hello and welcome to my talk
operation bypass catch my payload if you
can
my name is matthewberg i'm a technical
manager in optiv
under the adversarial services i am
primarily a lead there
my role is focusing primarily on red
teaming purple teaming basically any
type of adversarial real
nation-state-based attacks i've also
authored numerous open source tools and
frameworks
a lot of the research i've done has been
focused on invasion bypasses and as well
as circumventing edr and other endpoint
based controls and security
i'm a microsoft hall of famer related to
several disclosed microsoft com bypasses
and has spoken at
numerous places including defcons red
team village derbycon b-size las vegas
eurocon rsa
so just a brief overview of
the agenda that we're going to cover
today first we're going to understand
the level of detection and look at some
upset considerations and understand some
ttps for the modern era then we'll focus
in on using scarecrow a framework for
bypassing endpoint detection tools
and then kind of drilling more into the
indicators of compromise that can lead
to a detection or any type of artifacts
when we're talking about command and
control services
and then introduce a new tool to help
with
those c2
profiles so to begin
i mean this is a fairly you know common
uh diagram to kind of depict the red
team life cycle
primarily we're really going to focus in
today once again on the c2 and all the
aspects of it from establishing that
presence to making sure you don't get
detected
into your long-term longevity that leads
into eventually postx techniques
but first let's kind of define you know
endpoint detection and response tools
how do they actually detect us and you
know subsequently prevent uh our attacks
well they primarily rely on a series of
different combinations these days uh
user land hooking being the most common
uh kernel callbacks using etw events
or the moniker of machine learning ai
which
i use that in quotes because a lot of
times when we get down to it it's
usually a signature base or a
combination of the three with something
else in the background
um not to dispute that there is any
value to machine learning ai which is
often times when
we see this as a tool to prevent threats
it's usually something that is really
not selling the whole truth
and so there are a lot of misconceptions
to it
so
with that in mind how do we get around
it well the most common things have been
process injection but with more recent
events in the modern you know landscape
going to things such as using custom
system calls uh using a technique called
block dls which we'll kind of go into in
a little bit
uh but also more and more undocumented
api calls
now i've kind of
posted a link here
for a good buddy of mine he does an
amazing bit of research and he has a
great project called alternative shell
code exec this really focuses on using
alternative api calls
and kernel callbacks to basically
execute shell code
that are not in the normal way and this
kind of
by nature allows us to
circumvent the normal detections and
therefore establish a presence without
being detected because these are
alternative ways so edrs and other tools
are often not looking for these as a
point to see if malicious activity is
being used
so block dlls this has been a very
common and a great technique this is
essentially a technique where
you can set your process to have a flag
and this flag says hey
only allow
microsoft signed dlls which means that
only system level dlls such as ntdl
kernel kernel 32 these ones they're all
the only ones that are allowed to be
loaded into our process which means
frankly that any type of edr product
can't load their dll into our process to
then subsequently detect our activity
so their response to our attacks
they've started you getting their
dll signed by microsoft ca so this is a
very effective way so that allows them
to basically
still load in even with that flag
deploying as a feature whitelisting
controls
rather than the traditional black
listing but white listing where you
block everything and only limit certain
applications has been very effective as
binary based attacks um no longer work
uh these uh white listing rules are
often using hashes so it's really hard
to imitate a legitimate hash say of cmd
with your implant
um and other kind of controls xdr
this is just you know endpoints uh
detection tools way of gathering
telemetry from different aspects rather
than just the endpoint but looking at
you know the network behavioral traffic
what's egressing and activity between
the host to determine you know baseline
of malicious or suspicious activity such
as you know wmi exec calls or anything
along the lines that would lead to
techniques that an attacker would do or
things that are out of the norm for
that user
really heavily emphasizing the
baselining of activity
so
our response to their response so one of
the things that you know i kind of
preaches with this data age of more and
more people having their edr dll signed
by
microsoft is just to avoid block dlls as
a whole especially for initial photos
but also for postx techniques there are
a lot of great techniques right now
coming out there as a replacement
but this really kind of helps
prevent us from kind of being detected
as this flag of my only sign microsoft
dlls
uh isn't really standard across a lot of
processes and when we're talking about
trying to blend in
that flag itself can sometimes stick out
as a sore thumb therefore kind of
drawing more attention to our process
