Kazanciyan investigating PowerShell attacks - Black Hat

Investigating

PowerShell Attacks

Black Hat USA 2014

August 7, 2014

PRESENTED BY: Ryan Kazanciyan, Matt Hastings

? Mandiant, A FireEye Company. All rights reserved.

Background Case Study

Victim

VPN

Attacker

Client

WinRM,

SMB,

NetBIOS

Victim workstations,

servers

¡ì? Fortune 100 organization

¡ì? Command-and-control via

¡ì? Scheduled tasks

¡ì? Compromised for > 3 years

¡ì? Active Directory

¡ì? Authenticated access to

corporate VPN

? Mandiant, A FireEye Company. All rights reserved.

¡ì? Local execution of

PowerShell scripts

¡ì? PowerShell Remoting

2

Why PowerShell?

It can do almost anything¡­

Execute commands

Download files from the internet

Reflectively load / inject code

Interface with Win32 API

Enumerate files

Interact with the registry

Interact with services

Examine processes

Retrieve event logs

Access .NET framework

? Mandiant, A FireEye Company. All rights reserved.

3

PowerShell Attack Tools

¡ì? PowerSploit

¡ì?

¡ì?

¡ì?

¡ì?

¡ì?

Reconnaissance

Code execution

DLL injection

Credential harvesting

Reverse engineering

¡ì?

¡ì?

¡ì?

¡ì?

Posh-SecMod

Veil-PowerView

Metasploit

More to come¡­

¡ì? Nishang

? Mandiant, A FireEye Company. All rights reserved.

4

PowerShell Malware in the Wild

? Mandiant, A FireEye Company. All rights reserved.

5

 ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download