In In NTDLL I I Trust Process Reimaging and Endpoint Security - - PowerPoint PPT Presentation

In In NTDLL I I Trust Process Reimaging and Endpoint Security Solution Bypass

Hack in Paris 2019 Eoin Carroll Senior Security Researcher McAfee ATR

Attribution

Eoin Carroll Steve Hearnden Cedric Cochin Steve Povolny sacré bleu

About me

Semi-Conductor Electronic Engineer Medical Device Electronic Engineer SW Security Engineer Appsec Pentester Security Researcher Security Team Lead Security Mgr Security Architect 2000 2007 2011 2018 @w3knight

The next 40 minutes…

• Process Reimaging Overview
• AV scanners and Process Reimaging
• Mitre ATT&CK and Defensive Evasion
• Process Reimaging Prerequisite and Attack Vectors
• Process Reimaging Weaponization
• Windows Kernel APIs + Process Reimaging Deep Dive
• Windows Defender bypass demo
• Impact and Protection Recommendations

Process Reimaging Overview

• Process Reputation and Trust verification bypass
• Impacts non-EDR Endpoint Security Solutions using NTDLL APIs such

as K32GetProcessImageFilename

• Equivalent in impact to Process Hollowing or Process Doppelganging

within the Mitre Attack Defense Evasion Category

• Malicious Process can dwell on Endpoint until reboot or full scan post

signature update

Antivirus Scanner Detection Points

• 1. FileCreate
• 2. Section Create
• 3. Cleanup
• 4. ImageLoad
• 5. CloseFile
• Signature == detects @ 1,2,4

Antivirus Scanner Detection Points

• 1. FileCreate
• 2. Section Create
• 3. Cleanup
• 4. ImageLoad
• 5. CloseFile
• Signature == detects @ 1,2,4
• No Signature == depends on OS for

running process attribute verification @ 4

Antivirus Scanner Detection Points

• 1. FileCreate
• 2. Section Create
• 3. Cleanup
• 4. ImageLoad
• 5. CloseFile
• Signature == detects @ 1,2,4
• No Signature == depends on OS for

running process attribute verification @ 4

Process Reimaging Definition

“Windows Kernel APIs return stale and inconsistent FILE_OBJECT paths which enable an adversary to bypass Windows Operating System Process attribute verification”

Mitre ATT&CK

Mitre ATT&CK

Subverting Trust

Subverting Trust

Digital Signature Validation

Subverting Trust

Digital Signature Validation Process Attribute Verification

May 2018 – SynAck Ransomware

SynAck – Process Hollowing

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Endpoint Security Solution (ESS)

SynAck – Process Hollowing

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Endpoint Security Solution (ESS)

CreateProcess Create_Suspended

1. Process created with trusted binary

SynAck – Process Hollowing

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Malicious PE Endpoint Security Solution (ESS)

CreateProcess Create_Suspended NtUnmapViewOfSection VirtualAllocEx WriteProcessMemory ResumeThread

1. Process created with trusted binary 2. Process Hollowing with malicious code

SynAck – Process Hollowing

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Malicious PE Endpoint Security Solution (ESS) Protection failed to detect obfuscated dropper

CreateProcess Create_Suspended NtUnmapViewOfSection VirtualAllocEx WriteProcessMemory ResumeThread

1. Process created with trusted binary 2. Process Hollowing with malicious code

SynAck – Process Hollowing

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Malicious PE Endpoint Security Solution (ESS) Protection failed to detect obfuscated dropper Signatures updated

CreateProcess Create_Suspended NtUnmapViewOfSection VirtualAllocEx WriteProcessMemory ResumeThread

1. Process created with trusted binary 2. Process Hollowing with malicious code

SynAck – Process Hollowing

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Malicious PE Endpoint Security Solution (ESS) Protection failed to detect obfuscated dropper Signatures updated

CreateProcess Create_Suspended NtUnmapViewOfSection VirtualAllocEx WriteProcessMemory ResumeThread NTDLL API for Process Image Query

