Merge Develop to Master for Release v0.4.0-alpha #168

ION28 · 2020-02-07T20:19:24Z

User Level features

Monitor: this is a new feature that continuously monitors a Windows system for specific events. From there, BLUESPAWN can automatically launch hunts to take action against malicious activity.
New Mitigations:
- M1025 - LSA Protection
- M1042 - LLMNR
- M1042 - NBT-NS
- M1042 - Windows Script Host
- V1153 - NTLMv2 is used
- V63597 - Filter Privileged Tokens over the network (helps against T1075)
- V63817 - Include Builtin Admin account in UAC
- V63825 - Prompt for application installations
- V63829 - UAC is enabled
- V73519 - SMBv1 is disabled
New Hunts:
- T1055 - Process Injection
- T1183 - IFEO
Updated Hunts:
- T1050 - Monitor for new services
- T1100 - Web shells
New Reactions including SuspendProcess
Updates to the README & docs
Hunt Levels changed to Cursory, Normal, and Intensive now

Architecture Features

GitHub CI
- Add x86 builds
Integration of PESieve Project
Performance improvements with Hunts
Major Registry module changes
Major Event Log module updates
File System module added

…yKey object causes an issue

Update Registry base

The levels are Cursory, Normal, and Intensive

…lly free data to fix a memory leak caused by the reaction framework not properly handling binary registry keys

Change Hunts to use new levels

Fix a memory leak

Add detections for T1183

Mitigate smb1

Create initial test base

Add Mitigation for V-63597

Client mitigate v1153

Add filesystem module; Update hunt T1100 to use the new filesystem module; Update wrappers

Updated Coverage

* Fix Codacy Issues with README, Update Coverage Maps * Fix typo in T1186, Update coverage map with Partials * Add Status icons for Platform and OS * Update link to attack navigator * Attempt to fix spacing for Codacy * Fix spaces

* Add Mitigation to disable NBT-NS to stop T1171 * Fix typo in comment

Add detections when a webshell is identified

Clean up a few miscellaneous errors for merge to master

ION28 · 2020-02-08T23:07:21Z

README.md

 * Microsoft's documentation and examples on the Windows API
+* The Department of Defense's Defense Information Systems Agency (DISA) for their great work in publishing STIGs and various other technical security guidance for Windows.
+* [@hasherezade](https://github.com/hasherezade)'s [PE Sieve](https://github.com/hasherezade/pe-sieve), which currently manages our process analytics


Issue found: [list-item-indent] Incorrect list-item indent: add 2 spaces

ION28 · 2020-02-08T23:07:22Z

README.md

 * Red Canary's [Atomic Red Team Project](https://github.com/redcanaryco/atomic-red-team) which has been incredibly useful in helping to test the detections we are building
+* [@op7ic](https://github.com/op7ic)'s [EDR-Testing-Script](https://github.com/op7ic/EDR-Testing-Script) Project


Issue found: [list-item-indent] Incorrect list-item indent: add 2 spaces

ION28 · 2020-02-08T23:07:23Z

README.md

 * The [MITRE's ATT&CK Project](https://attack.mitre.org/) which has put together an amazing framework for which to consider, document, and categorize attacker tradercraft
+* [Sean Metcalf](https://twitter.com/PyroTek3)'s Active Directory Security blog [ADSecurity](https://adsecurity.org/)


Issue found: [list-item-indent] Incorrect list-item indent: add 2 spaces

ION28 · 2020-02-08T23:07:24Z

README.md

 * Microsoft's documentation and examples on the Windows API
+* The Department of Defense's Defense Information Systems Agency (DISA) for their great work in publishing STIGs and various other technical security guidance for Windows.


Issue found: [list-item-indent] Incorrect list-item indent: add 2 spaces

ION28 · 2020-02-08T23:07:25Z

BLUESPAWN-client/src/user/BLUESPAWN.cpp

+	using namespace Mitigations;
+
+	MitigateM1042LLMNR* m1042llmnr = new MitigateM1042LLMNR(mitigationRecord);
+	MitigateM1042NBT* m1042nbt = new MitigateM1042NBT(mitigationRecord);


Issue found: Variable 'm1042nbt' is assigned a value that is never used.

