Hello again.
It's time for another demo.
This time,
we'll be looking at Winlogbeat and its ability to facilitate
detection of Living off the Land attacks.
I'll start by verifying the Winlogbeat configuration as the required event ID.
Next,
we will look at the LOLBAS project and I will talk about some
ways to develop a scoped binary baseline.
Once the baseline is developed,
I will simulate a few Living off the Land techniques.
Then, last but not least,
we will head over to the Kibana web UI to observe what events were generated.
This is a domain‑joined workstation in the Globomantics environment.
Process creation events and command line login are enabled.
Now, let's look at the Winlogbeat configuration.
Event ID 4688 is already configured, so our first task is complete.
I mentioned the LOLBAS project in the last clip.
Let's visit the site and see what resources are available.
Here we are.
We can use this site to identify the LOLBAS functions
that can be used to support an attack.
A security team can use the information here to build
different baselines and detections.
Let's head over to Kibana.
This is the Dev Tools section of the Kibana web UI.
When you have Winlogbeat installed across your fleet,
you can observe trends and outliers in your data.
So when you want to see which Living off the Land binaries and
scripts have been executed in your environment,
you can use a search query like the one on the screen.
This query asks if my aggregated Winlogbeat dataset has
any of the Living off the Land binaries,
and if it does, to aggregate them and show me the number of times seen.
The first section should eliminate case sensitivity issues.
I know a lot is going on here; however,
the takeaway is that Winlogbeat can help you aggregate event
ID 4688 and allow you to develop anomaly detections. How you
develop your detections will vary.
If we scan the output from the search, we can see that bitsadmin is not present.
Let's take a look at an example attack.
I will use the bitsadmin binary to simulate the download of
a malicious DLL. Let's list the directory contents, and we
can see no existing files.
The first step is to create a bitsadmin job. Then, I will add
the file I want to download to that job, including the
destination. Next, bitsadmin automatically suspends jobs, so we
must activate it using a resume.
I will show you the job status for this demo because the next step
should be performed when the status changes to transferring.
Notice it's currently in progress, and if we wait a few seconds
and check again, there we go.
Now we release the file by telling bitsadmin to complete the job.
If we list the directory's contents again, we can see that we have our payload.
If we head over to Kibana and rerun our search, we can see that
bitsadmin now shows up. How this information is used will vary
for each organization, but generally, some follow‑up
investigation should be conducted.
Let's look at a follow‑up example where we use rundll32 to
perform proxy execution of the downloaded payload.
Notice it has over 100 individual log events in total
across five systems in this lab.
Real‑world environments could have several thousand.
Keep this in mind as I perform the next simulation. The adversary has renamed
rundll32.exe to smurf.exe as an additional evasion technique.
Remember, renaming this binary does not affect the cryptographic hash. So
now, we can execute our payload from the previous bitsadmin download. The
command line syntax I'm going to use requires the name of the DLL and
what's called an entry point. We will tell rundll32 that the entry point to
our DLL is Globomantics. The LOLBAS project has a few examples of how
rundll32 can be used, including the example I provided.
If we head back to Kibana, we need to run a different search across the
process command line field instead of the process name field.
Smurf is not in the LOLBAS database, so our previous approach won't work.
Using our knowledge of attacker TTPs and how rundll32 can be abused allows us
to arrive at a search for dll followed by a comma.
For this example,
I will use Globomantics because it simulates one particular
DLL entry point seen in threat research.
If we use a wildcard prefix in the query,
we can ignore the file name and instead focus on the command line usage.
Our results show us the command line, and I've
filtered out some of the other fields,
but we also have the entire contents of the event,
including the computer hostname, the user account that ran the command, and more.
That's all for this clip Thanks for watching.