

Bashfuscator was created for educational purposes only, use only on computers or networks you have explicit permission to do so. The Bashfuscator team is not responsible for any illegal or malicious acts preformed with this project.

How MDR Helps Solve the Cybersecurity Talent Gap

Cynet Protects Hospital From Lethal Infection

DFIR via XDR: How to expedite your investigations with a DFIRent approach

Deep Dive Into 6 Key Steps to Accelerate Your Incident Response

Mimicry - Security Tool For Active Deception In Exploitation And Post-Exploitation

Mimicry is a security tool developed by Chaitin Technology for active deception in exploitation and post-exploitation.

Active deception can live migrate the attacker to the honeypot without awareness. We can achieve a higher security level at a lower cost with Active deception.

English | 中文文档

Demo

️

Quick Start

1. Make sure docker, docker-compose is installed correctly on the machine

docker info
docker-compose version

2. Install honeypot service

docker-compose build
docker-compose up -d

3. Deploy deception tool on other machines

update config.yaml,replace ${honeypot_public_ip} to the public IP of honeypot service

4. Perform Webshell deceiving

./mimicry-tools webshell -c config.yaml -t php -p webshell_path



Advance Usage

️

Contact Us

1. You can make bug feedback and feature suggestions directly through GitHub Issues.
2. You can join the discussion group on Discord .

Sandfly-Entropyscan - Tool To Detect Packed Or Encrypt ed Binaries Related To Malware, Finds Malicious Files And Linux Processes And Gives Output With Cryptographic Hashes

What is sandfly-entropyscan?

sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy (measure of randomness) and if they are a Linux/Unix ELF type executable. Some malware for Linux is packed or encrypted and shows very high entropy. This tool can quickly find high entropy executable files and processes which often are malicious.

Features

• Written in Golang and is portable across multiple architectures with no modifications.
• Standalone binary requires no dependencies and can be used instanly without loading any libraries on suspect machines.
• Not affected by LD_PRELOAD style rootkits that are cloaking files.
• Built-in PID busting to find hidden/cloaked processes from certain types of Loadable Kernel Module (LKM) rootkits.
• Generates entropy and also MD5, SHA1, SHA256 and SHA512 hash values of files.
• Can be used in scanning scripts to find problems automatically.
• Can be used by incident responders to quickly scan and zero in on potential malware on a Linux host.

Why Scan for Entropy?

Entropy is a measure of randomness. For binary data 0.0 is not-random and 8.0 is perfectly random. Good crypto looks like random white noise and will be near 8.0. Good compression removes redundant data making it appear more random than if it was uncompressed and usually will be 7.7 or above.

A lot of malware executables are packed to avoid detection and make reverse engineering harder. Most standard Linux binaries are not packed because they aren't trying to hide what they are. Searching for high entropy files is a good way to find programs that could be malicious just by having these two attributes of high entropy and executable.

How Do I Use This?

Usage of sandfly-entropyscan:

-csv output results in CSV format (filename, path, entropy, elf_file [true|false], MD5, SHA1, SHA256, SHA512)

-delim change the default delimiter for CSV files of "," to one of your choosing ("|", etc.)

-dir string directory name to analyze

-file string full path to a single file to analyze

-proc check running processes (defaults to ELF only check)

-elf only check ELF executables

-entropy float show any file/process with entropy greater than or equal to this value (0.0 min - 8.0 max, defaults 0 to show all files)

-version show version and exit

Examples

Search for any file that is executable under /tmp:

sandfly-entropyscan -dir /tmp -elf

Search for high entropy (7.7 and higher) executables (often packed or encrypted) under /var/www:

sandfly-entropyscan -dir /var/www -elf -entropy 7.7

Generates entropy and cryptographic hashes of all running processes in CSV format:

sandfly-entropyscan -proc -csv

Search for any process with an entropy higher than 7.7 indicating it is likely packed or encrypted:

sandfly-entropyscan -proc -entropy 7.7

Generate entropy and cryptographic hash values of all files under /bin and output to CSV format (for instance to save and compare hashes):

sandfly-entropyscan -dir /bin -csv

Scan a directory for all files (ELF or not) with entropy greater than 7.7: (potentially large list of files that are compressed, png, jpg, object files, etc.)