than we actually want it
um with regards to white listening
controls uh we'll kind of talk a lot
more about this but you know avoiding
using power process injection
in favor of a technique called side
loading we're going to get into that in
a little bit
but with regards to xdr controls this is
really where some of the interesting
stuff about blocking or in-memory
patching of etw events
since um
atw and other things like that uh aren't
organically built into the windows
environment
how these things work is when they're
actually running
they actually have to basically start
enabling the traffic and stuff so
there's no additional resources that are
loaded so by patching and terminating or
tampering with them they don't send the
right information therefore these
controls don't really work
and so
this really comes down to the cat and
mouse game and how do we get better
and
really really
at the end of the day really has to come
down to
how are we getting that alert how are
teams seeing us and it's sometimes not
always the shell code or the implant's
fault there is a lot of different
phases that get to the point of that
shell code running
that can often be the catalyst for the
trigger and we really need to understand
this chain of events in order to
identify where we need to improve in our
trade craft
so when we look at this here the example
or definition i like to run by is
there's the delivery
the loader and the implant the delivery
is the mechanism that you're going to
get your
your loader onto the box most commonly
things like you know mshta
bits admin anything that allows you to
download or pull from a
remote or local resource
your code onto the desktop so that's one
area the second area is the loader
itself so you know whether it be a
binary a dll
you know a jscrip file what have you
this is the file that contains you know
your implant as well as you know
whatever techniques you're going to use
whether it be anti-sand boxing anything
for unhooking dlls or like a decryption
technique these are the things that
happen inside this process before your
actual implant will run i like to define
the implant as the shell code or you
know in cobalt strike says the
reflective dll that runs in memory and
that essentially is responsible for
establishing that remote connection out
so once we have these three things
defined we need to understand what's
detecting us
so i like to break it down into two
things
behavioral
which is really coming down to edrs so
edrs really like to focus in on that
behavioral indicators
i have the example up here of why is
excel spawning cmd.exe that that's a
behavioral thing but there's also
signaturizing you know as great as we
look at it signaturized based such as
like you know the historical antivirus
agents that still comes into play when
they're detecting things like large
block strings of base64
or shellcode
but what is the harder thing to
understand and often is more of the more
common reason that leads to an event
is actually coming from something like a
human interaction a sim or some kind of
stock tool that's monitoring for events
this can be something like files being
dropped in a location such as temp and
then a process spawning from a weird
location
to something even more abnormal uh such
as you know
an alert that says hey we're seeing a
lot of egress to a new destination and
tracing it back this is a
conference room pc so why is it calling
out at three in the morning
these are all taken from you know real
life
uh red team operations where there has
been some kind of generated alert and
you know the lessons here are really
kind of some of them are really simple
you know tell more of a
convincing story but of them are more
technical that you have to apply more
uh technical
advanced techniques to basically bypass
that technical control
so the detection
these are the most common gotchas that i
kind of mentioned i like to break them
down to kind of four things to really
focus in on when i'm developing an
attack
what is the command i'm executing so
obviously
you know these days things like
powershell or bits admin
they're very highly indicated there's
been a lot of research they're a very
prominent lol bin
so by focusing and using that there's a
high chance that there is some kind of
rule or type of mechanism out there
that's looking for the execution of it
now there are a couple things you can do
to kind of obfuscate that and that's
really where you have to understand what
you're going up against as well as being
mindful of the file type
obviously if you're dropping if you're
downloading from some random location a
binary is just straight there are going
to be things that passes through um web
proxies and external kind of control and
they can see it this large data stream
and you know binaries have a universal
header so it's easy to detect that so
these are all things you have to be
mindful of when you're setting up this
attack chain
also for abnormal behavior this one's a
little harder to kind of discern but
what i like to say is that you know if
you're going to start using commands you
know lol bins
you have to understand who you are you
are you someone
that you know as a standard user are you
is your user someone that would probably
use this and you know if a security team
is looking at they wouldn't bat an eye
so it's really about blending in telling
that story and finally
whitelisting controls so
when i talk about whitelisting controls
we have to really understand you know
what's there
