Hello and welcome to another
application of the modern attack
framework discussion today,
we're going to be looking at
filesystem permission weakness.
So let's go ahead and jump right
in.
So the objectives of
today's discussion are as follows.
We're going to describe file
permission, our filesystem,
permission, weakness, and look at
that area.
We're going to look at how has
filesystem permission weakness been
used?
We're going to look at some
mitigation techniques and then we're
going to discuss some detection
techniques.
So with that, let's go ahead and
jump right in.
So filesystem permission,
weakness.
So as a part of their
processes, binaries
may automatically execute
binaries as needed to
perform their functions or other
actions.
OK, so it is possible
for these binaries to be targeted
and the binary overwritten with
another binary.
So we're using binary a lot here,
but that's how this is laid
out and executed by
the original process.
So essentially what happens here
is this binary gets
overwritten by another binary.
It executes what it thinks is
the original process, thereby
executing the malicious binary.
And so if the original process
is running with a higher permissions
set, then the replaced binary
will execute under
the higher permissions set.
So that means that if the original
binary was of low permission and we
replace it with another, it may
execute with that higher permissions
set.
So some areas
that could be manipulated in this
manner are things like services.
And so Windows service binaries
are manipulated in.
And this is one technique which can
be used with respect to
file system permission weakness.
So in some cases, the right actors
can replace a legitimate service
executable with their own
and use it to gain persistance or
privilege escalation on an account.
Another way that this can be done is
executable installers.
And so this takes advantage of a
weakness that is common in
executable self extracting
installers. So the unpacking
of these files can result in the
execution of untrusted
code placed in subdirectories
in files which can
then overwrite binaries used
in the installation process.
And so both of these
are ways in which
permissions can be manipulated or
weak permissions can manipulate, be
manipulated with respect to
file systems.
Now, what are some potential
mitigation techniques with respect
to this this
vector?
So tools like Power Exploit
can be used to audit systems and
identify potential permission
weaknesses. And so we'll look at
this in our case study.
But PowerPoint is both
used for bad actors as
well as for good. So there are some
tools within it, some
scripts that we can run on our
systems to detect
where a threat actor may
take advantage of
privilege, escalation, or where
there may be weaknesses.
And so this is a great way for you
to kind of get ahead of the curve
and identify the low hanging fruit
that a threat at fruit they're a
an actor could take advantage of.
Now you can turn off UAC
privilege escalation for standard
users to automatically deny
elevation requests and
limit for privilege of users
to those that are necessary
to restrict the ability to make
service changes.
And so if you don't
allow your users to elevate
or escalate privilege for services
or do things of that nature, then
that can help to mitigate some risk
here and to make the threat
just drop essentially a little bit
harder on their end.
Now, what are some detection
techniques for this particular
vector? Well, we can
review systems looking
for changes to binaries and service
executables, as well as do
harshing of known good binaries
and service executables.
So doing regular comparisons
against a known good database.
So as long
as you maintain trust
with this known good database,
any of these binaries or service
executables that comes back with a
bad hash would essentially
mean that it's either been modified
outside of the regular process
or that we've got a threat factor
that is potentially
trying to take advantage of that
service and using it to their
advantage. So those are ways that
you could definitely
detect potential modification
or attempts to mess with
file system permissions.
So let's do a quick check on
learning.
True or false, executable installers
take advantage of the execution of
trusted code placed in
subdirectories and files.
So if you need to pause to take a
little more time, please do so
there's one word here that
makes this a false statement, and
that is the word
trusted.
So executable installers take
advantage of the execution of
untrusted code placed
in subdirectories and files.
And so in this case, this is a
false statement.
So let's go ahead and look at our
discussion summary for today.
The Scrat. We described file system
permission, weaknesses, looking at
services and
self installing executables
and things of that nature.
We described how these permission
weaknesses can be used.
And we looked at that.
We talked about some mitigation
techniques as well as some
detection techniques.
Again, coming back to at privilege,
as well as using some common tools
like PowerPoint to evaluate
systems, especially critical
systems, to determine where they
may be taken advantage of and where
file permissions or other
directories could be used
for threat actor to then do
some other form of white privilege
escalation. So always worth
taking the time to use some of those
tools to evaluate your systems
and see where there are areas that
you could potentially prevent
a threat actor from doing harm
and making their job a little bit
tougher.
So with that in mind, I want to
thank you for your time today,
and I look forward to seeing you
again soon.