Skip to content

Commit 4bff22f

Browse files
last-bytelast-byte
committed
implemented two new persistences; fixed suborner FP
1 parent ad0087d commit 4bff22f

File tree

4 files changed

+79
-25
lines changed

4 files changed

+79
-25
lines changed

‎CHANGELOG.md

+7
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
# Changelog
2+
## 1.16.0
3+
Features:
4+
- Detection for the BootVerificationProgram hijacking
5+
- Detection for the AppInit DLLs injection
6+
Fixes:
7+
- Fixed a false positive in the detection of the Suborner Attack caused by a faulty implementation of the Parse-NetUser internal function
8+
29
## 1.15.1
310
Fixes:
411
- Fixed a gap in the detection of the techniques which relied on Get-IfSafeExecutable function which would prevent Powershell persistences from showing up

‎PersistenceSniper/PersistenceSniper.psd1

4 Bytes
Binary file not shown.

‎PersistenceSniper/PersistenceSniper.psm1

+70-23
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<#PSScriptInfo
22
3-
.VERSION 1.15.1
3+
.VERSION 1.16.0
44
55
.GUID 3ce01128-01f1-4503-8f7f-2e50deb56ebc
66
@@ -154,7 +154,9 @@ function Find-AllPersistence {
154154
'RIDHijacking',
155155
'SubornerAttack',
156156
'DSRMBackdoor',
157-
'GhostTask'
157+
'GhostTask',
158+
'BootVerificationProgram',
159+
'AppInitDLLs'
158160
)]
159161
$PersistenceMethod = 'All',
160162

@@ -430,11 +432,10 @@ function Find-AllPersistence {
430432
}
431433

432434
$contentArray = @()
433-
foreach ($line in $item) {
434-
while ($line.Contains(" ")) {
435-
$line = $line -replace ' ', ' '
435+
foreach ($line in $item -split '\s{2,}') {
436+
if ($line -ne '') {
437+
$contentArray += $line
436438
}
437-
$contentArray += $line.Split(' ')
438439
}
439440

440441
foreach ($content in $contentArray) {
@@ -1820,6 +1821,7 @@ function Find-AllPersistence {
18201821
}
18211822
Write-Verbose -Message ''
18221823
}
1824+
18231825
function Get-DotNetStartupHooks {
18241826
Write-Verbose -Message "$hostname - Getting DotNet Startup Hooks..."
18251827
foreach ($hive in $systemAndUsersHives) {
@@ -1848,7 +1850,7 @@ function Find-AllPersistence {
18481850
}
18491851
Write-Verbose -Message ''
18501852
}
1851-
1853+
18521854
function Get-SubornerAttack {
18531855
$netUsers = net.exe users | Parse-NetUser
18541856
$poshUsers = Get-LocalUser | Select-Object Name
@@ -1860,6 +1862,7 @@ function Find-AllPersistence {
18601862
}
18611863
Write-Verbose -Message ''
18621864
}
1865+
18631866
function Get-RidHijacking {
18641867

