Skip to content

Commit 13006aa

Browse files
last-bytelast-byte
committed
updated to v1.17.1
1 parent f560683 commit 13006aa

File tree

4 files changed

+72
-40
lines changed

4 files changed

+72
-40
lines changed

‎CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# Changelog
2+
## 1.17.1
3+
Features:
4+
- Detection for SetupExecuteNoPnpSync
5+
- Enhanced detection for techniques implemented in 1.17.1 (expanded search outside of System32 - credit @sixtyvividtails)
6+
27
## 1.17.0
38
Features:
49
- Detection for BootExecute and BootExecuteNoPnpSync

‎PersistenceSniper/PersistenceSniper.psd1‎

8 Bytes
Binary file not shown.

‎PersistenceSniper/PersistenceSniper.psm1‎

Lines changed: 61 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<#PSScriptInfo
22
3-
.VERSION 1.17.0
3+
.VERSION 1.17.1
44
55
.GUID 3ce01128-01f1-4503-8f7f-2e50deb56ebc
66
@@ -2012,12 +2012,13 @@ function Find-AllPersistence {
20122012
if ($exe -eq "*") {
20132013
continue
20142014
}
2015-
2016-
if ($exe -like "*.exe") {
2017-
$exePath = "C:\Windows\System32\$exe"
2015+
2016+
if (([System.IO.Path]::IsPathRooted([System.Environment]::ExpandEnvironmentVariables($exe))) -eq $false) {
2017+
$exePath = "C:\Windows\System32\$exe"
20182018
}
2019-
else {
2020-
$exePath = "C:\Windows\System32\$exe.exe"
2019+
else
2020+
{
2021+
$exePath = $exe
20212022
}
20222023

20232024
if ((Get-IfSafeExecutable $exePath) -EQ $false) {
@@ -2034,13 +2035,13 @@ function Find-AllPersistence {
20342035
if ($exesProp) {
20352036
$exes = $exesProp.'BootExecuteNoPnpSync' -split '\s+'
20362037
foreach ($exe in $exes) {
2037-
if ($exe -like "*.exe") {
2038-
$exePath = "C:\Windows\System32\$exe"
2038+
if (([System.IO.Path]::IsPathRooted([System.Environment]::ExpandEnvironmentVariables($exe))) -eq $false) {
2039+
$exePath = "C:\Windows\System32\$exe"
20392040
}
2040-
else {
2041-
$exePath = "C:\Windows\System32\$exe.exe"
2041+
else
2042+
{
2043+
$exePath = $exe
20422044
}
2043-
20442045
if ((Get-IfSafeExecutable $exePath) -EQ $false) {
20452046
Write-Verbose -Message "$hostname - [!] Found a potentially malicious entry in the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecuteNoPnpSync property"
20462047
$propPath = (Convert-Path -Path $exesProp.PSPath) + '\BootExecuteNoPnpSync'
@@ -2053,6 +2054,7 @@ function Find-AllPersistence {
20532054
}
20542055

20552056
function Get-NetshHelperDLL {
2057+
Write-Verbose -Message "$hostname - Getting Netsh Helper DLLs"
20562058
$props = Get-Item 'HKLM:\SOFTWARE\Microsoft\NetSh' | Select-Object -ExpandProperty Property
20572059
foreach ($prop in $props) {
20582060
$dll = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\NetSh')."$prop"
@@ -2069,15 +2071,17 @@ function Find-AllPersistence {
20692071
}
20702072

20712073
function Get-SetupExecute {
2074+
Write-Verbose -Message "$hostname - Getting SetupExecute and SetupExecuteNoPnpSync executables"
20722075
$exesProp = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name 'SetupExecute'
20732076
if ($exesProp) {
20742077
$exes = $exesProp.'SetupExecute' -split '\s+'
20752078
foreach ($exe in $exes) {
2076-
if ($exe -like "*.exe") {
2077-
$exePath = "C:\Windows\System32\$exe"
2079+
if (([System.IO.Path]::IsPathRooted([System.Environment]::ExpandEnvironmentVariables($exe))) -eq $false) {
2080+
$exePath = "C:\Windows\System32\$exe"
20782081
}
2079-
else {
2080-
$exePath = "C:\Windows\System32\$exe.exe"
2082+
else
2083+
{
2084+
$exePath = $exe
20812085
}
20822086

