FreshRSS

🔒
❌ Secure Planet Training Courses Updated For 2019 - Click Here
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayYour RSS feeds

EDRaser - Tool For Remotely Deleting Access Logs, Windows Event Logs, Databases, And Other Files

By: Zion3R


EDRaser is a powerful tool for remotely deleting access logs, Windows event logs, databases, and other files on remote machines. It offers two modes of operation: automated and manual.


Automated Mode

In automated mode, EDRaser scans the C class of a given address space of IPs for vulnerable systems and attacks them automatically. The attacks in auto mode are:

  • Remote deletion of webserver logs.
  • SysLog deletion (on Linux).
  • Local deletion of Windows Application event logs.
  • Remote deletion of Windows event logs.
  • VMX + VMDK deletion

To use EDRaser in automated mode, follow these steps:

python edraser.py --auto

Manual Mode

In manual mode, you can select specific attacks to launch against a targeted system, giving you greater control. Note that some attacks, such as VMX deletion, are for local machine only.

To use EDRaser in manual mode, you can use the following syntax:

python edraser.py --ip <ip_addr> --attack <attack_name> [--sigfile <signature file>]

Arguments:

  • --ip: scan IP addresses in the specified range and attack vulnerable systems (default: localhost).
  • --sigfile: use the specified encrypted signature DB (default: signatures.db).
  • --attack: attack to be executed. The following attacks are available: ['vmx', 'vmdk', 'windows_security_event_log_remote', 'windows_application_event_log_local', 'syslog', 'access_logs', 'remote_db', 'local_db', 'remote_db_webserver']

Optional arguments:

  • port : port of remote machine
  • ``
  • db_username: the username of the remote DB.
  • db_password: the password of the remote DB.
  • db_type: type of the DB, EDRaser supports mysql, sqlite. (# Note that for sqlite, no username\password is needed)
  • db_name: the name of remote DB to be connected to
  • table_name: the name of remote table to be connected to
  • rpc_tools: path to the VMware rpc_tools

Example:

python edraser.py --attack windows_event_log --ip 192.168.1.133 

python EDRaser.py -attack remote_db -db_type mysql -db_username test_user -db_password test_password -ip 192.168.1.10

DB web server

You can bring up a web interface for inserting and viewing a remote DB. it can be done by the following command: EDRaser.py -attack remote_db_webserver -db_type mysql -db_username test_user -db_password test_password -ip 192.168.1.10

This will bring up a web server on the localhost:8080 address, it will allow you to view & insert data to a remote given DB. This feature is designed to give an example of a "Real world" scenario where you have a website that you enter data into it and it keeps in inside a remote DB, You can use this feature to manually insert data into a remote DB.

Available Attacks

In manual mode, EDRaser displays a list of available attacks. Here's a brief description of each attack:

  1. Windows Event Logs: Deletes Windows event logs from the remote targeted system.
  2. VMware Exploit: Deletes the VMX and VMDK files on the host machine. This attack works only on the localhost machine in a VMware environment by modifying the VMX file or directly writing to the VMDK files.
  3. Web Server Logs: Deletes access logs from web servers running on the targeted system by sending a malicious string user-agent that is written to the access-log files.
  4. SysLogs: Deletes syslog from Linux machines running Kaspersky EDR without being .
  5. Database: Deletes all data from the remotely targeted database.


ThreatHound - Tool That Help You On Your IR & Threat Hunting And CA

By: noreply@blogger.com (Unknown)


This tool will help you on your IR & Threat Hunting & CA. just drop your event log file and anlayze the results.


New Release Features:

  • support windows (ThreatHound.exe)
  • C for Linux based
  • new vesion available in C also
  • now you can save results in json file or print on screen it as you want by arg 'print' "'yes' to print the results on screen and 'no' to save the results on json file"
  • you can give windows event logs folder or single evtx file or multiple evtx separated by comma by arg -p
  • you can now give sigam ruels path by arg -s
  • add multithreading to improve runing speed
  • ThreatHound.exe is agent based you can push it and run it on multiple servers
  • Example:
$ ThreatHound.exe -s ..\sigma_rules\ -p C:\Windows\System32\winevt\Logs\ -print no

  • NOTE: give cmd full promission to read from "C:\Windows\System32\winevt\Logs"

  • Linux Based:

  • Windows Based

I’ve built the following:

