Monday, May 29, 2023

AzureHunter - A Cloud Forensics Powershell Module To Run Threat Hunting Playbooks On Data From Azure And O365


A Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes.


Getting Started

1. Check that you have the right O365 Permissions

The following roles are required in Exchange Online, in order to be able to have read only access to the UnifiedAuditLog: View-Only Audit Logs or Audit Logs.

These roles are assigned by default to the Compliance Management role group in Exchange Admin Center.

NOTE: if you are a security analyst, incident responder or threat hunter and your organization is NOT giving you read-only access to these audit logs, you need to seriously question what their detection and response strategy is!

More information:

NOTE: your admin can verify these requirements by running Get-ManagementRoleEntry "*\Search-UnifiedAuditLog" in your Azure tenancy cloud shell or local powershell instance connected to Azure.


2. Ensure ExchangeOnlineManagement v2 PowerShell Module is installed

Please make sure you have ExchangeOnlineManagement (EXOv2) installed. You can find instructions on the web or go directly to my little KB on how to do it at the soc analyst scrolls


3. Either Clone the Repo or Install AzureHunter from the PSGallery

3.1 Cloning the Repo
  1. Clone this repository
  2. Import the module Import-Module .\source\AzureHunter.psd1

3.2 Install AzureHunter from the PSGallery

All you need to do is:

Install-Module AzureHunter -Scope CurrentUser
Import-Module AzureHunter

What is the UnifiedAuditLog?

The unified audit log contains user, group, application, domain, and directory activities performed in the Microsoft 365 admin center or in the Azure management portal. For a complete list of Azure AD events, see the list of RecordTypes.

The UnifiedAuditLog is a great source of cloud forensic information since it contains a wealth of data on multiple types of cloud operations like ExchangeItems, SharePoint, Azure AD, OneDrive, Data Governance, Data Loss Prevention, Windows Defender Alerts and Quarantine events, Threat intelligence events in Microsoft Defender for Office 365 and the list goes on and on!


AzureHunter Data Consistency Checks

AzureHunter implements some useful logic to ensure that the highest log density is mined and exported from Azure & O365 Audit Logs. In order to do this, we run two different operations for each cycle (batch):

  1. Automatic Window Time Reduction: this check ensures that the time interval is reduced to the optimal interval based on the ResultSizeUpperThreshold parameter which by default is 20k. This means, if the amounts of logs returned within your designated TimeInterval is higher than ResultSizeUpperThreshold, then an automatic adjustment will take place.
  2. Sequential Data Check: are returned Record Indexes sequentially valid?



Usage

Ensure you connect to ExchangeOnline

It's recommended that you run Connect-ExchangeOnline before running any AzureHunter commands. The program checks for an active remote session and attempts to connect but some versions of Powershell don't allow this and you need to do it yourself regardless.


Run AzureHunter

AzureHunter has two main commands: Search-AzureCloudUnifiedLog and Invoke-HuntAzureAuditLogs.

The purpose of Search-AzureCloudUnifiedLog is to implement a complex logic to ensure that the highest percentage of UnifiedAuditLog records are mined from Azure. By default, it will export extracted and deduplicated records to a CSV file.

The purpose of Invoke-HuntAzureAuditLogs is to provide a flexible interface into hunting playbooks stored in the playbooks folder. These playbooks are designed so that anyone can contribute with their own analytics and ideas. So far, only two very simple playbooks have been developed: AzHunter.Playbook.Exporter and AzHunter.Playbook.LogonAnalyser. The Exporter takes care of exporting records after applying de-duplication and sorting operations to the data. The LogonAnalyser is in beta mode and extracts events where the Operations property is UserLoggedIn. It is an example of what can be done with the playbooks and how easy it is to construct one.

When running Search-AzureCloudUnifiedLog, you can pass in a list of playbooks to run per log batch. Search-AzureCloudUnifiedLog will pass on the batch to the playbooks via Invoke-HuntAzureAuditLogs.

Finally Invoke-HuntAzureAuditLogs can, be used standalone. If you have an export of UnifiedAuditLog records, you can load them into a Powershell Array and pass them on to this command and specify the relevant playbooks.


