Nasreddine Bencherchali nasbench

Detecting RMM

The most difficult challenge with RMM detection is contextual awareness around usage to determine if it is valid or malicious.

if the software is not used in the envrionment
- could it be legitimate by a random empoyee?
- is it an attacker BYOL
- even so, all occurrences could probably be considered suspicious
if it is used in the environment
- is every use of it legitimate? Probably not
this also creates significant living off the land (LOL) opportunity

You can execute commands in the context of an AppX Package to gain access to it's virtualized resources (example virtualized registry keys or files)

Here are the steps to follow in order to create a malicious CHM file. As used by APT37

Download the HTML Help Workshop (Htmlhelp.exe) from MSDN. If the link is dead you can use the archive version here
Once installed you should have a folder C:\Program Files (x86)\HTML Help Workshop and inside the Microsoft HTML Help Compiler (hhc.exe)
We need to create 3 files:
- Project File .hpp
- HTML File .htm
Table of Contents File .hhc

This binary can be used as a LOLBIN as described here

The arguments flags are meaningless only the order is important. This means as long as you provide exactly 6 flags and their value the binary will still work. Here are the exact positions for reference:

// Usage: --file <fullyResolvedPath> --processId <processId> --dumpType <dumpType>

This binary can be used as a LOLBIN as described here.

The arguments number must be at least 3
The first first argument can be anything (instead of both, normal or abnormal). Since the switch clause doesn't specify a default case. And the flag variable is set to true before the check.
The second argument also can be anything and it will be written to the execution path with the contents being the PID of the process File.WriteAllText(args[1], process.Id.ToString());
The thrid argument is passed directly to ProcessStartInfo and is executed Process.Start(startInfo);. Hence anything can be called

	<?xml version="1.0"?>
	<SiPolicy xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="urn:schemas-microsoft-com:sipolicy">
	<VersionEx>10.0.0.0</VersionEx>
	<PolicyTypeID>{4E61C68C-97F6-430B-9CD7-9B1004706770}</PolicyTypeID>
	<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
	<Rules>
	<Rule>
	<Option>Enabled:UMCI</Option>
	</Rule>
	<Rule>

	sing System;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;



	/*
	Author: Casey Smith, Twitter: @subTee

	# Source: System.Management.Automation.dll
	# This list is used to determin if a ScriptBlock contains potential suspicious content
	# If a match is found an automatic 4104 with a "warning" level is generated.
	# https://github.com/PowerShell/PowerShell/blob/master/src/System.Management.Automation/engine/runtime/CompiledScriptBlock.cs
	- "Add-Type"
	- "AddSecurityPackage"
	- "AdjustTokenPrivileges"
	- "AllocHGlobal"
	- "BindingFlags"
	- "Bypass"