Skip to content

Commit f560683

Browse files
last-bytelast-byte
committed
updated to v1.17.0
1 parent 02684c5 commit f560683

File tree

5 files changed

+177
-20
lines changed

5 files changed

+177
-20
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
.DS_Store
22
PersistenceSniper.zip
33
PersistenceSniper.7z
4+
.vs

‎CHANGELOG.md

+7
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
# Changelog
2+
## 1.17.0
3+
Features:
4+
- Detection for BootExecute and BootExecuteNoPnpSync
5+
- Detection for PlatformExecute
6+
- Detection for SetupExecute
7+
- Detection for Netsh Helper DLL
8+
29
## 1.16.3
310
Fixes:
411
- Fixed a bug in the remote computer execution which, under certain circumstances, prevented the proper execution of the module

‎PersistenceSniper/PersistenceSniper.psd1

-24 Bytes
Binary file not shown.

‎PersistenceSniper/PersistenceSniper.psm1

+168-19
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<#PSScriptInfo
22
3-
.VERSION 1.16.3
3+
.VERSION 1.17.0
44
55
.GUID 3ce01128-01f1-4503-8f7f-2e50deb56ebc
66
@@ -24,7 +24,7 @@
2424
2525
.EXTERNALSCRIPTDEPENDENCIES
2626
27-
.RELEASENOTES Check the CHANGELOG available at the Github Repository.
27+
.RELEASENOTES Check the CHANGELOG on the Github Repository.
2828
2929
.PRIVATEDATA
3030
@@ -154,7 +154,11 @@ function Find-AllPersistence {
154154
'DSRMBackdoor',
155155
'GhostTask',
156156
'BootVerificationProgram',
157-
'AppInitDLLs'
157+
'AppInitDLLs',
158+
'BootExecute',
159+
'NetshHelperDLL',
160+
'SetupExecute',
161+
'PlatformExecute'
158162
)]
159163
$PersistenceMethod = 'All',
160164

@@ -1991,6 +1995,126 @@ function Find-AllPersistence {
19911995
Write-Verbose -Message ''
19921996
}
19931997