uh oftentimes
your whole you have the greatest attack
chain ever
but if they block your ability to run
something you'll never know it and
especially in a black box situation the
beacon may not come home your implant
your c2 essentially won't fire and you
don't know if that detection is
so if i can leave you with one thing
when we talk about detections it's this
detections are really easy to trigger
but they can be impossible to understand
unless you have the ability to look at
the alert and understand what it's
triggering on and sometimes that can
only be done through life lessons and
experience
now let's kind of talk about an example
in this situation will you use cobalt
strike c2
let's say powershell scripted web
delivery so that would be a powershell
script that you know remotely calls
downloads establishes a beacon
and this happens the beacon calls home
calls home several times before the
operator even executes a command the
first command they run is who am i and
all of a sudden the beacon stops calling
home
so
right now let's kind of take a look and
follow this flow
so here we see you know the chain we see
that you know cmd was used to spawn
powershell
something in powershell was executed and
then who am i was the last process
when we look into it
we see that
first and foremost
the powershell script while it was an
event they don't have enough information
right here they believe there's
something malicious and there has
characteristics so it's not confirmed
they still need more data you know these
edr products don't want to you know jump
to the gun or terminate because they can
actually impact business so they need
the right information because if they're
terminating everything like that it
cannot be used in the environment
no one's going to use their product so
they need more data points to make that
decision
the next alert okay so now it's a bit
more of a severity they see there's a
base64 encoded command and we and it
appears to be malicious
but there's not enough indicators right
now for them to know what's going on
because sometimes this could be a false
positive
and then the final one we see a recon
command obviously who am i
was used and with all this combined
that's where this alert is so we see
this breakdown it wasn't necessarily
that the scripted web delivery was the
catalyst
it was simply enough behavioral
indicators had been tripped for
something to occur
so once again
oftentimes the implant
cannot be the primary cause of the
dejection it can sometimes be postx
techniques
and so
when you are looking at this and you're
establishing a uh a foothold you have to
be also mindful of you know just because
you have this world doesn't mean that
you're free in the clear there are often
secondary controls that can trigger that
can lead to a preventative measure and a
loss of a beacon
so it's really important to understand
even if you're successful how you be how
you were successful are there still
stuff are you fully flying blind do they
have enough information is there
something they're waiting for
um
even if you're using the latest
techniques if you're using a very common
you know
catalyst like a delivery command that's
highly indicated you can get caught
really easily and thus those highly
undetectable techniques will never
really be triggered or used i like to
call this fruit from a poison tree
because if they're already on to you for
the first initial call once again let's
say powershell
everything subsequent is already suspect
so going back to that event
i want to kind of say
who am i was just the tipping point
there was enough information from there
because from the behavioral stance who
am i simply used as a recon and with
everything in that attack chain it was
enough to discern and confirm
that based on the fact that who am i is
run
that the power shell activity was indeed
malicious
and why they did that it might be a
question
why didn't they just instantly block
powershell because powershell as much as
we use this still has legitimate
business uses for i.t and administration
so by completely terminating it doesn't
actually really work you need more
points to make a decision i'd like to
also call out here as an opposite
consideration to avoid powershell at all
costs
most of these days c-sharp tools pretty
much cover the gambit of everything the
c-sharp is highly flexible it's easier
to off these skates make it makes it
harder for blue teams or even uh
endpoint protection tools and
anti-malware controls to detect this so
if at all costs avoid using power
powershell
because it's highly indexed and um
kind of indicators of compromise are
clearly defined
so
some opsec considerations when we're
building out these attack chains as well
as our implants so first and foremost
let's look at the implant itself
so
first i always say
encryption
always use some sort of encryption the
higher the stronger the encryption the
better um sometimes i have discussions
and people ask well what about you know
base64 or something along those lines
that's good but it's by no means a
replacement for encryption
um
it's great to use a combination
especially when you're encrypting you
know with aes or something like that the
string into basic stream four encode it
makes it easier to store in your file
your loader
now that being said the next issue
becomes avoiding the strings this is
often a common thing that you know yara
rules or any type of blue teams are
looking for is you know for something to
write a rule or some kind of trigger on
