FarsightAD
is a PowerShell script that aim to help uncovering (eventual) persistence mechanisms deployed by a threat actor following an Active Directory domain compromise.
The script produces CSV / JSON file exports of various objects and their attributes, enriched with timestamps from replication metadata. Additionally, if executed with replication privileges, the Directory Replication Service (DRS)
protocol is leveraged to detect fully or partially hidden objects.
For more information, refer to the SANS DFIR Summit 2022 introductory slides.
FarsightAD
requires PowerShell 7
and the ActiveDirectory
module updated for PowerShell 7
.
On Windows 10 / 11, the module can be installed through the Optional Features
as RSAT:
Active Directory Domain Services and Lightweight Directory Services Tools
. Already installed module can be updated with:
Add-WindowsCapability -Online -Name Rsat.ServerManager.Tools~~~~0.0.1.0
If the module is correctly updated, Get-Command Get-ADObject
should return:
CommandType Name Version Source
----------- ---- ------- ------
Cmdlet Get-ADObject 1.0.X.X ActiveDirectory
. .\FarsightAD.ps1
Invoke-ADHunting [-Server <DC_IP | DC_HOSTNAME>] [-Credential <PS_CREDENTIAL>] [-ADDriveName <AD_DRIVE_NAME>] [-OutputFolder <OUTPUT_FOLDER>] [-ExportType <CSV | JSON>]
Cmdlet | Synopsis |
---|---|
Invoke-ADHunting | Execute all the FarsightAD AD hunting cmdlets (mentionned below). |
Export-ADHuntingACLDangerousAccessRights | Export dangerous ACEs, i.e ACE that allow takeover of the underlying object, on all the domain's objects. May take a while on larger domain. |
Export-ADHuntingACLDefaultFromSchema | Export the ACL configured in the defaultSecurityDescriptor attribute of Schema classes. Non-default (as defined in the Microsoft documentation) ACLs are identified and potentially dangerous ACEs are highlighted. |
Export-ADHuntingACLPrivilegedObjects | Export the ACL configured on the privileged objects in the domain and highlight potentially dangerous access rights. |
Export-ADHuntingADCSCertificateTemplates | Export information and access rights on certificate templates. The following notable parameters are retrieved: certificate template publish status, certificate usage, if the subject is constructed from user-supplied data, and access control (enrollment / modification). |
Export-ADHuntingADCSPKSObjects | Export information and access rights on sensitive PKS objects (NTAuthCertificates, certificationAuthority, and pKIEnrollmentService). |
Export-ADHuntingGPOObjectsAndFilesACL | Export ACL access rights information on GPO objects and files, highlighting GPOs are applied on privileged users or computers. |
Export-ADHuntingGPOSettings | Export information on various settings configured by GPOs that could be leveraged for persistence (privileges and logon rights, restricted groups membership, scheduled and immediate tasks V1 / V2, machine and user logon / logoff scripts). |
Export-ADHuntingHiddenObjectsWithDRSRepData | Export the objects' attributes that are accessible through replication (with the Directory Replication Service (DRS) protocol) but not by direct query. Access control are not taken into account for replication operations, which allows to identify access control blocking access to specific objects attribute(s). Only a limited set of sensitive attributes are assessed. |
Export-ADHuntingKerberosDelegations | Export the Kerberos delegations that are considered dangerous (unconstrained, constrained to a privileged service, or resources-based constrained on a privileged service). |
Export-ADHuntingPrincipalsAddedViaMachineAccountQuota | Export the computers that were added to the domain by non-privileged principals (using the ms-DS-MachineAccountQuota mechanism). |
Export-ADHuntingPrincipalsCertificates | Export parsed accounts' certificate(s) (for accounts having a non empty userCertificate attribute). The certificates are parsed to retrieve a number of parameters: certificate validity timestamps, certificate purpose, certificate subject and eventual SubjectAltName(s), ... |
Export-ADHuntingPrincipalsDontRequirePreAuth | Export the accounts that do not require Kerberos pre-authentication. |
Export-ADHuntingPrincipalsOncePrivileged | Export the accounts that were once member of privileged groups. |
Export-ADHuntingPrincipalsPrimaryGroupID | Export the accounts that have a non default primaryGroupID attribute, highlighting RID linked to privileged groups. |
Export-ADHuntingPrincipalsPrivilegedAccounts | Export detailed information about members of privileged groups. |
Export-ADHuntingPrincipalsPrivilegedGroupsMembership | Export privileged groups' current and past members, retrieved using replication metadata. |
Export-ADHuntingPrincipalsSIDHistory | Export the accounts that have a non-empty SID History attribute, with resolution of the associated domain and highlighting of privileged SIDs. |
Export-ADHuntingPrincipalsShadowCredentials | Export parsed Key Credentials information (of accounts having a non-empty msDS-KeyCredentialLink attribute). |
Export-ADHuntingPrincipalsTechnicalPrivileged | Export the technical privileged accounts (SERVER_TRUST_ACCOUNT and INTERDOMAIN_TRUST_ACCOUNT). |
Export-ADHuntingPrincipalsUPNandAltSecID | Export the accounts that define a UserPrincipalName or AltSecurityIdentities attribute, highlighting potential anomalies. |
Export-ADHuntingTrusts | Export the trusts of all the domains in the forest. A number of parameters are retrieved for each trust: transivity, SID filtering, TGT delegation. |
More information on each cmdlet usage can be retrieved using Get-Help -Full <CMDLET>
.
