# Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 1 **unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-** techniques-part-1 Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 1 Detection opportunities on lateral movement techniques used by CONTI ransomware group using CobaltStrike. Introduction: In an attempt to contribute to the defensive capabilities of security teams regarding the increase of CobaltStrike usage by threat actors (TA) and in a joined effort with [@MichalKoczwara, a series of articles will be released on CobaltStrike's TTP detections](https://twitter.com/MichalKoczwara) related to the CONTI leak. For the first part of this blog post, I will cover detection opportunities for lateral movement (LM) techniques used by the TA CONTI via CobaltStrike. Keep in mind that I tried to boil it down to analytics that can be used for other lateral movements variation and not just specific to CONTI Group or CobaltStrike (CS). Definition: MITRE ATT&CK defines lateral movement as : _Lateral Movement consists of techniques that adversaries use to enter and control_ _remote systems on a network. Following through on their primary objective often_ _requires exploring the network to find their target and subsequently gaining access to_ _it. Reaching their objective often involves pivoting through multiple systems and_ _accounts to gain. Adversaries might install their own remote access tools to_ _accomplish Lateral Movement or use legitimate credentials with native network and_ _operating system tools, which may be stealthier._ Looking in the CobaltStrike documentation we can find some built-in modules for Lateral Movement defined in the table bellow which were included in the leaked documentation: Jump Module Arch Description ----- **psexec** x86 Use a service to run a Service EXE artifact **psexec64** x64 Use a service to run a Service EXE artifact **psexec_psh** x86 Use a service to run a PowerShell one-liner **winrm** x86 Run a PowerShell script via WinRM **winrm64** x64 Run a PowerShell script via WinRM Other capabilities are used by the group like `Remote-Exec command, PTH module, RDP` and `SHELL` command to remotely execute commands using `WMIC.EXE utility. I will go` through these TTPs in the second part. Remote-Exec Module Description **psexec** Remote execute via Service Control Manager **winrm** Remote execute via WinRM (PowerShell) **wmi** Remote execute via WMI (PowerShell) ----- Simulation Setup CobaltStrike Zeek Elastic Stack (Winlogbeat + Filebeat) [Sysmon Configuration Blacksmith OTRF](https://github.com/OTRF/Blacksmith/tree/master/resources/configs/sysmon) VICTIM Windows 10 user machine (Initial Access) DC_ATLAS Domain Controller Windows Server 2016 (Lateral Movement Target) T1021.006 Remote Services: Windows Remote Management A primer to WinRM **WinRM is the Microsoft implementation of WS-Management protocol which is an open** source standard for constructing XML messages following the standards of Simple Object Access Protocol (SOAP) messages. This great [blog explain in simple steps a typical WinRM based conversation for invoking](https://www.hurryupandwait.io/blog/a-look-under-the-hood-at-powershell-remoting-through-a-ruby-cross-plaform-lens) commands: 1. 1. [Send a Create Shell message and get the shell id from the response](https://msdn.microsoft.com/en-us/library/cc251739.aspx) 2. 2. [Create a command in the shell sending the command and any arguments and grab the](https://msdn.microsoft.com/en-us/library/cc251740.aspx) command id from the response 3. 3. [Send a request for output on the command id which may return streams (stdout and/or](https://msdn.microsoft.com/en-us/library/cc251741.aspx) stderr) containing base64 encoded text. 4. 4. Keep requesting output until the command state is done and examine the exit code. 5. 5. [Send a command termination signal](https://msdn.microsoft.com/en-us/library/cc251743.aspx) 6. 