nasbench

• SPAirPortDataType
• SPApplicationsDataType
• SPAudioDataType
• SPBluetoothDataType
• SPCameraDataType
• SPCardReaderDataType
• SPConfigurationProfileDataType
• SPDeveloperToolsDataType
• SPDiagnosticsDataType
• SPDisabledSoftwareDataType

nasbench

<?xml version="1.0"?>
<SiPolicy xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="urn:schemas-microsoft-com:sipolicy">
  <VersionEx>10.0.0.0</VersionEx>
  <PolicyTypeID>{4E61C68C-97F6-430B-9CD7-9B1004706770}</PolicyTypeID>
  <PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
  <Rules>
    <Rule>
      <Option>Enabled:UMCI</Option>
    </Rule>
    <Rule>

nasbench

Detecting RMM

The most difficult challenge with RMM detection is contextual awareness around usage to determine if it is valid or malicious.

• if the software is not used in the envrionment
  • could it be legitimate by a random empoyee?
  • is it an attacker BYOL
  • even so, all occurrences could probably be considered suspicious
• if it is used in the environment
  • is every use of it legitimate? Probably not
• this also creates significant living off the land (LOL) opportunity

nasbench

sing System;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
 
 
  
/*
Author: Casey Smith, Twitter: @subTee

nasbench

800, AntiVirus
801, AntiSpyware
802, Antimalware
803, Full
804, Delta
805, Full Scan
806, Quick Scan
807, Custom Scan
808, Remove
809, Quarantine

nasbench

Invoke-CommandInDesktopPackage

You can execute commands in the context of an AppX Package to gain access to it's virtualized resources (example virtualized registry keys or files)

Docs

https://learn.microsoft.com/en-us/powershell/module/appx/invoke-commandindesktoppackage?view=windowsserver2022-ps

Example

nasbench

Malicious CHM - Proof of Concept

Here are the steps to follow in order to create a malicious CHM file. As used by APT37

• Download the HTML Help Workshop (Htmlhelp.exe) from MSDN. If the link is dead you can use the archive version here
• Once installed you should have a folder C:\Program Files (x86)\HTML Help Workshop and inside the Microsoft HTML Help Compiler (hhc.exe)
• We need to create 3 files:
  • Project File .hpp
  • HTML File .htm
• Table of Contents File .hhc

nasbench

DumpMinitool.exe LOLBIN

This binary can be used as a LOLBIN as described here

Addtional Info

• The arguments flags are meaningless only the order is important. This means as long as you provide exactly 6 flags and their value the binary will still work. Here are the exact positions for reference:

// Usage: --file <fullyResolvedPath> --processId <processId> --dumpType <dumpType>

nasbench

Microsoft.NodejsTools.PressAnyKey.exe LOLBIN

This binary can be used as a LOLBIN as described here.

Addtional Info

• The arguments number must be at least 3
• The first first argument can be anything (instead of both, normal or abnormal). Since the switch clause doesn't specify a default case. And the flag variable is set to true before the check.
• The second argument also can be anything and it will be written to the execution path with the contents being the PID of the process File.WriteAllText(args[1], process.Id.ToString());
• The thrid argument is passed directly to ProcessStartInfo and is executed Process.Start(startInfo);. Hence anything can be called

nasbench

# Source: System.Management.Automation.dll
# This list is used to determin if a ScriptBlock contains potential suspicious content
# If a match is found an automatic 4104 with a "warning" level is generated.
# https://github.com/PowerShell/PowerShell/blob/master/src/System.Management.Automation/engine/runtime/CompiledScriptBlock.cs
- "Add-Type"
- "AddSecurityPackage"
- "AdjustTokenPrivileges"
- "AllocHGlobal"
- "BindingFlags"
- "Bypass"