1998+
function Get-BootExecute {
1999+
Write-Verbose -Message "$hostname - Getting BootExecute and BootExecuteNoPnpSync executables"
2000+
$exesProp = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name 'BootExecute'
2001+
if ($exesProp) {
2002+
$exes = $exesProp.'BootExecute' -split '\s+'
2003+
foreach ($exe in $exes) {
2004+
if ($exe -eq "autocheck") {
2005+
continue
2006+
}
2007+
2008+
if ($exe -eq "autochk") {
2009+
continue
2010+
}
2011+
2012+
if ($exe -eq "*") {
2013+
continue
2014+
}
2015+
2016+
if ($exe -like "*.exe") {
2017+
$exePath = "C:\Windows\System32\$exe"
2018+
}
2019+
else {
2020+
$exePath = "C:\Windows\System32\$exe.exe"
2021+
}
2022+
2023+
if ((Get-IfSafeExecutable $exePath) -EQ $false) {
2024+
Write-Verbose -Message "$hostname - [!] Found a potentially malicious entry in the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute property"
2025+
$propPath = (Convert-Path -Path $exesProp.PSPath) + '\BootExecute'
2026+
$PersistenceObject = New-PersistenceObject -Hostname $hostname -Technique 'BootExecute Binary' -Classification 'MITRE ATT&CK T1547.001' -Path $propPath -Value $exePath -AccessGained 'System' -Note 'The executables specified in the "BootExecute" property of the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager key are loaded by the OS before any other process, including EDRs.' -Reference 'https://attack.mitre.org/techniques/T1547/001/'
2027+
$null = $persistenceObjectArray.Add($PersistenceObject)
2028+
}
2029+
}
2030+
}
2031+
2032+
Write-Verbose -Message ''
2033+
$exesProp = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name 'BootExecuteNoPnpSync'
2034+
if ($exesProp) {
2035+
$exes = $exesProp.'BootExecuteNoPnpSync' -split '\s+'
2036+
foreach ($exe in $exes) {
2037+
if ($exe -like "*.exe") {
2038+
$exePath = "C:\Windows\System32\$exe"
2039+
}
2040+
else {
2041+
$exePath = "C:\Windows\System32\$exe.exe"
2042+
}
2043+
2044+
if ((Get-IfSafeExecutable $exePath) -EQ $false) {
2045+
Write-Verbose -Message "$hostname - [!] Found a potentially malicious entry in the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecuteNoPnpSync property"
2046+
$propPath = (Convert-Path -Path $exesProp.PSPath) + '\BootExecuteNoPnpSync'
2047+
$PersistenceObject = New-PersistenceObject -Hostname $hostname -Technique 'BootExecuteNoPnpSync Binary' -Classification 'MITRE ATT&CK T1547.001' -Path $propPath -Value $exePath -AccessGained 'System' -Note 'The executables specified in the "BootExecuteNoPnpSync" property of the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager key are loaded by the OS before any other process, including EDRs.' -Reference 'https://attack.mitre.org/techniques/T1547/001/'
2048+
$null = $persistenceObjectArray.Add($PersistenceObject)
2049+
}
2050+
}
2051+
}
2052+
Write-Verbose -Message ''
2053+
}
2054+
2055+
function Get-NetshHelperDLL {
2056+
$props = Get-Item 'HKLM:\SOFTWARE\Microsoft\NetSh' | Select-Object -ExpandProperty Property
2057+
foreach ($prop in $props) {
2058+
$dll = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\NetSh')."$prop"
2059+
$dllProp = "C:\Windows\System32\$dll"
2060+
2061+
if ((Get-IfSafeLibrary $dllProp) -EQ $false) {
2062+
Write-Verbose -Message "$hostname - [!] Found a potentially malicious entry in the HKLM\SOFTWARE\Microsoft\NetSh\$prop property"
2063+
$propPath = "HKLM\SOFTWARE\Microsoft\NetSh\$prop"
2064+
$PersistenceObject = New-PersistenceObject -Hostname $hostname -Technique 'Netsh Helper DLL' -Classification 'MITRE ATT&CK T1546.007' -Path $propPath -Value $dllProp -AccessGained 'System/User' -Note 'The DLLs specified in the properties of the HKLM\SOFTWARE\Microsoft\NetSh key are loaded by netsh.exe whenever it is started.' -Reference 'https://attack.mitre.org/techniques/T1546/007/'
2065+
$null = $persistenceObjectArray.Add($PersistenceObject)
2066+
}
2067+
}
2068+
Write-Verbose -Message ''
2069+
}
2070+
2071+
function Get-SetupExecute {
2072+
$exesProp = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name 'SetupExecute'
2073+
if ($exesProp) {
2074+
$exes = $exesProp.'SetupExecute' -split '\s+'
2075+
foreach ($exe in $exes) {
2076+
if ($exe -like "*.exe") {
2077+
$exePath = "C:\Windows\System32\$exe"
2078+
}
2079+
else {
2080+
$exePath = "C:\Windows\System32\$exe.exe"
2081+
}
2082+
2083+
if ((Get-IfSafeExecutable $exePath) -EQ $false) {
2084+
Write-Verbose -Message "$hostname - [!] Found a potentially malicious entry in the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SetupExecute property"
2085+
$propPath = (Convert-Path -Path $exesProp.PSPath) + '\SetupExecute'
2086+
$PersistenceObject = New-PersistenceObject -Hostname $hostname -Technique 'SetupExecute Binary' -Classification 'Uncatalogued Technique N.20' -Path $propPath -Value $exePath -AccessGained 'System' -Note 'The executables specified in the "SetupExecute" property of the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager key are loaded by the OS before any other process, including EDRs.' -Reference 'https://github.com/rad9800/BootExecuteEDR'
2087+
$null = $persistenceObjectArray.Add($PersistenceObject)
2088+
}
2089+
}
2090+
}
2091+
Write-Verbose -Message ''
2092+
}
2093+
2094+
function Get-PlatformExecute {
2095+
$exesProp = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name 'PlatformExecute'
2096+
if ($exesProp) {
2097+
$exes = $exesProp.'PlatformExecute' -split '\s+'
2098+
foreach ($exe in $exes) {
2099+
if ($exe -like "*.exe") {
2100+
$exePath = "C:\Windows\System32\$exe"
2101+
}
2102+
else {
2103+
$exePath = "C:\Windows\System32\$exe.exe"
2104+
}
2105+
2106+
if ((Get-IfSafeExecutable $exePath) -EQ $false) {
2107+
Write-Verbose -Message "$hostname - [!] Found a potentially malicious entry in the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PlatformExecute property"
2108+
$propPath = (Convert-Path -Path $exesProp.PSPath) + '\PlatformExecute'
2109+
$PersistenceObject = New-PersistenceObject -Hostname $hostname -Technique 'PlatformExecute Binary' -Classification 'Uncatalogued Technique N.21' -Path $propPath -Value $exePath -AccessGained 'System' -Note 'The executables specified in the "PlatformExecute" property of the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager key are loaded by the OS before any other process, including EDRs.' -Reference 'https://github.com/rad9800/BootExecuteEDR'
2110+
$null = $persistenceObjectArray.Add($PersistenceObject)
2111+
}
2112+
}
2113+
}
2114+
Write-Verbose -Message ''
2115+
}
2116+
2117+
19942118
function Out-EventLog {
19952119