1. Process created with trusted binary 2. Process Hollowing with malicious code

SynAck – Process Hollowing

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Malicious PE Endpoint Security Solution (ESS) Protection failed to detect obfuscated dropper Signatures updated

CreateProcess Create_Suspended NtUnmapViewOfSection VirtualAllocEx WriteProcessMemory ResumeThread NTDLL API for Process Image Query

msiexec.exe

1. Process created with trusted binary 2. Process Hollowing with malicious code

SynAck – Process Doppelganging

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Endpoint Security Solution (ESS)

CreateTransaction CreateFileTransacted

1. Trusted Binary transacted as Malicious PE

SynAck – Process Doppelganging

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Malicious PE Endpoint Security Solution (ESS)

CreateTransaction CreateFileTransacted WriteFile CreateSection

1. Trusted Binary transacted as Malicious PE 2. Create Sections from transacted Malicious PE

SynAck – Process Doppelganging

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Malicious PE Endpoint Security Solution (ESS)

CreateTransaction CreateFileTransacted WriteFile CreateSection ResumeThread

1. Trusted Binary transacted as Malicious PE 2. Create Sections from transacted Malicious PE 3. Rollback transaction removes changes from Filesystem

RollBackTransaction NtCreateProcess

SynAck – Process Doppelganging

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Malicious PE Endpoint Security Solution (ESS) Protection failed to detect obfuscated dropper

CreateTransaction CreateFileTransacted WriteFile CreateSection ResumeThread

1. Trusted Binary transacted as Malicious PE 2. Create Sections from transacted Malicious PE 3. Rollback transaction removes changes from Filesystem

RollBackTransaction NtCreateProcess

SynAck – Process Doppelganging

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Malicious PE Endpoint Security Solution (ESS) Protection failed to detect obfuscated dropper Signatures updated

CreateTransaction CreateFileTransacted WriteFile CreateSection ResumeThread

1. Trusted Binary transacted as Malicious PE 2. Create Sections from transacted Malicious PE 3. Rollback transaction removes changes from Filesystem

RollBackTransaction NtCreateProcess

SynAck – Process Doppelganging

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Malicious PE Endpoint Security Solution (ESS) Protection failed to detect obfuscated dropper Signatures updated

CreateTransaction CreateFileTransacted WriteFile CreateSection ResumeThread NTDLL API for Process Image Query

1. Trusted Binary transacted as Malicious PE 2. Create Sections from transacted Malicious PE 3. Rollback transaction removes changes from Filesystem

RollBackTransaction NtCreateProcess

SynAck – Process Doppelganging

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe

msiexec.exe Malicious PE Endpoint Security Solution (ESS) Protection failed to detect obfuscated dropper Signatures updated

CreateTransaction CreateFileTransacted WriteFile CreateSection ResumeThread NTDLL API for Process Image Query

msiexec.exe

1. Trusted Binary transacted as Malicious PE 2. Create Sections from transacted Malicious PE 3. Rollback transaction removes changes from Filesystem

RollBackTransaction NtCreateProcess

Process Reimaging Prerequisite and Attack Vectors

Prerequisites

Process Reimaging targets the post-exploitation phase, whereby a threat actor has already gained access to the target system. This is the same prerequisite of Process Hollowing or Doppelganging techniques within the Defense Evasion category of the Mitre ATT&CK framework.

Attack Vectors

1. FILE_OBJECT Filepath changes 2. FILE_OBJECT Filename changes 3. LoadLibrary FILE_OBJECT reuse

SynAck using Process Reimaging

SynAck - Process Reimaging Weaponization

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe undetected.exe

undetected.exe Endpoint Security Solution (ESS)

CreateProcess

1. Process created with undetected binary

SynAck - Process Reimaging Weaponization

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe undetected.exe

undetected.exe msiexec.exe Endpoint Security Solution (ESS)

CreateProcess MoveFileW CreateDirectoryW CopyFileW

1. Process created with undetected binary 2. Process reimaged as msiexec

SynAck - Process Reimaging Weaponization

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe undetected.exe

undetected.exe msiexec.exe Endpoint Security Solution (ESS) Protection failed to detect obfuscated dropper