ION28 · 2020-02-08T23:07:26Z

BLUESPAWN-client/src/mitigation/mitigations/MitigateV3338.cpp

+		auto key = RegistryKey{ HKEY_LOCAL_MACHINE, L"System\\CurrentControlSet\\Services\\LanManServer\\Parameters" };
+		if(key.ValueExists(L"NullSessionPipes")){
+			auto values = *key.GetValue<std::vector<std::wstring>>(L"NullSessionPipes");
+			auto vGoodValues = std::vector<std::wstring>{};


Issue found: Variable 'vGoodValues' is assigned a value that is never used.

ION28 · 2020-02-08T23:07:27Z

BLUESPAWN-client/src/util/configurations/RegistryKey.cpp

+		}
+
+		if(ptr < size){
+			data[ptr] = { static_cast<WCHAR>(0) };


Issue found: Variable 'data[ptr]' is assigned a value that is never used.

ION28 · 2020-02-08T23:07:28Z

BLUESPAWN-client/src/util/configurations/RegistryKey.cpp

+
+	template<>
+	bool RegistryKey::SetValue(const std::wstring& name, LPCSTR value, DWORD size, DWORD type) const {
+		return RegistryKey::SetRawValue(name, { PBYTE(value), strlen(value), AllocationWrapper::STACK_ALLOC }, type);


Issue found: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

ION28 · 2020-02-08T23:07:29Z

BLUESPAWN-client/src/util/configurations/RegistryKey.cpp

+
+	template<>
+	bool RegistryKey::SetValue(const std::wstring& name, LPCWSTR value, DWORD size, DWORD type) const {
+		return RegistryKey::SetRawValue(name, { PBYTE(value), wcslen(value), AllocationWrapper::STACK_ALLOC }, type);


Issue found: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126).

ION28 · 2020-02-08T23:07:30Z

BLUESPAWN-common/headers/common/wrappers.hpp

@@ -35,7 +40,7 @@ class GenericWrapper {

 public:

-	GenericWrapper(T object, void(*freeFunction)(T) = [](T object){ delete object; }, T BadValue = nullptr)
+	GenericWrapper(T object, std::function<void(T)> freeFunction = [](T object){ delete object; }, T BadValue = nullptr)


Issue found: Class 'GenericWrapper < HANDLE >' has a constructor with 1 argument that is not explicit.

wtm99 and others added 30 commits January 23, 2020 12:51

Added ability to get MD5 hash of a file.

499eb76

Added the ability to create and delete files.

fc67e60

Added Read and Write over functions, both from arbitrary offsets

f82ba61

Basic File handling

55fda2f

Added logging

6c941be

Complete rework of registry. Known bug - creating a hive as a Registr…

902bda5

…yKey object causes an issue

Basic folder traversal

1820bf5

Work on final registry rework fixes with mitigations

723a874

Finish updating mitigations to use new registry base

2271a61

Merge pull request #136 from ION28/registry-rework

ff35d05

Update Registry base

Change Hunts to use new levels

0066e43

The levels are Cursory, Normal, and Intensive

Switch memory wrapping framework to use smart pointers and automatica…

f1a741b

…lly free data to fix a memory leak caused by the reaction framework not properly handling binary registry keys

Merge pull request #137 from ION28/client-change-hunt-levels

9afa6b4

Change Hunts to use new levels

Remove command lines from vcxproj file used to test

a651ce2

Merge pull request #138 from ION28/client-memory-leak

1cd468a

Fix a memory leak

Add detections for T1183

0398849

Delete BLUESPAWN-client.vcxproj.user

56db7cb

Merge pull request #146 from ION28/client-HuntT1183

2db1a2d

Add detections for T1183

Add tests for T1183

db0597d

Add S/O for T1183 test

ad8d8f1

Mitigate SMBv1

e3d712e

Remove some extraneous files

bd4e391

Fix commit to identify correct SMB version

7eb8176

Merge pull request #148 from ION28/mitigate-smb1

7f330dc

Mitigate smb1

Add Mitigation for V-63597

68f5eac

Create a mitigation for V-1153 (LM Compaitibility Level)

