This becomes a child process of the current process. Beacon then impersonates the token made by these steps and you’re ready to pass-the-hash.”įirst, the ‘spawnto’ process that is dictated in the Cobalt Strike profile is created, which in my case is dllhost.exe.
#COBALT STRIKE BEACON CUSTOMIZE NAMED PIPE UPDATE#
“The pth command asks mimikatz to: (1) create a new Logon Session, (2) update the credential material in that Logon Session with the domain, username, and password hash you provided, and (3) copy your Access Token and make the copy refer to the new Logon Session. The PTH, or pass-the-hash, command has even more indicators than shell. As you can see, shell generates quite a few artifacts and it’s common for detections to pick up as cmd.exe /c is seldom used in environments. If there is no session attached to the physical console, (for example, if the physical console session is in the process of being attached or detached), this function returns 0xFFFFFFFF.”Ī goal of op-sec is to always minimize the amount of traffic, or “footprints” that your activities leave behind.
“ The session identifier of the session that is attached to the physical console. In this case, Conhost.exe’s arguments are 0xffffffff -ForceV1, which tells Conhost which application ID it should connect to. What is unique, is how Conhost.exe is created: Conhost.exe is a process that’s required for cmd.exe to interface with Explorer.exe. But, before that occurs, conhost.exe is called in tandem with cmd.exe. whoami though, is also actually an executable within System32, so cmd.exe also spawns that as a child process.
We can see here that the shell command spawns cmd.exe under the parent process. Under the hood, the shell command calls cmd.exe /c. When an operator uses the shell command in Cobalt Strike, it’s usually to execute a DOS command directly, such as dir, copy, move, etc. These three commands tend to trigger several baseline alerts. Referencing the op-sec article from Cobalt Strike, the first set of built-in commands I’d like to point out are the ‘Process Execution’ techniques, which are run, shell, and pth. My detection lab for the blog post is extremely simple: just an ELK stack with Winlogbeat & Sysmon on the endpoints, so I’m not covering “advanced” detections here.
While the goal of this article isn’t to teach “good op-sec”, it still has a bias towards somewhat mature environments and certain techniques will be called out where they tend to trigger baseline or low-effort/default alerts & detections. If you’re operating in an environment with zero defensive and detection capabilities, there is no bad op-sec. Again, this is an extremely subjective question.
I won’t be able to cover all techniques and commands In one article, so this will probably be a two part series.īefore jumping into techniques and the logs associated with them, the baseline question must be answered: “What is bad op-sec?”. Realistically, this post is just breaking down a page straight from Cobalt Strike’s website, which can be found here. The purpose of this post is to document what some Cobalt Strike techniques look like under the hood or to a defender’s point of view. It’s been known that some built-in commands in Cobalt Strike are major op-sec no-no’s, but why are they bad? The goal of this post isn’t to teach you “good” op-sec, as I feel that is a bit subjective and dependent on the maturity of the target’s environment, nor is it “how to detect Cobalt Strike”.
0 kommentar(er)