CreateProcess MoveFileW CreateDirectoryW CopyFileW

1. Process created with undetected binary 2. Process reimaged as msiexec

SynAck - Process Reimaging Weaponization

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe undetected.exe

undetected.exe msiexec.exe Endpoint Security Solution (ESS) Protection failed to detect obfuscated dropper Signatures updated

CreateProcess MoveFileW CreateDirectoryW CopyFileW

1. Process created with undetected binary 2. Process reimaged as msiexec

SynAck - Process Reimaging Weaponization

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe undetected.exe

undetected.exe msiexec.exe Endpoint Security Solution (ESS) Protection failed to detect obfuscated dropper Signatures updated

CreateProcess MoveFileW CreateDirectoryW CopyFileW NTDLL API for Process Image Query

1. Process created with undetected binary 2. Process reimaged as msiexec

SynAck - Process Reimaging Weaponization

Initial Access Execution Defense Evasion Acting on Objectives

Drive-by-Compromise Phishing Obfuscated Trojan Dropper Dropper Location SynAck.exe msiexec.exe undetected.exe

undetected.exe msiexec.exe Endpoint Security Solution (ESS) Protection failed to detect obfuscated dropper Signatures updated

CreateProcess MoveFileW CreateDirectoryW CopyFileW NTDLL API for Process Image Query

msiexec.exe

1. Process created with undetected binary 2. Process reimaged as msiexec

Windows Kernel APIs + Process Reimaging Deep Dive

NtQueryInformationProcess Filename APIs

IDA Graph Displaying Complexity of NtQueryInformationProcess Filename APIs within NTDLL

NtQueryVirtualMemory Filename API

IDA Graph Displaying Complexity of NtQueryVirtualMemory Filename API within NTDLL

OS/Kernel version and API Matrix

Kernelbase.dll APIs Ntoskrnl.exe API & Structures Win 7 SP1 x64 Ntoskrnl 6.1.7601.17514 Win 8.1 x64 Ntoskrnl 6.3.9600.18946 Win10 RS1 x64 Ntoskrnl 10.0.14393.0 K32GetModuleFileNameEx

NtQueryInformationProcess

EPROCESS +0x448 ImageFilePointer (Win10) EPROCESS +0x3b8 SectionObject (<Win10)

Incorrect Filename Incorrect path Incorrect Filename Incorrect path Correct Filename Incorrect path

GetMappedFileName

NtQueryVirtualMemory

VAD FILE_OBJECT handle

Correct Filename Incorrect path Correct Filename Incorrect path Correct Filename Incorrect path

K32GetProcessImageFileName

NtQueryInformationProcess

EPROCESS SeAuditProcessCreationInfo

Incorrect Filename Incorrect path Incorrect Filename Incorrect path Incorrect Filename Incorrect path

QueryFullProcessImageFileName

NtQueryInformationProcess

EPROCESS +0x448 ImageFilePointer (Win10) EPROCESS +0x3b8 SectionObject (<Win10)

Incorrect Filename Incorrect path Incorrect Filename Incorrect path Correct Filename Incorrect path

Filepath Changes (impacts all Windows OS versions)

Filepath Changes (impacts all Windows OS versions)

Filepath Changes (impacts all Windows OS versions)

Filepath Changes (impacts all Windows OS versions)

Filename Changes (impacts Windows >= Windows 10)

Filename Changes (impacts Windows >= Windows 10)

Filename Changes (impacts Windows < Windows 10)

Filename Changes (impacts Windows < Windows 10)

Using LoadLibrary (impacts all Windows OS Versions)

Using CreateProcess (impacts all Windows OS Versions)

Windows Defender Bypass Demo

Process Manipulation Techniques Recap

Process Reimaging

Process Manipulation Techniques Recap

Process Reimaging Process Doppelganging

Process Manipulation Techniques Recap

Process Reimaging Process Doppelganging Process Hollowing

Process Manipulation Techniques Comparison

Process Manipulation Technique Advantages Disadvantages Protection Detection Process Reimaging

