x33fcon

x33fcon Release

This project enables the Introspection into EDR products, i.e. what the EDR is doing at a given step for malware analysis.

the git history of this repo is fucked, only clone it when you want to develop on in
the binaries are included, good luck trying to compile this on your own

Slides

Please find them here: Google Presentation

How To run the Framework

Depends on the EDR, harderning, etc. Generally, loading of vulnerable signed drivers and memory integrity (both in Device Security > Core Isolation) must be disabled for KDU and EDRSandblast to work.

Without EDRSandblast (without disabling kernel callbacks) the hooks cannot be injected.
Without KDU (without PPL) no ETW-TI can be consumed and the EDR proc cannot be opened.

It is recomended to make an exclusion for the EDR-Introspection folder, and then download this release and unzip!

# print help
.\x64\Release\EDRi.exe -h

# run simplest attack: no ETW-TI, no hooking, minimal traces, run attack as child proc, no debug
.\x64\Release\EDRi.exe --edr-profile MDE --attack ProcInject_standard -r

# all visibility: ETW-TI, hooking ntdll, all traces, debug
.\helpers\KDU\kdu.exe -pse "$(pwd)\x64\Release\EDRi.exe --edr-profile MDE --attack ProcInject_deconditioning -t -d" -prv 54

# alternative: first just hook, then do attacks (the hooks persist until restart)
.\helpers\KDU\kdu.exe -pse "$(pwd)\x64\Release\EDRi.exe --just-hook" -prv 54
.\helpers\KDU\kdu.exe -pse "$(pwd)\x64\Release\EDRi.exe --edr-profile MDE --attack ProcInject_deconditioning -t -d" -prv 54

How to create and analyse your own attack

1. Copy folder .\attacks\ProcInject to .\attacks\YourAttack
2. rename all .\attacks\YourAttack\ProcInject.vcxproj* to .\attacks\YourAttack\YourAttack.vcxproj*
3. rename both references in .\attacks\YourAttack\YourAttack.vcxproj from ProcInject to YourAttack
4. rename both references in .\attacks\YourAttack\build-features.bat from ProcInject.vcxproj to YourAttack.vcxproj and both ProcInject-%%C.exe to YourAttack-%%C.exe
5. build YourAttack with all features: .\attacks\YourAttack\build-features.bat
6. the created (encrypted) exes should now be visible in the EDRi under available attacks

# verify the attack is detected
.\x64\Release\EDRi.exe --edr-profile MDE --attack 

# run it
.\helpers\KDU\kdu.exe -pse "$(pwd)\x64\Release\EDRi.exe --edr-profile MDE --attack YourAttack_standard -t -d" -prv 54

Data Sources

The enabling technologies of this projects are:

• ETW and ETW-TI tracing and filtering for relevant events (related to malware and EDR operations)
• hooking of the EDR's ntdll to inspect the EDRs actions

How

• krabsETW to parse all relevant ETW providers
• kdu.exe to run EDRi.exe as PPL-AntiMalware -> access to EDR procs
• EDRSandblast to disable kernel callbacks -> full access to EDR procs
• EDRi.exe to
  • filter the ETW events
  • decrypt and run predefined attacks
  • hook ntdll of EDR procs

Analysed Attacks

see also /attacks/

• Proc Inject: allocates mem in own process, writes raw bytes of msfvenom -p windows/x64/exec CMD="calc.exe" and executes it
• C2 Loader: allocates mem in own process, writes raw bytes of default CobaltStrike beacon and executes it
• Lsass Read: calls MiniDumpWriteDump from dbghelp.dll on lsass.exe, like mimikatz.exe (LSASS' PPL must be stripped before)

Captured Attack Logs

• nicely formatted see Google Drive
• all attack logs see here