6. [Send a delete shell message](https://msdn.microsoft.com/en-us/library/cc251746.aspx) I will go more in depth about WinRM from a defensive perspective during lateral movement in a separate blog but for more details I recommend checking the official documentation [MSWSMV]. However, a couple of things we should keep in mind when it come to the limitations of WinRM and why PowerShell Remoting Protocol (PSRP) is much better choice to go with. ----- The default value of a SOAP message size 512KB and a maximum of 8192KB. This attribute can be modified with the following command : `winrm set winrm/config/winrs` ``` '@{=""}' . ``` WinRM also doesn't have a built-in functionality for file transfer. We will learn in the next section that PowerShell Remoting Protocol (PSRP) is much better alternative. Windows Built-in WinRM tools In order to understand CobaltStrike WinRM beacon capabilities, first, I tried to see normal behavior of some of the tools that can be used in a legitimate way. There are 3 main ways to execute command remotely using WinRM: **WinRS:** Windows Remote Shell built-in tool is a pure implementation of remote command execution via WinRM. Upon executing a command using winrs.exe utility via the command `winrs -` ``` r:dc_atlas "ipconfig" the following telemetry was recorded on the destination: svchost.exe spawns winrshost.exe with the parent command line C:\\Windows\\system32\\svchost.exe -k DcomLaunch ``` The `winrshost.exe then invokes cmd.exe` instance and execute the command within its context. ----- After finishing the execution of the command these processes are terminated because ``` winrs.exe doesn't support persistent sessions so every time you execute a command ``` remotely this behavior repeats itself. ----- winrs process tree **Invoke-Command & Enter-PSSession :** [These PowerShell cmdlets use the PowerShell Remoting Protocol [MS-PSRP] which is a](https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-PSRP/%5BMS-PSRP%5D.pdf) separate protocol that runs over WinRM. PSRP supports many message types to execute commands and retrieve their outputs and its main difference from WSMV specs is its message fragmentation handling process which makes it more reliable vis-à-vis WinRM message size limitations. While testing these cmdlets, the following telemetry was recorded on the destination: ``` svchost.exe spawns wsmprovhost.exe with the parent command line C:\Windows\system32\svchost.exe -k DcomLaunch ``` Executing nslookup command via Enter-PSSession ----- Executing ipconfig via Invoke-Command ``` Invoke-Command & Enter-PSSession both run commands within the context of wsmprovhost.exe ``` The difference between these two cmdlets is that `Invoke-Command will terminate` ``` wsmprovhost.exe process after receiving the output while the Enter-PSSession will ``` establish a persistent session. Invoke-Command & Enter-PSSession process tree Now that we have established what telemetry can be left behind by using Windows built-in tools we can distinguish suspicious process behavior. lets see in the following section how CS default configurations for lateral movement behave. CobaltStrike jump winrm ----- First, lets discover the telemetry that will be generated from source and destination for every attempt to use WinRM remotely: **_On the source:_** EID Action Provider Comment 6 WSMan Session Creation Microsoft-Windows-WinRM Creating WSMan Session. This event will give you the PID that initiated the connection 31 WSMan Session Creation Microsoft-Windows-WinRM WSMan Session Created Successfully 3 Network Connection Microsoft-Windows-Sysmon Network Direction: egress Infected Source Process Name Destination port : 5985 or 5986 **_On the destination:_** EID Action Provider ----- Comment 1 WSMan Session Creation Microsoft-Windows-Sysmon Process Name : `wsmprovhost.exe` Process CMD : `C:\Windows\system32\wsmprovhost.exe -Embedding` Process Parent Name : `svchost.exe` Process Parent CMD : `C:\Windows\system32\svchost.exe -k DcomLaunch` 3 WSMan Session Creation Microsoft-Windows-Sysmon Network Direction: ingress Process Name: System Destination port : 5985 or 5986 User : NT `AUTHORITY\SYSTEM` 17 Pipe Created Microsoft-Windows-Sysmon Network Direction: egress Infected Source Process Name Destination port : 5985 or 5986 Pipe Name : `\PSHost.[%NUMBERS%].