Hello and welcome to
another application of the minor
attack framework discussion
today we're going to be looking at
the vector command line interface.
Now, the objectives of
today's discussion are pretty
straightforward.
We're going to look at how
does Miner define
command line interface.
We're going to look at
what are some examples of common
command line attack tools.
We're going to look at
some recommended mitigation
techniques and then some detection
techniques as well.
So with that in mind, let's go ahead
and jump right in.
So command line interface Amanor,
that provides a way to interact with
the computer system.
So that's pretty straightforward.
Some examples of command line
interfaces include the following.
So if you've worked around
computer systems for some time,
then none of these are foreign
to you.
So we've got the Windows Dosser
Command prompt Bashour
with OSX and Linux Basche as well.
All of these are pertinent
to administering systems, managing
systems, things of that nature,
so that that shouldn't be anything
new.
Now, what's the overall goal
of using the command line?
Well, for an attacker,
it's to remotely control the target
system, much like when
we administer systems or make
changes to systems, whatever the
case may be, attackers
have the same goal in mind, but for
malicious purpose, to execute
changes to a target system.
So if we want to change permissions
or try to manipulate functions
or features or antivirus, we
may try to do so through the command
line as well, and
then to install other tools.
And so they may have
the system reach out to a command
and control server to download a
package or payload.
That could be something as well.
So before we get into the mitigation
techniques and things of that
nature, I'd like to bring up the
miners site and I'm just going to
pull that over. And I've got some
other tabs open as well that we're
going to look at prior to looking
at mitigation techniques.
So, again,
minor as far as the way it's
defining everything here is that the
command line interface provides a
way to interact with computer
systems and is common across many
platforms.
They do talk about the Windows code,
which again, if you do run CMD
or just type CMD and hit
enter most of the time that pulls
your command up command prompt up
performing tasks, including
execution of software so
it can be interacted with locally or
remotely via remote desktop
application, reverse shell, et
cetera.
So these areas here I'm sure you're
familiar with, if you do any type of
penetration testing or security
testing commands
or execute it with current
permission level, which is
important.
So if I compromise
a system and I'm just
a standard user and I attempt
to run the command prompt
commands, if I don't have the
appropriate permissions to make
changes and modifications, it won't
happen. But if I gain
access to a domain administrator
account, that can be troublesome
as well as if I do some form of
privilege escalation that gets me
system access or system level access
that can be very damaging
as well.
So Might also provides
some examples of different threat
groups.
They're just showing here that they
use command to
execute commands and custom back
doors, do some
review of who they are, who they are
as far as on the system.
And as you can see, most
threat actors execute
some form of command
or command type commands to help
them research a system,
put files in a system, make changes
to a system, execute malware,
whatever the case may be, it's
pretty prolific.
So this is definitely an area that
we would want to focus on
as far as the attack vectors
are concerned.
Now, MITERS mitigation is execution
prevention, which is to audit and or
block and necessary command line
interpreters using applications,
weightlifting, listing tools like
Defendor, Application Control App,
Locher, etc..
So I used a reference down here.
There's a number of references here
that go to different command line
resources.
Microsoft mentions application
control and using that,
which applies to Windows 10, server
20, 16 and server 20 19
to essentially prevent
the use of the command
line interface as well as
different file types and blocking
those types from either
being modified, changed, executed,
etc..
So this is one mitigating control
that we can look at.
The other direction you can go.
If you're not running something more
current, it may take a little more
research on your end if you're using
the command prompt to run some
things initially it start up,
whatever the case may be,
it may differ, but you can always
attempt to use group policy
as well to
not allow in users or standard
users to use.
Is the command prompt, so if
one of those accounts were in fact
compromised or whatever the
case may be, you
may be able to prevent
the threat actor from easily
moving forward or getting into other
systems. And so that could be
beneficial as well.
Now, let's go ahead and jump back
into our slides here and look at the
mitigation techniques that we
listed.
So, as
is mentioned, restrict user
accounts to not allow
for elevated command prompt.
So that's huge.
One of the first things that I would
do if I get into a limbic system
or if I get on to a Windows system,
is that I attempt to run
as either pseudo or
run as an administrator or run
the command prompt is a privileged
command prompt to then see if I can
further move through the system
or do things of that nature.
So threat actors are going to do the
same thing.
So if we can block
those types of things from
happening, if we could prevent
elevated problems
from happening, that would
definitely be great for standard
user accounts. Now, there may be
scenarios where you
use the command prompt for some
system management.
Maybe you've got some scheduled
tests that run certain commands and
things of that nature.
And so you would have to look at
ways to allow those things to happen
without
any unnecessary other
types of commands from being run.
And then we can block non-essential
or unnecessary command line
interpreters. And so we looked at
group policy at a high
level and just saying that we could
use that to block command
line interpreters altogether.
But that may be specific to the ones
on that system.
And so it may not block third party
command line interpreters.
And so you may need to use against
something like the application
controls provided by Microsoft or
some other software to prevent
those things from being run on
systems. And so that's definitely
some additional research that would
need to be done but worthwhile as
far as this being a common vector
for threat actors and using command
prompts, because they're they can be
minimized or almost invisible
when they're run.
And so it takes that much longer
for end users to either discovered
or even see it. Most of the times
when we log into systems, we
get the little blip of the command
prompt coming up and going away.
We don't get a chance to read it and
we just sometimes assume that's
probably just the administrators
doing something new or applying some
policies or whatever the case may
be. And we go about our business.
So very important here to
do those things now
from a detection standpoint,
ensure that security solutions or
activities are logged
or logging process execution
with command line arguments.
And so there are some ways
that you can get logs from
command line execution and things of
that nature or get a copy of
commands that were executed.
Definitely, regardless whether you
use in a Linux based system, Windows
based system, it would be beneficial
to maintain these logs
somewhere.
Again, that isn't easily
accessible by
administrators or in users,
because if they can get to those
things, then a threat actor would
be able to get to those things.
And again, the goal of preserving
this information is
not so much for
believing that people will do bad
things.
But if bad things do happen,
you have a way to pool that
information, trace it back,
and then potentially get an idea of
what a hacker was doing, what
commands they entered.
And then you could cross-reference
those commands
with signatures of other threat
actors on the Internet and then
potentially see what type of attacks
were being conducted and then
use that information to potentially
remove that threat actors
capabilities from your systems or
prevent them from doing further
damage to those systems.
So with that, let's go
ahead and touch on our summary
for today's discussion.
So we define command line interface.
And simply put, this is a
software or
feature of a system that allows
you to manage that system
either locally or remotely.
We discussed some examples of common
command line tools, really
just talking about OSX,
having bash or windows
using the DOS prompt.
Those are the common tools.
We're going to talk about power,
shell and some other things and
the later vectors.
But really.
The things that are natively
installed are going to be what we
would consider common command
line attack tools here,
we discussed
recommended mitigation techniques.
So it's things, again, such as
application controls and
limiting user capability to access
command prompts is going to be key
here.
And then we discussed recommended
detection techniques, in this case,
long in command line activity
and ensuring that we have a record
of events that allow us to trace
back to attack or activity
and even end user activity, because
sometimes end users can
do things they shouldn't be doing
and use that to figure out
what is going on.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.