Adding a fully hidden user
Hiding the SID History attribute of an user
Uncovering the fully and partially hidden users with Export-ADHuntingHiddenObjectsWithDRSRepData
The C#
code for DRS
requests was adapted from:
MakeMeEnterpriseAdmin
by @vletoux.Mimikatz
by @gentilkiwi and @vletoux.SharpKatz
by @b4rtik.The functions to parse Key Credentials are from the ADComputerKeys PowerShell module
.
The AD CS related persistence is based on work from:
The function to parse Service Principal Name is based on work from Adam Bertram.
CC BY 4.0 licence - https://creativecommons.org/licenses/by/4.0/
PersistenceSniper is a Powershell script that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. The script is also available on Powershell Gallery. |
Why writing such a tool, you might ask. Well, for starters, I tried looking around and I did not find a tool which suited my particular use case, which was looking for known persistence techniques, automatically, across multiple machines, while also being able to quickly and easily parse and compare results. Sure, Sysinternals' Autoruns is an amazing tool and it's definitely worth using, but, given it outputs results in non-standard formats and can't be run remotely unless you do some shenanigans with its command line equivalent, I did not find it a good fit for me. Plus, some of the techniques I implemented so far in PersistenceSniper have not been implemented into Autoruns yet, as far as I know. Anyway, if what you need is an easy to use, GUI based tool with lots of already implemented features, Autoruns is the way to go, otherwise let PersistenceSniper have a shot, it won't miss it :)
Using PersistenceSniper is as simple as:
PS C:\> git clone https://github.com/last-byte/PersistenceSniper
PS C:\> Import-Module .\PersistenceSniper\PersistenceSniper\PersistenceSniper.psd1
PS C:\> Find-AllPersistence
If you need a detailed explanation of how to use the tool or which parameters are available and how they work, PersistenceSniper's Find-AllPersistence
supports Powershell's help features, so you can get detailed, updated help by using the following command after importing the module:
Get-Help -Name Find-AllPersistence -Full
PersistenceSniper's Find-AllPersistence
returns an array of objects of type PSCustomObject with the following properties:
PS C:\> Find-AllPersistence | Where-Object "Access Gained" -EQ "System"
Of course, being PersistenceSniper a Powershell-based tool, some cool tricks can be performed, like passing its output to Out-GridView
in order to have a GUI-based table to interact with.
As already introduced, Find-AllPersistence
outputs an array of Powershell Custom Objects. Each object has the following properties, which can be used to filter, sort and better understand the different techniques the function looks for:
Find-AllPersistence
without a -ComputerName
parameter, PersistenceSniper will run only on the local machine. Otherwise it will run on the remote computer(s) you specify;Let's face it, hunting for persistence techniques also comes with having to deal with a lot of false positives. This happens because, while some techniques are almost never legimately used, many indeed are by legit software which needs to autorun on system boot or user login.
This poses a challenge, which in many environments can be tackled by creating a CSV file containing known false positives. If your organization deploys systems using something like a golden image, you can run PersistenceSniper on a system you just created, get a CSV of the results and use it to filter out results on other machines. This approach comes with the following benefits:
Find-AllPersistence
comes with parameters allowing direct output of the findings to a CSV file, while also being able to take a CSV file as input and diffing the results.
PS C:\> Find-AllPersistence -DiffCSV false_positives.csv
ย
One cool way to use PersistenceSniper my mate Riccardo suggested is to use it in an incremental way: you could setup a Scheduled Task which runs every X hours, takes in the output of the previous iteration through the -DiffCSV
parameter and outputs the results to a new CSV. By keeping track of the incremental changes, you should be able to spot within a reasonably small time frame new persistences implanted on the machine you are monitoring.
The topic of persistence, especially on Windows machines, is one of those which see new discoveries basically every other week. Given the sheer amount of persistence techniques found so far by researchers, I am still in the process of implementing them. So far the following 31 techniques have been implemented successfully:
The techniques implemented in this script have already been published by skilled researchers around the globe, so it's right to give credit where credit's due. This project wouldn't be around if it weren't for:
I'd also like to give credits to my fellow mates at @APTortellini, in particular Riccardo Ancarani, for the flood of ideas that helped it grow from a puny text-oriented script to a full-fledged Powershell tool.
This project is under the CC0 1.0 Universal license. TL;DR: you can copy, modify, distribute and perform the work, even for commercial purposes, all without asking permission.