Here is a fun #persistence technique to use if WSL is installed.
Execute "wsl --user root vi /etc/cron.d/persist" (or use an existing one)
Add your command "*/1 * * * * root /mnt/c/Windows/System32/calc.exe"
Start cron service "wsl --user root service cron start"
Execute "wsl --user root vi /etc/cron.d/persist" (or use an existing one)
Add your command "*/1 * * * * root /mnt/c/Windows/System32/calc.exe"
Start cron service "wsl --user root service cron start"
Processes created from this will be children of the "wslhost.exe" process so use that for detection.
For DFIR you can check the file sys as described here
You can also check the mounted system live from the special WSL share \\wsl.localhost\<distro-name>\
For DFIR you can check the file sys as described here
https://twitter.com/nas_bench/status/1616785291964043279
You can also check the mounted system live from the special WSL share \\wsl.localhost\<distro-name>\
This technique was part of a discussion we had about WSL/VHDX files during our usual detection meeting. It yielded some good results
https://twitter.com/cyb3rops/status/1617909598727409665
• • •
Missing some Tweet in this thread? You can try to
force a refresh
