Adding coverage for T1564.006 (malicious VM on host)#15
Conversation
- Replace inline URLs with reference-style links. - Add mandatory References section. - Wrap lines to 80 characters. - Move long strings (registry keys, paths, commands) to code blocks to comply with line length limits. - Fix a typo in event description. Co-authored-by: keepwatch <5501772+keepwatch@users.noreply.github.com>
…4214 Fix lint errors in TRR0000 README
|
I ran a linter before, it was just using a different rule set. I ran something that should pass this linter and specific configuration - can you rerun the workflow, @vanvleet ? |
Apologies, late to see this. Just approved the workflow run. |
mjwhitta
changed the title
mjwhitta
left a comment
mjwhitta
left a comment
There was a problem hiding this comment.
Sorry for the long delay. The content looks fairly good, I think. I did mostly do a high-level review and look for consistency of formatting. Things like whitespace before and after code-blocks, : being inside/outside of the bold, acronym/initialism definitions, etc... I will likely come back and do a more thorough review later, but figured I should get some feedback started.
| Hyper-V-Worker > Admin, or on-disk: | ||
| ```text |
There was a problem hiding this comment.
| Hyper-V-Worker > Admin, or on-disk: | |
| ```text | |
| Hyper-V-Worker > Admin, or on-disk: | |
| ```text |
| ```text | ||
| C:\Windows\System32\winevt\Logs\Microsoft-Windows-Hyper-V-Worker%4Admin.evtx | ||
| ``` | ||
| (the `%4` replaces the `/`, which is not a valid Windows file path). |
There was a problem hiding this comment.
| (the `%4` replaces the `/`, which is not a valid Windows file path). | |
| (the `%4` replaces the `/`, which is not a valid Windows file path). |
dumpst3rfir3
left a comment
dumpst3rfir3
left a comment
There was a problem hiding this comment.
There's a lot of great work in here, but I think some more background info is needed (at least at a high level). I added some comments.
| (focused on native Windows features). Third-party and portable hypervisors | ||
| (such as VirtualBox or VMware Player) represent additional out-of-scope | ||
| procedures not covered here. |
There was a problem hiding this comment.
This is probably a question for the larger group: should the title of this TRR reflect the narrow scope, given that it's focused specifically on native Windows features? How would it be handled if someone else puts a doc together for VB, VMWare, etc.?
| ## Technical Background | ||
|
|
||
| ### Hyper-V details | ||
|
|
There was a problem hiding this comment.
Should there be a high-level overview of what Hyper-V is? It goes right into how to enable it, but maybe it would be good for the reader to understand what enabling it does for you, etc.?
|
|
||
| #### Enable Hyper-V | ||
|
|
||
| There are two documented ways to enable Hyper-V, but the key is that they both |
There was a problem hiding this comment.
I don't know if this counts as an additional documented way to enable Hyper-V, or if it should just be lumped together with DISM, but I was looking around and saw you can enable it using DismAPI.dll, specifically the DismEnableFeature function (I believe this is what the DISM command uses): https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism/dismenablefeature-function?view=windows-11
There was a problem hiding this comment.
Where does the request move into the kernel? Is there some NT call that DismEnableFeature makes? Seems likely there's some common chokepoint where both the powershell and the DismAPI.dll end up?
| stored in the registry. Therefore, there aren't many good indicators for a new | ||
| VM being added to Hyper-V. |
There was a problem hiding this comment.
I don't know if these are good indicators, but I think there are potentially some useful ones? E.g., files are created on disk, and I think there is some logging by default? E.g., https://techcommunity.microsoft.com/blog/virtualization/looking-at-the-hyper-v-event-log-january-2018-edition/382411
| Event ID 7045 is a log entry that indicates a new service has been installed on | ||
| the system ([src][ref-4]). | ||
|
|
||
| #### Import VM to Hyper-V |
There was a problem hiding this comment.
I think this section needs some information about how an attacker would import a VM into Hyper-V.
| stored in the registry. Therefore, there aren't many good indicators for a new | ||
| VM being added to Hyper-V. | ||
|
|
||
| #### Start VM |
There was a problem hiding this comment.
There is a lot of good info on available telemetry, but similar to the previous section, I think this section is missing information about how attackers would start the VM, etc.
| ``` | ||
| (the `%4` replaces the `/`, which is not a valid Windows file path). | ||
|
|
||
| #### Connect VM to the network |
There was a problem hiding this comment.
Similar to previous sections, I think this needs more information about how attackers would connect the VM to the network, the advantages of doing so, etc.
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMSMP\Parameters\SwitchList\* (single level)\(new key created here) | ||
| ``` | ||
|
|
||
| The Hyper-V Virtual Switch Management Protocol (VMSMP) stores the configuration |
There was a problem hiding this comment.
