Accelerating the Analysis of Offensive
Security Techniques Using

DetectionLab
Chris LongJan 2021

$ cat agenda.txt● Introduction to DetectionLab● Tooling Overview● Realistic Analysis Scenarios2$ whoami
Chris Long (clong)
Sr. Security Engineer @ Netflix
Previously: Facebook, Uber, Palantir
Fun fact: ２年ぐらい日本語を勉強しています。
しかも、４回日本に行ったことがあります！

@Centurion & @DetectionLab
https://github.com/clong3

https://clo.ng

What is it?
4

“5A repository containing avariety of scripts that allow
you to automate the processof building an Active Directory
environment complete withlogging and security toolingThis is about efficiency, not novelty• It is not a new analysis/forensic technique• The major difference here is automation andmulti-platform support• Potential use-cases:o Testing security tooling (dev environment)o Checking your forensic trail (for pentesters)o Experimenting with offensive and defensivetechniqueso Learning new tools
6

Where can I deploy it?
7Locally

Cloud8What problems does it solve?
910Setting up an Active Directory lab byhand is not fun.
••••••••
11

Find a bunch of Windows ISOs
Install the operating systems
Go through the domain creation wizard…
Enroll a bunch of other hosts…
Install software...
Create GPOs…
Many hours later, you have a lab!
Not repeatable

There has to be a more efficient way• Packer for VM customization & creation• Vagrant for VM provisioning• How does this all fit together? Is this possible?

• ADFS2 showed me that this could work

12How do all the parts fit together?
• Inputs:o OS ISO,o batch and powershell scriptso OS-level customizations• Output:o A compressed Virtual Machine (box) for
VMware/Virtualbox/etc
13

For the visual learners…
windows_2016.json.bat scripts+
windows_2016_virtualbox.box

Server2016.iso .ps1 scripts
windows_10.json.bat scripts+
Windows10.iso .ps1 scripts
14

windows_10_virtualbox.box

How do all the parts fit together?
• Input:o VM Box (from Packer)o Vagrantfileo Powershell scripts• Output:o A customized virtual machine15

For the visual learners...
bento/ubuntu-18.04

Loggerwindows_2016.box+.ps1
windows_10.box
16

shellWEF

Vagrantfile
WIN10

Active DirectoryDC+

17

Lab Tooling Overview
Full documentation available at:https://detectionlab.network

18

Splunk19

Splunk
Splunk:Indexes:

●
●
●
●
●
●

●
●
●
●
●
●
●
●
●

Used to centralize data
Powerful query language
Apps and AddOns
Create alerts
Ingest 500mb/day
Dev license (free) =10GB/day● Splunk Fundamentals
training is excellent:

https://www.splunk.com/en_us/training/fr
ee-courses/splunk-fundamentals-1.html

20

evtx_attack_samples
osquery
osquery-statuspowershellsuricata
sysmonthreathunting
wineventlog
zeekWindows Event Forwarding

21

Image source: https://github.com/palantir/windows-event-forwarding

Windows Event Forwarding● Windows native feature. No extra software needed.
● XML based subscriptions let you granularly select events● WEF host centralizes the collection of event logs
○ Sent to Splunk● Filter out noisy and non-security relevant data
● Collect exponentially more data than Windows defaults● There are so many channels with valuable information● This is not a widely adopted technology○ I think it should be22Osquery + Fleet

23

osquery + Fleet
osquery:● uses basic SQL commands toleverage a relational datamodel to describe a device● Powerful introspection● Effectively read-only (safe)● “Point-in-time” analysis● Extensions add functionality

24Fleet:● osquery Manager● Connect via TLS● Ad-hoc queries across“fleet”● Centralize osquery logs
● Realtime configuration
updates● CLI + Web Interface

Velociraptor

25

Velociraptor● Similar to osquery, exposes state as a queryable database● Unlike native osquery:○ Can execute code
○ Download files + forensic artifacts● More powerful forensic capabilities○ MFT○ Memory images○ Browser history○ Etc...
26

Microsoft Advanced Threat Analytics

27

Microsoft Advanced Threat Analytics● Adept at detecting well-known Active Directory abuse○ Brute-forcing○ DCSync○ Recon (scanning for users)○ Pass the hash
● Why include it?
○ Help blue team understand what it does and doesn’t detect○ Help red team understand what it does and doesn’t detect28

Sysmon + Olaf Hartong’s Config

29

Image source: https://github.com/olafhartong/sysmon-modular/blob/master/10_process_access/include_lsass_access.xml

Sysmon + Olaf Hartong’s Config
Sysmon:● Most powerful free Windowstelemetry○ process creations○ network connections○ file modification● Developed by SysInternals● eBPF Linux version comingsoon:

30

Olaf Hartong’s Modular Sysmon:● Remove false positives● Mapped to MITRE ATT&CK● Modular● Consistently updated● Tested via CI pipeline

https://github.com/olafhartong/sysmon-modular

https://twitter.com/markrussinovich/status/1340737856201879552

Zeek + Suricata

Zeek (formerly Bro):31● Monitor network traffic fromlogger host
● Powerful protocol analysis● Lots of plugins/packages● Limited traffic visibility
depending on deployment androuting

Suricata:●●●●●Open Source IDS/IPS
Test IDS rules
PCAP Capture capability
Offline PCAP analysis
Alerting/Eventing engine

Apache Guacamole

32Additional Tooling33

Analysis Scenarios
34

Mimikatz - What do we know?
● Often used to retrieve plaintext credentials from LSASS.exe
memory (among other things)○ ADSecurity’s Unofficial Guide to Mimikatz is a must
read
● Mitigations introduced in Win10 can lessen theeffectiveness○ These mitigations can be bypassed
Let’s assume:● We don’t/won’t know the filename of malicious tools● Mimikatz has been modified to bypass AV detection● Our defenders have enabled LSA Protection○ TL;DR - To read memory or inject into a protected
process, a code signature is req’d35

36

● We now know what the Sysmon + Windows Event artifacts are● What other ways can we detect this?

