Jennifer Burns
67 lines
3.9 KiB
JSON
67 lines
3.9 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--93898324-e8f6-4864-ac0c-65de4c8517a6",
|
|
"spec_version": "2.0",
|
|
"objects": [
|
|
{
|
|
"id": "attack-pattern--bb0e0cb5-f3e4-4118-a4cb-6bf13bfbc9f2",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"name": "Netsh Helper DLL",
|
|
"description": "Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. (Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\\SOFTWARE\\Microsoft\\Netsh</code>.\n\nAdversaries can use netsh.exe with helper DLLs to proxy execution of arbitrary code in a persistent manner when netsh.exe is executed automatically with another Persistence technique or if other persistent software is present on the system that executes netsh.exe as part of its normal functionality. Examples include some VPN software that invoke netsh.exe. (Citation: Demaske Netsh Persistence)\n\nProof of concept code exists to load Cobalt Strike's payload using netsh.exe helper DLLs. (Citation: Github Netsh Helper CS Beacon)",
|
|
"external_references": [
|
|
{
|
|
"external_id": "T1128",
|
|
"url": "https://attack.mitre.org/techniques/T1128",
|
|
"source_name": "mitre-attack"
|
|
},
|
|
{
|
|
"url": "https://technet.microsoft.com/library/bb490939.aspx",
|
|
"description": "Microsoft. (n.d.). Using Netsh. Retrieved February 13, 2017.",
|
|
"source_name": "TechNet Netsh"
|
|
},
|
|
{
|
|
"url": "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html",
|
|
"description": "Demaske, M. (2016, September 23). USING NETSHELL TO EXECUTE EVIL DLLS AND PERSIST ON A HOST. Retrieved April 8, 2017.",
|
|
"source_name": "Demaske Netsh Persistence"
|
|
},
|
|
{
|
|
"url": "https://github.com/outflankbv/NetshHelperBeacon",
|
|
"description": "Smeets, M. (2016, September 26). NetshHelperBeacon. Retrieved February 13, 2017.",
|
|
"source_name": "Github Netsh Helper CS Beacon"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"x_mitre_version": "1.0",
|
|
"x_mitre_contributors": [
|
|
"Matthew Demaske, Adaptforward"
|
|
],
|
|
"x_mitre_data_sources": [
|
|
"DLL monitoring",
|
|
"Windows Registry",
|
|
"Process monitoring"
|
|
],
|
|
"x_mitre_detection": "It is likely unusual for netsh.exe to have any child processes in most environments. Monitor process executions and investigate any child processes spawned by netsh.exe for malicious behavior. Monitor the <code>HKLM\\SOFTWARE\\Microsoft\\Netsh</code> registry key for any new or suspicious entries that do not correlate with known system files or benign software. (Citation: Demaske Netsh Persistence)",
|
|
"x_mitre_permissions_required": [
|
|
"Administrator",
|
|
"SYSTEM"
|
|
],
|
|
"x_mitre_platforms": [
|
|
"Windows"
|
|
],
|
|
"x_mitre_system_requirements": [
|
|
"[netsh](https://attack.mitre.org/software/S0108)"
|
|
],
|
|
"type": "attack-pattern",
|
|
"kill_chain_phases": [
|
|
{
|
|
"phase_name": "persistence",
|
|
"kill_chain_name": "mitre-attack"
|
|
}
|
|
],
|
|
"modified": "2019-02-19T16:21:49.984Z",
|
|
"created": "2017-05-31T21:31:40.168Z"
|
|
}
|
|
]
|
|
} |