sandfly-entropyscan -dir /path/to/dir -entropy 7.7

Quickly check a file and generate entropy, cryptographic hashes and show if it is executable:

sandfly-entropyscan -file /dev/shm/suspicious_file

Use Cases

Do spot checks on systems you think have a malware issue. Or you can automate the scan so you will get an output if we find something show up that is high entropy in a place you didn't expect. Or simply flag any executable ELF type file that is somewhere strange (e.g. hanging out in /tmp or under a user's HTML directory). For instance:

Did a high entropy binary show up under the system /var/www directory? Could be someone put a malware dropper on your website:

sandfly-entropyscan -dir /var/www -elf -entropy 7.7

Setup a cron task to scan your /tmp, /var/tmp, and /dev/shm directories for any kind of executable file whether it's high entropy or not. Executable files under tmp directories can frequently be a malware dropper.

sandfly-entropyscan -dir /tmp -elf

sandfly-entropyscan -dir /var/tmp -elf

sandfly-entropyscan -dir /dev/shm -elf

Setup another cron or automated security sweep to spot check your systems for highly compressed or encrypted binaries that are running:

sandfly-entropyscan -proc -entropy 7.7

Build

• Install latest version of golang (www.golang.org)
• Clone the repo:

git clone https://github.com/sandflysecurity/sandfly-entropyscan.git

• Go into the repo directory and build it:

go build

• Run the binary with your options:

./sandfly-entropyscan

Build Scripts

There are a some basic build scripts that build for various platforms. You can use these to build or modify to suit. For Incident Responders, it might be useful to keep pre-compiled binaries ready to go on your investigation box.

build.sh - Build for current OS you're running on when you execute it.

ELF Detection

We use a simple method for seeing if a file may be an executable ELF type. We can spot ELF format files for multiple platforms. Even if malware has Intel/AMD, MIPS and Arm dropper binaries we will still be able to spot all of them.

False Positives

It's possible to flag a legitimate binary that has a high entropy because of how it was compiled, or because it was packed for legitimate reasons. Other files like .zip, .gz, .png, .jpg and such also have very high entropy because they are compressed formats. Compression removes redundancy in a file which makes it appear to be more random and has higher entropy.

On Linux, you may find some kinds of libraries (.so files) get flagged if you scan library directories.

However, it is our experience that executable binaries that also have high entropy are often malicious. This is especially true if you find them in areas where executables normally shouldn't be (such as again tmp or html directories).

Performance

The entropy calculation requires reading in all the bytes of the file and tallying them up to get a final number. It can use a lot of CPU and disk I/O, especially on very large file systems or very large files. The program has an internal limit where it won't calculate entropy on any file over 2GB, nor will it try to calculate entropy on any file that is not a regular file type (e.g. won't try to calculate entropy on devices like /dev/zero).

Then we calculate MD5, SHA1, SHA256 and SHA512 hashes. Each of these requires going over the file as well. It's reasonable speed on modern systems, but if you are crawling a very large file system it can take some time to complete.

If you tell the program to only look at ELF files, then the entropy/hash calculations won't happen unless it is an ELF type and this will save a lot of time (e.g. it will ignore massive database files that aren't executable).

If you want to automate this program, it's best to not have it crawl the entire root file system unless you want that specifically. A targeted approach will be faster and more useful for spot checks. Also, use the ELF flag as that will drastically reduce search times by only processing executable file types.

Incident Response

For incident responders, running sandfly-entropyscan against the entire top-level "/" directory may be a good idea just to quickly get a list of likely packed candidates to investigate. This will spike CPU and disk I/O. However, you probably don't care at that point since the box has been mining cryptocurrency for 598 hours anyway by the time the admins noticed.

Again, use the ELF flag to get to the likely problem candidate executables and ignore the noise.

Testing

There is a script called scripts/testfiles.sh that will make two files. One will be full of random data and one will not be random at all. When you run the script it will make the files and run sandfly-entropyscan in executable detection mode. You should see two files. One with very high entropy (at or near 8.0) and one full of non-random data that should be at 0.00 for low entropy. Example:

./testfiles.sh

Creating high entropy random executable-like file in current directory.

Creating low entropy executable-like file in current directory.

high.entropy.test, entropy: 8.00, elf: true

low.entropy.test, entropy: 0.00, elf: true

You can also load up the upx utility and compress an executable and see what values it returns.

