Intro

Sysinternals Suite is a bundle of 70+ tools authored by Mark Russinovich back in 1996. 

Russinovich created them under his company name (Winternals) along with the help of his colleague and co-founder Bryce Cogswell.

Winternals was then acquired in 2006 by Microsoft, and Mark Russinovich ended up working for them. He is currently the CTO of Microsoft Azure!

Behind this amazing story stands an even more amazing bundle of tools. 

Those little administrative tools can (and will) make your life much easier as a Sysadmin, IT Support Engineer, etc. However, they are also amply used by threat actors/adversaries, as well as Security personnel (from SOC Analysts to Threat Hunters).

As the name implies, Sysinternals can help you dig deeper into your Windows hosts.

Today, you can download it from the Microsoft Store by typing in Sysinternals Suite. Alternatively, you can use winget (Windows Package Manager) and PowerShell to fetch it from the MS Store for you.

You can simply do

winget install sysinternals

It’s all explained here.

Sysinternals suite utilities

Sysinternals offers the following utilities:

• File and disk utilities
• Process utilities
• Security utilities
• System information
• Networking utilities

+Misc tools (everything else in the Sysinternals Suite)

For this article, I’ve picked the most interesting ones (although that may depend on the person) while trying to cover as many categories as possible.

Process Utilities

Autoruns

As per the definition found here:

This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and when you start various built-in Windows applications like Internet Explorer, Explorer and media players. These programs and drivers include ones in your startup folder, Run, RunOnce, and other Registry keys. Autoruns reports Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond other autostart utilities.

As you can see from the image below, there are many tabs, some of which can be of great value to you.

Detailed entries about what processes are doing what to the registry (and when), for example, with the option of checking the hashes on VirusTotal, too (see below)

For example, this blog post describes (among other things) how Image Hijack can be …quite sneaky in that the Windows registry has a key to launch a certain process but instead is redirected to launch a different malicious process.

Adversaries are well aware of what they can exploit, and the registry being the db for the Windows OS is a prime target.

Autoruns can help you catch that. It can also help you check these entries for tampering, which can be one way they go on about establishing persistence.

Process Explorer

From the docs:

The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you’ll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you’ll see the DLLs and memory-mapped files that the process has loaded.” 

From the image below, you can see that I’ve chosen one of many Firefox.exe subprocesses, and under TCP/IP tab, I’ve inspected one of the IPs I’m connected with through Firefox. When I check the IP for reputation, I get the following (image 2.):

1.)

2.)

And this makes sense, as I have a connection to MS Azure portal.

On right-click, you can submit the specific process’ hash to VirusTotal (It’s the same with Autoruns, you can check from the application against VirusTotal). You can also create a full and partial dump. This can come in handy. Always keep in mind though, that the act of uploading to VirusTotal while helpful, means that you’re sharing your samples with the world. There are merits to both sharing and not, so figure out your whole (threat) model before just clicking on that option.

Process Explorer is, as you may have noticed, color-coded. This is explained in these two blog posts.

Under the options tab, there’s also the option called Replace Task Manager, which, you guessed it, replaces the Task Manager with the Process Explorer. You can revert to Task Manager in the same way. 

Also, note that malware would (commonly) hide within the svchost.exe – which is very nicely explained on the Malwarebytes blog I linked above. The reason behind this is primarily because the svchost.exe usually has a lot of children processes running at the same time, so it is kind of like security through obscurity. Or, in this case, maliciousness.

Process Monitor

Process Monitor or Procmon is a Windows monitoring tool; as per Microsoft’s documentation:

“Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such as session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.” 

Process Monitor will capture an enormous number of events in no time! 

Just as I started the app, it already has captured 78k events! By the end of the capture (around 81%), it shows ~5 million events!

This is probably one of the best guides to configure this little beast of a tool. It is an essential piece of info since you’d want to figure out what filters to use for your specific Procmon needs.