` ``` [%PID%].DefaultAppDomain.wsmprovhost ``` Process Name : `wsmprovhost.exe` 4656 ----- Process Access Microsoft-Windows-Security-Auditing Object Server : WS-Management Listener Process Name : `C:\Windows\System32\svchost.exe` 400 PowerShell Session Start PowerShell Host Name = `ServerRemoteHost` (Remote PowerSehll Session) Engine Version (Good for Downgrading PS attacks) Host Application : `C:\Windows\system32\wsmprovhost.exe -Embedding` 91 WSMan Session Creation Microsoft-Windows-WinRM 31 WSMan Session Creation Microsoft-Windows-WinRM WSMan Session Created Successfully 142 WSMan Operation Failure Microsoft-Windows-WinRM Helpful when WinRM is not enabled on the targeted host Other events are generated on the destination side but these in the previous table are the most relevant to remote WinRM activity. You can use them according to your collection and correlation strategy. Obviously, `EID 1,` `EID 91` and EID 4656 have much higher event ----- decisiveness than the rest. I will be releasing a Mindmap that groups all this telemetry in one place at the end of this blog post series. Now jumping to `jump winrm command and some first differences in process tree behavior` were observed at execution time: ``` jump winrm command generated the same telemetry as in previous observations ``` except that the beacon runs under the context of a PowerShell instance invoked by ``` wsmprovhost.exe . This is not something we can normally observe by using winrs, Invoke-Command or Enter-PSSession except if the command invoked powershell.exe itself then PowerShell cmdlets would produce this behavior. ``` By default the powershell.exe instance run via the command line : ``` "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile ``` CobalStrike provides a `shell` command to interact with the beacon and execute command. The `shell` command spawns a `cmd.exe instance from the invoked` ``` powershell.exe process for every executed command ``` ----- Executing systeminfo command via jump winrm beacon. A general diagram of process tree observed during the execution of this CS module is illustrated bellow: jump winrm process tree diagram CobaltStrike jump winrm64 Here are the main differences from `jump winrm command :` Like `Enter-PSSession,` `jump winrm64 executes commands within the context of a` ``` wsmprovhost.exe instance. The session is persistent no termination of the wsmprovhost.exe process was observed. ``` ----- Executing ipconfig and hostname command via a jump winrm64 shell Jump winrm64 process tree diagram Evidence of Execution In the previous sections we have established some key observations regarding remote command execution via WinRM. However, during the demo, I used a stageless beacon. The script first decodes the Base64 encoded payload then it uses the `.Net API to call` Windows API function in memory using assemblies. The script then allocates some memory and copies the payload in the allocated memory space. The payload was a 64-bits DLL and technique used was DLL Reflective Loading. The payload strings contained by default: "beacon.dll" "beacon.x86.dll" "beacon.x64.dll" This [yara rule can be effective in detecting default usage of CS stageless beacons.](https://github.com/airbnb/binaryalert/blob/master/rules/public/hacktool/windows/hacktool_windows_cobaltstrike_beacon.yara) ----- The following PowerShell events were observed on the target: ``` EID 4104 Script Block Logging: ``` This event can be considered noisy, so be careful during you detection engineering process and consider its verbosity. Script blocks exceeding the maximum length of an event log message are fragmented into multiple entries. Unlike `EID 4103, this event doesn't record the output of the script` ``` EID 4103 Module Logging: ``` Generates a large volume of events Records the output of the executed commands Keep in mind that these event are not enabled by default. Sigma Rules [PowerShell Events : Remote PowerShell Session by](https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_remote_powershell_session.yml) [@Cyb3rWard0g](https://twitter.com/Cyb3rWard0g) [Sysmon Process : Remote PowerShell Session by](https://github.com/OTRF/ThreatHunter-Playbook/blob/master/signatures/sigma/sysmon_remote_powershell_session_process.yml) [@Cyb3rWard0g](https://twitter.com/Cyb3rWard0g) [Windows Events : Remote PowerShell Session by](https://github.com/OTRF/ThreatHunter-Playbook/blob/master/signatures/sigma/win_remote_powershell_session.yml) [@Cyb3rWard0g](https://twitter.com/Cyb3rWard0g) [Sysmon Network : Remore PowerShell Session