Edit

Module 12: Antivirus Alerts and Evasion

Antivirus Basics

Antivirus Overview

Not much of note to add here.

Signature-Based Detection

An antivirus signature is a continuous sequence of bytes within malware that uniquely identify it. Signature-based anitivirus detection is mostly considered a denylist technology. This can still be quite effective however an attacker aware of the signature could adjust very minor parts of their malware to evade this detection.

Signature detection of signature_detect_nonstage.exe from manual file scan

C:\Program Files\Windows Defender>MpCmdRun -Scan -ScanType 3 -File C:\tools\av_alerts_evasion\signature_detect_nonstage.exe -DisableRemediation 
Scan starting...
Scan finished.
Scanning C:\tools\av_alerts_evasion\signature_detect_nonstage.exe found 1 threats.

<===========================LIST OF DETECTED THREATS==========================>
----------------------------- Threat information ------------------------------
Threat                  : Trojan:Win64/Meterpreter.A
Resources               : 1 total
    file                : C:\tools\av_alerts_evasion\signature_detect_nonstage.exe
-------------------------------------------------------------------------------

There isn't much useful information provided here, however we can take a look at the Windows Defender provider for Windows Event Log. Microsoft-Windows-Windows Defender/Operational

Initiating a manual scan of signature_detect_nonstage.exe using Start-MpScan

After importing the custom Get-WDLog.psm1...

Windows Defender detection of potentially-malicious threat

Full message listing of malicious event

Because Meterpreter provides remote access to the endpoint for active compromise, Windows Defender has rated it as "Severe". The Category field is a free-form guess as to the type of malware. In this case, a remote-access Trojan. With "Concrete" as the Detection Type, we can confirm that this is a signature-based detection. Both the User and the Detection Origin fields indicate where the detection was initiated. Because we initiated the Start-MpScan cmdlet from a remote connection, the source is System and the user is LOCAL SERVICE. Had we initiated it from the Windows 10 VM, the Detection Origin would be "User" and the User field would contain the domain/user information.

Defender keeps a list of threats detected and can be queried with Get-MpThreat.

Output from Get-MpThreat containing signature_detect_nonstage.exe

The queue of threats can be cleared with Remove-MpThreat.

Using Remove-MpThreat to clear the queue

Windows Defender removal of potentially-malicious threat

Full content of Windows Defender mitigation event

Definitions of malware and various categories are updated and stored in %PROGRAMDATA%\Microsoft\Windows Defender\Definition Updates\Default.

Real-time Heuristic and Behavioral-Based Detection

Real-time protection also uses heuristic-based detection and behavior-based detection to identify malicious activities taking place on an endpoint.

Heuristic-based detections rely on rules and algorithms to determine if an action is malicious. This is typically done by stepping through the instruction set of a binary file, or by attempting to decompile and analyze the source code.

Behavior-based detections dynamically analyze the behavior by executing the file in an emulated environment (sandbox) and determining if the actions taken are considered malicious.

Real-time Protection group policy options

When activating real-time protection, Windows Defender will generate a configuration change with Event ID 5007. The HKLM\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection key in the Windows Registry will change from 0x0 to 0x1.

Windows Defender Real-time protection detection of potentially-malicious threat

Full message listing of malicious detection event for signature_detect_staged.exe

FileCreate event for signature_detect_staged.exe

Using Remove-MpThreat to mitigate threats discovered by Windows Defender

Full contents of Windows Defender mitigation event for signature_detect_staged.exe

Because Remove-MpThreat was run from PowerShell Core, the User is logged as NT AUTHORITY\LOCAL SERVICE.

Setting up listener for the undetected payload execution

Executing generic_winhttps_connect

Meterpreter connection and commands

Malicious detections based on suspicious behavior

Full listing of above detections

Antimalware Scan Interface (AMSI)

Understanding AMSI

AMSI implementation overview

AMSI blocking a malicious string

Note that using a large number of AMSI trigger strings while testing may cause Windows Defender to "panic" and suddenly consider everything malicious. At this point, the only remedies are to reboot the system or revert the VM groups.

Full event of malicious detection by AMSI

Bypassing AMSI

There are ways to bypass AMSI, a couple are:

  1. Directly overwriting the AmsiScanBuffer function.

Full Script Block event with an AMSI bypass script

  1. Without going into detail, security researchers have found that the AmsiInitializefunction creates an undocumented context structure, which is used repeatedly by other functions in AMSI. Theoretically, if this unknown region of memory were corrupted or otherwise neutralized, AMSI would stop working altogether.

PreviousModule 11: Network DetectionsNextModule 13: Active Directory Enumeration

Last updated