HackTool.Win64.EDRSandBlast.B

その他

プログラムは、以下を実行します。

• It monitors the activity of a process to detect EDR implementation and subsequently bypasses the detection mechanisms.
• It employs techniques utilized to bypass EDR detections both in user and kernel mode.
• It performs the following actions to bypass EDR detections:
  • Kernel Notify Routines Callbacks Removal → by exploiting an arbitrary kernel memory read/write primitive through exploiting a vulnerable driver
  • Object Callbacks Removal → by disabling the Enabled flag in the OB_CALLBACK_ENTRY structure, unlinking the CallbackList of threads and process, or disabling object callbacks through disabling the SupportsObjectCallbacks bit in the ObjectTypeFlags field
  • Minifilters' Callbacks Unlinking → by scanning structures used by the Windows Filter Manager to detect callback nodes containing monitoring functions and unlink them from their lists, making them temporarily invisible from the filter manager
  • Disable ETW Microsoft-Windows-Threat-Intelligence Provider → by patching in kernel memory during runtime the ETW TI provider
  • Userland Hooking Bypass → by either removing the hooks, using a custom or the existing EDR's trampoline to jump over and execute the rest of the function as is, using a duplicate DLL, or using direct syscall methods
• It detects EDR drivers and processes.
• It bypasses RunAsPPL by elevating its protection level higher than the LSASS process to dump the LSASS process memory.
• It bypasses Credential Guard by enabling Wdigest to store cleartext credentials in LSASS memory.
• It conducts offset retrieval to perform kernel monitoring bypass operations.
• It requires the existence of the following file in the same directory as the grayware to proceed with its behavior:
  • WNBIOS.sys
• It checks for the existence of the following service:
  • Service Name: {8 Random Characters}
• If the service above is not found, it is then created with the following details and started subsequently:
  • Name: {8 Random Characters}
  • Display Name: {8 Random Characters}
  • Type: Driver service
  • Start Type: Auto start
  • Binary Path: {Grayware File Path}\WNBIOS.sys

マルウェアは、以下のパラメータを受け取ります。

• -h | --help → Show the following message on the console: Usage.
• -v | --verbose →Enable a more verbose output.
  
  Actions mode:
  • audit → Display the user-land hooks and / or Kernel callbacks without taking actions.
  • dump → Dump the process specified by --process-name (LSASS process by default), as '' in the current directory or at the specified file using -o | --output {DUMP_FILE}.
  • cmd → Open a cmd.exe prompt.
  • credguard → Patch the LSASS process' memory to enable Wdigest cleartext passwords caching even if Credential Guard is enabled on the host. No kernel-land actions required.
  • firewall → Add Windows firewall rules to block network access for the EDR processes/services.
  • load_unsigned_driver → Load the specified unsigned driver, bypassing Driver Signature Enforcement (DSE).
• --usermode → Perform user-land operations (DLL unhooking).
• --kernelmode → Perform kernel-land operations (Kernel callbacks removal and ETW TI disabling).
  
  Hooking-related options:
• --add-dll {dll name or path} → Loads arbitrary libraries into the process' address space, before starting anything.This can be useful to audit userland hooking for DLL that are not loaded by default by this program. Use this option multiple times to load multiple DLLs all at once.
• --unhook-method {n} → Choose the userland un-hooking technique, from the following:
  • 0 → Do not perform any unhooking (used for direct syscalls operations).
  • 1 → (Default) Uses the (probably monitored) NtProtectVirtualMemory function in ntdll to remove all present userland hooks.
  • 2 → Constructs a 'unhooked' (i.e. unmonitored) version of NtProtectVirtualMemory, by allocating an executable trampoline jumping over the hook, and remove all present userland hooks.
  • 3 → Searches for an existing trampoline allocated by the EDR itself, to get an 'unhooked' (i.e. unmonitored) version of NtProtectVirtualMemory, and remove all present userland hooks.
  • 4 → Loads an additional version of ntdll library into memory, and use the (hopefully unmonitored) version of NtProtectVirtualMemory present in this library to remove all present userland hooks.
  • 5 → Allocates a shellcode that uses a direct syscall to call NtProtectVirtualMemory, and uses it to remove all detected hooks
• --direct-syscalls → Use direct syscalls to dump the selected process memory without unhooking unserland hooks.
  
  BYOVD options:
• --dont-unload-driver → Keep the vulnerable driver installed on the host. Default to automatically unsinstall the driver.
• --no-restore → Do not restore the EDR drivers' Kernel Callbacks that were removed. Default to restore the callbacks.
• --vuln-driver | --driver {wnbios.sys} → Path to the vulnerable driver file. Default to 'wnbios.sys' in the current directory.
• --vuln-service {SERVICE_NAME} → Name of the vulnerable service to install/start.
  
  Driver sideloading options:
• --unsigned-driver {evil.sys} → Path to the unsigned driver file. Default to 'evil.sys' in the current directory.
• --unsigned-service {SERVICE_NAME} → Name of the unsigned driver's service to install/start.
• --no-kdp → Switch to g_CiOptions patching method for disabling DSE (default is callback swapping).
  
  Offset-related options:
• --nt-offsets {NtoskrnlOffsets.csv} → Path to the CSV file containing the required ntoskrnl.exe's offsets. Default to 'NtoskrnlOffsets.csv' in the current directory.
• --fltmgr-offsets {FltmgrOffsets.csv} → Path to the CSV file containing the required fltmgr.sys's offsets Default to 'FltmgrOffsets.csv' in the current directory.
• --wdigest-offsets {WdigestOffsets.csv} → Path to the CSV file containing the required wdigest.dll's offsets (only for the 'credguard' mode). Default to 'WdigestOffsets.csv' in the current directory.
• --ci-offsets {CiOffsets.csv} → Path to the CSV file containing the required ci.dll's offsets (only for the 'load_unsigned_driver' mode). Default to 'WdigestOffsets.csv' in the current directory.
• -i | --internet → Enables automatic symbols download from Microsoft Symbol Server. If a corresponding *Offsets.csv file exists, appends the downloaded offsets to the file for later use. OpSec warning: downloads and drops on disk a PDB file for the corresponding image
  
  Dump options:
• -o | --dump-output {DUMP_FILE} → Output path to the dump file that will be generated by the 'dump' mode. Default to 'process_name' in the current directory.
• --process-name {NAME} → File name of the process to dump (defaults to 'lsass.exe')