by](https://github.com/OTRF/ThreatHunter-Playbook/blob/master/signatures/sigma/sysmon_remote_powershell_session_network.yml) [@Cyb3rWard0g](https://twitter.com/Cyb3rWard0g) Detection Validation ----- In order to validate your detection rules against WinRM being used for remote command execution, Atomic Red Team provides a great guide bellow: atomic-red-team/T1021.006.md at master · redcanaryco/atomic-red-team GitHub DFIR In DFIR engagements these events can be good source of information to get the right attack attributions: **EID 142 WSMan operation CreateShell failed (Helpful when WinRM is not enabled on** the target host) **EID 169 User Authenticated Successfully (The user who was connected remotely)** **EID 81 Processing Client Request for Operation CreateShell (Start of remoting activity)** **EID 134 Sending Response for Operation DeleteShell (End of remoting activity)** **EID 403 Engine state is changed from Available to Stopped (This event records the** completion of a PowerShell activity) WinRM event logs lack simple attribution and traceability meaning you need multiple correlation layers in order to identify the user, source IP and the ID of the infected process. The command `Get-WSManInstance -ComputerName localhost -ResourceURI Shell -` ``` Enumerate lists all currently active remote WinRM sessions and provides useful information ``` : **Owner : Username that opened the remote session** **ClientIP: Source IP from where the attacker attempted to move laterally.** **ProcessID: In this case it is wsmprovhost.exe where the executed commands will be** invoked from. **ChildPocesses: Number of child processes it opened.** **MemoryUsed: Can be good indicator since** `winrm64 CS module used more than` twice the memory used by `Enter-PSSession for the same command.` 1 ----- PS C:\\Users\\Administrator> Get-WSManInstance -ComputerName localhost -ResourceURI Shell -Enumerate 2 3 rsp : 4 lang : en-US 5 ShellId : 04E49AF8-1CA8-4ACC-9135-6A3269115F3E 6 Name : WinRM1 7 ResourceUri : 8 Owner : ATLAS\\Administrator 9 ClientIP : 10.10.10.30 10 ProcessId : 2844 11 IdleTimeOut : PT7200.000S 12 InputStreams : stdin pr 13 ----- OutputStreams : stdout 14 MaxIdleTimeOut : PT2147483.647S 15 Locale : en-US 16 DataLocale : en-US 17 CompressionMode : XpressCompression 18 ProfileLoaded : Yes 19 Encoding : UTF8 20 BufferMode : Block 21 State : Connected 22 ShellRunTime : P0DT0H4M32S 23 ShellInactivity : P0DT0H1M28S 24 MemoryUsed : 134MB 25 ChildProcesses : 2 ----- Copied! A good idea would be to generate an event with the output of this command every time the process wsmprovhost.exe is created using scheduled tasks. T1570 : Lateral Transfer Tool CobaltStrike jump psexec & psexec64 I love going through ZEEK logs first and look for network related telemtery specially for lateral movement techniques. When using CS psexec or psexec64 modules for lateral movement I observed remote service creation. These modules use named pipes (RPC/NP) method to interact with the service control manager (SCM) RPC server. The server interface is identified by UUID `367ABB81-9844-` ``` 35F1-AD32-98F038001003 and uses RPC endpoint \\PIPE\\svcctl . ``` The following ZEEK event logs were recorded : ZEEK DCE-RPC event was generated with DCE-RPC endpoint `SVCCTL and` operation `CreateServiceWoW64A` Zeek DCE-RPC Telemtry for Service Creation ----- On the target `EID 5145 A network share object was checked to see whether client` can be granted desired access will be generated with `Relative Target Name` defined as `SVCCTL` and Share Name `\*\IPC$` A service is then created with a random name and Image Path calling the process via the command `\\127.0.0.1\ADMIN$\[SERVICE_RANDOM_NAME].exe . This will` generate `EID 7045 New Service Was Installed and` `EID 4697 A Service Was` ``` Installed in the System ``` Then `\\127.0.0.1\ADMIN$\[SERVICE_RANDOM_NAME].exe is executed and it` invokes a `rundll32.exe instance with no arguments which is very suspicious.