Agentless Linux Security

Sandfly Security produces an agentless endpoint detection and incident response platform (EDR) for Linux. Automated entropy checks are just one of thousands of things we search for to find intruders without loading any software on your Linux endpoints.

Get a free license and learn more below:

https://www.sandflysecurity.com @SandflySecurity

Accelerate Your Incident Response

Pylirt - Python Linux Incident Response Toolkit

With this application, it is aimed to accelerate the incident response processes by collecting information in linux operating systems.

Features

Information is collected in the following contents.

/etc/passwd

cat /etc/group

cat /etc/sudoers

lastlog

cat /var/log/auth.log

uptime/proc/meminfo

ps aux

/etc/resolv.conf

/etc/hosts

iptables -L -v -n

find / -type f -size +512k -exec ls -lh {}/;

find / -mtime -1 -ls

ip a

netstat -nap

arp -a

echo $PATH

Installation

git clone https://github.com/anil-yelken/pylirt

cd pylirt

sudo pip3 install paramiko

Usage

The following information should be specified in the cred_list.txt file:

IP|Username|Password

sudo python3 plirt.py

Contact

https://twitter.com/anilyelken06

https://medium.com/@anilyelken

Pywirt - Python Windows Incident Response Toolkit

With this application, it is aimed to accelerate the incident response processes by collecting information in windows operating systems via winrm.

Features

Information is collected in the following contents.

IP Configuration

Users

Groups

Tasks

Services

Task Scheduler

Registry Control

Active TCP & UDP ports

File sharing

Files

Firewall Config

Sessions with other Systems

Open Sessions

Log Entries

Installation

git clone https://github.com/anil-yelken/pywirt

cd pywirt

pip3 install pywinrm

Usage

The following information should be specified in the cred_list.txt file:

IP|Username|Password

Contact

https://twitter.com/anilyelken06

https://medium.com/@anilyelken

ThreatWise TV: Exploring Recent Incident Response Trends

Today we’re examining some of the revelations in the Q3 Cisco Talos Incident Response Trends Report. This document is an anonymized look at of all the engagements that the Cisco Talos Incident Response team have been involved in over the previous three months. It also features threat intelligence from our team of researchers and analysts.  

To start, take a watch of this episode of ThreatWise TV which explores how these trends have evolved since the previous quarter. Our guests also talk about incidents and cyber-attacks that they themselves have consulted on recently, including a particularly interesting insider threat case. 

Highlights of the Q3 Cisco Talos Incident Response report 

Ransomware returned as the top threat this quarter, after commodity trojans narrowly surpassed ransomware last quarter. Ransomware made up nearly 18 percent of all threats observed, up from 15 percent last quarter. Cisco Talos Incident Response (CTIR) observed high-profile families, such as Vice Society and Hive, as well as the newer family Blast Basta, which first emerged in April of this year.   

Also noteworthy is the fact that CTIR saw an equal number in ransomware and pre- ransomware engagements this quarter, totalling nearly 40 percent of threats observed. Pre-ransomware is when we have observed a ransomware attack is about to happen, but the encryption of files has not yet taken place. 

Pre-ransomware comprised 18 percent of threats this quarter, up from less than 5 percent previously. While it’s difficult to determine an adversary’s motivations if encryption does not take place, several behavioral characteristics bolster Talos’ confidence that ransomware may likely be the final objective. In these engagements adversaries were observed deploying frameworks such as Cobalt Strike and Mimikatz, alongside numerous enumeration and discovery techniques.  

Commodity malware, such as the Qakbot banking trojan, was observed in multiple engagements this quarter. In one engagement, several compromised endpoints were seen communicating with IP addresses associated with Qakbot C2 traffic. This activity coincides with a general resurgence of Qakbot and its delivery of emerging ransomware families and offensive security frameworks that we have not previously observed Qakbot deploy. This comes at a time where competing email-based botnets like Emotet and Trickbot have suffered continued setbacks from law enforcement and tech companies.  

Other threats this quarter include infostealers like Redline Stealer and Raccoon Stealer. Redline Stealer was observed across three engagements this quarter, two of which involved ransomware. The malware operators behind Raccoon introduced new functionality to the malware at the end of June, which likely contributed to its increased presence in engagements this quarter.  

As infostealers have continued to rank highly in CTIR engagements, let’s explore them in a bit more detail. 

