Windows Events - Part 3 - Disrupt Code Execution with ETW

Background

• First two parts are related to observing process: what is it doing? Part 1 touched on Windows Process Auditing & Part 2 covered Sysmon.

• This part illustrates how to use Event Tracing for Windows to disrupt malicious Code-Execution.

• Some terms & concepts are based on background materials from my Cyber Security in 7 weeks series.

Outline & Objectives

1. Controls based on keeping track of “bad” as signatures to block are ineffective because evasion is cheap.

2. Review some COTS products & gain ideas to disrupt offensive TTPs.

3. Quick introduction to ETW to prepare you for C# code compilation & step-through of a simple App-Control program.

4. Simulate Multi-stage or Chained Code-Execution & watch it being disrupted by this simple App-Control, to experience & strengthen understanding of earlier sections.

From Observing to Disrupting

Detection Engineering is EXPENSIVE

Engineering Attack Disruption

Case Study 1: Disrupting Web-based Malware Delivery & C2 channel

Case Study Two: Zero Trust File-Level Protection

Why Download→WriteFile→Execute?

1. Microsoft Windows (both server & user zones) is still a very popular target! (System Susceptibility ⇒ Value + Vulnerabilities)
1. Think of valuable purpose-built networks like hospitals, Point-of-Sale & …
2. Enterprise services like email, web application & what not services that are exposed to Internet
3. No end to Microsoft systems’ vulnerabilities & to be fair, even security vendors!

2. Majority of malware are still Windows based PE files in the formats of EXE & DLL (goodware also uses these formats) (Threat Accessibility; able to deliver such payloads cheaply & widely, regardless direct exposure of vulnerabilities or not)
1. 95% of millions of samples over the years are EXE & DLLs: https://blog.virustotal.com/2021/10/ransomware-in-global-context.html
2. A majority of early infiltrations involved written PE files (e.g. backdoors, RATs & so on) see https://thedfirreport.com & assortments of technical analysis available online

3. Cheap & easy, with countless payload generators, evasion toolkits & tutorials freely available (Threat Capability; tools, techniques & resources in abundance for Threat Actors)

Isn’t there App Control within Windows?

1. Complex for some organisations to enforce & maintain

2. Some features of AppLocker & WDAC are only available for Windows Enterprise versions

3. May not be perceived as worth the effort when abusing system tools aka Living Off the Land is becoming common

Tracking is TEDIOUS, regardless “Good” or “Bad” files

Disrupting Download → WriteFile → Execute

For this ETW intro exercise, we will start with file writes. Just a quick back story to how this came about. Like everyone else who had worked in a SOC with SIEM environment, I started tracking hashes of each executed file (Sysmon.ProcessCreate.Hashes field). In a staged development environment, things were pretty predictable until I started collecting events from 2 of my interns’ personal laptops, who were both using Windows 10 Home edition. There would be a fire-hose of alerts if my initial detection logic were to be deployed in production. To figure out why, I wrote a simple Powershell script to enumerate ALL EXE & DLLs within their Windows & wrote various file attributes into a CSV file.

Why File Ownership matters?

1. System files & directories that are installed or updated by OS are typically owned by either TrustedInstaller or SYSTEM

2. Apps that we installed with RunAs admin are owned by Administrators group

3. Files created within explorer or any processes started by user (e.g. browser, MSOffice…) are owned by user

Using File Ownership to disrupt Code-Execution

1. When to check file ownership?

2. How to “deny” execution without maintaining a list?

3. What if malware was already installed before App Control starts?

4. Will it affect legit software operations & deployments?

When to check file ownership?

How to “deny” execution without maintaining a list?

$WebClient = New-Object System.Net.WebClient
$DesktopPath = [Environment]::GetFolderPath("Desktop")
$WebClient.DownloadFile("https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe","$DesktopPath\q.exe")
& $DesktopPath\q.exe

What do I need to get started with ETW?