` ----- Interacting with the beacon via `SHELL` command invokes a `CMD` instance Exeecuting Net command via jump psexec installed beacon The following table is a summary of the observed telemetry relevant to this lateral movement technique. EID Action ----- Provider Comment 5145 Network Share Access Microsoft-Windows-Security-Auditing Relative Target Name : `svcctl` Share Name : `\*\IPC$` 7045 Service Creation System Service File Name: `\\127.0.0.1\ADMIN$\[SERVICE_RANDOM_NAME].exe` 4697 Service Creation Microsoft-Windows-Security-Auditing Service File Name: `\\127.0.0.1\ADMIN$\[SERVICE_RANDOM_NAME].exe` 1 Process Creation Microsoft-Windows-Sysmon Command Line : `\\127.0.0.1\ADMIN$\[SERVICE_RANDOM_NAME].exe` Parent Command Line : `C:\Windows\System32\services.exe` 1 Process Creation Microsoft-Windows-Sysmon Command Line : `C:\Windows\System32\rundll32.exe` Arguments count : 0 ----- Parent Image : `\\127.0.0.1\ADMIN$\[SERVICE_RANDOM_NAME].exe` 13 Registry Value Set Microsoft-Windows-Sysmon Image Path : `\\127.0.0.1\ADMIN$\[SERVICE_RANDOM_NAME].ex e` CobaltStrike jump psexec_psh CobaltStrike can laverage a PowerShell version of PsExec using the built-in module psexec_psh with everything being executed in memory via a one-liner. As previously noticed an interaction with SCM RPC server in order to create a service remotely was observed. Bellow are the ZEEK DCE-RPC event logs with the same operation as `psexec & psexec64` `CreateServiceWOW64A` Followed by creation of a new service which generated EID 7045/4697 with `%COMSPEC% and` `powershell` in the `Service File Name field.` ----- PowerShell s EID 400 can be used as a detection opportunity where `HostApplication` contains `powershell -nop -w hidden -encodedcommand .` Pipe creation with regex pattern `status_[0-9a-f]{2} was also observed. I provided` bellow a gist with several regex pattern to detect hard coded named pipes in CobaltStrike modules. Bellow is a EID 5145 that can be used for this purpose but I encourage you to sysmon instead for it high event traceability quality. ----- Cobalt Strike Named Pipe Regex.csv Interacting with the beacon via the CS `shell` command would invoke a `cmd.exe` instance. Executing commands via psexec_psh module ----- This pattern alone is very suspicious and can be a good detection opportunity for default usage of `psexec_psh command.` The following are the event logs I observed during the demos: EID Action Provider Comment 5145 Network Share Access Microsoft-Windows-Security-Auditing Relative Target Name : `status_[0-9a-f]{2}` Share Name : `\*\IPC$` 7045 Service Creation System Service File Name contains : `%COMSPEC% or` `powershell` 4697 Service Creation Microsoft-Windows-Security-Auditing Service File Name contains : `%COMSPEC% or` `powershell` ----- 17 Pipe Created Microsoft-Windows-Sysmon Command Line : `\\127.0.0.1\ADMIN$\[SERVICE_RANDOM_NAME].exe` Parent Command Line : `C:\Windows\System32\services.exe` 18 Pipe Connected Microsoft-Windows-Sysmon Image Path : `\\127.0.0.1\ADMIN$\[SERVICE_RANDOM_NAME].ex e` 1 Process Creation Microsoft-Windows-Sysmon Command Line Arguments : `powershell, -nop, hidden, -encodedcommand` Process Name : `powershell.exe` Parent Process Name : `cmd.exe` Sigma Rules Detection Validation Atomic Red Team provides a good start to validate your detection against some of these attack techniques: atomic-red-team/T1569.002.md at master · redcanaryco/atomic-red-team GitHub DFIR ----- You can use the following CyberChef recipe to decode and extract shellcode information executed by psexec_psh command. CyberChef/Cobalt Strike recipe for JABz.txt at main · SophosRapidResponse/CyberChef GitHub You can list created pipes using Get-ChilIt `em` PowerShell cmdlets 1 Get-ChildItem \\\\.\\pipe\\ Copied! Systinternal has a dedicated tool that also can be leveraged for the same purpose. Pipelist - Windows Sysinternals docsmsft Closing thoughts This blog post series of Detecting CONTI CobaltStrike Lateral Movement Techniques is focused on default usage of CS built-in capabilities meaning that sophisticated attacker will be able to change these settings and evade detections based on them thanks to CobalStrike modularity. My hope is to increase awareness at least about the telemetry that needs to be audited and qualified, how to correlate it and how to respond to relevant attacks in order to increase the time, effort and skills an APT has to invest in order to compromise your assets. [You can read my previous post on Detection Engineering Dimensions Analytics part where I](https://www.unh4ck.com/detection-engineering-dimensions/analytics) discuss analytic resilience. -----