Why infostealers proliferate  

Throughout the incidents discussed over the last few quarters, and CTIR engagements in general, information stealing plays a big part of the attackers’ TTPs.   

From a high level, infostealers can be used to gain access a variety of sensitive information, such as contact information, financial details, and even intellectual property. The adversaries involved often proceed to exfiltrate this information and may then attempt to sell it in dark web forums, threaten to release it if a ransom isn’t paid, among other things.  

While these instances can and do crop up in CTIR engagements, many of the infostealers seen in this space are used for accessing and collecting user credentials. Once an attacker has gained an initial foothold on a system, there are many places within an operating system that they can look for and collect credentials through the practice of credential dumping.   

These stolen credentials may be offered up for sale on the dark web, alongside the stolen information mentioned above, but they can also prove to be a key weapon in an attacker’s arsenal. Their usefulness lies in one simple concept—why force your way into a system when you can just log in?  

There are several advantages for bad actors that use this approach. Probably the most oblivious of these is that using pre-existing credentials is far more likely to go unnoticed than other more flagrant tactics an attacker can use. If part of the goal of an attack is to remain under the radar, activities carried out by “known users” are less likely to trigger security alerts when compared to tactics such as exploiting vulnerabilities or downloading malware binaries.  

Adversaries tend to seek credentials with higher privileges, allowing them further control over the systems they compromise, with those including administrative access being the crown jewels.  

User credentials can not only provide an attacker with means to elevate privileges and establish persistence on a system, but also to move laterally through a network. Some credentials, especially those with administrative privileges, can offer access to multiple systems throughout a network. By obtaining them, many more options become available to further an attack.  

Repeat offenders  

There are several threats involved in information stealing that appear repeatedly in CTIR engagements over the last few quarters.  

Perhaps the most notorious is Mimikatz—a tool used to pull credentials from operating systems. Mimikatz is not malware per-se and can be useful for penetration testing and red team activities. But bad actors leverage it as well, and over the last few quarters CTIR has observed it being used in ransomware-as-a-service attacks, as well as pre-ransomware incidents.   

CTIR has also observed Redline Stealer being utilized by adversaries in CTIR engagements across quarters. This infostealer has grown in popularity as a supplementary tool used alongside other malware. On more than one occasion, CTIR has identified stolen credentials on the dark web that claimed to have been obtained via Redline Stealer.  

Other information stealers seen across the last few quarters include the Vidar information stealer, Raccoon Stealer, and SolarMaker, all of which have been used to further an adversary’s attacks.   

Insider threats 

Over the last several months, Talos has seen an increasing number of engagements involving insider threats. In one engagement this quarter, passwords were reset through a management console of a perimeter firewall that a disgruntled employee had access to.   

The organization’s team changed all associated passwords but overlooked one administrative account. On the following day, someone logged in using that account, deleted all other accounts and firewall rules, and created one local account, likely to provide persistence.  

You’ll hear Alexis Merritt, Incident Response Consultant for Cisco Talos, talk about this more in the ThreatWise TV episode. 

To help protect against this threat when an individual leaves an organization, steps like disabling accounts and ensuring that connections to the enterprise remotely through VPN has been removed can be very valuable. Implementing a mechanism to wipe systems, especially for remote employees, is important as well.  

For more on this topic, Cisco Secure recently put together a white paper on the Insider Threat Maturity FrameWork.

How to protect  

In several incidents over the last few quarters that involved information stealers, multi-factor authentication (MFA) was not properly implemented by the organizations impacted, providing adversaries an opportunity to infiltrate the networks. MFA tools like Cisco Secure Access by Duo can prevent attackers from successfully gaining access. 

Connecting with Wolfgang Goerlich 

And finally, Cisco Advisory CISO Wolfgang Goerlich has created this storytelling video, to help people think about incident response in a new way: 

Join the Cisco Talos Incident Response team for a live debrief of the Q3 report on 27th October. 

We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!

Cisco Secure Social Channels

Instagram
Facebook
Twitter
LinkedIn

Shomon - Shodan Monitoring Integration For TheHive

ShoMon is a Shodan alert feeder for TheHive written in GoLang. With version 2.0, it is more powerful than ever!

Functionalities

• Can be used as Webhook OR Stream listener

  • Webhook listener opens a restful API endpoint for Shodan to send alerts. This means you need to make this endpoint available to public net
  • Stream listener connects to Shodan and fetches/parses the alert stream

• Utilizes shadowscatcher/shodan (fantastic work) for Shodan interaction.

