Detection & Response with LimaCharlie (EDR)

In this lab, we explored LimaCharlie's detection and response (D&R) capabilities. We installed a LimaCharlie sensor on a Windows 11 virtual machine (target) and initiated remote attacks from an Ubuntu Server virtual machine (attack) with Sliver installed, a Command & Control (C2) framework developed by BishopFox. We conducted two distinct attacks on the target machine. Initially, we gained access to LSASS (Local Security Authority Subsystem Service) on the target machine, simulating a credential-stealing attack. Subsequently, we attempted to delete volume shadow copies using the vssadmin (Volume Shadow Copy Service administrative command-line tool), a technique frequently associated with ransomware attacks. We crafted specialized D&R rules in the LimaCharlie platform, designed to analyze the telemetry generated by the EDR solution, detect the two previously executed attacks, and take necessary action. The effectiveness of these rules was verified through repeated execution of the attacks.

Summary

• Configured in VirtualBox:
  • A Windows 11 (target) with Windows Defender disabled and Sysmon and LimaCharlie sensors installed.
  • An Ubuntu Server (attack) with Sliver C2 framework installed.
• Generated a C2 payload in Sliver and executed it on the target machine to start a Sliver C2 session on the attack machine.
• Utilized the Sliver C2 session to perform two attacks on the target machine:
  • LSASS access (credential-stealing attack).
  • Volume shadow copies deletion using vssadmin Windows utility (used in ransomware attacks).
• Implemented D&R rules in the LimaCharlie platform to detect the two previous attacks and respond accordingly. These rules were verified by repeating the attacks for testing purposes.

Tools

• Kali Linux
  • LimaCharlie web platform
  • VirtualBox
    • Windows 11
      • LimaCharlie sensor
      • Sysmon
      • Windows Defender disabled
    • Ubuntu Server
      • Silver C2 framework

Procedure

The procedures to build this lab can be found here. It was adapted from Eric Capuano.

Diagram

VirtualBox NAT Network

The NAT Network configuration and Port Forwarding Rule are essential for enabling SSH access to the Ubuntu Server from the host machine. Within a NAT Network, virtual machines can freely communicate with one another, as well as with the host machine, and access the Internet via the host gateway. However, it's crucial to note that the host can solely interact with the virtual machines through the specified port forwarding settings.

IP Addresses

The image below shows the IP address of the Ubuntu Server on the left and the IP address of the Windows 11 on the right.

Highlights

1 - Windows 11 Setup

1.1 - Virus & Threat Protection Disabled

The Windows Defender was deliberately disabled to enable malicious activities, including downloading and executing the payload for establishing the C2 session with Sliver.

1.2 - Sysmon Events

Sysmon was installed to enhance the telemetry collected by LimaCharlie. Here are the latest 10 Sysmon events retrieved using the Get-WinEvent command in PowerShell.

2 - Payload Generation and C2 Session

2.1 - Payload Generation

The C2 payload, named CURLY_DRAWER.exe, was generated using the Sliver C2 framework on the attack machine. Sliver randomly selected the name. This payload was configured to establish a connection with the attack machine when executed on any other device within the same network, initiating a C2 session on Sliver.

2.2 - LimaCharlied Timeline Payload Events

The Timeline section of LimaCharlie displays events from the target machine, including the payload download (A), execution (B), and connection (C) to the attack machine. This is depicted in the image below, which also provides the specific details of these events.

2.3 - Sliver C2 Session

The Sliver C2 framework on the attack machine indicates the established C2 session with the target machine via an HTTP listener and the payload generated earlier. On the lower half, there are examples of information that can be gathered from the target machine.

2.4 - LimaCharlie Processes Section

In the Processes section of LimaCharlie, you can observe the processes running on the target machine. This includes the execution of the CURLY_DRAWER.exe payload in PowerShell, along with details about the established network connection.

3 - LSASS Access Attack (Credential Stealing)

3.1 - LSASS Access Event

The LimaCharlie Timeline displays the event logged when the command procdump -n lsass.exe -s lsass.dmp was executed in the Sliver C2 session. This command was employed to dump the lsass.exe process from memory. The event details indicated that the origin of this process was the CURLY_DRAWER.exe file, and the target file was lsass.exe.

3.2 - LSASS Access Custom D&R Rule

A specific Detection and Response (D&R) rule, titled "LSASS Accessed", was crafted to identify LSASS access attacks. This rule was developed using data gathered from the earlier LSASS access attack event. It triggers when the lsass.exe file becomes the target of a process, leading to the creation of an entry in the Detections section on LimaCharlie, specifically under the LSASS access category.

3.3 - LSASS Access Detection

The image displayed below illustrates LimaCharlie's Detections section, showing LSASS access events linked to the credential-stealing attack. These specific events were detected by a custom D&R rule crafted in the preceding subsection. This rule belongs to the LSASS access category and is specifically named LSASS Accessed.

4 - Volume Shadow Copies Deletion Attack

4.1 - Volume Shadow Copies Deletion Event

On the LimaCharlie's Timeline, an event was logged when the command vssadmin delete shadows /all was executed in the Sliver C2 session shell. This command deletes volume shadow copies, commonly targeted in ransomware attacks. The event properties indicate that powershell.exe executed the command "C:\Windows\system32\vssadmin.exe" delete shadows /all to remove any existing volume shadow copies.

4.2 - Volume Shadow Copies Deletion Custom D&R Rule

Utilizing telemetry data from a logged event during a volume shadow copies deletion attack, a specific detection and response (D&R) rule, labeled as vss_deletion_kill_it, was created. This rule identifies when the Windows vssadmin utility, located on the monitored machine, executes the command "C:\Windows\system32\vssadmin.exe" delete shadows /all. When this attack pattern is detected, LimaCharlie records an entry in the Detections section, categorized as vss_deletion_kill_it. Additionally, the connection with the remote machine engaged in the attack is promptly terminated.

4.3 - Volume Shadow Copies Deletion Detection

The entry highlighted in LimaCharlie's Detections section below showcases the detection of the Volume Shadow Copies Deletion attack. This attack was identified by a custom D&R rule established earlier. In response, this rule promptly terminated the connection with the attacking machine. Specifically, the custom rule falls under the vss_deletion_kill_it category and is denoted as vss_deletion_kill_it.

5 - Pre-Loaded Rules Triggered by Sliver C2 Activity

5.1 - Sigma Rule at Category Non-Interactive PowerShell Process Spawned

This rule was developed by Roberto Rodriguez @Cyb3rWard0g (rule) and oscd.community (improvements). It detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent or "CURLY_DRAWER.exe" in this case.

This rule, created by Roberto Rodriguez @Cyb3rWard0g (rule) and oscd.community (improvements), detects non-interactive PowerShell activity. It identifies the "powershell" process when initiated by a non-user GUI process, such as 'explorer.exe' or, in this specific case, 'CURLY_DRAWER.exe'.

5.2 - Rule from the Category HackTool - Sliver C2 Implant Activity Pattern

This rule was created jointly by Nasreddine Bencherchali and Florian Roth, both from Nextron Systems. It identifies process activity patterns observed in Sliver C2 framework implants.

5.3 - Rule from the Category Silver Shell

This rule, crafted by Trenton Tait, detects the specific PowerShell command employed when a Sliver agent establishes an interactive shell through its built-in shell command line.

5.4 - Sigma Rule from the Category Shadow Copies Deletion Using Operating System Utilities

This rule was jointly created by Florian Roth from Nextron Systems, Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, Andreas Hunkeler (known as @Karneades), and the oscd.community. It detects volume shadow copy deletion by utilizing operating system utilities.