20832087
if ((Get-IfSafeExecutable $exePath) -EQ $false) {
@@ -2089,18 +2093,41 @@ function Find-AllPersistence {
20892093
}
20902094
}
20912095
Write-Verbose -Message ''
2096+
2097+
$exesProp = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name 'SetupExecuteNoPnpSync'
2098+
if ($exesProp) {
2099+
$exes = $exesProp.'SetupExecuteNoPnpSync' -split '\s+'
2100+
foreach ($exe in $exes) {
2101+
if (([System.IO.Path]::IsPathRooted([System.Environment]::ExpandEnvironmentVariables($exe))) -eq $false) {
2102+
$exePath = "C:\Windows\System32\$exe"
2103+
}
2104+
else
2105+
{
2106+
$exePath = $exe
2107+
}
2108+
2109+
if ((Get-IfSafeExecutable $exePath) -EQ $false) {
2110+
Write-Verbose -Message "$hostname - [!] Found a potentially malicious entry in the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SetupExecuteNoPnpSync property"
2111+
$propPath = (Convert-Path -Path $exesProp.PSPath) + '\SetupExecuteNoPnpSync'
2112+
$PersistenceObject = New-PersistenceObject -Hostname $hostname -Technique 'SetupExecuteNoPnpSync Binary' -Classification 'Uncatalogued Technique N.20' -Path $propPath -Value $exePath -AccessGained 'System' -Note 'The executables specified in the "SetupExecuteNoPnpSync" property of the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager key are loaded by the OS before any other process, including EDRs.' -Reference 'https://github.com/rad9800/BootExecuteEDR'
2113+
$null = $persistenceObjectArray.Add($PersistenceObject)
2114+
}
2115+
}
2116+
}
20922117
}
20932118

20942119
function Get-PlatformExecute {
2120+
Write-Verbose -Message "$hostname - Getting PlatformExecute executables"
20952121
$exesProp = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name 'PlatformExecute'
20962122
if ($exesProp) {
20972123
$exes = $exesProp.'PlatformExecute' -split '\s+'
20982124
foreach ($exe in $exes) {
2099-
if ($exe -like "*.exe") {
2100-
$exePath = "C:\Windows\System32\$exe"
2125+
if (([System.IO.Path]::IsPathRooted([System.Environment]::ExpandEnvironmentVariables($exe))) -eq $false) {
2126+
$exePath = "C:\Windows\System32\$exe"
21012127
}
2102-
else {
2103-
$exePath = "C:\Windows\System32\$exe.exe"
2128+
else
2129+
{
2130+
$exePath = $exe
21042131
}
21052132

21062133
if ((Get-IfSafeExecutable $exePath) -EQ $false) {
@@ -2591,12 +2618,11 @@ function Find-AllPersistence {
25912618

