| Invoke-WebRequest -Uri https://attack.mitre.org/docs/subtechniques/subtechniques-crosswalk.json | | |
| Select-Object -ExpandProperty Content | | |
| ConvertFrom-Json | | |
| ForEach-Object { | |
| $OldTID = Get-Member -InputObject $_ -MemberType NoteProperty -Name T* | | |
| Select-Object -ExpandProperty Name; | |
| [PSCustomObject] @{ OldTID = $OldTID; NewTID = $_.$OldTID[0].id; Explanation = $_.$OldTID[0].explanation } } | | |
| Sort-Object NewTID, OldTID |
| { | |
| "BeaconType": [ | |
| "HTTPS" | |
| ], | |
| "Port": 443, | |
| "SleepTime": 5000, | |
| "MaxGetSize": 1049611, | |
| "Jitter": 99, | |
| "MaxDNS": 255, | |
| "C2Server": "static.rennorigroup.com,/api/v1/meemes/latest", |
| ID | Name | MitigatedByAppControl | Notes | |
|---|---|---|---|---|
| T1001 | Data Obfuscation | Not Applicable | Relevant sub-techniques addressed below | |
| T1001.001 | Junk Data | No | Technique is not necessarily related to the execution of arbitrary code on an endpoint. | |
| T1001.002 | Steganography | Limited | If custom attacker code were necessary to perform this technique, it would be prevented. | |
| T1001.003 | Protocol Impersonation | Limited | If custom attacker code were necessary to perform this technique, it would be prevented. | |
| T1003 | OS Credential Dumping | Not Applicable | Relevant sub-techniques addressed below | |
| T1003.001 | LSASS Memory | Limited | Built-in utilities exist to perform this technique. They would have to be explicitly blocked. | |
| T1003.002 | Security Account Manager | Limited | Built-in utilities exist to perform this technique. They would have to be explicitly blocked. | |
| T1003.003 | NTDS | Limited | Built-in utilities exist to perform this technique. They would have to be explicitly blocked. | |
| T1003.004 | LSA Secrets | Limited | Built-in utilities exist to perform this technique. |
| <?xml version="1.0" encoding="utf-8"?> | |
| <SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy"> | |
| <VersionEx>10.0.0.0</VersionEx> | |
| <PolicyTypeID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyTypeID> | |
| <PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID> | |
| <Rules> | |
| <Rule> | |
| <Option>Enabled:Unsigned System Integrity Policy</Option> | |
| </Rule> | |
| <Rule> |
| <?xml version="1.0" encoding="utf-8"?> | |
| <SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy"> | |
| <VersionEx>10.0.1.0</VersionEx> | |
| <PolicyID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyID> | |
| <BasePolicyID>{A244370E-44C9-4C06-B551-F6016E563076}</BasePolicyID> | |
| <PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID> | |
| <Rules> | |
| <Rule><Option>Enabled:Unsigned System Integrity Policy</Option></Rule> | |
| <Rule><Option>Enabled:Audit Mode</Option></Rule> | |
| <Rule><Option>Enabled:Advanced Boot Options Menu</Option></Rule> |
Step 1) Start an AMSI ETW trace from an elevated command prompt
logman start trace AMSITrace -p Microsoft-Antimalware-Scan-Interface (Event1) -o amsi.etl -ets
Step 2) Run your evil maldoc or script. Note: AMSI can capture runtime context of VBA, Excel4, JScript, VBScript, PowerShell, WMI, and .NET (4.8+) in-mem assembly loads
Step 3) Stop the AMSI trace
| function Start-ProcessWithCommandLine { | |
| <# | |
| .SYNOPSIS | |
| A simple CreateProcess wrapper for demonstrating starting a process with custom command-line arguments. | |
| Author: Matt Graeber | |
| Company: Red Canary, Inc. | |
| .PARAMETER ApplicationName |
| <Sysmon schemaversion="4.50"> | |
| <HashAlgorithms>md5,sha256</HashAlgorithms> | |
| <EventFiltering> | |
| <!--Event ID 1: Process creation--> | |
| <ProcessCreate onmatch="include"></ProcessCreate> | |
| <!--Event ID 2: A process changed a file creation time--> | |
| <FileCreateTime onmatch="include"></FileCreateTime> | |
| <!--Event ID 3: Network connection--> | |
| <NetworkConnect onmatch="include"></NetworkConnect> | |
| <!--Event ID 5: Process terminated--> |
| <QueryList> | |
| <Query Id="0" Path="Security"> | |
| <Select Path="Security"> | |
| *[System[(EventID='4688')]] | |
| and | |
| *[EventData[Data[@Name='NewProcessName']='C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe']] | |
| </Select> | |
| <Select Path="Microsoft-Windows-PowerShell/Operational"> | |
| *[System[(EventID='4104')]] | |
| and |
| <?xml version="1.0" encoding="utf-8"?> | |
| <SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy"> | |
| <VersionEx>10.0.1.0</VersionEx> | |
| <PolicyID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyID> | |
| <BasePolicyID>{A244370E-44C9-4C06-B551-F6016E563076}</BasePolicyID> | |
| <PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID> | |
| <Rules> | |
| <Rule> | |
| <Option>Enabled:Unsigned System Integrity Policy</Option> | |
| </Rule> |