In In NTDLL I I Trust Process Reimaging and Endpoint Security - PowerPoint PPT Presentation

In In NTDLL I I Trust Process Reimaging and Endpoint Security Solution Bypass Eoin Carroll Senior Security Researcher Hack in Paris 2019 McAfee ATR

Attribution sacré bleu Eoin Carroll Steve Povolny Steve Hearnden Cedric Cochin

About me @w3knight Security Researcher Semi-Conductor SW Security Engineer Medical Device Electronic Engineer Electronic Engineer Appsec Pentester Security Team Lead Security Mgr Security Architect 2000 2007 2011 2018

The next 40 minutes… • Process Reimaging Overview • AV scanners and Process Reimaging • Mitre ATT&CK and Defensive Evasion • Process Reimaging Prerequisite and Attack Vectors • Process Reimaging Weaponization • Windows Kernel APIs + Process Reimaging Deep Dive • Windows Defender bypass demo • Impact and Protection Recommendations

Process Reimaging Overview • Process Reputation and Trust verification bypass • Impacts non-EDR Endpoint Security Solutions using NTDLL APIs such as K32GetProcessImageFilename • Equivalent in impact to Process Hollowing or Process Doppelganging within the Mitre Attack Defense Evasion Category • Malicious Process can dwell on Endpoint until reboot or full scan post signature update

Antivirus Scanner Detection Points 1. FileCreate • Signature == detects @ 1,2,4 2. Section Create 3. Cleanup 4. ImageLoad 5. CloseFile

Antivirus Scanner Detection Points 1. FileCreate • Signature == detects @ 1,2,4 2. Section Create • No Signature == depends on OS for 3. Cleanup running process attribute verification @ 4 4. ImageLoad 5. CloseFile

Antivirus Scanner Detection Points 1. FileCreate • Signature == detects @ 1,2,4 2. Section Create • No Signature == depends on OS for 3. Cleanup running process attribute verification @ 4 4. ImageLoad Process Reimaging Definition 5. CloseFile “Windows Kernel APIs return stale and inconsistent FILE_OBJECT paths which enable an adversary to bypass Windows Operating System Process attribute verification”

Mitre ATT&CK

Mitre ATT&CK

Subverting Trust

Subverting Trust Digital Signature Validation

Subverting Trust Digital Signature Validation Process Attribute Verification

May 2018 – SynAck Ransomware

SynAck – Process Hollowing Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper Dropper Location SynAck.exe Phishing msiexec.exe msiexec.exe Endpoint Security Solution (ESS)

SynAck – Process Hollowing Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper 1. Process created with trusted binary Dropper Location SynAck.exe Phishing msiexec.exe msiexec.exe CreateProcess Create_Suspended Endpoint Security Solution (ESS)

SynAck – Process Hollowing Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper 1. Process created with trusted binary 2. Process Hollowing with malicious code Dropper Location SynAck.exe Phishing msiexec.exe msiexec.exe CreateProcess Create_Suspended NtUnmapViewOfSection VirtualAllocEx Malicious PE WriteProcessMemory ResumeThread Endpoint Security Solution (ESS)

SynAck – Process Hollowing Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper 1. Process created with trusted binary 2. Process Hollowing with malicious code Dropper Location SynAck.exe Phishing msiexec.exe msiexec.exe CreateProcess Create_Suspended NtUnmapViewOfSection VirtualAllocEx Malicious PE WriteProcessMemory ResumeThread Protection failed to detect obfuscated dropper Endpoint Security Solution (ESS)

SynAck – Process Hollowing Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper 1. Process created with trusted binary 2. Process Hollowing with malicious code Dropper Location SynAck.exe Phishing msiexec.exe msiexec.exe CreateProcess Create_Suspended NtUnmapViewOfSection VirtualAllocEx Malicious PE WriteProcessMemory ResumeThread Protection failed to detect obfuscated dropper Signatures updated Endpoint Security Solution (ESS)

