This post is just about running a tool created by hasherezade to perform process doppleganging.
All credit goes to the researchers Tal Liberman and Eugene Kogan from enSilo and also hasherezade
I just wanted to simulate the same process doppleganging and detect with pe-sieve, it is recommended to walk through author's blackhat presentation Lost in transaction - Process Doppelgänging and tool creator's write up Process Doppelgänging – a new way to impersonate a process
Process doppelganing is a code injection technique ( can be a substitute to traditional process hollowing code injection technique) that leverages NTFS transacations related Windows API calls which are less used with malicious intent and hence "less known" to AV vendors, hence this code injection technique is more likely to go undetected.
The Doppelgänging objective is to load and execute aribitrary code in the context of a legitimate process, none of the process hollowing API calls like NtUnmapViewOfSection, VirtualProtectEx and SetThreatContext can be identified
Download and compile code from hasherezade git repo
Detecting Process Doppleganging using PE-sieve
All credit goes to the researchers Tal Liberman and Eugene Kogan from enSilo and also hasherezade
I just wanted to simulate the same process doppleganging and detect with pe-sieve, it is recommended to walk through author's blackhat presentation Lost in transaction - Process Doppelgänging and tool creator's write up Process Doppelgänging – a new way to impersonate a process
Process doppelganing is a code injection technique ( can be a substitute to traditional process hollowing code injection technique) that leverages NTFS transacations related Windows API calls which are less used with malicious intent and hence "less known" to AV vendors, hence this code injection technique is more likely to go undetected.
The Doppelgänging objective is to load and execute aribitrary code in the context of a legitimate process, none of the process hollowing API calls like NtUnmapViewOfSection, VirtualProtectEx and SetThreatContext can be identified
Download and compile code from hasherezade git repo
Process Doppleganging - running mimikatz
Detecting Process Doppleganging using PE-sieve
Easy guide, thank you! Videos are also very useful.
ReplyDeleteWonderful article, Which you have shared, your article is very important and I was really interested to read it. If anyone looking for Google Search Api then visit SERP House, It’s the best choice.
ReplyDelete