so if they can find a static string or a
value that's always going to be the same
they will use that as a catalyst to
create their rule for detection this
kind of plays away from the edr
perspective into those simstock all that
type of stuff
so i always like to say if you can make
your
loader as morphic as it can be so each
time you generate it's always going to
be different values the strings are
going to be different sizes and
everything like that that just adds a
level of entropy making it harder to see
it you can kind of see here if you see
in this example the yaro you can see
these ops and all these things if these
are static values the chances are that
it when that triggers there will be an
alert
also
if you can if depending how fluid or
your comfortability in using uncommon
languages is a great way to add a layer
of observation to your loaders
you know the most common ones these days
for tooling is c sharp c plus but
looking things like golang rust
um f sharp can be very valuable as just
a natural way of obvious skating
so offset considerations when we're
talking about a loader so
this is where it becomes very much an
art form and situational so the key
thing here is to understand
you know your environment what are you
targeting what controls do they have
is there something that you know could
just not execute in that environment for
a specific reason
um
more so to the point you know what are
the products everything like that is it
a thin client is it the endpoint that
you're targeting is it like a limited
box everything like that
um if you're gonna you know use some
kind of
com agent or something like that are
those com things if they're related to
you know outlook or word
they might not exist on the server so
those are things you need to be mindful
of other things
can be
you know the file name if your file name
stands out as something very suspicious
that's that's like one major thing
it looks more like a like a program that
would be found in enterprise that kind
of makes it easier to tell that story
once again to blend in
as well as going deeper looking at the
metadata at the attributes you don't
want your home computer or your own
personal name in the metadata
and that all kind of stems down to how
does it look on disk if it's just a
weird size but a weird binary or
something really weird sitting on the
desktop
on you know
a laptop someone's laptop they might see
this
as well as you know where you're
executing it from if you're once again
executing from temp or app data it might
it could be suspicious enough that it
would warrant investigation
um
i called this up before but you know
strings base64 large strings is a very
easy way microsoft is becoming more
adept into looking for files that have
large basic base64 strings by breaking
them up
you uh it makes it harder for the
discern that oh this is this is
definitely something that's suspicious
because there's this large string of
code
and as always binaries
i don't mean to beat up on them a lot
but binaries are really easy to detect
that's why you know looking at and we're
going to talk about it right now
looking at new ways to
basically
load shell code into memory so
onto the tactics techniques procedures
for this modern era
we talked about this a little bit but
side loading
this is becoming more and more prevalent
threat groups around the world are
trying to use this technique more and
more in favor of traditional things like
binaries or even process injection
attacks
this technique
is simply the act of loading your dll
into a program
at a legitimate program of that in a
malicious way
so how this can be is you know an
example can be with cpl files where when
they are executed
if you execute your malicious cpl file
it will spawn run dll which is manage
which is responsible for the control
panel cpls or control panel applets
so
when you execute that binary that cpl i
should say
it will spawn a run dll process and that
process will then load if it has the
proper export functions that cpl file
into memory and execute it
so what does that look like it looks
like run dll a legitimate pros
process
is loading something in you see this a
lot with you know reg server 32 as well
with dlls
but it basically circumvents and a lot
of times white listing controls because
these are native to the windows
operating system these are things that
are allowed
uh these are part of the system they're
not selling foreign so they're often
white listed there's many of them
different types of silos i just use run
dll and register as the most common ones
out there but what's great about these
is once they're loaded in
your loader away that drops any type of
dropper that drops that dll or cpl which
whatever your
catalyst you're using
you can remove it and clean it up so
that way the process is there
it's running in memory and how you got
it onto disk how you got everything you
set up
can be cleaned away and it's very
effective
so now let's talk about scarecrow
scarecrow is the framework i developed
that actually performs a lot of the kind
of techniques we've been talking about
so first and foremost
using custom system calls it actually
will reload
ntdl kernel base and kernel 32 flushing
out the edr's userland hooks in it so
there won't be any hooks
it also
encrypts the shell code in an aes format
it patches etw so that way there's no
telemetry and it actually goes a step
further in it and uses
an alternative way to execute shell code
that's not standard so everything we've