• Console logs are in JSON format and can be ingested by any other further log management tools

• CI/CD via Github Actions ensures that a proper Release with changelogs, artifacts, images on ghcr and dockerhub will be provided

• Provides a working docker-compose file file for TheHive, dependencies

• Super fast and Super mini in size

• Complete code refactoring in v2.0 resulted in more modular, maintainable code

• Via conf file or environment variables alert specifics including tags, type, alert-template can be dynamically adjusted. See config file.

• Full banner can be included in Alert with direct link to Shodan Finding.

  

• IP is added to observables

  

Usage

• Parameters should be provided via conf.yaml or environment variables. Please see config file and docker-compose file

• After conf or environment variables are set simply issue command:

  ./shomon

Notes

• Alert reference is first 6 chars of md5("ip:port")
• Only 1 mod can be active at a time. Webhook and Stream listener can not be activated together.

Setup & Compile Instructions

Get latest compiled binary from releases

1. Check Releases section.

Compile from source code

1. Make sure that you have a working Golang workspace.
2. go build .
   • go build -ldflags="-s -w" . could be used to customize compilation and produce smaller binary.

Using Public Container Registries

1. Thanks to new CI/CD integration, latest versions of built images are pushed to ghcr, DockerHub and can be utilized via:
   • docker pull ghcr.io/kaansk/shomon
   • docker pull kaansk/shomon

Using Dockerfile

1. Edit config file or provide environment variables to commands bellow
2. docker build -t shomon .
3. docker run -it shomon

Using docker-compose file

1. Edit environment variables and configurations in docker-compose file
2. docker-compose run -d

Credits

• Logo Made via LogoMakr.com
• shadowscatcher/shodan
• Dockerfile Reference
• Release management with GoReleaser

LastPass source code breach – incident response report released

PersistenceSniper - Powershell Script That Can Be Used By Blue Teams, Incident Responders And System Administrators To Hunt Persistences Implanted In Windows Machines

The Why

Why writing such a tool, you might ask. Well, for starters, I tried looking around and I did not find a tool which suited my particular use case, which was looking for known persistence techniques, automatically, across multiple machines, while also being able to quickly and easily parse and compare results. Sure, Sysinternals' Autoruns is an amazing tool and it's definitely worth using, but, given it outputs results in non-standard formats and can't be run remotely unless you do some shenanigans with its command line equivalent, I did not find it a good fit for me. Plus, some of the techniques I implemented so far in PersistenceSniper have not been implemented into Autoruns yet, as far as I know. Anyway, if what you need is an easy to use, GUI based tool with lots of already implemented features, Autoruns is the way to go, otherwise let PersistenceSniper have a shot, it won't miss it :)

Usage

Using PersistenceSniper is as simple as:

PS C:\> git clone https://github.com/last-byte/PersistenceSniper
PS C:\> Import-Module .\PersistenceSniper\PersistenceSniper\PersistenceSniper.psd1
PS C:\> Find-AllPersistence

If you need a detailed explanation of how to use the tool or which parameters are available and how they work, PersistenceSniper's Find-AllPersistence supports Powershell's help features, so you can get detailed, updated help by using the following command after importing the module:

Get-Help -Name Find-AllPersistence -Full

PersistenceSniper's Find-AllPersistence returns an array of objects of type PSCustomObject with the following properties:

This allows for easy output formatting and filtering. Let's say you only want to see the persistences that will allow the attacker to regain access as NT AUTHORITY\SYSTEM (aka System):

PS C:\> Find-AllPersistence | Where-Object "Access Gained" -EQ "System"

Of course, being PersistenceSniper a Powershell-based tool, some cool tricks can be performed, like passing its output to Out-GridView in order to have a GUI-based table to interact with.