PSExec

Now this one is already somewhat infamous. Chances are you’ve heard of PSExec if you’re in Cyber. It is associated with the following MITRE techniques:

• T1021.002 – Remote Services: SMB/Windows Admin Shares
• T1569.002 – System Services: Service Execution
• T1570 – Lateral Tool Transfer

Docs:

“PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec’s most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.”

Also, check out this resource for in-depth information on PSExec.

It’s all about sharing, or rather remote administration, which we all know how dangerous it can be, if not done right.

File and disk utilities

Streams

Another useful and interesting tool is called streams, and, as per MS docs, it:

“The NTFS file system provides applications the ability to create alternate data streams of information. By default, all data is stored in a file’s main unnamed data stream, but by using the syntax ‘file:stream’, you are able to read and write to alternates. Not all applications are written to access alternate streams, but you can demonstrate streams very simply. First, change to a directory on a NTFS drive from within a command prompt. Next, type ‘echo hello > test:stream’. You’ve just created a stream named ‘stream’ that is associated with the file ‘test’. Note that when you look at the size of test it is reported as 0, and the file looks empty when opened in any text editor. To see your stream enter ‘more < test:stream’ (the type command doesn’t accept stream syntax so you have to use more).”

Why does this matter? We know some malware devs have been using the ADS to hide their data. Further, if you, say, downloaded a file from the Internet, there are indicators written in its stream that it was indeed downloaded from the Internet.

Zone.Identifier is the keyword here. And as you can see:

ADS or Alternate Data Streams is specific to the Windows NTFS. Since all files will have at least one data stream – $DATA- if you ever need another one, it’s where the ADS comes in.

I can simply say:

echo This is my super secret password > secret.txt

Which creates the .txt file…

No nefarious stuff to be found here… but wait till we hide our secret in the ADS stream!

echo hidden in the stream... Pa$$w0rd1! > secret.txt:supersecret.txt

We check using CMD to see if everything went okay. Use dir /r (a very sneaky command, as /r will look for another stream – what we want!)

One answer on Stackoverflow explains this nicely.

The /r option of CMD’s dir command calls FindFirstStreamW and FindNextStreamW on each file or directory in a listing in order to list its $DATA streams.

You can notice our hidden supersecret.txt file hidden in the stream. We can uncover it with a simple command:

notepad secret.txt:supersecret.txt

You can have more alternate data streams!

*Note the first columns (which tells us the size in bytes, respectively) – this confirms to us that something is written in the ADS. It also gives us the ADS names.

notepad secret.txt:second.txt

*Note that you can do this for .exe’s too, which is when it all becomes potentially scary. I covered the .txt’s but the logic remains the same. Google this stuff, it’s fascinating and useful! Doesn’t matter if you’re an analyst or a Red teamer.

This attack vector might contain a slight element of creativity to it, but do not underestimate it.

SDelete

Secure delete, as it promises, deletes files securely. And per Microsoft’s documentation  …implements the Department of Defense clearing and sanitizing standard DOD 5220.22-M, to give you confidence that once deleted with SDelete, your file data is gone forever.

Reliable, simple, and easy way to securely delete data, that’s Software-based. You can always use a magnet or a hammer too.

Sigcheck

A CLI utility that will give you a file version number, timestamp information, and digital signature details (as well as certificate chains). It will also have an option to check against VirusTotal.

I can quickly check my executables for any unsigned ones (on Windows systems, all .exes are to be found in the C:\Windows\System32 directory – except the Explorer.exe! Explorer.exe is located in the C:\Windows path)

I check by issuing a command:

sigcheck -u -e C:\Windows\System32

 From MS docs:

-e Scan executable images only (regardless of their extension)

-u If VirusTotal check is enabled, show files that are unknown by VirusTotal or have non-zero detection, otherwise, show only unsigned files.

If you were to get a matching here, you should probably investigate that executable.

Honorable Mentions

Don’t disregard this paragraph. These are not less important or potent. I just didn’t have the space/have chosen otherwise, but I will briefly touch upon these few tools here. The reasoning is me covering just two out of (or 6 if you count misc) five categories the Suite offers.