25922619
Write-Verbose -Message 'Module execution finished.'
25932620
}
2594-
25952621
# SIG # Begin signature block
25962622
# MIIVlQYJKoZIhvcNAQcCoIIVhjCCFYICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB
25972623
# gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR
2598-
# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU2AMLG/6kaZeZg5jMmp6TQXQq
2599-
# BwegghH1MIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B
2624+
# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUAd5By56s4SERLveuQihdaRrn
2625+
# hlmgghH1MIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B
26002626
# AQwFADB7MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVy
26012627
# MRAwDgYDVQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEh
26022628
# MB8GA1UEAwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTIxMDUyNTAwMDAw
@@ -2696,17 +2722,17 @@ function Find-AllPersistence {
26962722
# ZDErMCkGA1UEAxMiU2VjdGlnbyBQdWJsaWMgQ29kZSBTaWduaW5nIENBIFIzNgIR
26972723
# ANqGcyslm0jf1LAmu7gf13AwCQYFKw4DAhoFAKB4MBgGCisGAQQBgjcCAQwxCjAI
26982724
# oAKAAKECgAAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIB
2699-
# CzEOMAwGCisGAQQBgjcCARUwIwYJKoZIhvcNAQkEMRYEFNRWktTrzCqbIbaCV8/e
2700-
# YWgurXYiMA0GCSqGSIb3DQEBAQUABIICADev3hFAk8V7YSgdu8aldgy4wJDT3nGe
2701-
# 9PJS8Gc8ioYn149tXONm8xqsDR7UyX9TND5QT6GusbTtaHzDrjp0itjH0WnlqdbR
2702-
# zkG0BmSGQbPEhoxG8BpThvB44c7dhVG3aZ0c4//CLuGuhwygdSAifE2cftVoOWc2
2703-
# XyzQoohtYUZGvwYIiB9Cf6bbwiSsxwexl0mR/K6ZZAzBsHmqmiKSQ3hTg+jF+cnC
2704-
# wzk5DFyyT96Gr00Shac1dG56PccqlMy+zki5vn+IP8sD+/cjIWK1dxoR6kt01rSY
2705-
# tjYOkuVzUbkxcwTYoGl8/PCxmy16wKYCg0dG8xTDyFq7LRgf3vwn1mEtqDwGfdcg
2706-
# bWwRhg/DWToICNQXFdgmUokmLOcZ1jOqUg1kMqxJ34m9RbKFh+U4nBhzGOl5de+x
2707-
# D1EZk7IFo9z4jr3KK8HIzbbpbNSGnA6oaHHLf6D9cjjrXPt/XlRY9mc0gfYGoTD1
2708-
# lT8ESJn3SItLgfTASOCAZweQGLBm7CT1XGM58ll4YLls/oIXUBEVbCeiDDLgIghD
2709-
# lAaUORJXmAG4Wg2DlyziOGEEyYFSPkDuX/Pd8ATaY1NzrskkPt3EFKMVMhUu8ryv
2710-
# vhkmj36pb/aNCuxNNaeMd+Mqunszt0wjxw0sTMWBJ4SLFeEMwh2XvKXPNz/4ith9
2711-
# 1polcpknHvN2
2725+
# CzEOMAwGCisGAQQBgjcCARUwIwYJKoZIhvcNAQkEMRYEFNx6PcNOyGT7bxM73lF+
2726+
# buEOIc73MA0GCSqGSIb3DQEBAQUABIICADIOHpYaO7YIe6IZavtE8/X0vu3KLt9L
2727+
# HRcUu4YUcf7Zs9nIHHP82myxWWxXqEI+MU9h4+FNgzvFp5X2gF+NUpyEii17VCW1
2728+
# +HOc6LO5NCglBUwlO6LmqneibEYgNrNKMMTrHe6M8Ulx3PI3SETUg6bYhKm0R/G4
2729+
# hMqOXZ8NGQiSni5H1dTQR/PwK43TSem+dC1KzHjnzR/S5vMmqZyd8KsPD9XqnGTy
2730+
# gXgOoj5TgnODnBDAw/vcTx0mmdTsIriPX40OMlKgzfS7hiB5JtmlAg7Jc+ycb+ti
2731+
# uHx/6Qdxlh08Z6hbR8KwaEUvgZmcZSszlZeo3peeQu0nmQYT2DEcn3sN0c8yl+gT
2732+
# LV67OYtTy+vI9TfY8a57NmU07Sn/uDC044nmXbQ+AGR1EVnpqgVetswxIldj5GIx
2733+
# m+p0qC236EqTMbcHZ37RdAaEmUbN+6TFgmwAiupAMkoEDlEfI2mu4eQ+abNGt/uC
2734+
# 7Z3NnFNCKZLgDr1MA8sbOG8Q3aGQZxCIYKu+IJr7YnHqyXAQ063EKuRs1tAguojn
2735+
# dDtrPeRiK3O19tfnKFbNemsunTOvQpEvyrR2JvBmZCtRqyekcDEUphTglVmPRjlC
2736+
# BKgwtdHkxihniBrCzbrQ8pM+2ElrsdvDLLyMxBLfl21WFYbfT6F2s21j8i2pz8i9
2737+
# 5kJ5Pcls70on
27122738
# SIG # End signature block

‎README.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,14 @@ Most of this tool is based on the work of other skilled researchers, so it's rig
3939
- All the other researchers who disclosed cool and unknown persistence techniques.
4040

4141
Furthermore, these people contributed to the project:
42-
- [Riccardo Ancarani](https://twitter.com/dottor_morte)
43-
- [Cecio](https://twitter.com/red5heep)
44-
- [Vadim](https://twitter.com/D3F7A5105)
45-
- [fkadibs](https://twitter.com/fkadibs)
42+
- [Riccardo Ancarani](https://x.com/dottor_morte)
43+
- [Cecio](https://x.com/red5heep)
44+
- [Vadim](https://x.com/D3F7A5105)
45+
- [fkadibs](https://x.com/fkadibs)
4646
- [suinswofi](https://github.com/suinswofi)
4747
- [Antonio Blescia](https://github.com/ablescia)
48-
- [Strassi](https://twitter.com/strassi7)
48+
- [Strassi](https://x.com/strassi7)
49+
- [sixtyvividtails](https://x.com/sixtyvividtails)
4950

5051
I'd also like to give credits to my fellow mates at [@APTortellini](https://aptw.tf/about/) for the flood of ideas that helped it grow from a puny text-oriented script to a full-fledged Powershell module.
5152

0 commit comments

Comments
 (0)