441f958

Merge pull request #147 from ION28/create-testing-folder

f449464

Create initial test base

Merge pull request #150 from ION28/client-add-mitigate-v63597

66a4b3c

Add Mitigation for V-63597

Merge branch 'develop' into client-mitigate-v1153

59773a8

Merge pull request #149 from ION28/client-mitigate-v1153

794cf71

Client mitigate v1153

Jack-McDowell and others added 7 commits February 7, 2020 14:27

Merge pull request #162 from ION28/filesystem

306854b

Add filesystem module; Update hunt T1100 to use the new filesystem module; Update wrappers

Merge pull request #167 from ION28/Updated-Coverage

40ccb78

Updated Coverage

Add detections when a webshell is identified

9aea59c

Update Markdown in README and Coverage Maps (#169)

200a318

* Fix Codacy Issues with README, Update Coverage Maps * Fix typo in T1186, Update coverage map with Partials * Add Status icons for Platform and OS * Update link to attack navigator * Attempt to fix spacing for Codacy * Fix spaces

Optimize suspend process reaction for files that are not executable

6b8abd9

Add Mitigation to disable NBT-NS to stop T1171 (#170)

eca7154

* Add Mitigation to disable NBT-NS to stop T1171 * Fix typo in comment

Merge pull request #171 from ION28/client-fix-t1100

5a68454

Add detections when a webshell is identified

Repository owner deleted a comment from Jack-McDowell Feb 8, 2020

Clean up a few miscellaneous errors for merge to master

0eb4119

CalvinKrist approved these changes Feb 8, 2020

View reviewed changes

Merge pull request #172 from ION28/develop-fixes

9c1ea25

Clean up a few miscellaneous errors for merge to master

Jack-McDowell self-requested a review February 8, 2020 21:35

Jack-McDowell approved these changes Feb 8, 2020

View reviewed changes

Merge branch 'master' into develop

3b88e14

ION28 commented Feb 8, 2020

View reviewed changes

ION28 merged commit 3b8c797 into master Feb 8, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Merge Develop to Master for Release v0.4.0-alpha #168

Merge Develop to Master for Release v0.4.0-alpha #168

Uh oh!

ION28 commented Feb 7, 2020 •

edited

Loading

Uh oh!

ION28 Feb 8, 2020

Uh oh!

ION28 Feb 8, 2020

Uh oh!

ION28 Feb 8, 2020

Uh oh!

ION28 Feb 8, 2020

Uh oh!

ION28 Feb 8, 2020

Uh oh!

ION28 Feb 8, 2020

Uh oh!

ION28 Feb 8, 2020

Uh oh!

ION28 Feb 8, 2020

Uh oh!

ION28 Feb 8, 2020

Uh oh!

ION28 Feb 8, 2020

Uh oh!

Uh oh!

		* Red Canary's [Atomic Red Team Project](https://github.com/redcanaryco/atomic-red-team) which has been incredibly useful in helping to test the detections we are building
		* [@op7ic](https://github.com/op7ic)'s [EDR-Testing-Script](https://github.com/op7ic/EDR-Testing-Script) Project

		* The [MITRE's ATT&CK Project](https://attack.mitre.org/) which has put together an amazing framework for which to consider, document, and categorize attacker tradercraft
		* [Sean Metcalf](https://twitter.com/PyroTek3)'s Active Directory Security blog [ADSecurity](https://adsecurity.org/)

		* Microsoft's documentation and examples on the Windows API
		* The Department of Defense's Defense Information Systems Agency (DISA) for their great work in publishing STIGs and various other technical security guidance for Windows.

Merge Develop to Master for Release v0.4.0-alpha #168

Merge Develop to Master for Release v0.4.0-alpha #168

Uh oh!

Conversation

ION28 commented Feb 7, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User Level features

Architecture Features

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ION28 commented Feb 7, 2020 •

edited

Loading