For years, we at Countercept have seen adversaries across the threat pyramid make use of PowerShell tool-kits for lateral movement, data exfiltration and persistence over different environments. As defenders, we have done a pretty good job – PowerShell is a fading threat in time. Mimikatz execution through PowerShell? AMSI and PowerShell logging can handle that relatively well. However, adversaries being adversaries don’t just give up. They have migrated tool-kits to areas where visibility is still limited – such as .NET. Favoured by adversaries due to its wide range of functionalities, ease of development, and default presence on modern Windows platforms, we have seen a significant increase in exploitation toolkits leveraging .NET to perform usual activities - but in an area where they are relatively hidden.

1. YOU ARE NOT HIDING
FROM ME .NET!

2. FOUR THINGS ABOUT MYSELF
Netflix addict
Attack detection bloggerThreat Hunter @ Countercept
Code junkie

3. THE AGENDA
Detect
Why .NET ?

4. IN THE NOT SO DISTANT PAST
PowerShell
VBScript
Office Macros

5. POWERSHELL, A HOT FAVOURITE
Load shellcode
into memory
Call upon
.NET API
Call upon
native API
Powerful

6. DEFENCES ARE GETTING BETTER
EDR AGENTS
Command Line Arguments Logging
CommandLine powershell write host “This is an evil command”
Parent-Child Process Relationship

7. DEFENCES ARE GETTING BETTER
AMSI assisting Anti-Virus with script-based detection
PowerShell Script Block Logging to aid with detection

8. INDUSTRY AS A WHOLE
More opportunities to
detect bad PowerShell

9. ADVERSARIES JUST DON’T GIVE UP
Invoke .NET directly
instead of via PowerShell

10. WHY .NET THOUGH?
Powerful
functions
Installed by
default
Lack of
telemetry

11. 10
LET’S COMPARE POWERSHELL AND .NET
Write a registry key
through a .NET API
Pop a Message box
with a native API

12. POWERSHELL VS .NET

13. HOW DID I EXECUTE MY .NET PAYLOAD?
In-memory
assembly loading

14. IN MEMORY .NET ASSEMBLY LOADING
Compile
Serialize
Load into memory
De-serialize
Instantiate

15. A FUN FACT
This does exactly the same thing

16. WHAT CAN THE LOADED OBJECT DO?
Load shellcode
into memory
Call upon .NET API
Call upon native API
Similar to
PowerShell

17. MID-POINT CHECK
Challenge: Can we detect this?
Similar to PowerShell
Lack of telemetry

18. THE AGENDA
Detect
Why .NET ?

19. …… WITH PROCESS HACKER
Process Hacker
Mshta.exe
Analyze

20. DETECTING .NET LOADED DLLS
Loading of .NET runtime DLLs can be observed

21. DEFINITELY DODGY
MSHTA typically
only runs HTML or
JavaScript code!

22. HUNT HYPOTHESIS
Hunt for presence of.NET
runtime DLLs in binaries

23. WHAT IF A BINARY RELATED TO .NET WAS USED
Msbuild.exe
3rd Party Application
Not uncommon to have .NET
runtime DLL

24. WE NEED SOMETHING BETTER
And the answer lies deep
within Process Hacker

25. .NET ASSEMBLIES
Events of assembly loads

26. .NET ASSEMBLIES
Lack of a path indicates potential in-memory
assembly loads

27. .NET ASSEMBLIES
How did Process
Hacker achieve this?

28. DEEP WITHIN PROCESS HACKER
A set of .NET ETW providers
Microsoft-Windows-DotNETRuntime
Microsoft-Windows-DotNETRuntimeRundown

29. PROOF-OF-CONCEPT
.NET ETWConsumes

30. LET’S TRY TO DETECT MY ATTACK
Indicators for in-memory
assembly load
Indicators for .NET API
related to registry creation
Indicators for invoking of native API

31. IN-MEMORY ASSEMBLY LOAD
Events
related to
in-memory
assembly
load
Loading of .NET
assemblies
Just In Time
compilation

32. .NET CODE COMPILATION ARCHITECTURE
Compile
CIL
Compile Native
code
Upon
execution
JIT
Compiler
Compilation time Runtime

33. JIT COMPILATION
Events generated
whenever a .NET
method is first utilized

34. IN-MEMORY ASSEMBLY LOAD INDICATORS
Loading of .NET
assemblies
Just In Time
compilation

35. IN-MEMORY ASSEMBLY LOAD INDICATORS
Detect execution of the MyAssembly
constructor

36. REMEMBER THIS?
In-memory loading of assembly attempts
to replicate the above behavior

37. DETECTION SUMMARY
Indicators for in-memory
assembly load
Indicators for .NET API
related to registry creation
Indicators for invoking
of native API

38. JIT ETW
Just In Time compilation
Can we use this?

39. UNFORTUNATELY….
JIT compilation
doesn’t occur for
native .NET assemblies

40. NATIVE .NET ASSEMBLIES?
System.text
Console.writeLine()

41. WHY THOUGH?
Compile
Native Image Generator (NGEN)
compiles .NET assemblies to native
images, and caches them
Cache

42. WHY THOUGH?
Compile
JIT compilation would not occur
Cache

43. DETECTION SUMMARY
Indicators for in-memory
assembly load
Indicators for .NET API
related to registry creation
Indicators for invoking
of native API

44. NATIVE CODE
Native function imported from User32.dll

45. .NET ETW EVENTS
Interop events

46. INTEROP EVENTS
Events generated
during calls made to
Window’s native API

47. INTEROP EVENTS
Detected a call towards MessageBox

48. THIS IS REALLY USEFUL
Logging of
keystrokes
Credential
extraction from
memory
Other malicious
activities

49. DETECTION SUMMARY
Indicators for in-memory
assembly load
Indicators for .NET API
related to registry creation
Indicators for invoking
of native API

50. REAL WORLD EXAMPLE, SILENTRINITY
49
Launch a .NET
assembly
Launch SafetyKatz,
a credential
extraction tool

51. 50
.NET TELEMETRY
.NET runtime
DLLS
.NET ETW
events

52. HOW ABOUT OTHER TELEMETRY?
Objective
Lateral
Movement
Control
Persistence
Execution
Delivery
Recon
Attacker

53. TO WRAP IT UP
1
.NET isn’t that invisible
2
PowerShell, still
deadly but…..
3
Try it yourself!
QUESTIONS?