Easier to execute No code injection All Windows versions No API signatures No Protection No fileless No trusted path execution location Cannot delete malicious file from disk Track FILE_OBJECT ID from FileCreate EDR tracing Memory scanning (requires trigger)

Process Doppelganging

Fileless Trusted path execution location Delete malicious file from disk Transaction API not legitimate usage Code Injection Microsoft Protection ESS protection Proprietary Techniques Yara Rules EDR tracing Yara Rules Memory scanning (requires trigger)

Process Hollowing

Fileless Trusted path execution location Delete malicious file from disk Noisy APIs Signatures Code Injection ESS protection Proprietary Techniques Yara Rules EDR tracing Yara Rules Memory scanning (requires trigger)

Impact

• 1. Process reputation of a remote process – any product using the APIs

to determine if executing code is from a malicious file on disk

CVSS score 5.0 (Medium) https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N (same score as Doppelganging)

Impact

• 1. Process reputation of a remote process – any product using the APIs

to determine if executing code is from a malicious file on disk

CVSS score 5.0 (Medium) https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N (same score as Doppelganging)

• 2. Trust verification of a remote process - any product using the APIs to

verify trust of a calling process

CVSS score will be higher than 5.0; scoring specific to Endpoint Security Solution architecture

Impact

• 1. Process reputation of a remote process – any product using the APIs

to determine if executing code is from a malicious file on disk

CVSS score 5.0 (Medium) https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N (same score as Doppelganging)

• 2. Trust verification of a remote process - any product using the APIs to

verify trust of a calling process

CVSS score will be higher than 5.0; scoring specific to Endpoint Security Solution architecture Note: you are vulnerable if you use any of the APIs listed in the “OS/Kernel version and API Matrix” for above use cases

Protection Recommendations (to ESS Vendor)

• The FILE_OBJECT ID must be tracked from FileCreate as the process

closes its handle for the filename by the time the image is loaded at ImageLoad.

• This ID must be managed by the Endpoint Security Vendor so that it

can be leveraged to determine if a process has been reimaged when performing process attribute verification.

Protection Recommendations (to Microsoft)

• File System Synchronization (EPROCESS structures out of sync with the filesystem or File Control Block structure (FCB)
• Allow the EPROCESS structure fields to reflect filepath changes
• There are other EPROCESS fields which do not reflect changes to filenames and need to be updated
• API Usage (most returning file info for process creation time)
• Defender (MpEngine.dll should be using K32GetModuleFileNameEx to get process image filename
• Consolidate the duplicate APIs being exposed from NtQueryInformationProcess to provide easier management and guidance to consumers
• Differentiate in API description whether the API is only limited to retrieving the filename and path at process creation or real-time at time
• f request
• Filepath Locking
• Lock filepath and name similar to lock file modification when a process is executing to prevent modification.
• Standard user at a minimum should not be able to rename binary paths for its associated executing process.
• Reuse of existing FILE_OBJECT with LoadLibrary API
• LoadLibrary should verify any existing FILE_OBJECT it reuses, has the most up to date Filepath at load time.
• As a short term mitigation, Defender should flag that it found malicious process activity

Microsoft June 2019 Cumulative update

• Microsoft released a partial mitigation to Defender in the June 2019

Cumulative update for the Process Reimaging FILE_OBJECT filename changes attack vector only

• This update was only for Windows 10 and does not address the vulnerable

APIs in “OS/Kernel version and API Matrix” at the OS level; therefore, Endpoint Security Solutions are still vulnerable to Process Reimaging

• Defender also remains vulnerable to the FILE_OBJECT filepath changes attack

vector executed in the bypass demo video, and this attack vector affects all Windows OS versions

McAfee Blog

https://securin ingtomorrow.mcafee.com/other-blogs/mcafee-labs/in- ntdll ll-i-trust-process-reimaging-and-endpoin int-security-solu lution-bypass/

sin in é daoine dzNrbmlnaHQ=