just kind of talked about it's built in
this framework what it also does is
those loaders those files whether it be
a binary a dll a jscript file it it
spoofs the attributes of ones that are
legitimately found on the windows
environments you know ranging from
cmd.exe
word.exe to
libcrypto.dll all these values as well
as allows you the ability to validly
code sign
by actually spoofing the attributes of a
domain for a code signing search
uh i've provided a link and i'll provide
an at the end um
to the framework but talking about the
loaders
there are several different ones here
and i've kind of listed them out so
primarily it still does use binaries
there is a place still in the world for
binaries
but the control the dll the excel ms
exact and w script these are all
techniques to side load so we've already
kind of talked about
control and dll but the dll is very
polymorphic it can be used for anything
um it just generates a dll and you can
use it with any type of attack or you
know exploit
excel it actually will
create an excel plugin once again with
valid attributes and a code signing cert
and then uses jscript to actually spawn
excel in the background and load this
plugin in to memory in a side learning
technique
we've recently added msi exec this
creates an msi exact process and loads
once again that dll into memory
um in wscript it uses a technique called
registrationfreecom
which takes a manifest file and says
this manifest cell says hey you need to
load this dll
into memory and it provides the
attributes everything of what it needs
to do so it will look for that dll which
is our malicious dll
and then load it into memory
now
because side loading has become so
prevalent
and as again you know threat actors are
using this in the wild more and more
edrs are trying to combat this
so you can kind of see right here there
was a malicious module loaded you know
they rank this as a high but what are
they actually looking at because this is
a really hard thing to kind of detect
and stop
so you know
simply put sometimes what from my
investigations
looking at it when they are looking at
this look for some abnormal module
behavior being
occurring in the process what does that
mean
sometimes it can be as simple as
the two dlls were loaded at the same
time with the same name
just by changing it
there's no trigger anymore there's no
alert
so it really comes down to that this
technique is very valuable and really
hard to
detect
as such
scarecrow does ensure that the dll names
that it does load in for wscript excel
run dll control panels uh they're not
dlls you're ever going to see in those
processes so this alert never will be
triggered
so
i wanted to provide some tips using this
framework
so the first one is the loader flag
this flag actually stipulates what type
of loader you're going to make
so as we kind of talked about side
loading loaders are way better than
binary
base loaders this is simply because they
can bypass whitelisting controls
if you don't fill this in it will by
default fill it in as binaries and that
might break your success so always
ensure that you know what you're using
don't just use the defaults
dlls like i said they have their place
they're real it's really versatile so it
can be used with pretty much any type of
attack if you have a metasploit module
or anything along those lines or maybe
an ex another exploit where it needs a
dll as a catalyst for your implant this
is where that feature really comes into
play
the next one is the domain flag
this flag
basically determines the domain you're
going to use to spoof the code signing
search now
if you do have a valid code sentence you
can enter it
along with the password and it will
actually use that to validly code sign
it
one thing and it's a very common thing
that i get asked is you know sometimes
it doesn't work you can't reach out it's
stalled when trying to sign that's
sometimes because wherever you're
creating your loader it needs to be able
to reach out to that domain so if there
if you're coming from a host that has no
access to that domain name or the domain
doesn't actually exist
um
that can be a problem
um one of the biggest things i always
want to stress to people is that when
you're actually choosing the domain
never use the company's domain
very few companies
unless they're a big tech company that
actually has a code signature they they
use software or anything like that um
they're typically not going to have a
code signing cert and therefore they're
typically not going to whitelist it in
their own edr products
or across the enterprise so stick to
things that are more common in the
enterprise you know
everyone has network switches everyone
uses windows everyone uses you know
those are the things that are going to
give you a higher success rate when
you're picking a domain
next thing is the delivery command this
is what we talked about this is very
very very dependent on what you're
facing like i've been saying you know
lol bins are great
but there's also they also come with a
high chance of detection so the
double-edged sword
um the way i kind of tell people is that
you know hgas are good but macros and
calm objects they're better
um you know everyone has there's always
that once again that fluid it depends on
the environment so the more information
you get from your recon everything like
that will really tell you which one will
work better it's never going to be that
this one's always the best it's always
going to be this one is the best for
this situation