37

We could just search our logs for mimikatz.exe!
But this is cheating… 😄
38

Adversary Perspective - Mimikatz● Attacker runs mimikatz (renamed to sysconfig.exe)● Tries to dump passwords:● It fails because LSA Protection is enabled● Loads Mimikatz driver39

Mimikatz Cont’d...
● “Un-protects” LSASS.exe using the driver (mimidrv.sys)● Tries again to dump passwords○ Gets NTLM hash, but no plaintext (Win10 mitigations)40

Mimikatz Cont’d...
● Adds registry key to enable using WDigest to store plaintext
credentials in memory● Waits for next user logon● Dumps passwords again - plaintext password now present41

Defender Perspective - Mimikatz● Filename based detections are weak and brittle● What else can we use to detect this?

42Detecting Mimikatz● Filename based detections are weak and brittle● What else can we use to detect this?

● Monitor sensitive registry keys that can weaken security

43

Defender Perspective

44

Detecting Mimikatz● Filename based detections are weak and brittle● What can we use instead?

● Monitor sensitive registry keys that can weaken security● We know LSA Protection is enabled, Mimikatz will have toinstall a service.
○ Monitor services running unsigned executables○ Monitor services installing kernel mode drivers

45

Detecting Mimikatz● Filename based detections are weak and brittle● What can we use instead?

● Monitor sensitive registry keys that can weaken security● We know LSA Protection is enabled, Mimikatz will have toinstall a service.
○ Monitor services running unsigned executables○ Monitor services installing kernel mode drivers● Filenames aren’t great, but unique parameters can be!
○ It takes extra work for attackers to modify tools○ “sekurlsa” is going to be common

46Detecting Mimikatz● osquery now supports YARA scanning on Windows!
○ scan all running processes or specify directories○ choose your own YARA rules
SELECT DISTINCT path, matches, count, strings, tags
FROM yara
JOIN processes
USING (path)
WHERE sigfile='kiwi_passwords.yara' AND count > 0;47

Detecting Mimikatz
Process Injection

48

Image: https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-processProcess Injection- What do we know?
● Often used to disguise malicious behavior by executing code under thecontext of a legitimate process● Not always malicious!
● Legitimate process is targeted○ Memory is allocated○ Code is written to that memory allocation○ CreateRemoteThread() is a common way to execute that code
● Extremely common○ Red Canary #1 TTP for 2019
○ Cobalt Strike● Let’s assume:○ One of our hosts has a process
affected by malicious process
injection49
https://redcanary.com/threat-detection-report/techniques/process-injection/

Adversary Perspective - Process Injection● The attacker already has a meterpreter reverse shell● Uses “migrate” command to inject malicious code intoa legitimate process● The attacker now executes malicious code under the context
of a legitimate process50

Detecting Process Injection● Memory Images + Volatility○ Doesn’t scale to hundreds/thousands of hosts● Some EDR○ Excellent if you have it deployed○ Not free
● Let’s do a hunt with Velociraptor○ Free○ Open-Source

51

Detecting Process Injection● Inspiration for this goes to @eric_capuano - How to
Eliminate a Red Team in under 30 minutes● Open Hunt Manager console● Create new hunt
● Use “Windows.System.Powershell” as the artifact

52

Detecting Process Injection● Download Jared Atkinson’s Get-InjectedThread.ps1● Import the function● Run it53

Detecting Process Injection● Run it on all of our hosts (3)54Detecting Process Injection● Now that we know the time, we could use Velociraptor to…
○ Download event logs
■ Windows.EventLogs.Evtx○ Pull memory■ Windows.Memory.Acquisition○ Download NTFS Master File Table (MFT)■ Windows.Timeline.MFT● Rapid Response○ <1 hour!
● Single Interface○ No need for multiple forensics tools

55Conclusion● Save time setting up lab environments by hand
● Easily re-creatable. Infrastructure as code!
● Learn:○ How to use a variety of popular defensive tools○ How to configure and automate a lab environment○ Different ways to detect malicious activity● Customize:○ The VMs to include or exclude whichever software○ Add additional VMs to create a larger network● Contribute○ Pull requests and/or bug reports○ Feedback56

Thank You● JSAC Committee and Staff● DetectionLab Sponsors

I hope to meet all of you in person in Japannext time!

57

References● https://adsecurity.org/?p=2207● https://www.elastic.co/blog/ten-processinjection-techniques-technical-surveycommon-and-trending-process● https://www.youtube.com/watch?v=uql8i
xHNHVo&feature=youtu.be58

Questions?
59