Yeah.
So that's awesome.
And so what we're going to talk about is kind of
how to catch some of that stuff, and I know you've got some examples.
What's one way that we can, if you're just browsing the internet,
we're talking about the Bitcoin money, and I browse internet,
where would I get this type of malware from?
How would that get executed on my box?
You could be going anywhere.
If a site gets compromised, then you will,
you could just land on a site that you go to every day,
and then it just happens to get compromised,
and you go there again, and it launches exploits.
Okay,
so it's got code on the site similar to code injection or a reflected attack.
Or the example that we're going to look at.
You could get a document in your email, and documents are,
attackers love documents because they have their own
scripting languages inside of it as well,
and those scripting languages can be used to pivot to these fileless techniques.
They could be used to launch PowerShell,
to launch WMI commands, and so on, and so they're great for attackers.
So phishing, of course,
someone always clicks the button that they're not supposed to click every time.
Or it downloads the document and opens it up.
Yeah, it happens all the time.
Yeah.
Like 99% of the time, it works every time.
Yeah.
Phishing is probably one of the number one,
it probably is the number one way for attackers to get
into a network because organizations,
they're not going to block documents in email.
You're not going to block Word documents or PDFs.
Yeah, you can't do that.
And so attackers know this, and so they,
this is the hole in our organization's defenses that they can get through.
So do you have some examples of a document and what that looks like?
So here, I have a document.
It's called invoice.
If I was a, let's say, an accountant,
and I received a document that was named invoice.
It may--- it's not suspicious to me.
I would go ahead and open it up.
You do this every day,
so of course you're going to open up the invoice
document because that's your job.
Now the one thing that I'll say is I've kind of neutered this one a little bit.
So nothing just executed right now on your box.
Nothing just executed, and I'll explain why.
You're not pinging out to Russia right now.
No.
So here, if we dig down into it,
you'll see that there's a macro called Document_Open.
If it had been renamed to Auto_Open,
then it would have automatically executed when I opened the document.
That's it.
So instead of saying Document_Open, it just says Auto_Open,
and now as soon as you click it, it opens up inside of Macro.
And I just did this to neuter it so that we can go in and it's not
going to be doing anything bad in the background.
But if we go in and we edit it, we'll see exactly what the macro is doing.
And here, we see that there is a shell command within the macro,
and it's launching PowerShell.
One of the ways when you look at PowerShell,
and we'll see this later on too,
you know that there's something suspicious going on when
you see the -EncodedCommand on there.
And the EncodedCommand,
you're going to see a string of hex characters after that,
and that's just Base64 code.
If we see some equal signs, that's kind of a pretty good--- If we scroll over,
I bet we see some equal signs.
Yeah, there we go.
You'll also see one or two equal signs at the end,
and that is a key indicator that you're dealing with a Base64 encoded string.
Is it always Base64 if it says Encoded in the PowerShell?
You know what?
I think it is.
I have not seen anything outside of Base64.
_____ unencrypt it.
It is, and it's actually very easy to do it.
And in fact, we'll go ahead and do that.
Let me copy this out.
I'm just copying out this whole string.
See?
And this is where CTF experience comes in handy for security operations.
Base64 is used all the time with capture the flags.
And so just to explain what's going on here.
So what happens is when you open the documents,
it's going to launch PowerShell,
and whatever the deobfuscated version of whatever this Base64 code is,
which is what we'll look at in a second,
that's going to be run by PowerShell.
So the accountant was sitting here, he thought he was opening up an invoice,
and little to his knowledge in the scenes behind him,
it's launching PowerShell and doing all of this other stuff.
So let me, I've copied it.
And this is a VBScript or is it macro?
A VBA script.
Yeah.
You use VBA?
Okay.
Yeah.
Word docs, they support VBA, Excel docs now support JavaScript,
and PDFs support JavaScript,
so there's lots of different languages that you can go to.