I don't know if it would be in this section, but it might be good to provide some info on how Hyper-V uses virtual switches. Totally guessing, but I think a lot of people use VMware or VB and may not be familiar with how Hyper-V does networking a little bit differently.
|
|
||
| #### VM Execution Identification | ||
|
|
||
| The execution of the sandbox is distinct from standard Hyper-V VMs. |
There was a problem hiding this comment.
Similar to previous sections, I think more info is needed here. What are the differences? What are the advantages of each? I know this isn't saying much, but I wasn't aware of WindowsSandbox.exe
- Define MSFT acronym on first use as "Microsoft (MSFT)" - Define VMMS acronym on first use as "Virtual Machine Management Service (VMMS)" - Remove orphaned [VM] brackets (not a link) and fix missing space - Convert all ([src][ref-N]) inline citations to cleaner footnote style [^ref-N] - Add blank lines before code blocks (lines 69-70, 98-99, 140-141) - Add footnote definitions at bottom of file https://claude.ai/code/session_017TASv5Tkfw5o2pcaUx3dsE
- Wrap paragraphs to 80 characters to satisfy linter line length checks. - Add missing list format to references section to fix "mandatory references list" lint error. - Remove unused footnote definitions (ref-14 and ref-20) and renumber references sequentially. - Make sure no extra artifacts are checked into the repo. Co-authored-by: keepwatch <5501772+keepwatch@users.noreply.github.com>
…223627432462759 Fix TRR0000 README linting and unused references
|
Thanks for the extensive comments, @mjwhitta and @dumpst3rfir3 ! I addressed all of your feedback, as well as some from @vanvleet , in a significant rewrite. Let me know what you think of this version! |
mjwhitta
left a comment
mjwhitta
left a comment
There was a problem hiding this comment.
Sorry for the delay.
This looks like it's coming along quite well! Still a few things I'd recommend changing.
| documented ways to enable Hyper-V, but the key is that they both require service | ||
| changes, per [Microsoft's documentation][ref-3]: | ||
|
|
||
| - Requires a reboot: |
There was a problem hiding this comment.
| - Requires a reboot: | |
| - Requires a reboot: | |
| ```powershell | ||
| Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All | ||
| ``` | ||
| - Does not require a reboot: |
There was a problem hiding this comment.
| - Does not require a reboot: | |
| - Does not require a reboot: | |
| the switch for each "port" in use (by default one) [^ref-9], and deletes the | ||
| ports when the VM stops | ||
| [^ref-10]. Therefore, a network-enabled VM starting will create a Registry |
There was a problem hiding this comment.
While technically wrapped to 80 characters, why is line 192 so short?
| - [^ref-4]: [Splunk: Event ID 7045][ref-4] | ||
| - [^ref-8]: [Microsoft Learn: Overview of Hyper-V Extensible Switch | ||
| Ports][ref-8] | ||
| - [^ref-9]: [Rlevchenko: Hyper-V 3.0 interaction with registry][ref-9] | ||
| - [^ref-10]: [Kickthatcomputer: Hyper-V failed to update configuration for | ||
| port][ref-10] | ||
| - [^ref-11]: [YouTube: How to set up Default Switch in Hyper-V][ref-11] | ||
| - [^ref-12]: [YouTube: How to Enable Default Switch in Hyper-V Server][ref-12] | ||
| - [^ref-13]: [Hatena Blog: Event ID 232][ref-13] | ||
| - [^ref-14]: [Microsoft Learn: Windows Sandbox configuration][ref-14] | ||
| - [^ref-15]: [HackTheBox: Windows Sandbox Data Exfiltration Attack | ||
| Forensics][ref-15] | ||
| - [^ref-16]: [Microsoft Learn: Windows Sandbox overview][ref-16] | ||
| - [^ref-17]: [Check Point Research: Playing in the Windows Sandbox][ref-17] | ||
| - [^ref-18]: [Microsoft Learn: Windows Sandbox configuration file][ref-18] | ||
| - [^ref-20]: [Sophos: Ragnar Locker Ransomware Deploys Virtual Machine to Dodge | ||
| Security][ref-20] | ||
| - [^ref-21]: [Thriving Defense: Some Techniques Should Only Be Detected | ||
| Opportunistically][ref-21] | ||
| - [^ref-22]: [JPvRiel: Windows Event Metadata][ref-22] |
There was a problem hiding this comment.
Looks like you got a bit overzealous, these reference links were also converted to footnotes and render with no text.
|
Really sorry for the long delay, but I see more changes were requested. I'll wait for the updates and review - and I won't wait months this time. |
4 participants
Linked to #9 . I ended up adding the Windows Sandbox case. Once this TRR is approved, I'll add an Atomic Red Team validation test as well (and submit that back to this repo).
I ended up including simple Sigma rules - I know it's not part of the current format today. Eventually I would want to incorporate them into a specific rule repo, but for now they stand as a recommended detection approach (a starting point), which I think is still useful enough to include. Happy to discuss further!