  • A dedicated backend to support Sigma rules for python
  • A dedicated backend for parsing evtx for python
  • A dedicated backend to match between evtx and the Sigma rules

Features of the tool:

  • Automation for Threat hunting, Compromise Assessment, and Incident Response for the Windows Event Logs
  • Downloading and updating the Sigma rules daily from the source
  • More then 50 detection rules included
  • support for more then 1500 detection rules for Sigma
  • Support for new sigma rules dynamically and adding it to the detection rules
  • Saving of all the outputs in JSON format
  • Easily add any detection rules you prefer
  • you can add new event log source type in mapping.py easily

To-do:

  • Support for Sigma rules dedicated for DNS query
  • Modifying the speed of algorithm dedicated for the detection and making it faster
  • Adding JSON output that supports Splunk
  • More features

installiton:

$ git clone https://github.com/MazX0p/ThreatHound.git
$ cd ThreatHound
$ pip install - r requirements.txt
$ pyhton3 ThreatHound.py
  • Note: glob doesn't support get path of the directory if it has spaces on folder names, please ensure the path of the tool is without spaces (folders names)

Demo:

https://player.vimeo.com/video/784137549?h=6a0e7ea68a&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479

Screenshots:



Whids - Open Source EDR For Windows

By: noreply@blogger.com (Unknown)


What

EDR with artifact collection driven by detection. The detection engine is built on top of a previous project Gene specially designed to match Windows events against user defined rules.

What do you mean by "artifact collection driven by detection" ?

It means that an alert can directly trigger some artifact collection (file, registry, process memory). This way you are sure you collected the artifacts as soon as you could (near real time).

All this work has been done on my free time in the hope it would help other people, I hope you will enjoy it. Unless I get some funding to further develop this project, I will continue doing so. I will make all I can to fix issues in time and provide updates. Feel free to open issues to improve that project and keep it alive.


Why

  • Provide an Open Source EDR to the community
  • Make transparency on the detection rules to make analysts understand why a rule triggered
  • Offer powerful detection primitives though a flexible rule engine
  • Optimize Incident Response processes by drastically reducing the time between detection and artifact collection

How

NB: the EDR agent can be ran standalone (without being connected to an EDR manager)

Strengths

  • Open Source
  • Relies on Sysmon for all the heavy lifting (kernel component)
  • Very powerful but also customizable detection engine
  • Built by an Incident Responder for all Incident Responders to make their job easier
  • Low footprint (no process injection)
  • Can co-exist with any antivirus product (advised to run it along with MS Defender)
  • Designed for high throughput. It can easily enrich and analyze 4M events a day per endpoint without performance impact. Good luck to achieve that with a SIEM.
  • Easily integrable with other tools (Splunk, ELK, MISP ...)
  • Integrated with ATT&CK framework

Weaknesses

  • Only works on Windows
  • Detection limited to what is available in Windows event logs channels ETW providers/sessions (already a lot in there)
  • No process instrumentation (it is also a strength as it depends on the point of view)
  • No GUI yet (will develop one if requested by the community)
  • No support for ETW (available in beta)
  • Tell me if you notice others ...

Installation

Requirements

  1. Install Sysmon
  2. Configure Sysmon
    • You can find optimized Sysmon configurations here
    • Logging any ProcessCreate and ProcessTerminate is mandatory
  3. Take note of the path to your Sysmon binary because you will need it later on

NB: event filtering can be done at 100% with Gene rules so do not bother creating a complicated Sysmon configuration.

Pre-Installation Recommendations

In order to get the most of WHIDS you might want to improve your logging policy.

  • Enable Powershell Module Logging
  • Audit Service Creation: gpedit.msc -> Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\System Audit Policies\System\Audit Security System Extension -> Enable
  • Enable File System Audit. Sysmon only provides FileCreate events when new files are created, so if you want/need to log other kind of accesses (Read, Write, ...) you need to enable FS Auditing.
    1. gpedit.msc -> Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\System Audit Policies\Object Access\Audit File System -> Enable
    2. Right Click Any Folder -> Properties -> Security -> Advanced -> Auditing -> Add
      1. Select a principal (put here the name of the user/group you want the audit for). Put group Everyone if you want to log access from any user.
      2. Apply this to is used to select the scope of this audit policy starting from the folder you have selected
      3. Basic permissions select the kinds of accesses you want the logs to be generated for
      4. Validate
    3. File System auditing logs will appear in the Security log channel
  • If you want an antivirus to run on your endpoints, keep Microsoft Defender, first because it is a good AV but also because it logs alerts in a dedicated log channel Microsoft-Windows-Windows Defender/Operational monitored by the EDR.