and that situation can change client to
client network to network enterprise and
security sector security stack
you really want to then focus in on the
user behavior i like to always say you
know sally from accounting does not know
how to use your tail so if you're trying
to pretend to be sally maybe certain is
probably not the best thing for you to
do maybe it might be a different way um
and i mean sometimes it can be as easy
as if you have you know an rdp based
access
it's next to impossible for any product
to detect
you know a mouse and keyboard clicks
there's no way to design that you know
once again this is sally's clicks and
keyboard actions versus my me as a
malicious attacker so when you're
thinking about it it really comes down
to that story and what you have access
to the more you have the better the
story is
i also wanted to provide some sample
you know commands to get you know the
ideas going so here we have
the first one is just creating assigned
binary
with etw bypassing
that's the first option
second option is a jscript the jscript
ones are usually my favorite they're my
go-to
jscript is really great to kind of get
through those network controls and land
on this environment
so you see right here with the domain
flag and the loader set to control with
dash o
then finally
the last one uh w script now w script is
my go-to loader uh just with that
manifest file it's very powerful and
really hard to detect but it might not
be yours you might depending on once
again in the situation it might be
something better of a different loader
always keep that in mind when you're
looking at these situations
so
here we have a little example
we have our loader.js and it's going to
spawn
and if you can see in the private bytes
you can see that value is going up
because our dll is being sideloaded into
the process and once it's finished it
will start executing it will unhook
all those dlls then decode the shell
code using custom system calls once that
happens it will use a different way to
execute
giving us
a remote shell
here we can then enter commands
without being detected
so now let's talk indicators of
compromise
what are they simply put they are
pieces of or artifacts that can help
identify malicious activity
this can be
you know related to attacks postx um
techniques you know data breaches or
even infectious malware that we drop on
environments uh
as our attacks become more advanced in
this age iocs are becoming more and more
relied on to look for this is that
transition away from relying solely on
an anti-malware controller or an evil
product to solely be your sole point but
that layered approach
where you have a sim or a sock analyzing
all this stuff
to ensure
that the behavior or anything that's
dropped or anything that happens is then
correlated to behavioral or known attack
techniques
and
we should care about this because this
is how the game is changing
as we look at it the defenders are
learning from us they're they're in our
they're coming to our talks they're com
they're reading our research they're
they they're following whenever we come
up with new techniques and then trying
to figure a signature to detect it
and as we modify
this so do the iocs so if we are
constantly evolving our tradecraft
we are circumventing those predefined
iocs that they're looking for and once
again that can mouse game is occurring
and simply put if we can do that further
by extending by modifying how our c2
interacts
that's a great step ahead and keeping
them always keeping us always one step
ahead of them
and
simply put thread actors are doing this
with huge success
so i'd like to give an example
using cobalt strike
and a c2 profile that didn't have
beacon.dll stripped out a phishing email
that contained a payload when the user
opened the file and enabled the macro
the shell code executed it's great
the beacon called home but any time the
command was executed
the edr would block the payload by
simply stripping things out such as
beacon and beacon x64 out of the profile
and retrying again the er did not catch
on
to this because it couldn't
it wasn't look it was looking for this
and didn't see beacon.dll in memory
therefore it didn't have enough points
of data to make this discern decision to
terminate the process
that's just one example of what we can
do for our c2 to manipulate it to avoid
detection
another one once again looking at those
human
that human aspect
user agent strings now this only comes
into play you know if you're using dns
based beacons you don't really need to
worry about a user agent um
also while we're on the subject
really good to avoid using tcp over the
internet
it's very odd it sticks out if you're
going across the internet https is the
best
but oftentimes the usual agent string
can be a dead giveaway if it's something
that's odd or weird or doesn't look
normal
sometimes that's an indication that
there needs to be something to
investigate
more mature companies can go as specific
as looking at well we're a firefox shop
and then one day they start seeing
internet explorer user agent strings
that stands out from the crowd
and that's can be the point of an ioc
that they can start investigating on
so with all of this in your mind let's
introduce a new tool i'll be releasing
today called source point
source point is a tool that actually
generates malleable c2 profiles for
cobalt strike
talking using all these features we kind
of talked about and more
it really ensures that each time you
generate a profile regardless if you put
