Isolating the Ghost in the Machine: Unveiling Post Exploitation Threatsrsac
1 like186 views
The document discusses the threat of agentless/non-malware attacks and presents a framework to assess the maliciousness of scripts, particularly focusing on VBA and PowerShell. It details case studies of malware campaigns, such as Dridex and Anunak, explaining their execution flow and methods of obfuscation. Additionally, the document introduces symbolic execution as a potential technique for analysis and various patterns associated with suspicious activities in scripts.
Isolating the Ghost in the Machine: Unveiling Post Exploitation Threatsrsac
- 1. SESSION ID:SESSION ID: #RSAC Rotem Salinas Isolating the Ghost in the Machine: Unveiling Post Exploitation Threats HTA-R11 Senior Security Researcher RSA Security Rotem.Salinas@rsa.com @rotemsalinas Uri Fleyder-Kotler Advanced Threats Research Lab Manager RSA Security Uri.Fleyder@rsa.com @ufleyder
- 2. #RSAC Houston We Have a Problem 2 Agentless/non malware attacks is a rapidly growing threat Attackers are implementing stealthier methods to bypass defenses
- 3. #RSAC Research Goals 3 Goals Find a way to assess a script’s “maliciousness” automatically Do it without the potential harm of infection Make it fast! Narrow the problem space VBA Powershell Not focused on the code extraction The same concepts can apply to similar problems
- 4. #RSAC The “Imaginary Engine” 4 How can we develop such 1337 imaginary engine Problem solving in 3 basic steps Analyze Brainstorming Implementation
- 5. #RSAC The First Step – Malware Analyst Standpoint 5 Determine Execution Flow Deobfuscate Find Suspicious Activity Traditional Static Analysis Approach
- 6. #RSAC Perception Test – What Attackers Do? 6
- 7. #RSAC The First Step – Understanding The Attacker’s Mindset 7
- 8. #RSAC The First Step – Understanding The Attacker’s Mindset 8
- 9. #RSAC The First Step – The Attacker’s Main Objectives 9 Objectives Indicators Code execution Prerequisite, Spawning New Processes/Threads Persistency Disk operations, Registry operations Stealth OS manipulation Enumeration Registry operations, Enumeration Command & Control / Data Exfiltration Network operations Lateral Movement Network operations, Enumeration
- 10. #RSAC Case Study – Dridex Campaign 10 Peaked during 2015-2016 Used Macro in Office Documents to deploy Dridex variants Targeted many companies and financial entities around the world Delivered in a large scale Spam/Spear-Phishing campaigns
- 11. #RSAC Case Study – Dridex Campaign 11
- 12. #RSAC Case Study 1 – Dridex Campaign 12 Entrypoint – This is where the code starts its execution Non-Linear Code Execution - GoTo jumping to labels
- 13. #RSAC Case Study 1 – Dridex Campaign 13 COM Object Creation
- 14. #RSAC Case Study 1 – Dridex Campaign 14 URL De-Obfuscation + Http Request Creation
- 15. #RSAC Case Study 1 – Dridex Campaign 15 Sending GET request Initializing ADODB object to write file to disk
- 16. #RSAC Case Study 1 – Dridex Campaign 16 Writing Response Body Data to disk
- 17. #RSAC Case Study 1 – Dridex Campaign 17 Executing Downloaded File
- 18. #RSAC Case Study – Anunak/Carbanak 18 Financial APT Only 1 submission to VT Attributed to Anunak Cybergang Final payload VBS/Powershell PE Executable See Full Analysis in Appendix
