Thread by @jhencinski

Can we detect ZIP / JScript for initial access on 🪟?

1. Open txt editor
2. var WshShell = new ActiveXObject("Wscript.Shell");

WshShell.Popup("You can configure WSH files to open in Notepad");

WScript.exit;

3. Save as 1.js
4. Double-click
5. Query SIEM / EDR

What about #BEC in O365?

1. Create an inbox rule to fwd emails to the RSS Subscriptions folder
2. Query your SIEM
3. How often does this happen?
4. Can you build alert or cadence around inbox rule activity?

What about lateral movement?

1. Open PS
2. wmic /node:localhost process call create "cmd.exe /c notepad"
3. winrs:localhost "cmd.exe /c calc"
4. schtasks /create /tn legit /sc daily /tr c:\users\<user>\appdata\legit.exe
5. Query SIEM / EDR

What about hijacked scheduled tasks?

1. Open PS
2. copy calc.exe c:\legit.exe
3. schtasks /s localhost /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /st 12:00 /enable /tr "c:\legit.exe"
4. Interrogate your #SIEM and #EDR
5. Improve

What about evil PS commands?

1. Open PS
2. powershell -Enc cABpAG4AZwAuAGUAeABlACAAZwBvAG8AZwBsAGUALgBjAG8AbQA=
3. powershell -exec bypass -window hidden -noni -nop -encoded aABvAHMAdABuAGEAbQBlAA==
4. Query SIEM / EDR

What's the point of this thread?

Simple tests like the above are a great way to understand what you can and can't see (yet!)

Atomic Red Team is an incredible resource to run tests like these mapped to ATT&CK

But don't be afraid to start small in a shell or your O365 inbox!