And Tyler,
thanks for going through all of this with me and
being here for this Play by Play.
I think we talked about hunting and detecting fileless malware,
and we've really kind of delivered on that,
or you have,
in showing not just that fileless malware actually has
files and can be associated with files, but also,
the things that we'd miss, and the techniques that are used,
and then tools used to catch that,
but there seems to be quite a bit of backend stuff that has to
be done as well to enable us to catch that.
Yeah, there is.
You can't just walk into an organization or an organization just can't start
up and assume that it's going to be detecting all these.
You have to do the prep work.
You have to prepare, understand what you're not seeing,
and what you need to in order to see that.
And that's where the logging comes in.
Like we saw,
if we had not turned on that PowerShell logging and
the process creation logging, and even we didn't go through on how to do this,
but the network connection logging, we would not have seen all that information.
And with that information being logged,
we saw exactly what the attacker did without having antivirus,
or EDR, or any of those other tools on the system.
And although we don't have any kind of tangible assets to pull
out and say this was the thing that was ran because the memory
is probably long gone by now,
but we were able to catch literally everything that happened.
And that's a great point because memory,
the length of time that memory exists is finite.
You may be walking into months down the line after it happened,
which is not uncommon, and memory is long gone by that point.
The attacker may have cleaned up their tools,
but event logs, especially if you're centrally logging them,
probably still exist.
Yeah, and that's awesome.
So we were able to go over PowerShell.
We went into C# a little bit and how that can compile on the box.
You can compile programs on the fly.
That's great for bypassing static signatures.
The executable really never touches disk at that point.
Yeah,
and then even deeper and kind of even more old school a little bit in WMI
exploits in the subscriptions and the event handlers.
WMI is, I think,
one of those things that security investigators and organizations know exists,
but it's not as understood as well.
There's not a lot of logging.
It's a little bit more esoteric than PowerShell is.
But attackers have realized that this is a great thing that they can use.
It's deployed everywhere.
It's been deployed everywhere forever.
It's even deployed on systems that PowerShell isn't.
So an attacker is going to use whatever advantage they can,
and WMI is the perfect place for them to do it.
Yeah, and there's going to be artifacts,
especially if we're working on persistence,
there's going to be registry artifacts that come from that
because that's a likely mode of persistence.
Oh yeah, absolutely.
And the thing to remember too is that the registry where a lot of
this persistence is going to be located at,
you don't always just have the run key that everybody is familiar with.
You may have executables which place themselves directly in the registry.
There's entire classes of malware where the malware
executable lives in the registry, it never touches disk,
and the executable itself never goes to disk anywhere.
And so it gets launched from the registry,
it lives in the registry,
and so if you're not looking there for it or you're not
familiar with these types of things, you might very well miss it.
So kind of in an aspect, the registry is not volatile memory,
but it still is a place that you're not normally looking for an executable.
Exactly.
When you think about an executable,
you think directly I'm going to look for it on the disk.
It's got to be somewhere on the disk.
And the whole thing that we've been talking about is
the attackers avoiding going to disk.
Because as soon as it touches disk, antivirus is going to be looking at it,
EDR is going to be looking at it, it leaves a footprint on the disk.
Even if the attacker deletes it,
there's always the chance that it can be recovered or at
least snippets of it can be recovered.
So the less time they spend on the disk,
the more likely they are to avoid detection.
Well, we definitely learned a lot here, but as always with cyber security,
there is always a whole bunch more to learn.
There is.
Absolutely.
And that speaks to continuous learning as really the best maybe
mitigation for detecting advanced threats.
It is.
I mean, in security, you can't stop learning and you can't stop learning.
In my opinion,
the best thing that anybody can do is use their
curiosity and look in their environment,
look for these anomalies on their own because it all
starts with that analyst going hmm, this looks weird,
and they start digging into it, and that's when things usually blow wide open.
Yeah, so if we want to implement this in a new environment,
we would turn on some logging, probably locally with Group Policy,
and then we'd start using some tools to remotely query.
And then if we're really getting on our game,
remotely query, pull that information back,
maybe using the OS query or something like that,
into a centralized hub.
And that's really it.
If you're not looking for this stuff, you're not going to find it.
And you don't need to go out and buy this huge commercial environment to do so.
There are tons of free tools,
which will do this for you and do it effectively and will
allow you to essentially log things.
So for most organizations,
there's really no excuse why they shouldn't be doing
this because once you start doing it, you're going to find stuff.
Absolutely.
Yeah, and that's the fun part.
It is.
That's the only fun we get as blue team.
Well, unless it's Friday at 4 PM.
That's when you tend to find stuff.
That's when it's there.
Exactly.
Awesome.
Well, thanks for joining me, Tyler.
This Play by Play has been awesome, and I think,
I hope the viewers can look forward to more of your expertise
in some future Play by Plays and courses.
You have some Filebase malware analysis courses out there,
as well as some intro into malware analysis.
And I think malware analysis sounds scary to the average analyst,
but if you really, especially watching some of your courses,
you start to get into it and realize how it's extremely pertinent,
like in this scenario, to even continuous monitoring,
incident response, and forensics.
It's not like its own bucket or its own stovepipe.
Yeah, very good.
Well,
thanks for joining us for this Play by Play with Hunting for Fileless Malware.
Alright, I was glad to be here.
Thank you.
Great.