19962120
Param (
@@ -2059,6 +2183,10 @@ function Find-AllPersistence {
20592183
'GhostTask' = $null
20602184
'BootVerificationProgram' = $null
20612185
'AppInitDLLs' = $null
2186+
'BootExecute' = $null
2187+
'NetshHelperDLL' = $null
2188+
'SetupExecute' = $null
2189+
'PlatformExecute' = $null
20622190
}
20632191

20642192
# Collect the keys in a separate list
@@ -2146,6 +2274,10 @@ function Find-AllPersistence {
21462274
Get-GhostTask
21472275
Get-BootVerificationProgram
21482276
Get-AppInitDLLs
2277+
Get-BootExecute
2278+
Get-NetshHelperDLL
2279+
Get-SetupExecute
2280+
Get-PlatformExecute
21492281

21502282
if ($IncludeHighFalsePositivesChecks.IsPresent) {
21512283
Write-Verbose -Message "$hostname - You have used the -IncludeHighFalsePositivesChecks switch, this may generate a lot of false positives since it includes checks with results which are difficult to filter programmatically..."
@@ -2383,12 +2515,28 @@ function Find-AllPersistence {
23832515
Get-AppInitDLLs
23842516
break
23852517
}
2518+
'BootExecute' {
2519+
Get-BootExecute
2520+
break
2521+
}
2522+
'NetshHelperDLL' {
2523+
Get-NetshHelperDLL
2524+
break
2525+
}
2526+
'SetupExecute' {
2527+
Get-SetupExecute
2528+
break
2529+
}
2530+
'PlatformExecute' {
2531+
Get-PlatformExecute
2532+
break
2533+
}
23862534
}
23872535
}
23882536

23892537

23902538
if ($LogFindings.IsPresent) {
2391-
Write-Verbose -Message "$hostname - You have used the -LogFindings switch, what's been found on the machine will be saved in the Event Log."
2539+
Write-Verbose -Message "$hostname - You have used the -LogFindings switch, the results will be saved in the Event Log."
23922540
Out-EventLog $persistenceObjectArray
23932541
}
23942542