EDR Endpoint agent (Whids.exe)

This section covers the installation of the agent on the endpoint.

  1. Download and extract the latest WHIDS release https://github.com/0xrawsec/whids/releases
  2. Run manage.bat as administrator
  3. Launch installation by selecting the appropriate option
  4. Verify that files have been created at the installation directory
  5. Edit configuration file by selecting the appropriate option in manage.bat or using your preferred text editor
  6. Skip this if running with a connection to a manager, because rules will be updated automatically. If there is nothing in the rules directory the tool will be useless, so make sure there are some gene rules in there. Some rules are packaged with WHIDS and you will be prompted to choose if you want to install those or not. If you want the last up to date rules, you can get those here (take the compiled ones)
  7. Start the services from appropriate option in manage.bat or just reboot (preferred option otherwise some enrichment fields will be incomplete leading to false alerts)
  8. If you configured a manager do not forget to run it in order to receive alerts and dumps

NB: At installation time the Sysmon service will be made dependent of WHIDS service so that we are sure the EDR runs before Sysmon starts generating some events.

EDR Manager

The EDR manager can be installed on several platforms, pre-built binaries are provided for Windows, Linux and Darwin.

  1. Create TLS certificate if needed for HTTPS connections
  2. Create a configuration file (there is a command line argument to generate a basic config)
  3. Run the binary

Configuration Examples

Please visit doc/configuration.md

Further Documentation

Known Issues

  • Does not work properly when ran from a network share mapped as a network drive (this case prevent whids to identify itself and thus generate some noise). Example: if \\vbox\test is mounted as Z: drive, running Z:\whids.exe won't work while running \\vbox\test\whids.exe actually would.

Roadmap until next release

  • find a new name to the project because we all agree it sucks
  • better sysmon integration (config, deployment, update)
  • endpoint configuration from manager
  • tooling management (update, install), like OSQuery
  • code refactoring and optimization
  • implement a performance monitor
  • get rid of any on-disk configuration
  • implement IOC management capabilities
  • ETW support
  • automatic documentation (OpenAPI) and testing of manager's API
  • provide endpoint system information in manager
  • implement actionable rules
  • provide canary file management
  • builtin commands to be executed by endpoints
  • provide Incident Response reports about endpoints
  • overall manager API improvement
  • provide event streams so that a client can receive events in realtime
  • standardize HTTP headers
  • provide a python library to interact with EDR manager (https://github.com/0xrawsec/pywhids)

Changelog

v1.7

  • New Administrative HTTP API with following features:
    • Manage endpoints (list, create, delete)
    • Get basic statistics about the manager
    • Execute commands on endpoints and get results
      • Can drop files prior to execution, to execute binaries/scripts not present on endpoint. Dropped files are deleted after command was ran.
      • Can retrieve files (post command execution), to retrieve results of the command
    • Collect files from endpoints for forensic purposes
    • Contain / Uncontain endpoints by restricting any network traffic except communication to the manager.
    • Query endpoints logs
    • Query endpoints alerts
    • Pivot on a timestamp and retrieve logs/alerts around that time pivot
    • Access endpoint report
      • Scoring (relative to each environment) allowing to sort endpoints and spot the ones behaving differently from the others.
      • Alerts / TTPs observed on a given time frame
    • Manage rules (list, create, update, save, delete)
  • Integration with Sysmon v12 and v13
    • Integrate ClipboardData events
      • Put the content of the clipboard data inside the event to allow creating rule on the content of the clipboard
    • Integrate ProcessTampering events
      • Enrich event with a diffing score between .text section on disk and in memory
  • Implemented certificate pinning on client to enhance security of the communication channel between endpoints and management server
  • Log filtering capabilities, allowing one to collect contextual events. Log filtering is achieved by creating Gene filtering rules (c.f. Gene Documentation).
  • Configuration files in TOML format for better readability
  • Better protection of the installation directory

Related Work

Sponsors

Github:https://github.com/tines Website:https://www.tines.com/ Twitter:@tines_io



❌