Example 1 | Run search on Azure UnifiedAuditLog and extract records to CSV file (default behaviour)
Search-AzureCloudUnifiedLog -StartDate "2020-03-06T10:00:00" -EndDate "2020-06-09T12:40:00" -TimeInterval 12 -AggregatedResultsFlushSize 5000 -Verbose

This command will:

  • Search data between the dates in StartDate and EndDate
  • Implement a window of 12 hours between these dates, which will be used to sweep the entire length of the time interval (StartDate --> EndDate). This window will be automatically reduced and adjusted to provide the maximum amount of records within the window, thus ensuring higher quality of output. The time window slides sequentially until reaching the EndDate.
  • The AggregatedResultsFlushSize parameter speficies the batches of records that will be processed by downstream playbooks. We are telling AzureHunter here to process the batch of records once the total amount reaches 5000. This way, you can get results on the fly, without having to wait for hours until a huge span of records is exported to CSV files.

Example 2 | Run Hunting Playbooks on CSV File

We assume that you have exported UnifiedAuditLog records to a CSV file, if so you can then do:

$RecordArray = Import-Csv .\my-exported-records.csv
Invoke-HuntAzureAuditLogs -Records $RecordArray -Playbooks 'AzHunter.Playbook.LogonAnalyser'

You can run more than one playbook by separating them via commas, they will run sequentially:

$RecordArray = Import-Csv .\my-exported-records.csv
Invoke-HuntAzureAuditLogs -Records $RecordArray -Playbooks 'AzHunter.Playbook.Exporter', 'AzHunter.Playbook.LogonAnalyser'

Why?

Since the aftermath of the SolarWinds Supply Chain Compromise many tools have emerged out of deep forges of cyberforensicators, carefully developed by cyber blacksmith ninjas. These tools usually help you perform cloud forensics in Azure. My intention with AzureHunter is not to bring more noise to this crowded space, however, I found myself in the need to address some gaps that I have observed in some of the tools in the space (I might be wrong though, since there is a proliferation of tools out there and I don't know them all...):

  1. Azure cloud forensic tools don't usually address the complications of the Powershell API for the UnifiedAuditLog. This API is very unstable and inconsistent when exporting large quantities of data. I wanted to develop an interface that is fault tolerant (enough) to address some of these issues focusing solely on the UnifiedAuditLog since this is the Azure artefact that contains the most relevant and detailed activity logs for users, applications and services.
  2. Azure cloud forensic tools don't usually put focus on developing extensible Playbooks. I wanted to come up with a simple framework that would help the community create and share new playbooks to extract different types of meaning off the same data.

If, however, you are looking for a more feature rich and mature application for Azure Cloud Forensics I would suggest you check out the excellent work performed by the cyber security experts that created the following applications:

I'm sure there is a more extensive list of tools, but these are the ones I could come up with. Feel free to suggest some more.


Why Powershell?
  1. I didn't want to re-invent the wheel
  2. Yes the Powershell interface to Azure's UnifiedAuditLog is unstable, but in terms of time-to-production it would have taken me an insane amount of hours to achieve the same thing writing a whole new interface in languages such as .NET, Golang or Python to achieve the same objectives. In the meanwhile, the world of Cyber Defense and Response does not wait!

TODO
  • Specify standard playbook metadata attributes that need to be present so that AzureHunter can leverage them.
  • Allow for playbooks to specify dependencies on other playbooks so that one needs to be run before the other. Playbook chaining could produce interesting results and avoid code duplication.
  • Develop Pester tests and Coveralls results.
  • Develop documentation in ReadTheDocs.
  • Allow for the specification of playbooks in SIGMA rule standard (this might require some PR to the SIGMA repo)

More Information

For more information


Credits

Read more


Posted by at No comments:

Linux Command Line Hackery Series - Part 4




Welcome back to Linux Command Line Hackery, hope you have enjoyed this series so far. Today we are going to learn new Linux commands and get comfortable with reading text files on Linux.

Suppose that you wanted to view your /etc/passwd file. How will you do that? From what we have learned so far what you'll do is type:

cat /etc/passwd

And there you go, but really did you see all the output in one terminal? No, you just ended up with last few lines and you'll have to cheat (i,e use graphical scroll bar) in order to see all the contents of /etc/passwd file. So is there a command line tool in linux with which we can see all the contents of a file easily without cheating? Yes, there are actually a few of them and in this article we'll look at some common ones.

Command: more
Syntax:  more [options] file...
Function: more is a filter for paging through text one screenful at a time. With more we can parse a file one terminal at a time or line by line. We can also go backward and forward a number of lines using more.

