🤔 How Do I Audit Management Tools?

Admins on payroll and those “magnanimous volunteers” often tread the very same path, albeit guided by different compasses of motivation. Once our cunning adversary ascends to the lofty heights of respect usually reserved for the admin on payroll, the misuse of these management tools becomes bound only by the limits of their mischievous imagination.

Windows

Services

❗️Doesn’t require admin privileges to pull off.

📕 sc \\host create service_name binpath="path/to/service"

Tasks

📕 at \\host time "path\to\exe"
📕 schtasks /CREATE /TN taskname /TR C:\path\to\evil.exe /SC once /RU "SYSTEM" /ST 15:00 /S host /u uname

# RU - run as user
# TR - what to do
# S - remote system to connect to

For the below artefacts watch out for at.exe and schtasks.exe.

🛡️Security and 🥀 Task logs

WMI

✍🏻 T1047 MITRE ATTACK

✍🏻 Whitelisted Event Consumers: SCM Event Log, RmAssistEventFilter , WSCEAA.exe, BVTFilter, TsLogonEvent.vbs, TsLogonFilter, RAevent.vbs, RmAssistEventFilter, NTEventLogConsumer and KernCap.vbs (?)

This tool’s artefacts usually reside mostly in RAM. Also, it uses WBEM protocol, and thus, it’s tricky to eavesdrop on this connection. If no WinRM - network forensics is an option.

✍🏻 CIM - common info model, shows object-relationships information.

📕 wmic /node:host /user uname process call create "path\to\exe"

# Reconnaissance with WMI
📕 wmic useraccount list full
📕 wmic group list full
📕 wmic netuse list full
📕 wmic qfe get Caption, Description, HotFixID, InstalledOn
📕 wmic startup get Caption, Command, Location, User

# Escalation with WMI
# Show services that are set to autostart, have no quotes in the path and are NOT in Windows folder
📕 wmic service get name, displayname, path, startmode | findstr /:"Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

# get the owners of the processes running in order to spot a high privileged user
📕 $Owners = @{}
Get-WmiObject -Class Win32_Process | Where-Object {$_} | For-Each {&Owners[$_.handle] = $_.getowner().user}

📕 $VulnerableServives = Get-WmiObject -Class Win32_service | Where-Object {$_} | Where-Object {($_.pathname -ne $null) -and ($_.pathname.trim() -ne " ")} | Where-Object {-not $_.pathname.StartsWith("`")} | Where-Object {-not $_.pathmname.StartsWith(" ")} 

# Lateral Movement
📕 wmic process call create "path\to\rundll32.exe path\to\dll, #opcode"
# Alternative to wmic is good old PowerShell, Invoke-WmiMethod and Get-WmiObject
📕 Invoke-WmiMethod -Computer host -Class Win32_Process -Name create -Argument "better\be\a\good\argument.exe"

Look out for the following executables wmic being invoked (on the source), along with srccons, mofcomp, wmiprvse and some custom names limited to the attacker’s quirky whims (on the target).

🛡️Security, 🍉 Microsoft-Windows-WMI-Activity%4Operational (Win10+ enabled by default), 🍇 Sysmon (📑 Microsoft-Windows-Sysmon/Operational)

✍️ Suspicious strings: ps1, eval, vbs, ActiveXObject (when screens process is run)

PowerShell Remote

✍️ Close to SSH, traffic is also encrypted.

✍️ WSMan stands for “Web Services for Management.” It’s a term used in the context of Microsoft’s implementation of the WS-Management protocol, which is a standard Simple Object Access Protocol (SOAP)-based, firewall-friendly protocol that allows hardware and operating systems from different vendors to interoperate. WSMan provides a common way for systems to access and exchange management information across an IT infrastructure. It allows IT administrators to remotely manage the system settings of devices that support the WS-Management protocol, which can include desktops, servers, or any other devices that have embedded systems. In the context of PowerShell, the WS-Management service is used by the “WinRM” (Windows Remote Management) service to provide remote management capabilities. PowerShell uses WinRM and WS-Management to enable administrators to run management shell commands and scripts on remote computers. For example, you might use the Enter-PSSession cmdlet in PowerShell to start an interactive session with a remote computer, and this would be facilitated by WinRM and WS-Management. Or you might use the Invoke-Command cmdlet to run a command on a remote computer, and this would also be facilitated by WinRM and WS-Management. Remember, like any remote management tool, WinRM and WS-Management should be used securely to prevent unauthorized access or other security risks. Always follow best practices for authentication and encryption when using these tools.

📕 Enter-PSSession -ComputerName host -Credential uname
📕 Invoke-Command -ComputerName host -ScriptBlock { Start-Process \path\to\process}

🪵 Logs: 🛡️ Security, 🍌 Microsoft-Windows-PowerShell%4Operational, 🍒 Windows-PowerShell.evtx and 🥝 Microsoft-Windows-WinRM.

⚙️ Processes: powershell.exe (source, dest), wsmprovhost.exe (dest)

❓EID 4096 is referenced in the poster, but no information on the Internet.

Registry

❗️ Requires authentication.

📕 reg add \some\reg\key /v data /t REG_SZ /d "path\to\whatever"

winrs

📕 winrs -r:host -u:user command_to_run

References