18651868
Write-Verbose -Message "$hostname - Checking for RID Hijacking"
@@ -1938,6 +1941,37 @@ function Find-AllPersistence {
19381941
}
19391942
Write-Verbose -Message ''
19401943
}
1944+
1945+
function Get-BootVerificationProgram {
1946+
Write-Verbose -Message "$hostname - Checking for Boot Verification Program hijacking..."
1947+
$bootVerificationProgram = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\BootVerificationProgram").ImagePath
1948+
if ($bootVerificationProgram) {
1949+
Write-Verbose -Message "$hostname - [!] Found custom Boot Verification Program at ImagePath property of the HKLM:\SYSTEM\CurrentControlSet\Control\BootVerificationProgram key!"
1950+
$PersistenceObject = New-PersistenceObject -Hostname $hostname -Technique 'Boot Verification Program Hijacking' -Classification 'Uncatalogued Technique N.19' -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\BootVerificationProgram\ImagePath' -Value $bootVerificationProgram -AccessGained 'System' -Note "The executable pointed to by the ImagePath property of the HKLM:\SYSTEM\CurrentControlSet\Control\BootVerificationProgram key is run by the Windows Service Manager at boot time in place of the legitimate Bootvrfy.exe" -Reference 'https://persistence-info.github.io/Data/bootverificationprogram.html'
1951+
$null = $persistenceObjectArray.Add($PersistenceObject)
1952+
}
1953+
Write-Verbose -Message ''
1954+
}
1955+
1956+
function Get-AppInitDLLs {
1957+
Write-Verbose -Message "$hostname - Getting AppInit DLLs..."
1958+
$appInitDLL = (Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows").AppInit_DLLs
1959+
if ($appInitDLL) {
1960+
Write-Verbose -Message "$hostname - [!] AppInit_DLLs property under the HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows key is populated!"
1961+
$PersistenceObject = New-PersistenceObject -Hostname $hostname -Technique 'AppInit DLL injection' -Classification 'MITRE ATT&CK T1546.010' -Path 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows' -Value $appInitDLL -AccessGained 'System/User' -Note "The DLLs specified in the AppInit_DLLs property of the HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows key are loaded by user32.dll whenever a new process starts." -Reference 'https://attack.mitre.org/techniques/T1546/010/'
1962+
$null = $persistenceObjectArray.Add($PersistenceObject)
1963+
}
1964+
1965+
$appInitDLL = (Get-ItemProperty -Path "HKLM:\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows").AppInit_DLLs
1966+
if ($appInitDLL) {
1967+
Write-Verbose -Message "$hostname - [!] AppInit_DLLs property under the HKLM:\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows key is populated!"
1968+
$PersistenceObject = New-PersistenceObject -Hostname $hostname -Technique 'AppInit DLL injection' -Classification 'MITRE ATT&CK T1546.010' -Path 'HKLM:\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows' -Value $appInitDLL -AccessGained 'System/User' -Note "The DLLs specified in the AppInit_DLLs property of the HKLM:\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows key are loaded by user32.dll whenever a new process starts." -Reference 'https://attack.mitre.org/techniques/T1546/010/'
1969+
$null = $persistenceObjectArray.Add($PersistenceObject)
1970+
}
1971+
1972+
Write-Verbose -Message ''
1973+
}
1974+
19411975
function Out-EventLog {
19421976

19431977
Param (
@@ -2004,6 +2038,8 @@ function Find-AllPersistence {
20042038
'Suborner Attack' = $null
20052039
'DSRM Backdoor' = $null
20062040
'GhostTask' = $null
2041+
'BootVerificationProgram' = $null
2042+
'AppInitDLLs' = $null
20072043
}
20082044

20092045
# Collect the keys in a separate list
@@ -2089,6 +2125,8 @@ function Find-AllPersistence {
20892125
Get-RidHijacking
20902126
Get-DSRMBackdoor
20912127
Get-GhostTask
2128+
Get-BootVerificationProgram
2129+
Get-AppInitDLLs
20922130

20932131
if ($IncludeHighFalsePositivesChecks.IsPresent) {
20942132
Write-Verbose -Message "$hostname - You have used the -IncludeHighFalsePositivesChecks switch, this may generate a lot of false positives since it includes checks with results which are difficult to filter programmatically..."
@@ -2318,6 +2356,16 @@ function Find-AllPersistence {
23182356
Get-GhostTask
23192357
break
23202358
}
2359+
'BootVerificationProgram'
2360+
{
2361+
Get-BootVerificationProgram
2362+
break
2363+
}
2364+
'AppInitDLLs'
2365+
{
2366+
Get-AppInitDLLs
2367+
break
2368+
}
23212369
}
23222370
}
23232371