@@ -2443,11 +2591,12 @@ function Find-AllPersistence {
24432591

24442592
Write-Verbose -Message 'Module execution finished.'
24452593
}
2594+
24462595
# SIG # Begin signature block
24472596
# MIIVlQYJKoZIhvcNAQcCoIIVhjCCFYICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB
24482597
# gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR
2449-
# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUwQc7ywgH4cUYVHh5Soh7NfQ4
2450-
# yjmgghH1MIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B
2598+
# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU2AMLG/6kaZeZg5jMmp6TQXQq
2599+
# BwegghH1MIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B
24512600
# AQwFADB7MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVy
24522601
# MRAwDgYDVQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEh
24532602
# MB8GA1UEAwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTIxMDUyNTAwMDAw
@@ -2547,17 +2696,17 @@ function Find-AllPersistence {
25472696
# ZDErMCkGA1UEAxMiU2VjdGlnbyBQdWJsaWMgQ29kZSBTaWduaW5nIENBIFIzNgIR
25482697
# ANqGcyslm0jf1LAmu7gf13AwCQYFKw4DAhoFAKB4MBgGCisGAQQBgjcCAQwxCjAI
25492698
# oAKAAKECgAAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIB
2550-
# CzEOMAwGCisGAQQBgjcCARUwIwYJKoZIhvcNAQkEMRYEFOBKd9JIgqs+7GGgu8J1
2551-
# nIMQu41IMA0GCSqGSIb3DQEBAQUABIICAG4CpFHpN3zAH7N+S6c2TTWYzm+SyTW3
2552-
# d9bsXfWgFZHPeYjc9Z6t4UnbMeCW88eLnPHM/+urzyJ4NWKFLc97FwT7on2Pte4r
2553-
# 3EK2RWtp8BaZ0l/YMusAt0tLiHBR0N3MK/5KQFYjeH1HS5NzNO/gdna7g3aEUtAb
2554-
# p+klO7Dosu0YeYKBovLA11yDtmX/6w4qODVVT4SEs/DUVGQVjobHYxFuSr0qx+4p
2555-
# if4v/s1XcjhRxFqZLJWn0Q2siA4m93E7WIwEymRUWqjrlt28EEfCDMXpDjHICA+j
2556-
# 5rX+TDRISIz8j49dK4kIW+s3iJldxn2ZUq2XUKSkWvvaRF/A/iVc7cCrhRZINFex
2557-
# rqt2CHDuJIQH1VWodzU8nhLAPv9Wb+sB1zsLdZ6KA6fCn9MGn4WeG0sGN4IF+r4A
2558-
# dyUx5cxoWQI5a0w0h/YzOScYxkXr3/AVsnpdV3evERaX4XKSGvNxDhRRM+7KOC2p
2559-
# gl2zYzMOs/VjYhYr7bSs19yVCnUsEBs/ndrGET28bYP7m+JUGyJqZFHyKyKS/NCp
2560-
# EPqO8diaKdHi/7EXMrTWD8kIb8H6RMyauhm5RozqmsCUv36MMr7l8VNZHAsXj/ZJ
2561-
# /9cMyRzo2Jh9/zdnZs1qz+OIaqmOOlLcO5MWBlj3UwwFURHeEPLU+RXQLPxiwVzy
2562-
# HA6651mBKEF5
2699+
# CzEOMAwGCisGAQQBgjcCARUwIwYJKoZIhvcNAQkEMRYEFNRWktTrzCqbIbaCV8/e
2700+
# YWgurXYiMA0GCSqGSIb3DQEBAQUABIICADev3hFAk8V7YSgdu8aldgy4wJDT3nGe
2701+
# 9PJS8Gc8ioYn149tXONm8xqsDR7UyX9TND5QT6GusbTtaHzDrjp0itjH0WnlqdbR
2702+
# zkG0BmSGQbPEhoxG8BpThvB44c7dhVG3aZ0c4//CLuGuhwygdSAifE2cftVoOWc2
2703+
# XyzQoohtYUZGvwYIiB9Cf6bbwiSsxwexl0mR/K6ZZAzBsHmqmiKSQ3hTg+jF+cnC
2704+
# wzk5DFyyT96Gr00Shac1dG56PccqlMy+zki5vn+IP8sD+/cjIWK1dxoR6kt01rSY
2705+
# tjYOkuVzUbkxcwTYoGl8/PCxmy16wKYCg0dG8xTDyFq7LRgf3vwn1mEtqDwGfdcg
2706+
# bWwRhg/DWToICNQXFdgmUokmLOcZ1jOqUg1kMqxJ34m9RbKFh+U4nBhzGOl5de+x
2707+
# D1EZk7IFo9z4jr3KK8HIzbbpbNSGnA6oaHHLf6D9cjjrXPt/XlRY9mc0gfYGoTD1
2708+
# lT8ESJn3SItLgfTASOCAZweQGLBm7CT1XGM58ll4YLls/oIXUBEVbCeiDDLgIghD
2709+
# lAaUORJXmAG4Wg2DlyziOGEEyYFSPkDuX/Pd8ATaY1NzrskkPt3EFKMVMhUu8ryv
2710+
# vhkmj36pb/aNCuxNNaeMd+Mqunszt0wjxw0sTMWBJ4SLFeEMwh2XvKXPNz/4ith9
2711+
# 1polcpknHvN2
25632712
# SIG # End signature block

