Evading process creation telemetry with doppelganging techniques

// Understanding the Threat Landscape

Process creation telemetry is a critical component of modern endpoint detection and response (EDR) solutions. It captures the creation of processes on endpoints, a crucial indicator of potentially malicious activity. When adversaries seek to evade detection, they employ various techniques, notably doppelganging, herpaderping, and ghosting. Each method has distinct operational profiles, benefits, and associated risks.

// Doppelganging Explained

Doppelganging involves creating a malicious process that mimics a legitimate one. This method can confuse telemetry systems that rely heavily on process names for detection. The essential idea is to leverage common binaries that are already trusted by the system, making the malicious activity less likely to raise alarms.

Step-by-Step Implementation of Doppelganging

1. Identify a legitimate process to mimic. Common candidates include svchost.exe and explorer.exe.

2. Create a copy of the legitimate executable. Use the following command to duplicate an executable:

   copy C:\Windows\System32\svchost.exe C:\Temp\svchost_copy.exe

3. Modify the copy to execute your payload. You can use a tool like Resource Hacker or PE Explorer to modify the binary, or simply create a new executable that has the same name and arguments:

   C:\Temp\svchost_copy.exe -your-payload-argument

4. Launch the copy using CreateProcess, which allows for more control over how the process appears to the system:

   START C:\Temp\svchost_copy.exe

Considerations and Risks

• Visibility: Ensure your malicious process runs in the background to avoid user interaction or visibility in process monitors like Task Manager.
• Cleanup: Implement a cleanup routine to remove your copies to reduce forensic footprint.

// Herpaderping Defined

Herpaderping is about creating processes that exist only in memory, avoiding traditional logging mechanisms that capture disk activity. This is particularly effective against systems that do not monitor internal memory states closely.

Executing Herpaderping

1. Leverage PowerShell or similar scripting tools to initiate processes:

   powershell -Command "Start-Process 'cmd.exe' -ArgumentList '/C yourmaliciouscommand' -WindowStyle Hidden"

2. Use reflective DLL injection to spawn a shell or other payload directly in memory:

   rundll32.exe yourmalicious.dll,YourFunction

Operational Anecdote

In a controlled engagement, using herpaderping allowed an operator to execute code without triggering any file creation logs, bypassing a SIEM's file monitoring capabilities entirely.

// Ghosting Operations

Ghosting refers to the art of making an existing process misbehave to hide malicious activities. By manipulating an existing process, the attacker can blend their actions within the normal operational noise of a system. This can confuse detection mechanisms and lead to false negatives.

Steps for Ghosting

1. Select a benign process that has a long runtime and is unlikely to be terminated. Standard choices include explorer.exe or powershell.exe.

2. Modify the environment of the process using tools like hollowing or token manipulation to inject your payload into the memory space of the existing process:

   C:\PathToTool\ProcessHollowing.exe -p explorer.exe -d yourmaliciouspayload.dll

3. Monitor the effectiveness of your ghosting attempt. Check the running processes and their resource utilization to ensure that your payload operates without triggering alarms:

   Get-Process | Where-Object { $_.Name -eq 'explorer' }

Defensive Implications and Detection

• Behavioral Analysis: Incorporate behavioral-based detection mechanisms that can recognize unusual patterns in existing process executions.
• Telemetry Improvements: Upgrade logging to capture more than just process creation; logging command line arguments, parent process IDs, and user context can offer better visibility.

// Checklist for Effective Evasion Techniques

• Identify target processes for doppelganging, herpaderping, and ghosting.
• Plan for cleanup of artifacts and logs post-engagement.
• Ensure the technique aligns with current operational security controls of your environment.
• Deploy robust monitoring for behavior anomalies instead of relying solely on static telemetry.

// Conclusion

Doppelganging, herpaderping, and ghosting are advanced techniques that require careful execution and understanding of the underlying system behavior. They illustrate how attackers can operate under the radar, necessitating continuous adaptation and enhancement of detection methodologies in security practices. As always, conduct these exercises in a controlled environment that you own or have explicit permission to assess.

--- // FIELDOPS REPORT AUTHORIZED BY: Rachel H. //