@@ -2375,12 +2423,11 @@ function Find-AllPersistence {
23752423

23762424
Write-Verbose -Message 'Module execution finished.'
23772425
}
2378-
23792426
# SIG # Begin signature block
23802427
# MIIVlQYJKoZIhvcNAQcCoIIVhjCCFYICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB
23812428
# gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR
2382-
# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU9SiTa0xD0GnMf2t+M6qW2lGJ
2383-
# H4KgghH1MIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B
2429+
# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUiPjkk6OPIYFuG1J6aiCVyWL0
2430+
# h+egghH1MIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B
23842431
# AQwFADB7MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVy
23852432
# MRAwDgYDVQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEh
23862433
# MB8GA1UEAwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTIxMDUyNTAwMDAw
@@ -2480,17 +2527,17 @@ function Find-AllPersistence {
24802527
# ZDErMCkGA1UEAxMiU2VjdGlnbyBQdWJsaWMgQ29kZSBTaWduaW5nIENBIFIzNgIR
24812528
# ANqGcyslm0jf1LAmu7gf13AwCQYFKw4DAhoFAKB4MBgGCisGAQQBgjcCAQwxCjAI
24822529
# oAKAAKECgAAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIB
2483-
# CzEOMAwGCisGAQQBgjcCARUwIwYJKoZIhvcNAQkEMRYEFK607bYv/sX0YdRQRuZR
2484-
# j+OLOdmBMA0GCSqGSIb3DQEBAQUABIICAIYW6zYeHFFW1XA66hhxQpxhdNZiczwK
2485-
# zEosiMtuOnmnwsLZ3oQcObdIQMCVXjV+HLDdDXI/L+qJJMhaF9fileo3hjGS+AWs
2486-
# aG0g5/K5d61BB6ypgHlb/dkrqzhoDbTosZDCK9WWoo37RcvZv+jNuls3IJ9r4E7+
2487-
# 24lPxb7TROkBq/C2zkhYT2+OqVLRpKpaai8cKWvNPyJRM/rsZjbuJsD0Qkr8NbCM
2488-
# Ki718QLkGHA1dOn3tuGTY5zBCGSkeTGnqaSxK2fDa3zW/c+5ZxxmZOs4tmHrcWVV
2489-
# 0N/BP+wQ6ejKlQtZZEyPtEwguLM2EioRipW7wfzUY6T3QYZRjgJvhIRAfCVCJfPJ
2490-
# dSjzOMwDekI2hCVfg4f4wQOghtXnzcU3rWgfjfUWg+pfWSDYnEMufI7UcKmkMetz
2491-
# fHJB1bLySttljorCRb8voVFcax5EpYPyexoUYnSxkwNwlsKIW+1Vgoj93SmLfnpm
2492-
# KnfavplaC6C14cqo3E7NgVjSu1dpkLBKGZ6cEUJt1KI2ubc2ZObB3uy1/gq5JJZk
2493-
# jYHPZcGvNqLR000K+sV4T23kKOsR5LjtGzIPmsRUc/7hpKmAKnKjKptmbOGr3iX/
2494-
# UDqG6zSaks1fUmpmLkrvsXqHZcimeetIBA8H9fnTIlY3H0iKfAV9CcIjXXDpGgWf
2495-
# ykCKkIwijJZg
2530+
# CzEOMAwGCisGAQQBgjcCARUwIwYJKoZIhvcNAQkEMRYEFPS/pEkn0cXGewvPHFBm
2531+
# 9PsnKwXDMA0GCSqGSIb3DQEBAQUABIICAFsAtmXr8hNrs+uIdkjiSaUqbRqaE8Ng
2532+
# RFTX8kSUi3f2DCEgjtBU+nS+50t5Owubdc+zkEVXzFSrJ1A3SrEOzil/yI1JzLNs
2533+
# 9UWQqbgkXTs1feb+bqeI9tvK2INDMYqqPZD1IaXmqAIgaXqprVdj2z69c1px4wYF
2534+
# wjhoyMn6qbCztumhzdsk/xbZ7HWQ1oZoI7ji9RDrJfXna6vSsCAbEmH7kLEDkbw1
2535+
# 4RUpyHS+7wc1NO9fkeg+oEYD3mK8eWfhk7PhSlw94mI4F6L9v8UFUOEnKJWxtGh8
2536+
# q/F19YgIBTrQQAokng8Nq+ikzNKcl4jIUDiIv229eZSNct7ia54jYwtphEmxdG8f
2537+
# OvxPlpkG8cBnpbjNXVkWDPMh8jFEDoAMctnBbDutsUmUXew9n+gRUNubk9U2GpzD
2538+
# D19KCeKaroUNp2pe8Gq9wYIrHHajiaPUedzuGXcN4sr0pWiXQynTBuIYk1yIqBfB
2539+
# BVH5tZBhvUYEAOx8f66f+L25JwEE1fyjNI9ti+YfzfrqOgS4mKzvBkRiimjGeWpL
2540+
# tYHF6kBCa021bBXwUoHgdXcpGTgAWNbIBhpg6OJ5JhKGVdgisc//Bc/PGRXMWNm4
2541+
# 5p+G7iraTsbyo4lrHVg2hE00ynARid6MMs39PpyCqPvItCRoKu3p6ep0a6fyHIG5
2542+
# NaCLSEJs0RYu
24962543
# SIG # End signature block

