Tweet

More from @inversecos

inversecos ᐡ ꒳ ᐡ

@inversecos

Jun 22

1\ #ThreatHunting: How to detect Linux anti-forensics log tampering

Attackers can alter the utmp, wtmp, btmp files to hide malicious logon attempts by:

> Zeroing entries out in hex
> Overwriting the files with a malicious copy

BLOG POST BELOW 👇 UwU
inversecos.com/2022/06/detect…

2\ Method 1: Zeroing entries in hex

This leaves OBVIOUS AF traces. Look for entries with zeros, and datetime defaulting to 1970. You can also review timestamps (covered in thread 4).

I highlighted in purple where you zero out the data in hex.

3\ Method 2: Overwriting the file

Overwrite the entire entry with a "cleaned" version. In this example I removed all lines pertaining to "sansforensics" logging in. Timestamp detection is the best method to discover this technique.

Read 4 tweets

inversecos ᐡ ꒳ ᐡ

@inversecos

May 19

1\ #ThreatHunting: How to detect fileless Linux malware

Look for processes in /proc/<PID>/exe where the path shows "(deleted)"

Here are two examples👇
1. BPFDoor deleted binary
2. An attacker abusing memfd_create() to exec their malware in RAM w/o dropping files to disk.

2\ To recover/extract these binaries running in memory - you can copying them out from this location:

/proc/<PID>/exe

Also as an FYI for memfd_create() abuse detection you can hunt for the "memfd: (deleted)" string directly.

3\ You can also review what command line spawned the pid by reviewing:

/proc/<PID>/cmdline

This screenshot shows the cmdline used for the memdf_create() reverse shell. There are a lot of other interesting things you can also review in /proc/PID

Read 4 tweets

inversecos ᐡ ꒳ ᐡ

@inversecos

Apr 28

1\ How to detect file timestomping 👀

APT28, APT29, APT32, APT38 have all used this defence evasion technique to modify malicious file creation times. 😈

Did you also know it's possible to timestomp $FN time?

👇👇 BLOG & TL;DR BELOW 👇👇

bit.ly/3KsX1ua

2\ Most IR analysts are taught to detect timestomping using two methods:

> Compare $FI vs $SI times in the MFT
> Look for 0s in timestamp nanoseconds

These two detections are NOT foolproof - they will catch simple cases. Attackers can set nanoseconds and modify $FN time!

3\ Why should you care?

Most forensic courses teach these 2 detections without introducing more variables. A lot of analysts treat what they are taught as the "bible" without questioning it and when it comes to detecting these anomalies... critical evidence may be missed.

Read 6 tweets

inversecos ᐡ ꒳ ᐡ

@inversecos

Apr 6

1\ #DefenceEvasion Technique: Maliciously Modifying Registry Timestamps 👿👀

This technique doesn't log events in the Security.evtx and is almost trivial to perform as a defence evasion technique...

Read my blog for technique + detection:
bit.ly/3r7jfuO

TL;DR 👇👇

2\ Why should you care?

During an IR, registry timestamps are important evidence items for timelining & triaging an incident. They answer questions like...

> What files did the TAs open?
> When was a security tool disabled?
> What folders were the TAs looking at?
> etc...

3\ The native API "NtSetInformationKey" specifically allows a TA to overwrite a registry "Last Write" timestamp in an extremely trivial manner.

The param KEY_SET_INFORMATION_CLASS being passed the value KEY_WRITE_TIME_INFORMATION is what performs this.

undocumented.ntinternals.net/UserMode/Undoc…

Read 10 tweets

inversecos ᐡ ꒳ ᐡ

@inversecos

Mar 23

1\ Windows Event Log Evasion via Native APIs 👀🧠

Some native Windows API calls can be used to install services WITHOUT generating correlating entries in the event log. This was seen in Stuxnet.

This blog covers the technique + detection.

bit.ly/3D7KI4n

TL;DR 👇👇

2\ High level of how the technique works.....

Services are normally created through standard API calls to “CreateServiceA” using sc.exe/at.exe. This API is what EDR usually detects on.

Note that using svcscan.. Stuxnet isnt showing any of the malicious services ...why is that?

3\ The "svcscan" plugin detects services using two methods:

1. Walk the VAD tree reviewing process memory for indicators of running services

2. Identify service records with the tags 'sErv' and 'serH' which finds any services unlinked from the doubly / linked list.

Read 10 tweets

inversecos ᐡ ꒳ ᐡ

@inversecos

Mar 9

1\ How to detect what command line spawned a process with no EDR/AV? 👀 #DFIR

If you have a memory sample, this is how you can figure out what cmd spawned the processes by using volshell and memory forensics.

STEP BY STEP GUIDE BELOW

👇 👇 👇 👇

#MemoryForensics

2\ Each process in Windows is represented by an "EPROCESS" structure.

These EPROCESS blocks are joined in a doubly linked list structure. The flink (forward link) tells you the next process running and blink (backwards link) tells you the previous process.

3\ When you see a list of processes on a live system, often times this is gathered by walking this doubly-linked structure of EPROCESS blocks.

Of course malware can unlink a process in this doubly linked list to hide from detection :P

Read 13 tweets

Share this page!

inversecos ᐡ ꒳ ᐡ

People who liked this thread also liked...

Try unrolling a thread yourself!

More from @inversecos

inversecos ᐡ ꒳ ᐡ

inversecos ᐡ ꒳ ᐡ

inversecos ᐡ ꒳ ᐡ

inversecos ᐡ ꒳ ᐡ

inversecos ᐡ ꒳ ᐡ

inversecos ᐡ ꒳ ᐡ

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?