Interpreting results

As already introduced, Find-AllPersistence outputs an array of Powershell Custom Objects. Each object has the following properties, which can be used to filter, sort and better understand the different techniques the function looks for:

• ComputerName: this is fairly straightforward. If you run Find-AllPersistence without a -ComputerName parameter, PersistenceSniper will run only on the local machine. Otherwise it will run on the remote computer(s) you specify;
• Technique: this is the name of the technique itself, as it's commonly known in the community;
• Classification: this property can be used to quickly identify techniques based on their MITRE ATT&CK technique and subtechnique number. For those techniques which don't have a MITRE ATT&CK classification, other classifications are used, the most common being Hexacorn's one since a lot of techniques were discovered by him. When a technique's source cannot be reliably identified, the "Uncatalogued Technique N.#" classification is used;
• Path: this is the path, on the filesystem or in the registry, at which the technique has been implanted;
• Value: this is the value of the registry property the techniques uses, or the name of the executable/library used, in case it's a technique which relies on planting something on the filesystem;
• Access Gained: this is the kind of access the technique grants the attacker. If it's a Run key under HKCU for example, the access gained will be at a user level, while if it's under HKLM it will be at system level;
• Note: this is a quick explanation of the technique, so that its workings can be easily grasped;
• Reference: this is a link to a more in-depth explanation of the technique, should the analyst need to study it more.

Dealing with false positives

Let's face it, hunting for persistence techniques also comes with having to deal with a lot of false positives. This happens because, while some techniques are almost never legimately used, many indeed are by legit software which needs to autorun on system boot or user login.

This poses a challenge, which in many environments can be tackled by creating a CSV file containing known false positives. If your organization deploys systems using something like a golden image, you can run PersistenceSniper on a system you just created, get a CSV of the results and use it to filter out results on other machines. This approach comes with the following benefits:

• Not having to manage a whitelist of persistences which can be tedious and error-prone;
• Tailoring the false positives to the organizations, and their organizational units, which use the tool;
• Making it harder for attackers who want to blend in false positives by not publicly disclosing them in the tool's code.

Find-AllPersistence comes with parameters allowing direct output of the findings to a CSV file, while also being able to take a CSV file as input and diffing the results.

PS C:\> Find-AllPersistence -DiffCSV false_positives.csv

 

Looking for persistences by taking incremental snapshots

One cool way to use PersistenceSniper my mate Riccardo suggested is to use it in an incremental way: you could setup a Scheduled Task which runs every X hours, takes in the output of the previous iteration through the -DiffCSV parameter and outputs the results to a new CSV. By keeping track of the incremental changes, you should be able to spot within a reasonably small time frame new persistences implanted on the machine you are monitoring.

Persistence techniques implemented so far

The topic of persistence, especially on Windows machines, is one of those which see new discoveries basically every other week. Given the sheer amount of persistence techniques found so far by researchers, I am still in the process of implementing them. So far the following 31 techniques have been implemented successfully:

• Run Key
• RunOnce Key
• Image File Execution Options
• Natural Language Development Platform 6 DLL Override Path
• AEDebug Keys
• Windows Error Reporting Debugger
• Windows Error Reporting ReflectDebugger
• Command Prompt AutoRun
• Explorer Load
• Winlogon Userinit
• Winlogon Shell
• Windows Terminal startOnUserLogin
• AppCertDlls DLL Injection
• App Paths Hijacking
• ServiceDll Hijacking
• Group Policy Extensions DLLs
• Winlogon MPNotify
• CHM Helper DLL
• Hijacking of hhctrl.ocx
• Startup Folder
• User Init Mpr Logon Script
• AutodialDLL Winsock Injection
• LSA Extensions DLL
• ServerLevelPluginDll DNS Server DLL Hijacking
• LSA Authentication Packages DLL
• LSA Security Packages DLL
• Winlogon Notify Packages DLL
• Explorer Tools Hijacking
• .NET DbgManagedDebugger
• ErrorHandler.cmd Hijacking
• WMI Subscriptions

Credits

The techniques implemented in this script have already been published by skilled researchers around the globe, so it's right to give credit where credit's due. This project wouldn't be around if it weren't for:

• Hexacorn and his never-ending Beyond good ol' Run key series;
• Grzegorz Tworek and his amazing persistence-info.github.io website;
• All the other researchers who disclosed cool and unknown persistence techniques.

I'd also like to give credits to my fellow mates at @APTortellini, in particular Riccardo Ancarani, for the flood of ideas that helped it grow from a puny text-oriented script to a full-fledged Powershell tool.

License

This project is under the CC0 1.0 Universal license. TL;DR: you can copy, modify, distribute and perform the work, even for commercial purposes, all without asking permission.

Download PersistenceSniper

[Template] Incident Response for Management Presentation