‎README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88
<tr>
99
<td class="tg-0pky"><p align="center">
1010
<img src="https://blog.notso.pro/img/persistencesnipernew4.png" width="40%">
11-
<p align="center"><a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/badge/Language-Powershell-blue" alt="language" style="text-align:center;display:block;"></a> <a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/powershellgallery/v/PersistenceSniper?label=Module%20Version" alt="version shield logo" style="text-align:center;display:block;"></a> <a href="https://github.com/last-byte/PersistenceSniper/wiki/3-%E2%80%90-Detections"><img src="https://img.shields.io/badge/Persistence%20Techniques-54-brightgreen" alt="number of techniques implemented" style="text-align:center;display:block;"></a> <a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/badge/Digital%20Signature-Valid-brightgreen" alt="workflow" style="text-align:center;display:block;"></a> <a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/powershellgallery/dt/PersistenceSniper?label=Gallery%20Downloads" alt="gallery downloads" style="text-align:center;display:block;"></a> <a href="https://twitter.com/PersistSniper"><img src="https://img.shields.io/twitter/follow/PersistSniper?style=social" alt="twitter" style="text-align:center;display:block;"></a> <a href="https://twitter.com/last0x00"><img src="https://img.shields.io/twitter/follow/last0x00?style=social" alt="twitter" style="text-align:center;display:block;"></a> <a href="https://twitter.com/dottor_morte"><img src="https://img.shields.io/twitter/follow/dottor_morte?style=social" alt="twitter_rick" style="text-align:center;display:block;"></a> <a href="https://www.buymeacoffee.com/last0x00"><img src="https://img.shields.io/badge/buy%20me%20a-coffee-yellow" alt="buy me a coffee" style="text-align:center;display:block;"></a></p>
12-
<p align="center">PersistenceSniper is a Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. It is also available on <a href=https://www.powershellgallery.com/packages/PersistenceSniper/1.0>Powershell Gallery</a> and it is digitally signed with a valid code signing certificate. The tool is under active development with new releases coming out by the week, so make sure to use the up-to-date version. Official Twitter/X account <a href="https://twitter.com/PersistSniper">@PersistSniper</a>.</p>
11+
<p align="center"><a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/badge/Language-Powershell-blue" alt="language" style="text-align:center;display:block;"></a> <a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/powershellgallery/v/PersistenceSniper?label=Module%20Version" alt="version shield logo" style="text-align:center;display:block;"></a> <a href="https://github.com/last-byte/PersistenceSniper/wiki/3-%E2%80%90-Detections"><img src="https://img.shields.io/badge/Persistence%20Techniques-56-brightgreen" alt="number of techniques implemented" style="text-align:center;display:block;"></a> <a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/badge/Digital%20Signature-Valid-brightgreen" alt="workflow" style="text-align:center;display:block;"></a> <a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/powershellgallery/dt/PersistenceSniper?label=Gallery%20Downloads" alt="gallery downloads" style="text-align:center;display:block;"></a> <a href="https://twitter.com/PersistSniper"><img src="https://img.shields.io/twitter/follow/PersistSniper?style=social" alt="twitter" style="text-align:center;display:block;"></a> <a href="https://twitter.com/last0x00"><img src="https://img.shields.io/twitter/follow/last0x00?style=social" alt="twitter" style="text-align:center;display:block;"></a> <a href="https://twitter.com/dottor_morte"><img src="https://img.shields.io/twitter/follow/dottor_morte?style=social" alt="twitter_rick" style="text-align:center;display:block;"></a> <a href="https://www.buymeacoffee.com/last0x00"><img src="https://img.shields.io/badge/buy%20me%20a-coffee-yellow" alt="buy me a coffee" style="text-align:center;display:block;"></a></p>
12+
<p align="center">PersistenceSniper is a Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. It is also available on <a href=https://www.powershellgallery.com/packages/PersistenceSniper>Powershell Gallery</a> and it is digitally signed with a valid code signing certificate. The tool is under active development with new releases coming out by the week, so make sure to use the up-to-date version. Official Twitter/X account <a href="https://twitter.com/PersistSniper">@PersistSniper</a>.</p>
1313
</td>
1414
</tr>
1515
</tbody>

0 commit comments

Comments
 (0)