- 19. #RSAC The Second Step – Brainstorming 19 Common approaches pros and cons Hooking — Use available source code or patch existing dll/exe — Inserting code that would sink certain expressions — Remove potentially harmful code Taint Analysis / Symbolic Execution — Implement an engine that would emulate the language interpreter — The engine should evaluate each line of code — Instead of invoking potentially harmful expressions it would sink them
- 20. #RSAC We Have a Winner! 20 Symbolic Execution Pros — Cannot harm the machine in any way (even if we missed something) — We know exactly how it works. NO Reverse Engineering! — Not limited to specific platform/OS Cons — Hard to Implement — Might lack some language functionality
- 21. #RSAC Symbolic Execution: Double Sweep Method 21 First sweep Global context — Global variables — Code Function declarations External DLL declarations
- 22. #RSAC Symbolic Execution: Double Sweep Method 22 Second sweep Function code - starts with Entrypoint Follows execution flow Executes stubs instead of built-in language functions Evaluates expressions — Math — String manipulation — Logical expressions (condition evaluation)
- 23. #RSAC Implementation Details 23 Python PyParsing Dave Beazley’s (Python guru) PLY – Python Lex Yacc — Lex – lexical analysis/tokenizer — Yacc (Yet Another Compiler Compiler) – Syntax Analyzer BNF – Backus Naur Form Where to start RTFM
- 24. #RSAC Lexical Analyzer (Tokenizer) 24 Tokens Language keywords Immediate values — Strings — Integer/numeric values — Floating point values — Arrays/compound data-types Identifiers – variable names, function names, object names Operators – math, bitwise, logical, string manipulation * Diagram courtesy of David Beazley
- 25. #RSAC Syntax Analyzer (Parser) 25 Parses a language syntax according to the tokenized output from the lexer The language syntax/grammar is defined by multiple functions Each function represents a BNF expression and will pass the parsed/extracted values to the next function inline according to the BNF statement * Diagram courtesy of David Beazley
- 26. #RSAC PLY Lex Example 26 * Diagram courtesy of David Beazley
- 27. #RSAC PLY Lex Example 27 * Diagram courtesy of David Beazley
- 28. #RSAC PLY Lex Example 28 * Diagram courtesy of David Beazley
- 29. #RSAC PLY Lex Example 29 * Diagram courtesy of David Beazley
- 30. #RSAC PLY Lex Example 30 * Diagram courtesy of David Beazley
- 31. #RSAC PLY Lex Example 31 * Diagram courtesy of David Beazley
- 32. #RSAC PLY Lex Example 32 * Diagram courtesy of David Beazley
- 33. #RSAC PLY Lex Example 33 * Diagram courtesy of David Beazley
- 35. #RSAC PLY Yacc Example 35 * Diagram courtesy of David Beazley
- 36. #RSAC PLY Yacc Example 36 * Diagram courtesy of David Beazley
- 37. #RSAC PLY Yacc Example 37 * Diagram courtesy of David Beazley
- 38. #RSAC PLY Yacc Example 38 * Diagram courtesy of David Beazley
- 39. #RSAC PLY Yacc Example 39 * Diagram courtesy of David Beazley
- 40. #RSAC Engine Design Overview 40 Scoring Blacklist (score++) Whitelist (score--) A higher score -> more malicious If score >= threshold Then isMalicious = True;
- 41. #RSAC Obfuscation As Heuristics 41 Obfuscation can be a strong indicator for malicious behavior Examples Object returned from function call Object created from function call return value string
- 42. #RSAC Obfuscation As Heuristics – More Examples 42 More Examples Self modifying code (during runtime) Data read from controls embedded in the document is considered suspicious
- 44. #RSAC The Age Old Question of FP vs. FN 44 False positives False negatives Decide what works best for you!