So if we're to use more on /etc/passwd file how will we do that? We'll simply type

more /etc/passwd

now we'll get a screenful output of the file and have a prompt at the bottom of terminal. In order to move forward one line at a time press <Enter Key>. Using enter we can scroll through the file one line at a time. If you want to move one screen at a time, you can press <Space Key> to move one screen at a time. There are more functions of more program, you can know about them by pressing <h key>. To exit out of more program simply type <q key> and you'll get out of more program.

Command: less
Syntax: less [options] file...
Function: less is similar to more but less has more functionality than more. less is particularly useful when reading large files as less does not have to read the entire input file before starting, so it starts up quickly than many other editors.

less command is based on more so what you've done above with more can be done with less as well. Try it out yourself.

Command: head
Syntax: head [OPTION]... [FILE]...
Function: head command prints the head or first part of a file. By default head prints out first 10 lines of a file. If more than one file is specified, head prints first 10 lines of all files as a default behavior.

If we want to see only first 10 lines of /etc/passwd we can type:

head /etc/passwd

We can also specify to head how many lines we want to view by using the -n flag. Suppose you want to see first 15 lines of /etc/passwd file you've to type:

head -n 15 /etc/passwd

Ok you can view the first lines of a file what about last lines, is there a tool for that also? Exactly that's what our next command will be about.

Command: tail
Syntax: tail [OPTION]... [FILE]...
Function: tail is opposite of head. It prints the last 10 lines of a file by default. And if more than one file is specified, tail prints last 10 lines of all files by default.

To view last 10 lines of /etc/passwd file you'll type:

tail /etc/passwd

and as is the case with head -n flag can be used to specify the number of lines

tail -n 15 /etc/passwd

Now one more thing that we're going to learn today is grep.

Command: grep
Syntax: grep [OPTIONS] PATTERN [FILE...]
Function: grep is used to search a file for lines matching the pattern specified in the command.

A PATTERN can simply be a word like "hello" or it can be a regular expression (in geek speak regex). If you aren't familiar with regex, it's ok we'll not dive into that it's a very big topic but if you want to learn about it I'll add a link at the end of this article that will help you get started with regex.

Now back to grep say we want to find a line in /etc/passwd file which contains my user if we'll simply type:

grep myusername /etc/passwd

Wohoo! It gives out just that data that we're looking for. Remember here myusername is your username.
One cool flag of grep is -v which is used to look in file for every line except the line containing the PATTERN specified after -v [it's lowercase v].

Take your time practicing with these commands especially grep and more. We'll learn a lot more about grep in other upcoming articles.

References:
https://en.wikipedia.org/wiki/Regular_expression
http://www.regular-expressions.info/
Awesome website to learn Regular expressions - http://www.regexr.com/

