Stephan Berger Profile picture
Aug 19 5 tweets 3 min read
1/ #Hardening:

If the Windows App sideloading feature is enabled, users can also install APPX packages not originating not from the Microsoft Store, ideal for distributing malware with these packages 🤯[1],[2]

🧵 #CyberSecurity
2/ We can search our network for systems with enabled sideloading:

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock".
3/
AllowAllTrustedApps:

This value can also be set via GPO if a company wants to distribute trusted line-of-business (LOB) apps that are not from the Windows Store.

However, these apps must still have a valid certificate chain; otherwise, the app will not be loaded.
4/ The value AllowDevelopmentWithoutDevLicense was set on my test machine as soon as I turned on the sideloading feature.
5/ If you want to find out more about malicious apps, @SentinelOne wrote an excellent article about this topic.

[1] sentinelone.com/labs/inside-ma…
[2]

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Stephan Berger

Stephan Berger Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @malmoeb

Aug 17
1/ #ThreatHunting:

#QuasarRAT is another RAT we see from time to time in our IR cases and was also used against NATO facilities in March. [1]

We can hunt for

1⃣ The default port within the FW logs
2⃣Mutexes
3⃣User-Agent
4⃣Persistence mechanisms

🧵
2/ @qualys has published an excellent paper ("Stealthy Quasar Evolving to Lead the RAT Race") about Quasar, where the whole builder and much more are described in detail. [2]
3/ In the client builder (which creates an executable which is used for the infection), the default port is pre-configured to 4782. Image
Read 12 tweets
Aug 14
1/ #ThreatHunting

MeshCentral is another remote admin software installed by TAs we have seen in our IR cases [1].

Following is a brief introduction to the software and what forensic traces MeshCentral leaves on the network and the hosts. 🧵

#CyberSecurity
2/ For our tests, we use the hosted instance of MeshCentral.com, but the management software can also be run on a separate server, controlled by the TA.

After logging into the panel, we can download an agent for different operating systems (Windows, Mac, Linux).
3/ Before the installation or execution of the agent, the server URL is displayed under "Connection Details".

In our example, the agent connects to meshcentral.com, but another domain can be configured when the management server is self-hosted.
Read 19 tweets
Aug 8
1/ Playing around with #manjusaka, as reported by @TalosSecurity [1].

Following are some insights and potential #ThreatHuning tips and ideas. 🧵

#CyberSecurity @b3ard3dav3ng3r
2/ After starting the ELF binary (a reduced version is publicly available on GitHub [2]), the login credentials are printed out (username: manjusaka, PW: b3e..), and the port (3200) on which the panel is accessible.
3/ The password is different for each instance of manjusaka.

This mechanism prevents the use of default passwords in case scanners would find the login panel.
Read 19 tweets
Aug 6
1/ #ThreatHunting for #AsyncRAT

We have various ways to find infected hosts with AsyncRAT:

1⃣ Usage of standard C2 ports
2⃣Hunting for persistence
3⃣Mutexes FTW
4⃣Last but not least, hunting for dropped DLLs

Let's go 🤠🧵

#CyberSecurity
2/ AsyncRAT is a popular Trojan executed at the end of an infection chain on target computers.

@hpsecurity ([2],[3]) and @Trellix ([4]) have both reported in recent reports that TAs have been deploying AsyncRAT.
3/ Since the source code of AsyncRAT is publicly available [1], we can obtain a copy to investigate and build detection capabilities for this RAT.
Read 25 tweets
Aug 1
1/ @ZephrFish and @myexploit2600 presented "Paving The Way To DA" at this year's @Steel_Con.

A few thoughts on the topics mentioned in the talk 🧵:

1⃣MFA, Password Spraying, Common Passwords
2⃣RDP Shadowing
3⃣MFA spamming
4⃣Password in Shares
5⃣GPP
6⃣Sam the admin
2/ 1⃣ A popular initial vector they often use is Citrix without MFA.

This is also a classic from our IR cases, where either the password was found out with password spraying (the user used a weak password), or the user was phished beforehand.
3/ MFA is a MUST for any remote access.

If Azure AD is used, Azure Active Directory Password Protection could be used, which checks the password from the user against a global blocklist or a configurable blocklist [2] (this is done when the user changes the password).
Read 15 tweets
Jul 27
1/ We analyzed a breached server and found the IP address and domain from which the TA downloaded additional tools onto the server.

The initial breach happened a few months ago, but the TA uses the same server till today. 🧵
2/ Because of an open-dir, we can see various tools and scripts placed (and replaced over time) on the server by the TA.

Following are some takeaways from the analysis of the arsenal of the TA:
3/ One hosted tool on the server is KrbRelayUp.exe (717fccf1e6081d012f06d24872563529), a compiled version from the GitHub repo of the same name. [1]

The binary is quite well known at VT with 38 AV detections [2], but that doesn't seem to bother the TA as there are also various
Read 18 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(