• Sysmon (Security utilities)
• TCPView (Networking utilities)
• Strings

Sysmon is extremely powerful. You can think of it as of an Event Viewer with much more details and controls. Sysmon can be used to hunt for malware, Metasploit, Mimikatz, persistence, etc. All the usual suspects, and more! 

Strings – Working on NT and Win2K means that executables and object files will many times have embedded UNICODE strings that you cannot easily see with a standard ASCII strings or grep programs. So we decided to roll our own. Strings just scans the file you pass it for UNICODE (or ASCII) strings of a default length of 3 or more UNICODE (or ASCII) characters. Note that it works under Windows 95 as well. Source.

Strings extracted from malware samples can be of valuable insight. Also, you can scan/analyze binaries. Useful.

TCPView – Technically, Windows already offers this functionality built-in within the Resource Monitor (you can call it from command-line with resmon) – you can find it under the Network tab.

As stated on the MS docs:

“TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows Server 2008, Vista, and XP, TCPView also reports the name of the process that owns the endpoint. TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows. The TCPView download includes Tcpvcon, a command-line version with the same functionality.”

This is handy to have and can actually be used for some hunting too. Though, there might be better tools for the job.

Conclusion

This brings us to the end. I hope you liked the Sysinternals Suite introduction! I also hope to cover Sysmon in the future, so stay tuned.

Cover by Joshua Hanson

#sysinternals #procmon #autoruns #sdelete #procexp #psexec #streams #sigcheck #sysmon #strings #vicarius_blog

As malicious actors have advanced technologically and are finding new ways to infiltrate network systems globally, organizations need to respond accordingly by enhancing their knowledge and capabilities. 

The Verizon DBIR (Data Breach Investigations Report) has played a significant role in raising awareness among the workforce about the importance of maintaining cybersecurity hygiene. Below is a summary of the 2022 DBIR that helps organizations understand the essence of the report and equip themselves with better strategies to thwart cyberattacks and safeguard the confidentiality, integrity, and availability of their critical information assets.

Some Important Verizon DBIR 2022 Findings

The Verizon 2022 DBIR is an exhaustive report running more than 100 pages. Its 15th annual edition, DBIR 2022, is the most comprehensive report presented by Verizon since the first one in 2008. It analyzes 5,212 breaches in 2021 spread across eleven industrial sectors distributed in four regions globally. Below is the outline of the critical findings from the report that merit immediate consideration.

1. Gateways that allow access: The DBIR has pointed out four significant gateways that enable malicious actors to infiltrate network systems and cause data breaches. They are:

   • Credential Theft

   • Phishing

   • Exploiting vulnerabilities

   • Botnets

No organization is safe without formulating a robust plan for handling these four compromising gateways.

2. Ransomware’s continued growth: Ransomware continues to be a significant threat to organizations worldwide. It showed around a 13% increase last year, equivalent to the previous five years’ combined rise. Thus, it has increased by around 25% over those years combined. However, organizations can block ransomware by taking proper care of the four gateways discussed above, as the threat uses these gateways to access network systems.
   

3. Supply Chain Attacks on the rise: The DBIR hints toward one significant supply chain attack that had an enormous impact. Though the report does not name the attack, it points toward the Solar Winds Supply Chain attack. As per the report, the supply chain area became responsible for 62% of last year’s system intrusions. 

4. The internal element is still involved: The DBIR states that one cannot ignore internal involvement in data breaches. While external players comprise 80% of bad actors, the breaches caused by internal actors have been more significant, with an average breach impacting ten times more than an external one.

5. The motive behind cyber crimes: The DBIR concludes that financial gain remains the primary motive behind 96% of cyber incidents and data breaches.
   

In a nutshell, the deduction will be as follows.

• Ransomware attacks are increasing by the day.

• Supply chain attacks are evolving into a significant threat.