- 45. #RSAC Lessons Learned 45 Challenges Condition evaluation Recursion limit Lessons When in doubt bruteforce! Use the language specification guide as a guideline rather than implementing every language feature that exists
- 46. #RSAC Apply 46 DIY 1: Develop It Yourself DIY 2: Deploy In Your Organization Network Endpoint Use for your investigations
- 47. #RSAC Q&A Rotem Salinas Uri Fleyder-Kotler Uri.Fleyder@rsa.com @ufleyder Rotem.Salinas@rsa.com @rotemsalinas
- 48. #RSAC VBA Indicators of Suspicious Activity 48 File System Operations COM Objects: Scripting.FileSystemObject, ADODB.Stream Cmd – output redirect/copy/del/move Open builtin function Importing External DLLs - URLMON Network Operations COM Objects: Microsoft.XMLHTTP, WinHttp.WinHttpRequest OS Manipulation Importing External DLLs – KERNEL32 WMI Objects Registry Importing External DLLs – ADVAPI32
- 49. #RSAC VBA Indicators of Suspicious Activity 49 Enumeration WMI Objects Cmd – net share/net use/ipconfig/environment variables Obfuscation Self Modifying Code Eval CodeModule Obfuscation Beyond Reasonable Doubt
- 50. #RSAC VBA Indicators of Suspicious Activity 50 COM Object Creation WMI Objects Creation Self Modifying Code Eval CodeModule Built-In Functions Importing External DLL Obfuscation Beyond Reasonable Doubt
- 51. #RSAC VBA – COM Object Creation – Network Activity 51 Rule of thumb - If your Office Documents are communicating you are in serious trouble Network Activity - COM Objects Microsoft.XMLHTTP MSXML2.SERVERXMLHTTP.6.0 MSXML2.SERVERXMLHTTP MSXML2.XMLHTTP WinHttp.WinHttpRequest.5.1 WinHttp.WinHttpRequest InternetExplorer.Application
- 52. #RSAC VBA – COM Object Creation – Network Activity 52 Microsoft.XMLHTTP WinHttp.WinHttpRequest.5.1
- 53. #RSAC VBA – COM Object Creation – File System Activity 53 Scripting.FileSystemObject ADODB.Stream
- 54. #RSAC VBA – COM Object Creation – Command Execution 54 WScript.Shell Shell.Application
- 55. #RSAC VBA – COM Object Creation – Obfuscation 55 XStandard.Base64 MSXML2.DOMDocument.3.0 MSXML2.DOMDocument
- 56. #RSAC VBA – Built-In Functions 56 CreateObject – Create COM object by String Object Name GetObject – Create WMI/COM object Eval – Covered In Self-Modifying ExecuteGlobal – VBS specific CallByName – Calls a Function/Method by string name Shell – Executes a Command Environ – Evaluates Environment Variables Kill – Deletes a File Application.Run – Calls a Function by String Name
- 57. #RSAC VBA – WMI Object Creation 57 winmgmts:impersonationLevel=impersonate}!.rootcimv2 Examples . .
- 58. #RSAC VBA – Self-Modifying Code – Code Module 58 CodeModule – Allows modifications of the VBA code
- 59. #RSAC VBA – Self-Modifying Code – Eval 59 Eval - Evaluates an expression and executes it code ExecuteGlobal
- 60. #RSAC VBA – Open Built-In Function 60 Write to File with Open Built-In Function
- 61. #RSAC VBA – Importing External DLL 61 Win32 API Examples . .
- 62. #RSAC Appendix – Case Study 1 A - Dridex 62 Entrypoint – This is where the code starts its execution Non-Linear Code Execution - GoTo jumping to labels
- 63. #RSAC Appendix – Case Study 1 A - Dridex 63 COM Object Creation
- 64. #RSAC Appendix – Case Study 1 A - Dridex 64 URL De-Obfuscation + Http Request Creation
- 65. #RSAC Appendix – Case Study 1 A - Dridex 65 Sending GET request Initializing ADODB object to write file to disk
- 66. #RSAC Appendix – Case Study 1 A - Dridex 66 Writing Response Body Data to disk
- 67. #RSAC Appendix – Case Study 1 A - Dridex 67 Executing Downloaded File
- 68. #RSAC Appendix – Case Study 1 B - Dridex 68 Defining Globals Entrypoint
- 69. #RSAC Appendix – Case Study 1 B - Dridex 69 Create obfuscated COM object
- 70. #RSAC Appendix – Case Study 1 B - Dridex 70 Create more obfuscated COM objects
- 71. #RSAC Appendix – Case Study 1 B - Dridex 71 Deobfuscate URL and create GET request
