Hello.
I'm Matt Glass, and welcome to this course on Execution with Unicorn.
Using Unicorn,
we can execute our payloads on Windows hosts using a variety of attack
methods to run the PowerShell commands Unicorn generates.
But first, let's look at what Unicorn is and how it's used.
Unicorn is a simple open source tool for using a PowerShell downgrade attack,
originally created by Dave Kennedy.
This tool is available on GitHub and is currently
managed by multiple contributors.
Unicorn is designed to generate PowerShell commands with
Metasploit payloads or custom payloads.
You can download versions of the tool from GitHub or
clone the repository using Git.
Once loaded on your host, Unicorn enables in‑memory execution of shellcode.
Unicorn accomplishes this by using a PowerShell downgrade attack to
execute your shellcode, tools like Cobalt Strike or Metasploit
payloads. On the kill chain, Unicorn falls under exploit‑only.
Although the programs and payloads Unicorn allows you to execute can
be used to accomplish escalation,
lateral movement, and action, Unicorn itself just enables the
execution of these programs on the exploited host.
The ATT&CK knowledge base developed by MITRE categorizes
adversary tactics and techniques into multiple different
categories to describe the adversary's behavior.
The tactics are categories that cover different phases of an
attack and allow defensive teams to model an adversary's actions
and improve the defense of their networks.
We'll cover two techniques that Unicorn can be used for,
which both fall under the execution tactic.
The first is the command scripting interpreter, PowerShell. The
second is exploitation for client execution.
Unicorn can accomplish this by enabling adversaries to generate
PowerShell commands from their malicious payloads and easily embed them
into an Office document or HTML applications.
They could use these to target and exploit hosts and
attempt to trick the users into running their PowerShell
commands that execute the payload.
If this command succeeds,
the attackers can obtain control of the host through bind and reverse shells.