More articles


  1. Hacker Tools For Mac
  2. Pentest Tools Free
  3. Hack Tools Online
  4. Hack Tool Apk
  5. Hacks And Tools
  6. Top Pentest Tools
  7. Hacking Tools For Pc
  8. Pentest Tools Android
  9. Bluetooth Hacking Tools Kali
  10. Hack Tools Mac
  11. Pentest Tools Github
  12. Hack Tools For Games
  13. Hacker Tools List
  14. Black Hat Hacker Tools
  15. Hacking Tools For Windows
  16. Pentest Tools Nmap
  17. Hack Tools For Mac
  18. Usb Pentest Tools
  19. Hacking Tools For Windows
  20. How To Hack
  21. Hacker Tools Linux
  22. Hak5 Tools
  23. Beginner Hacker Tools
  24. Hacking App
  25. Pentest Tools Download
  26. Hacker Tools Mac
  27. Pentest Tools Free
  28. Pentest Tools Open Source
  29. Hack Tools Mac
  30. Best Pentesting Tools 2018
  31. Hacker Tools List
  32. Pentest Tools Subdomain
  33. Hack Tool Apk
  34. Hack Tools
  35. Kik Hack Tools
  36. Pentest Tools Apk
  37. Hacking Tools Windows
  38. Hacker Tools Free Download
  39. Hack Tools For Mac
  40. Nsa Hacker Tools
  41. Wifi Hacker Tools For Windows
  42. New Hack Tools
  43. Pentest Recon Tools
  44. Android Hack Tools Github
  45. Pentest Tools Windows
  46. Install Pentest Tools Ubuntu
  47. Hacker Tools Apk Download
  48. Pentest Tools Online
  49. Game Hacking
  50. Hacker Tools Hardware
  51. Hack Tools Online
  52. World No 1 Hacker Software
  53. Hacker Tools Apk
  54. Hacking Tools Name
  55. Hacking Tools For Windows 7
  56. Nsa Hack Tools
  57. Hacking Tools Software
  58. Pentest Tools Linux
  59. Kik Hack Tools
  60. Hacking Tools Mac
  61. Hack Tools
  62. Pentest Tools Subdomain
  63. Hacking Tools Usb
  64. Hackers Toolbox
  65. Hacking Tools 2019
  66. Hacker Tools 2020
  67. Pentest Automation Tools
  68. Hacking Tools 2020
  69. Hacking Tools And Software
  70. Pentest Tools For Android
  71. Wifi Hacker Tools For Windows
  72. Hacking Tools Download
  73. Hacking Tools For Windows Free Download
  74. Nsa Hacker Tools
  75. Hacker Tools For Windows
  76. Pentest Tools Bluekeep
  77. Hacker Tools 2019
  78. Pentest Tools Framework
  79. Hackers Toolbox
  80. Pentest Tools Free
  81. Hacking Tools Windows
  82. Pentest Reporting Tools
  83. Pentest Tools Review
  84. Hacker Tools For Pc
  85. Hack Tool Apk
  86. Hacking Tools Name
  87. Hacking Tools Windows
  88. Hacking Tools Kit
  89. Hak5 Tools
  90. Hacking Tools Online
  91. Hack Tools
  92. Hack Tools For Pc
  93. Hacking Tools Name
  94. Hacker Tools Mac
  95. Hacking Tools
  96. Hacking App
  97. Hacking App
  98. Hack Tools 2019
  99. Pentest Tools For Ubuntu
  100. Growth Hacker Tools
  101. Growth Hacker Tools
  102. Hacker Search Tools
  103. Hack Tool Apk No Root
  104. Hacking Tools For Mac
  105. Hack Tools 2019
  106. Pentest Tools Find Subdomains
  107. Pentest Tools
  108. Pentest Tools Apk
  109. Pentest Tools Url Fuzzer
  110. Pentest Tools For Ubuntu
  111. Pentest Tools Linux
  112. Pentest Box Tools Download
  113. Ethical Hacker Tools
  114. Pentest Tools Alternative
  115. Hak5 Tools
  116. Hacking Tools Name
  117. Growth Hacker Tools
  118. Pentest Tools Nmap
  119. Hacker Tools Free Download
Posted by at No comments:

Sunday, May 28, 2023

Reversing Some C++ Io Operations

In general decompilers are not friendly with c++ let's analyse a simple program to get familiar with it.
Let's implement a simple code that loads a file into a vector and then save the vector with following functions:

  • err
  • load
  • save
  • main


Lets identify the typical way in C++ to print to stdout with the operator "<<"


The basic_ostream is initialized writing the word "error" to the cout, and then the operator<< again to add the endl.




The Main function simply calls  "vec = load(filename)"  but the compiler modified it and passed the vector pointer as a parámeter. Then it bulds and prints "loaded  " << size << " users".
And finally saves the vector to /tmp/pwd and print "saved".
Most of the mess is basically the operator "<<" to concat and print values.
Also note that the vectors and strings are automatically deallocated when exit the function.


And here is the code:


Let's take a look to the load function, which iterates the ifs.getline() and push to the vector.
First of all there is a mess on the function definition, __return_storage_ptr is the vector.
the ifstream object ifs is initialized as a basic_ifstream and then operator! checks if it wasn't possible to open the file and in that case calls err()
We see the memset and a loop, getline read a cstr like line from the file, and then is converted to a string before pushing it to the vector. lVar1 is the stack canary value.

In this situations dont obfuscate with the vector pointer vec initialization at the begining, in this case the logic is quite clear.



The function save is a bit more tricky, but it's no more than a vector iteration and ofs writing.
Looping a simple "for (auto s : *vec)" in the decompiler is quite dense, but we can see clearly two write, the second write DAT_0010400b is a "\n"



As we see, save implememtation is quite straightforward.




