Hello and welcome to
another application of the minor
attack framework discussion
today we're going to be looking at
scripting.
So with that, what are
today's objectives?
Well, first, what we're going to do
is look at what scripting
is and just define it a
little bit for you.
Now, you may notice that we'll use
terms that are associated with
power, shell and things of that
nature.
Scripting covers more than
just power shell scripting.
It's just any kind of automated
tasking that we can do by running
either VBS script or PowerShares
script or Basche files or
whatever the case may be,
scripting would fall into that area.
We're going to look at some examples
as to how scripting can be used.
We're going to, of course, look at
some mitigation techniques and
then we will talk about some
detection techniques as well
that are specific to scripting.
So scripting
is essentially defining scripts
and scripts are used
to perform multiple actions
in a quick and automated
manner.
This provides some of the following
advantages, so it reduces the
time to gain access to resources.
So instead of an actor
having to manually enter commands
line by line, they can dump
a script on the system.
Then an end user runs
and then that script will run
through a set of tasks that could
potentially give them access to
resources or outright download
information. Depending on what
they're trying to do, it can
potentially bypass monitoring
mechanisms. So some scripts
may be interpreted as
benign or not as a threat.
It may run in a space
such as memory or something
of that nature or the threat.
Actor may have a measure in place
that allows it to maybe be
obfuscated. Whatever the case may
be, there is the potential that it
could be used for bypassing these
mechanisms and it can be ran
without the user's knowledge.
As we saw with our show, we can run
that in the background, running in
memory, run it without
a user knowing some common
languages that are associated
with scripting in windows as VBS
script power shell
and that scripts.
Of course, there are other operating
systems out there where scripting is
popular. There are also languages
not mentioned here, such as Python
and Ruby, which can be used
as well.
Really, if it is a language that a
computer can understand, then
you can design some type of script
to work with it.
Now what are some uses
for scripting?
Well, threat actors can embed
scripts inside of office documents
using macros.
Once the file is interacted with,
then essentially what happens there?
The script runs.
And so, again,
there has to be some form of
interaction or engagement
on the user's part here.
Scripting can be used for
information gathering
prior to the threat actor
using the system.
So essentially I've
written simple scripts that will go
out and provide a response
to paying.
And what will happen is if the
script picks up the IP address
of the system, you make some
assumptions about subnet mask and
things of that nature, and it'll do
a quick sweep of the range to see if
there are in fact live
systems on the network that can be
reached.
That can be one thing.
Account information could be
gathered with scripts prior to a
threat. Actor using
a machine
scripting can be used to again
silently install applications
and things of that nature.
So that could be beneficial
and then run commands from those
applications. And so
if you've administered in an
environment of really any size and
you've had to work around
end users and things of that nature,
typically you have to find a way
to get something on a system
to get it or get something fixed on
a system and do it in a manner
that's not going to interrupt
the productivity of the
end user. And so a lot of times
applications, if you go out and look
on the websites for software and
look through the technical guides,
you'll find ways to silently install
software. You'll find ways to
run commands through the software
that otherwise you'd have to
log in via the GUI or something of
that nature.
Same thing can happen here.
We could design scripts to pull
software from a server on
the Internet and then
do a silent install of that
particular software.
And then we could have a phase
of that script that runs commands
from the successfully installed
software as well. So we could do all
of that in a matter of minutes,
seconds, whatever the case may be,
using scripting
now, a platform that has
some mention or a framework that has
some mention in
the attack framework under
scripting that I use quite often
is MÃÂ©tis Boit.
So if you've had any experience with
Minhas Boyd, it's a security tool
that can, of course, be used by
threat actors. The framework is
open to. Anyone
can be installed on both Linux
and Mac, OSX and Windows
based systems, and so any
of the operating systems
that you can imagine being in
possession of, you can run a split
on it.
A flavor of Linux that's not
mentioned here is called Linux,
which has the framework
on it out the box.
And it does more than just
so it's known for these things, for
exploitation and the ability
to add custom exploits
and things of that nature using Ruby
to make a split.
But there's also vulnerability
validation that you can do.
There are different auxiliary
modules where you can do information
gathering and things of that
nature. So really, if you become
fluent in using this
framework, it has the capability
to script a number of information
gathering areas, a
number of vulnerability, validation
areas, exploitation
areas, as well as
maintaining access and
keeping sessions open.
So there's a lot of different things
that you can do just with this one
framework, another framework
that was mentioned that is not
listed here because we just got done
talking about it was PowerPoint
again, even though it's mentioned
underpowered shell power,
shell is a separate vector, a
separate area and minor.
But it still is
a scripting tool
that can be used for exploitation
purposes as far as that piece
is concerned.
So let's go ahead and jump into
mitigation so we don't have a huge
list here,
but enabling capabilities
that allow for the sandboxing and
blocking of macros.
And so where this comes into play
is where we talk about end users
interacting with attachments,
interacting with you, Earles, or
interacting with anything really
that could run a script.
So the goal here would be that you
have a system where that script
would be executed in a safe
environment and that system would
look to see if it makes connections
to known bad IPS, if it tries to
install software, if it tries to do
anything that's not common
to that particular extension
type, file type, whatever the case
may be, this would be a
way that you could potentially
mitigate that or catch it.
And then, of course, you can
outright disable, remove or restrict
access to scripting engines.
Again, scripts have
to run using
something like power shell, using
something like the command line or
using something like
the terminal or whatever the case
may be, it would still need access
to those local resources.
And so if you've got a standard user
that can't, of course,
access those things and they
interact with a file
that would need to run
a script of some kind.
It's a script of some kind that
would need to run.
Then if it can't access those
resources, it
can't effectively execute.
Now, there may be ways that that can
be bypassed potentially, but
in this case, it's definitely
something to consider.
Now, let's talk about detection.
So, of course, we want to
log any attempts made by standard
users to run scripts.
If we know in the environment that
users don't need
access to scripts, they don't need
to run scripts. It's not something
that they do in their day to day
tasks, then
we want to log and attempt to do so.
That would be a violation, maybe a
policy, and it would need to be
reviewed immediately.
We'd want to monitor command line
arguments for script execution.
Again, if we see
activity that's indicative of
scripting, if we see
that terminals or that power
shell or that anything is really
being used in that fashion, we'd
want to learn on it and maybe do
some correlation and see if we've
got a threat factor in the
environment or an issue monitor
alert on scripts that spawn unusual
processes.
So this is great.
There's a number of tools out there
that if something let's say like a
word document attempts
to run power shell,
that doesn't make sense.
Why would we need to run a power
shell?
So it would flag that
alert on that and you could
potentially install systems that
would prevent that entirely
as well. So with that, let's do a
quick check on learning.
True or false
scripting is not common among
threat actors and should be
considered a low risk.
All right, if you need some
additional time, please pause the
video. So this is a false
statement, scripting as mentioned
in minor, and it is very common
for threat actors to use scripting
as a means to gain access
to or get tools on
a machine.
And it should definitely not be
considered a low risk.
You would definitely want to
consider controls and mitigating
factors accordingly.
So with that, let's jump over to our
summary.
So in summary, we describe scripting
and looked at what that is.
We describe how it can be used.
We looked at some mitigation
techniques in their capabilities
there, as well as some detection
techniques.
So with all of that in mind,
I want to thank you for your time
today.
And I look forward to seeing you
again soon.