- 72. #RSAC Appendix – Case Study 1 B - Dridex 72 Send GET request
- 73. #RSAC Appendix – Case Study 1 B - Dridex 73 Receive Response Body and write to File
- 74. #RSAC Appendix – Case Study 1 B - Dridex 74 Save To Disk Execution
- 75. #RSAC Appendix – Case Study 2 - Ananuk 75 Entrypoint De-obfuscate
- 76. #RSAC Appendix – Case Study 2 - Ananuk 76 Beacon and Deploy final Payload De-Obfuscate
- 77. #RSAC Appendix – Case Study 2 - Ananuk 77 Beacon Command & Control – Phase 1 Deobfuscate
- 78. #RSAC Appendix – Case Study 2 - Ananuk 78 Beacon Command & Control – Phase 2 Deobfuscate
- 79. #RSAC Appendix – Case Study 2 - Ananuk 79 Deploy Base64 Payload Write Base64 Decoded Payload to Temp Path Execute Payload
- 80. #RSAC Appendix – Case Study 2 - Ananuk 80 Analyzing Payload 1 Payload is an icon Used for credibility Attempts to gain persistency on the Victim’s machine both by using known Autorun registry paths and by creating A scheduled task using the schtasks command
- 81. #RSAC Appendix – Powershell Indicators of Suspicious Activity 81 .NET Objects .NET Reflection Add-Type New-Object WinAPI32 DLL Loading WMI Objects Invoke-WmiMethod Command Execution Invoke-Command COM Objects New-Object –Com
- 82. #RSAC Appendix – Powershell Obfuscation 82 Obfuscation Methods Base64 SecureString Custom Decoding Methods
- 83. #RSAC Powershell Techniques - .NET Reflection 83 Example 1 – LoadWithPartialName Example 2 - LoadName
- 84. #RSAC Powershell Techniques - Add-Type .NET code injection 84 Creation of a new type/class using .NET code Creating an instance of the class and invoking it’s Start method
- 85. #RSAC Powershell Techniques – New-Object 85 Creating an object instance In this example System.Net.WebClient instance is created in order to download a file
- 86. #RSAC Powershell Techniques - Invoke-WmiMethod 86 Using WMI for enumeration and system maniupulation In this case creating a key in the windows registry
- 87. #RSAC Powershell Techniques - DLL loading 87 Resolving Native Win32 API functions $module = “kernel32.dll” API Function to be resolved
- 88. #RSAC Powershell Techniques - New-Object -com 88 Similarly to the COM objects in VBA The same COM objects can be used in Powershell using this command
- 89. #RSAC Powershell Techniques Obfuscation 89 Obfuscation methods in Powershell Adding Ticks (Escapes special characters but ignored if used non- special characters) + Lowercase/Uppercase String Concatenation/Manipulation Get-Command + WildCards + Aliases Invoke-Expression
- 90. #RSAC Powershell Techniques Obfuscation - Base64 90 Base64 using .NET classes CertUtil By Executing the certutil tool as a command certutil -decode encodedInputFileName decodedOutputFileName
- 91. #RSAC Case Study 3 – Targeted Spear Phishing Campaign 91 Javascript outer script with obfuscated strings Base64 encoded payloads Each string in the list is reversed A list of string including commands and base64 Encoded payloads
- 92. #RSAC Case Study 3 – Targeted Spear Phishing Campaign 92 Deploys 3 Powershell scripts on the victims machine Payload 1 – .NET code injection using Add-Type Creation of a new type/class using .NET code Creating an instance of the class and invoking it’s Start method
- 93. #RSAC Case Study 3 – Targeted Spear Phishing Campaign 93 Payload 2 – .NET code injection using Add-Type like the 1st payload Imports multiple Win32 api functions using .NET
- 94. #RSAC Case Study 3 – Targeted Spear Phishing Campaign 94 Payload 3 – Downloads TOR Proxifier as scheduled task
- 95. #RSAC Case Study 4 – Powersploit + Invoke-Obfuscation 95 Open source project available on GitHub PowerSploit includes capabilities such as: Shellcode injection Reflective DLL injection WMI Code execution Mimikatz – NTLM/LM password dump Invoke-Obfuscation is a Powershell code obfuscation framework developed by Daniel Bohannon