the same values in
the actual profile itself will be unique
so you can generate multiple profiles
using the same values and they'll be
unique from each other
there's over 15 different customization
options in this tool alone for you to
select but if you choose to use leave
them blank they'll be randomly selected
for you so you're always ensuring you
know a high level of entropy
it does you know 15 options can seem
daunting so there is yaml support so
it's really good to use a yaml file so
you can always have kind of like your
go-to sampling that you can start
modifying it is written in go
but it's simply using a template based
language to
generate these
profiles
so some of the features it has
as i mentioned before about that user
agent strength there's over 60 ranging
from windows 10 windows 10 chrome
windows 10 ie firefox
server
mac
linux you get you kind of get the
picture so there's a lot of them also
different options for a pe header
there's over 21 currently built into it
there are seven different types of
profiles
for your traffic to be shaped to
in right now it does strip out 95
strings that you know edrs use to look
and detect shell code especially around
your cobalt strike you can kind of see
right here a large list of them now
usually the question i get is well
there's options to obfuscate and encrypt
so why would i bother with this
oftentimes
all that stuff gets down to the point
that it's a great way to avoid detection
but at some point it needs to be read
and interpreted by the
the system so it has to be in an
unencrypted state for it to be processed
on the stack properly and that's when
those detection all over alerts can be
triggered so that's why going through
this i've looked through and found the
common indicators of compromise looking
for commonalities and things that they
would look for and just removing them
as i mentioned before there is a lot of
randomization so the values for
allocations on different features are
always changing
obviously there's you know sleep jitter
your kind of standard things but more
interesting thing is the manipulation of
injection based strings for post decks
there's even 18 options
i like to also call we can kind of see
here this is a great document or image
if you haven't had a chance please look
go ahead look at this it is basically a
parent relation process map of normal
windows processes and their parent and
child processes so with this when we're
talking about you know post decks or any
type of spawn to processes especially
like execute assembly we can actually
map a process with
a pro a more realistic child process for
spawning it makes sense and it's harder
to detect and it doesn't stand out as
much
uh this right this tool source point has
cdn support for anything that you need
for cdn depending on how you're setting
up your your c2
as well as our location
manipulation values also supports ssl
certificates
so why use it
it's been development for several years
it's been deployed on hundreds of red
team ops prior to today's public release
the most important thing i would
probably say is unique profiles if
you're taking something that is static
or using something that's the same
profile over and over again for multiple
engagements
eventually you're going to get caught
burnt
especially if it you're basing it off
with something that's public and you're
not really modifying it extensively
chances are other people are downloading
it and doing the same thing so having
completely unique profiles really does
aid and once again keeping
one step ahead of blue teams another
reason is it automates the process
and reduces the basically overhead of
building and stripping out these iocs
from your c2
my personal favorite is human error you
know people make mistakes i'm i often
make them that's why i developed this
it's that way i can do it once and have
it automate it
so i couldn't
show an example template because it
would just run off the screen we can be
here for hours going through all the
different features
uh but to kind of show you what the
results are from c2 in it
you can kind of see right here how it
looks all the different features what
it's done the transformations everything
like that the values and how it just
really blends in
so my final thoughts
before we wrap up
we really need to
as red teamers
understand blue teams and their
procedures better from that we can
understand how they're detecting us
and what we can do to go around those
detections
uh simply blue teamers are attending our
talks they're reading our research every
time we publish something they're
reading it they're learning it so that
way they can you know fine-tune their
tradecraft to be better at detecting it
so we really need to do that and that's
how this cat and mouse game is going to
work and continuously keep uh continue
lastly at the end of the day for us to
be better red teamers we need to start
learning blue
so any questions um you can find the
scarecrow framework for bypassing edrs
and all that stuff for developing
implants
here uh source point can be found on my
github
along with the slides
if you have any questions or ever want
to talk about the stuff you know i this
this is my passion my bread and butter i
really spend a lot of free time doing
this and learning and kind of advancing
my own tradecraft so if you ever have a
question i want to talk feel free to
reach out to me my twitter github
before i wrap up today i just want to
say thank you for attending my talk
have a great day