TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Black Hills InfoSec

Initial Access Operations Part 1: The Windows Endpoint Defense Technology Landscape

BHIS · 2024-02-22 · Read original ↗

ATT&CK techniques detected

18 predictions
T1055.001Dynamic-link Library Injection
99%
"is a set of application programming interfaces used in the windows operating system. “ ntdll. dll ” is a dynamic - link library that contains a collection of functions that are part of the windows native api. “ ntdll. dll ” system calls ( syscalls ), are low - level functions tha…"
T1055.001Dynamic-link Library Injection
99%
"new memory location. conveniently, a 32 - bit short jmp instruction fits nicely into the 5 bytes available to us. overall, the sequence to hook an api in “ ntdll. dll ” for a defensive product might look something like this : - the defensive product receives some kernel notificat…"
T1055.001Dynamic-link Library Injection
99%
"eax register and then jmp back to the syscall instruction of the original api. [ me1 ] “ ntdll. dll ” api hooking may or may not be implemented dynamically using kernel notification callbacks. in some instances, the defense product design might hook many of the “ ntdll. dll ” api…"
T1068Exploitation for Privilege Escalation
99%
"##p ) attack methods. kernel driver block listing one of the more attractive attacker targets that exists in the microsoft windows kernel environment is a signed driver that has a vulnerability. with direct access to kernel memory via a vulnerable signed driver, any kernel mode d…"
T1055.001Dynamic-link Library Injection
98%
"that read, write, and execute permissions on virtual memory pages is an indicator of compromise is related to how virtual memory is used in a typical windows process. executable machine code in say the “. text ” section of a pe / coff executable will typically be mapped into virt…"
T1055.001Dynamic-link Library Injection
98%
"new frame. a stack frame will contain local variables belonging to the specific function, as well as a function return address. as any code in a thread executes, its stack will grow and shrink as various functions are called. this means that at any point in time, the thread ’ s s…"
T1055.001Dynamic-link Library Injection
98%
"it is also possible to use the “ ntdll. dll ” api call “ ntreadvirtualmemory ( ) ” to directly examine memory contents itself. some easy detection opportunities arise from memory page scanning : - if virtual memory is allocated and protections are set to read, write, and execute,…"
T1055.001Dynamic-link Library Injection
97%
"s ) to the page _ execute _ read permission and create a thread pointing to the start address of the memory allocated. virtual memory is a memory management technique that provides an abstraction of the physical memory resource. on windows, and many other operating systems, a pag…"
T1068Exploitation for Privilege Escalation
96%
"threat actors today. as such, with the introduction of windows 11 as of the 2022 update, microsoft has enabled the vulnerable driver blocklist. microsoft runs a program for vulnerable driver submissions, and updates the vulnerable driver blocklist with each major release of windo…"
T1055.001Dynamic-link Library Injection
95%
"- registers a callback routine for object changes such as when a process, thread, or desktop handle is opened or duplicated. - cmregistercallback - registers a callback routine for any windows registry operations given this granularity of notification information, it should be no…"
T1055.001Dynamic-link Library Injection
93%
"the introduction of windows 11, and appropriate processor support, there exists a new defensive technique called hardware enforced stack protection. this feature will only work if the underlying processor provides support, such as intel ’ s control - flow enhancement technology (…"
T1654Log Enumeration
79%
"’ s cover some of these other techniques. event tracing for windows ( etw ) this technology implements tracing and event logging for both user mode applications and kernel driver activities. the windows event tracing api is implemented in three components : - controllers which ca…"
T1685.001Disable or Modify Windows Event Log
70%
"’ s cover some of these other techniques. event tracing for windows ( etw ) this technology implements tracing and event logging for both user mode applications and kernel driver activities. the windows event tracing api is implemented in three components : - controllers which ca…"
T1055.001Dynamic-link Library Injection
65%
"across 0road array of information technology solutions. the defensive technique / technology list below is focused on defense product techniques with brief mention of integrated windows features. there exists a host of other windows operating system security features, such as : a…"
T1055.001Dynamic-link Library Injection
52%
"’ t particularly like this technique, since any small 3rd party developer software defects could ( and did ) result in destabilizing the windows kernel. when windows vista was released, microsoft released an accompanying change called patch guard ( kernel patch protection ) which…"
T1055.001Dynamic-link Library Injection
49%
"disassembled the api call. first note that this is a 64 - bit process, and we are staying there because there is a dwindling amount of 32 - bit systems these days anyway. the first two machine code opcodes below are doing the following : - “ mov r10, rcx ” : save a copy of rcx in…"
T1078Valid Accounts
42%
"initial access operations part 1 : the windows endpoint defense technology landscape initial access operations part 1 : the windows endpoint defense technology landscape security consultant, malware researcher, new technology researcher evangelist. today ’ s endpoint defense land…"
T1055.003Thread Execution Hijacking
34%
"’ t particularly like this technique, since any small 3rd party developer software defects could ( and did ) result in destabilizing the windows kernel. when windows vista was released, microsoft released an accompanying change called patch guard ( kernel patch protection ) which…"

Summary

Today’s endpoint defense landscape on the Windows desktop platform is rich with product offerings of quite sophisticated capabilities. Beyond the world of antivirus products, Extended Detection and Response (XDR), and […]

The post Initial Access Operations Part 1: The Windows Endpoint Defense Technology Landscape appeared first on Black Hills Information Security, Inc..