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
<tr>
99
<td class="tg-0pky"><p align="center">
1010
<img src="https://github.com/last-byte/PersistenceSniper/blob/main/persistencesnipernew4.png?raw=true" width="40%">
11-
<p align="center"><a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/badge/Language-Powershell-blue" alt="language" style="text-align:center;display:block;"></a> <a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/powershellgallery/v/PersistenceSniper?label=Module%20Version" alt="version shield logo" style="text-align:center;display:block;"></a> <a href="https://github.com/last-byte/PersistenceSniper/wiki/3-%E2%80%90-Detections"><img src="https://img.shields.io/badge/Persistence%20Techniques-56-brightgreen" alt="number of techniques implemented" style="text-align:center;display:block;"></a> <a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/badge/Digital%20Signature-Valid-brightgreen" alt="workflow" style="text-align:center;display:block;"></a> <a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/powershellgallery/dt/PersistenceSniper?label=Gallery%20Downloads" alt="gallery downloads" style="text-align:center;display:block;"></a> <a href="https://twitter.com/PersistSniper"><img src="https://img.shields.io/twitter/follow/PersistSniper?style=social" alt="twitter" style="text-align:center;display:block;"></a> <a href="https://twitter.com/last0x00"><img src="https://img.shields.io/twitter/follow/last0x00?style=social" alt="twitter" style="text-align:center;display:block;"></a> <a href="https://twitter.com/dottor_morte"><img src="https://img.shields.io/twitter/follow/dottor_morte?style=social" alt="twitter_rick" style="text-align:center;display:block;"></a> <a href="https://www.buymeacoffee.com/last0x00"><img src="https://img.shields.io/badge/buy%20me%20a-coffee-yellow" alt="buy me a coffee" style="text-align:center;display:block;"></a></p>
11+
<p align="center"><a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/badge/Language-Powershell-blue" alt="language" style="text-align:center;display:block;"></a> <a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/powershellgallery/v/PersistenceSniper?label=Module%20Version" alt="version shield logo" style="text-align:center;display:block;"></a> <a href="https://github.com/last-byte/PersistenceSniper/wiki/3-%E2%80%90-Detections"><img src="https://img.shields.io/badge/Persistence%20Techniques-60-brightgreen" alt="number of techniques implemented" style="text-align:center;display:block;"></a> <a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/badge/Digital%20Signature-Valid-brightgreen" alt="workflow" style="text-align:center;display:block;"></a> <a href="https://www.powershellgallery.com/packages/PersistenceSniper/"><img src="https://img.shields.io/powershellgallery/dt/PersistenceSniper?label=Gallery%20Downloads" alt="gallery downloads" style="text-align:center;display:block;"></a> <a href="https://twitter.com/PersistSniper"><img src="https://img.shields.io/twitter/follow/PersistSniper?style=social" alt="twitter" style="text-align:center;display:block;"></a> <a href="https://twitter.com/last0x00"><img src="https://img.shields.io/twitter/follow/last0x00?style=social" alt="twitter" style="text-align:center;display:block;"></a> <a href="https://twitter.com/dottor_morte"><img src="https://img.shields.io/twitter/follow/dottor_morte?style=social" alt="twitter_rick" style="text-align:center;display:block;"></a> <a href="https://www.buymeacoffee.com/last0x00"><img src="https://img.shields.io/badge/buy%20me%20a-coffee-yellow" alt="buy me a coffee" style="text-align:center;display:block;"></a></p>
1212
<p align="center">PersistenceSniper is a Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. It is also available on <a href=https://www.powershellgallery.com/packages/PersistenceSniper>Powershell Gallery</a> and it is digitally signed with a valid code signing certificate. The tool is under active development with new releases coming out by the week, so make sure to use the up-to-date version. Official Twitter/X account <a href="https://twitter.com/PersistSniper">@PersistSniper</a>.</p>
1313
</td>
1414
</tr>

0 commit comments

Comments
 (0)