Share this page!

Stephan Berger Profile picture
Twitter logo
Aug 21 • 6 tweets • 3 min read
/1 #Hardening:

@0xdf_ finds credentials in the ConsoleHost_history.txt file in the latest walkthrough of the #HTB machine Timelapse. [1]

In our Compromise Assessments, we regularly audit the PowerShell history to find (stored) credentials in this file. 🧵

#CyberSecurity
2/ Hunting for credentials in the PowerShell history is quickly done with @Velocidex Velociraptor.

We can get the file's entire content from the hosts or search specifically for keywords within the file.
3/ The content of this file (the PowerShell history), is not only interesting for searching stored credentials in it but also an excellent forensic artifact.

In the case of a CA, we can specifically search for (older) traces of TAs (Invoke-commands, downloading of tools/code..)
4/ In the case of an IR, we may find current traces of the attacker within the PowerShell history.

5/ If the command line of the hosts is recorded (with Sysmon or an EDR), one could possibly monitor for disabling of the PowerShell history, as @DissectMalware mentioned in a tweet:

1⃣ remove-module psreadline
2⃣-HistorySaveStyle SaveNothing
6/ References:

[1] 0xdf.gitlab.io/2022/08/20/htb…
[2]

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Stephan Berger

Stephan Berger Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @malmoeb

Stephan Berger Profile picture
Aug 19
1/ #Hardening:

If the Windows App sideloading feature is enabled, users can also install APPX packages not originating not from the Microsoft Store, ideal for distributing malware with these packages 🤯[1],[2]

🧵 #CyberSecurity
2/ We can search our network for systems with enabled sideloading:

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock".
3/
AllowAllTrustedApps:

This value can also be set via GPO if a company wants to distribute trusted line-of-business (LOB) apps that are not from the Windows Store.

However, these apps must still have a valid certificate chain; otherwise, the app will not be loaded.
Read 5 tweets
Stephan Berger Profile picture
Aug 17
1/ #ThreatHunting:

#QuasarRAT is another RAT we see from time to time in our IR cases and was also used against NATO facilities in March. [1]

We can hunt for

1⃣ The default port within the FW logs
2⃣Mutexes
3⃣User-Agent
4⃣Persistence mechanisms

🧵
2/ @qualys has published an excellent paper ("Stealthy Quasar Evolving to Lead the RAT Race") about Quasar, where the whole builder and much more are described in detail. [2]
3/ In the client builder (which creates an executable which is used for the infection), the default port is pre-configured to 4782. Image
Read 12 tweets
Stephan Berger Profile picture
Aug 14
1/ #ThreatHunting

MeshCentral is another remote admin software installed by TAs we have seen in our IR cases [1].

Following is a brief introduction to the software and what forensic traces MeshCentral leaves on the network and the hosts. 🧵

#CyberSecurity
2/ For our tests, we use the hosted instance of MeshCentral.com, but the management software can also be run on a separate server, controlled by the TA.

After logging into the panel, we can download an agent for different operating systems (Windows, Mac, Linux).
3/ Before the installation or execution of the agent, the server URL is displayed under "Connection Details".

In our example, the agent connects to meshcentral.com, but another domain can be configured when the management server is self-hosted.
Read 19 tweets
Stephan Berger Profile picture
Aug 8
1/ Playing around with #manjusaka, as reported by @TalosSecurity [1].

Following are some insights and potential #ThreatHuning tips and ideas. 🧵

#CyberSecurity @b3ard3dav3ng3r
2/ After starting the ELF binary (a reduced version is publicly available on GitHub [2]), the login credentials are printed out (username: manjusaka, PW: b3e..), and the port (3200) on which the panel is accessible.
3/ The password is different for each instance of manjusaka.

This mechanism prevents the use of default passwords in case scanners would find the login panel.
Read 19 tweets
Stephan Berger Profile picture
Aug 6
1/ #ThreatHunting for #AsyncRAT

We have various ways to find infected hosts with AsyncRAT:

1⃣ Usage of standard C2 ports
2⃣Hunting for persistence
3⃣Mutexes FTW
4⃣Last but not least, hunting for dropped DLLs

Let's go 🤠🧵

#CyberSecurity
2/ AsyncRAT is a popular Trojan executed at the end of an infection chain on target computers.

@hpsecurity ([2],[3]) and @Trellix ([4]) have both reported in recent reports that TAs have been deploying AsyncRAT.
3/ Since the source code of AsyncRAT is publicly available [1], we can obtain a copy to investigate and build detection capabilities for this RAT.
Read 25 tweets
Stephan Berger Profile picture
Aug 1
1/ @ZephrFish and @myexploit2600 presented "Paving The Way To DA" at this year's @Steel_Con.

A few thoughts on the topics mentioned in the talk 🧵:

1⃣MFA, Password Spraying, Common Passwords
2⃣RDP Shadowing
3⃣MFA spamming
4⃣Password in Shares
5⃣GPP
6⃣Sam the admin
2/ 1⃣ A popular initial vector they often use is Citrix without MFA.

This is also a classic from our IR cases, where either the password was found out with password spraying (the user used a weak password), or the user was phished beforehand.
3/ MFA is a MUST for any remote access.

If Azure AD is used, Azure Active Directory Password Protection could be used, which checks the password from the user against a global blocklist or a configurable blocklist [2] (this is done when the user changes the password).
Read 15 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(