CircleCI Atomic Red Team doc generator
69 lines
3.8 KiB
Markdown
69 lines
3.8 KiB
Markdown
# T1121 - Regsvcs/Regasm
|
|
## [Description from ATT&CK](https://attack.mitre.org/wiki/Technique/T1121)
|
|
<blockquote>Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)
|
|
|
|
Adversaries can use Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Both utilities may be used to bypass process whitelisting through use of attributes within the binary to specify code that should be run before registration or unregistration: <code>[ComRegisterFunction]</code> or <code>[ComUnregisterFunction]</code> respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: SubTee GitHub All The Things Application Whitelisting Bypass)
|
|
|
|
Detection: Use process monitoring to monitor the execution and arguments of Regsvcs.exe and Regasm.exe. Compare recent invocations of Regsvcs.exe and Regasm.exe with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity. Command arguments used before and after Regsvcs.exe or Regasm.exe invocation may also be useful in determining the origin and purpose of the binary being executed.
|
|
|
|
Platforms: Windows
|
|
|
|
Data Sources: Process monitoring, Process command-line parameters
|
|
|
|
Defense Bypassed: Process whitelisting
|
|
|
|
Permissions Required: User, Administrator
|
|
|
|
Remote Support: No
|
|
|
|
Contributors: Casey Smith</blockquote>
|
|
|
|
## Atomic Tests
|
|
|
|
- [Atomic Test #1 - Regasm Uninstall Method Call Test](#atomic-test-1---regasm-uninstall-method-call-test)
|
|
|
|
- [Atomic Test #2 - Regsvs Uninstall Method Call Test](#atomic-test-2---regsvs-uninstall-method-call-test)
|
|
|
|
|
|
<br/>
|
|
|
|
## Atomic Test #1 - Regasm Uninstall Method Call Test
|
|
Executes the Uninstall Method, No Admin Rights Required
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
#### Inputs
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| filename | Location of the payload | Path | T1121.dll|
|
|
|
|
#### Run it with `command_prompt`!
|
|
```
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library T1121.cs
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U T1121.dll
|
|
```
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #2 - Regsvs Uninstall Method Call Test
|
|
Executes the Uninstall Method, No Admin Rights Required, Requires SNK
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
#### Inputs
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| filename | Location of the payload | Path | T1121.dll|
|
|
|
|
#### Run it with `powershell`!
|
|
```
|
|
$key = 'BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZbp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhbdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkbix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFbD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZbOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FbdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIboWsx4V8aiWx8FPPngEmNz89tBAQ8zbIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9b/WKQHIHjkzG+z6nWHMoMYV5VMTZ0jLM5aZQ6ypwmFZaNmtL6KDzKv8L1YN2TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT3rpZ9tbLZUefrFnLNiHfVjNi53Yg4='
|
|
$Content = [System.Convert]::FromBase64String($key)
|
|
Set-Content key.snk -Value $Content -Encoding Byte
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /target:library /keyfile:key.snk T1121.cs
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe T1121.dll
|
|
```
|
|
<br/>
|