Related news


  1. Hacker Tools For Ios
  2. World No 1 Hacker Software
  3. Hacker Tools For Mac
  4. Hack Tool Apk
  5. Pentest Tools Bluekeep
  6. Pentest Tools Find Subdomains
  7. Pentest Tools Tcp Port Scanner
  8. Hacker Tools For Mac
  9. Hacker Tools Software
  10. Hack Tools For Games
  11. Hacker Tools 2019
  12. Hacking Tools Github
  13. Pentest Recon Tools
  14. Pentest Tools Kali Linux
  15. Hacking Tools Kit
  16. Github Hacking Tools
  17. Hacker Security Tools
  18. Pentest Tools Github
  19. Hacking Tools Github
  20. Hack App
  21. Hack Tools
  22. Pentest Tools Url Fuzzer
  23. Hack Rom Tools
  24. Hacker Tools Free
  25. World No 1 Hacker Software
  26. Hacking Tools Usb
  27. Nsa Hack Tools
  28. Pentest Tools For Android
  29. Hacker Tools For Windows
  30. Pentest Tools Subdomain
  31. Pentest Tools Linux
  32. Hacking Tools
  33. Hacker Tool Kit
  34. New Hacker Tools
  35. Hack Tool Apk No Root
  36. Pentest Tools List
  37. Hacker Tools Apk
  38. Hack Tools
  39. How To Hack
  40. Hacking Tools Usb
  41. Hacking Tools Hardware
  42. Physical Pentest Tools
  43. Easy Hack Tools
  44. Hack Tool Apk
  45. Hacker Tools For Mac
  46. Pentest Tools Nmap
  47. Hackers Toolbox
  48. How To Make Hacking Tools
  49. Hacker Tools Apk
  50. Hacker Tools Windows
  51. Pentest Tools Free
  52. Pentest Tools Website
  53. Hacking Tools Free Download
  54. Computer Hacker
  55. Hacking Tools
  56. Pentest Tools For Ubuntu
  57. Hacker Tools Software
  58. What Is Hacking Tools
  59. Pentest Tools For Android
  60. Hack Tool Apk No Root
  61. Nsa Hack Tools
  62. Nsa Hacker Tools
  63. Hacker Tools Online
  64. Hack Tools 2019
  65. Hacking Tools Pc
  66. Pentest Tools List
  67. Pentest Tools Find Subdomains
  68. Hack Tools Download
  69. Hacker Tools Hardware
  70. Hacker Tools Mac
  71. Hacker Tool Kit
  72. Hacking Tools Online
  73. Black Hat Hacker Tools
  74. Tools For Hacker
  75. Pentest Tools For Ubuntu
  76. Hacks And Tools
  77. Hack Tool Apk No Root
  78. Hacking Tools 2020
  79. Hacking Tools Usb
  80. Hacker Tools
  81. New Hack Tools
  82. Hack Tools Pc
  83. Easy Hack Tools
  84. Pentest Tools Bluekeep
  85. Pentest Reporting Tools
  86. Physical Pentest Tools
  87. Hack And Tools
  88. Pentest Reporting Tools
  89. Hack Tools For Games
  90. Pentest Tools Review
  91. Hackrf Tools
  92. Hacker Tools 2019
  93. Pentest Reporting Tools
  94. Pentest Tools Port Scanner
  95. Hacker Tools 2019
  96. Pentest Tools List
  97. Hack Tool Apk
  98. Hacking Tools For Windows
  99. Pentest Tools Kali Linux
  100. Blackhat Hacker Tools
  101. Beginner Hacker Tools
  102. Usb Pentest Tools
  103. Hack Tools For Windows
  104. Hacking Tools Name
  105. Physical Pentest Tools
  106. Tools For Hacker
  107. Hacker Tools Windows
Posted by at No comments:

Files Download Information




After 7 years of Contagio existence, Google Safe Browsing services notified Mediafire (hoster of Contagio and Contagiominidump files) that "harmful" content is hosted on my Mediafire account.

It is harmful only if you harm your own pc and but not suitable for distribution or infecting unsuspecting users but I have not been able to resolve this with Google and Mediafire.

Mediafire suspended public access to Contagio account.

The file hosting will be moved.

If you need any files now, email me the posted Mediafire links (address in profile) and I will pull out the files and share via other methods.

P.S. I have not been able to resolve "yet" because it just happened today, not because they refuse to help.  I don't want to affect Mediafire safety reputation and most likely will have to move out this time.

The main challenge is not to find hosting, it is not difficult and I can pay for it, but the effort move all files and fix the existing links on the Blogpost, and there are many. I planned to move out long time ago but did not have time for it. If anyone can suggest how to change all Blogspot links in bulk, I will be happy.
P.P.S. Feb. 24 - The files will be moved to a Dropbox Business account and shared from there (Dropbox team confirmed they can host it )  

The transition will take some time, so email me links to what you need. 

 Thank you all
M

More info


Posted by at No comments:
Subscribe to: Posts (Atom)