Presented at
Shakacon X (2018),
Unknown date/time
(Unknown duration).
Adversaries love leveraging legitimate functionality that lays dormant inside of Microsoft Windows for malicious purposes and often disguise their activity under the smoke screen of “normal administrator behavior”. Over the last year, there has been a significant surge in the malicious use of Component Object Model (COM) objects as a “living off the land” approach to lateral movement. COM, a subsystem that has been around since the early days of Microsoft Windows, exposes interfaces and functionality within software objects and has the ability to share this functionality over the network via Distributed COM (DCOM). With over 20 years in existence and over a year of relative popularity among adversaries, one would imagine that network analysis and detection of DCOM attacks was old news. On the contrary, very few people understand the techniques, tools fail to properly parse the network protocol, and adversaries continue to successfully leverage it to further the compromise of networks. Needless to say, it’s difficult to defend against techniques that the defenders don’t understand.
This talk aims to address that knowledge gap by exploring DCOM as a lateral movement technique and provide a methodical walk through of the technique from both the attacker and defender perspectives. The audience will get a deep dive into:
-[D]COM 101
-How does an adversary choose a COM object for lateral movement
-NSM approaches with regards to DCOM (pros vs cons)
-Network protocol analysis of the attack using open source tools
-Technical content released during the talk to aid in analysis and detection
Presenters:
-
Justin Warner
Justin Warner (@sixdub) is a Security Engineer at ICEBRG where he researches and develops network threat detection capabilities while also regularly assisting partners in performing network forensics during incident response engagements. Justin is an Air Force Academy graduate, former USAF Cyber Ops officer, co-founder of the Empire project and former red team lead where he focused on adversary emulation operations against several Fortune 100 companies as well a federal, state, and local government organizations. Justin has a passion for and uses his “free time” for threat research, reverse engineering, and diving into mountains of data to keep his analytics skills sharp.
Links:
Similar Presentations: