Hello and welcome to
another application of the minor
attack framework discussion
today we're going to be focusing
on power shell.
So with that, let's go ahead and
jump over to our objectives.
So today's objectives are
pretty straightforward.
We're going to be looking at what
power Shell is.
We're going to see what you can do
with it. As far as from the threat
actor standpoint, we're going
to look at some mitigation
techniques specifically
toward Power Shell, and
then we're going to also look at
some detection techniques as
well. So with that, let's
go ahead and jump right in.
So Power Shell is
an interactive command line and
scripting environment that is
included with Windows operating
systems. And so the great
thing about it from an
administrative standpoint is that
Power Shell has
a lot of additional flexibility in
scripting mundane tasks,
giving us the ability to automate
setups of systems, to manage
systems, to do
just a number of things that
were otherwise limited with best
script and and things of that
nature. And it's just got so many
other functions and features in.
And of course, with these
functions and features come
capabilities that threat actors
are able to take advantage of.
And so one of the things that power
show can be used for is to download
and run
executables and
they can be ran on either the disk
or in memory.
So for those of you that are
familiar with how,
you know, antivirus can be
circumvented, one of those ways is
to run
things in memory.
And by doing that, by using power
shell for those functions,
that actors can attempt to
circumvent those controls.
Now, there's a number of offensive
tools out there that include things
like Empire Powers, Foyt
and Attack.
And these are essentially
libraries that are built on
top of power shell that allow you
to either for legitimate
purposes, do security testing or
for illegitimate purposes, take
advantage of that framework
and use those tools to
either compromise systems, take
passwords, do savane
activities, whatever the case may be
there.
And so let's talk
about some things that threat actors
can do with power shell.
So power shell scripts
installed as services.
And so this essentially allows
the threat actor to work in a manner
that could evade detection
by posing as a legitimate
part of the operating system.
And so this could be effective
in intrusion detection
type systems, endpoint detection
type systems, where maybe
if you get the software
or the script to run as a legitimate
service, maybe it will overlook
that. Now, if
you've got a good
endpoint detection system in place
and you've got appropriate
correlation rules in place for login
and things of that nature, it
should notice a nonstandard
service operating in a
nonstandard way or even a standard
service maybe that
this script has taken the place of
running in a manner that's not
indicative of that service.
And so there could be some ways to
still catch that.
But this is one thing that you can
do it Paracha now using
malicious macros to
launch run commands or scripts in
the background. So this typically
starts with user interaction
in the form of email attachments.
And so, again,
it comes back to this isn't just
something that threat actors do
right out the gate.
There has to be that initial
access game to the system through
something like a spear fishing link
or some type of spearfishing
attachment, or
an end user goes to a site and
downloads what they think is
legitimate software or legitimate
components to the system, and they
run that without really doing any
further research.
Now, we
did talk about injecting malicious
code into memory.
And so, again, this provides a
means for threat actors to
evade antivirus systems
and to evade other controls
that may be put in place.
Now, in kind of continuing the
discussion, I took some
time to pull some
snippets from PowerPoint off
of my Kelly Linux distribution.
And so this is just its founding,
Kelly Linux. But you can easily
download power
and the scripts and things of that
nature that it comes with.
Again, this is based on
PowerShares scripts that can be used
in this case post exploitation.
But as you'll see here, they've
got some modules within this
framework for bypassing antivirus
code execution, exfiltration.
There's a mayhem piece here,
persistance.
Here's some PowerPoint pieces that
run Prosek.
There's a read me Rickon script
modification and.
Tests, and then if you look
at the directory that it's sitting
in, here is the user share,
wind resources, power exploit.
I did a quick list of that directory
which lists it. And as you can see
here, everything that was found
above when we initially executed
Power Exploit has come
up.
Now, we went down into
the exfiltration
directory and just did a quick
listing of that directory as well.
As you can see here, there's some
ways that you can invoke Mimi Cats,
which can be used for taking
a password information, GPP
password here
in the token manipulation.
So there's a number of things,
again, that can be done with this
framework. And it's not just for
malicious entities.
It can also be used for legitimate
security testing and things of that
nature as well. So this is just one
example of the tools that we
mentioned. But PowerShares scripts
can be written without tools and
can be used outside of this
framework as well. So it's not just
limited to a tool or something of
that nature.
Now, let's step into
some mitigation techniques that can
be applied here.
So use code signing to only
allow power shell to execute
signed scripts.
Now, there were some legitimate
reasons that I had seen as far as
when I was working with Power Shell,
where you may not want
to use code signing,
but really the risk probably
doesn't outweigh the reward
there. So it would definitely be
beneficial to ensure that that is
enabled.
Remove the power shell features from
the system entirely only after
confirming how this will impact
administration and if there are any
dependencies.
So if your administrators have
already design power shell scripts
to run on a scheduled task or
something of that nature, it may be
beneficial to
do that research and make sure that
those things are not
going to get messed up in the
process and then only
allow Shell execution
as an administrator.
So standard users probably don't
need access to power
shell. They probably don't need it.
So if you can
validate that, then this just
further limits the ability of
a threatened actor again to easily
get into a system and start
causing issues.
Now, as far as detection is
concerned, it would be
good to look for changes to
execution policy, which is something
that threat actors normally do
as soon as they get into an
environment and they're trying to
use power shell.
So if you're monitoring
for that activity specific to
power shell or if you're in the
environment that does not use power
shell, then any time
that tool is used or an attempt to
use the tool is made, then
it should definitely be reviewed.
You're going to also want to take
advantage of some of the logging
capabilities that are built into
power. Shell now.
And this can assist security teams
in gathering power, shell execution
details. So this will help you to
again better understand what a
threat actor may be trying to do,
what activities were successful,
what we're not successful.
And then you could also just again
look to see if it's tied to
legitimate business use and
it never hurts to you to have
something like that in place again,
making sure that those logs and that
information is going offsite
so that if an administrator or party
that's privy to that log information
were compromised or a threat, actor
wouldn't be able to wipe that
information out.
So with that, let's do a quick check
on learning that true
or false, another name
for power Shell is Powers
PowerPoint.
All right, well, if you need some
additional time, please go ahead and
pause the video.
So this is a false
statement. Power shell is
power, shell power exploit
is a tool that
takes advantage of power,
power, shell. So power
exploit is not another name
for power shell in this case.
So at that, let's go ahead and jump
into our summary.
So today we reviewed what Power
Shell is. Again, it
is a command line tool
that also allows us to do some
advanced scripting and things of
that nature. So definitely a
step above using just the standard
command prompt and windows.
We reviewed some uses that the
attackers could have for it, such as
running processes or services
and memory and installing
things in memory so that they can
avoid antivirus and things of that
nature.
We talked about some mitigation
techniques, such as only
allowing things that are designed to
be run through power shell
or completely removing power
shell from the environment.
And then we went on to review some
detection techniques.
Remember, any time you can log
activity as far as wind
power shell is run or when any
command is run, it
would be good to have that
information so you can tie
activities back to a threat
actor.
So with that in mind, I want to
thank you for your time today and
I look forward to seeing you again
soon.