1. Read excellent ETW notes from https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/etw-event-tracing-for-windows-101, especially the section on Consuming Events via Code so as to install the Microsoft TraceEvent package.

2. Visual Studio Community Edition running off Win 10 Home or Pro

3. Sign up ChatGPT

Create a C# .NET Core Console Project

• Run Visual Studio CE as admin (necessary for starting ETW trace)

• Install Microsoft TraceEvent package for your new project

• Edit Program.cs & replace with the following (see my comments within):

using System;
using System.IO;
using System.Security.AccessControl;
using System.Security.Principal;
using Microsoft.Diagnostics.Tracing.Parsers;
using Microsoft.Diagnostics.Tracing.Session;

namespace ConsoleAppETW
{
    class Program
    {
        static void Main(string[] args)
        {
            using (TraceEventSession session = new TraceEventSession("MyFileCreateTracer")) 
            {
								// we are using Kernel Provider NOT Sysmon
                session.EnableKernelProvider(KernelTraceEventParser.Keywords.DiskFileIO);

								// interested only with FileIOFileCreate
                session.Source.Kernel.FileIOFileCreate += Kernel_FileIOFileCreate;

								// start the trace
                session.Source.Process();
            }
        }

        private static void Kernel_FileIOFileCreate(Microsoft.Diagnostics.Tracing.Parsers.Kernel.FileIONameTraceData obj)
        {
            try
            {
								// interested with files, not directories
                if (Directory.Exists(obj.FileName))
                {
                    Console.WriteLine(obj.FileName + " | It's directory!");
                    return;
                }
								// get owner string
                FileSecurity fileSecurity = new FileInfo(obj.FileName).GetAccessControl();
                IdentityReference sid = fileSecurity.GetOwner(typeof(SecurityIdentifier));
                NTAccount ntAccount = sid.Translate(typeof(NTAccount)) as NTAccount;

                string owner = ntAccount.Value;
                Console.WriteLine(obj.FileName + " | owned by " + owner);
            }
            catch // GetAccessControl can throw exceptions when denied by Windows
            {

            }
        }

    }
}

• Build project & Run. It should look something similar:

Add an Access Rule Programmatically

• Review https://learn.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.filesystemrights?view=net-7.0 & decide which is the appropriate field to deny.

• Modify your eariler console program’s Kernel_FileIOFileCreate such that it will add this access rule when file is NOT owned by NT SERVICE\TrustedInstaller, NT AUTHORITY\SYSTEM or BUILTIN\Administrators.

• Test out your own agent with the earlier Powershell download-then-execute test script!

• For those who are adventurous, install Sysmon, use the correct Provider for Sysmon, modify the codes… or just ask ChatGPT again!

Will it affect legit software?

1. Use centralised software deployment that deploys into Program Files such that it is owned by BUILTIN\Administrators

2. Retroactively adjust file ownership with elevated Powershell command (e.g. GPO computer startup script option, or equivalent):

# the target file gets ownership + ACL from cmd.exe
get-acl c:\windows\system32\cmd.exe | set-acl c:\targetDirectory\whateverLegit.exe

What about NON-PE based Code-Execution?

By making life harder to launch written PE, we are cornering adversaries to use NON-PE approach. But why?

🧠

The set of system tools that can be abused is a MUCH SMALLER set than the infinite Portable Executables set that attackers can churn out. Also, within the set of system tools that are commonly abused, some system tools are NOT really used or irrelevant to your environment!

A quick recap of my Code-Execution mental model shared in another series. There are only 3 types of Code-Execution to Divide & Conquer!

What’s Next?

• Convert a simple web chat client-server program into a backdoor

• Use FreeEDR to observe what’s going on with this DIY backdoor

Further Reading

• https://nasbench.medium.com/finding-detection-and-forensic-goodness-in-etw-providers-7c7a2b5b5f4f

• https://bmcder.com/blog/event-tracing-for-windows-monitoring-file-and-process-interactions

• More than 1 way to skin whatever animal https://www.easefilter.com/Forums_Files/FileProtector.htm