• Malicious actors and not human error cause more data breaches.

• Cybercrime has become a significant money-spinning industry.

Eight Critical Threat Patterns Pointed out by the Report

The report highlights eight threat patterns responsible for almost all security breaches. Organizations must concentrate on these eight patterns while formulating defense strategies.

1. System Intrusion 

System Intrusion is a complex attack pattern where malicious actors infiltrate the victim’s network systems using malware or complex intrusion techniques. Ransomware is the prime example of compromising systems and disrupting businesses for financial gains.

The DBIR mentions 7,013 incidents, of which 1,999 resulted in confirmed data breaches. Mostly, the bad actors exploited C2 (Command and Control) or a backdoor entry and included ransomware. Among the confirmed data breaches, 42% compromised credentials, while 37% compromised personal data. Besides, the report talks of increasing supply chain attack incidents.

2. Social Engineering

Social Engineering attacks comprise the human element involved in cyber incidents. As per DBIR, about 82% of data breaches involve a human angle. It reports 2,249 social engineering attack incidents resulting in 1,063 confirmed data breaches. Furthermore, 63% of the violations compromised credentials, whereas 32% resulted in internal data loss. The primary attack modes were phishing and BEC (Business Email Compromise).

3. Denial of Services

DDoS (Distributed Denial of Service) attacks are among the oldest attack patterns where the cyber attackers simultaneously target the network and application layers to increase traffic and compromise the application’s availability. The primary objective of the DDoS attack is to disrupt business and not steal data. The DBIR 2022 lists 8,456 disruptions, including four cases compromising information assets.  

4. Privilege Misuse 

Privilege misuse is a dangerous trend because it compromises the trust element that employers have with their employees. Here, the malicious actors misuse their privileges and cause data breaches solely for financial gain. All of these attacks involve internal actors, with DBIR reporting 4% involving external collaboration. DBIR highlights 275 incidents resulting in 216 confirmed data breaches; 78% of such attacks are carried out for financial gain and the remaining are due to ulterior grudges, espionage, and convenience. 

5. Basic Web Application (BWA) Attacks

The BWA attacks are similar to hit-and-run cases where the threat actors target a specific web application, compromise it, collect as much data as possible, and abandon the system. The DBIR lists 4,751 such instances culminating in 1,273 data breaches. 69% of these breaches compromised personal information and 67% credentials. Usually, the malicious actors exploit a known vulnerability in the system or use brute force to access it and compromise the information assets.

6. Miscellaneous Errors

Miscellaneous errors generally constitute unintentional actions that directly compromise the information asset’s integrity. These could be errors like misconfiguring an asset or unwittingly sending information to the wrong person. Usually, internal employees are involved in such cases. The DBIR lists 715 such incidents, with nearly all resulting in compromising information assets, primarily personal data.  

7. Lost and Stolen Assets

Such attack patterns involve losing track of a specific information asset. At times, there can be theft of sensitive data. The DBIR mentions 885 incidents in this category, involving 85% internal threat actors. It included 81 data breach incidents, and the stolen devices were mostly documents, desktops, laptops, and mobile phones. 

8. Everything Else 

This section covers the incidents that do not fit into the seven patterns described above. Though the DBIR has not listed any incident in this category, it has included it in the report for organizations to introspect.

Final Words

Verizon’s DBIR is a comprehensive report that provides a wealth of information about the different types of threats in today’s cybersecurity landscape. The report highlights how security-related incidents occur and thus, helps organizations to formulate a comprehensive cybersecurity strategy. As it has systematically classified the various threat factors, it is easy for organizations to verify which security control they are deficient in and which attack vectors they need to be cautious about most. They can then improve the safeguards to ensure their valuable information assets’ confidentiality, integrity, and availability.

#verizon #vicarius_blog

Reference

1. Verizon. Data Breach Investigations Report (DBIR) – 2022. 

https://www.verizon.com/business/resources/reports/2022/dbir/2022-dbir-data-breach-investigations-report.pdf