SynAck – Process Hollowing Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper 1. Process created with trusted binary 2. Process Hollowing with malicious code Dropper Location SynAck.exe Phishing msiexec.exe msiexec.exe CreateProcess Create_Suspended NTDLL API for Process Image Query NtUnmapViewOfSection VirtualAllocEx Malicious PE WriteProcessMemory ResumeThread Protection failed to detect obfuscated dropper Signatures updated Endpoint Security Solution (ESS)

SynAck – Process Hollowing Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper 1. Process created with trusted binary 2. Process Hollowing with malicious code Dropper Location SynAck.exe Phishing msiexec.exe msiexec.exe CreateProcess Create_Suspended NTDLL API for Process Image Query NtUnmapViewOfSection VirtualAllocEx msiexec.exe Malicious PE WriteProcessMemory ResumeThread Protection failed to detect obfuscated dropper Signatures updated Endpoint Security Solution (ESS)

SynAck – Process Doppelganging Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper 1. Trusted Binary transacted as Malicious PE Dropper Location SynAck.exe Phishing msiexec.exe msiexec.exe CreateTransaction CreateFileTransacted Endpoint Security Solution (ESS)

SynAck – Process Doppelganging Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper 1. Trusted Binary transacted as Malicious PE 2. Create Sections from transacted Malicious PE Dropper Location SynAck.exe Phishing msiexec.exe msiexec.exe CreateTransaction CreateFileTransacted WriteFile CreateSection Malicious PE Endpoint Security Solution (ESS)

SynAck – Process Doppelganging Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper 1. Trusted Binary transacted as Malicious PE 2. Create Sections from transacted Malicious PE Dropper Location 3. Rollback transaction removes changes from Filesystem SynAck.exe Phishing msiexec.exe msiexec.exe CreateTransaction CreateFileTransacted WriteFile CreateSection Malicious PE RollBackTransaction NtCreateProcess ResumeThread Endpoint Security Solution (ESS)

SynAck – Process Doppelganging Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper 1. Trusted Binary transacted as Malicious PE 2. Create Sections from transacted Malicious PE Dropper Location 3. Rollback transaction removes changes from Filesystem SynAck.exe Phishing msiexec.exe msiexec.exe CreateTransaction CreateFileTransacted WriteFile CreateSection Malicious PE RollBackTransaction NtCreateProcess ResumeThread Protection failed to detect obfuscated dropper Endpoint Security Solution (ESS)

SynAck – Process Doppelganging Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper 1. Trusted Binary transacted as Malicious PE 2. Create Sections from transacted Malicious PE Dropper Location 3. Rollback transaction removes changes from Filesystem SynAck.exe Phishing msiexec.exe msiexec.exe CreateTransaction CreateFileTransacted WriteFile CreateSection Malicious PE RollBackTransaction NtCreateProcess ResumeThread Protection failed to detect obfuscated dropper Signatures updated Endpoint Security Solution (ESS)

SynAck – Process Doppelganging Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper 1. Trusted Binary transacted as Malicious PE 2. Create Sections from transacted Malicious PE Dropper Location 3. Rollback transaction removes changes from Filesystem SynAck.exe Phishing msiexec.exe msiexec.exe CreateTransaction CreateFileTransacted NTDLL API for Process Image Query WriteFile CreateSection Malicious PE RollBackTransaction NtCreateProcess ResumeThread Protection failed to detect obfuscated dropper Signatures updated Endpoint Security Solution (ESS)

SynAck – Process Doppelganging Initial Access Execution Defense Evasion Acting on Objectives Obfuscated Trojan Drive-by-Compromise Dropper 1. Trusted Binary transacted as Malicious PE 2. Create Sections from transacted Malicious PE Dropper Location 3. Rollback transaction removes changes from Filesystem SynAck.exe Phishing msiexec.exe msiexec.exe CreateTransaction CreateFileTransacted NTDLL API for Process Image Query WriteFile CreateSection msiexec.exe Malicious PE RollBackTransaction NtCreateProcess ResumeThread Protection failed to detect obfuscated dropper Signatures updated Endpoint Security Solution (ESS)