How to protect against RDP brute force attacks

• Disabling the public IP address, and using one of these connection methods:
  • Point-to-site VPN
  • Site-to-site VPN
  • ExpressRoute
• Require two-factor authentication
• Use complex passwords
• Limit the amount of time that  the port are open 

How JIT VM Access works

1. First, you need to be in the Standard Pricing tier of Azure Security Center 
2. Enable JIT access for the selected Azure virtual machine(s)
3. At this point, the Network Security Group (NSG) of the virtual machine(s) is updated with rules to block remote management access
4. Use  Azure Security Center to request access to a virtual machine using one of the protocols in the policy 
5. The required NSG is updated to allow inbound access for that protocol 
6. Admin/Dev can remote into the virtual machine
7. Security Center will remove the allow rule in the NSG after the predetermined amount of time that is specified in the policy

Automating JIT VM Access

• Request RDP port (3389) access
• Limit the time to one and a half hours
• Allow connections only from the source IP address where the script was running

Enable-JustInTimeAccess -Hours 1.5 -Port 3389 -UseCurrentIP

• Connecting to Azure Security Center (you can use SubscriptionId parameter, or select during runtime)
• Then, select the Resource Group
• The script will enable the JIT Access VM for all the virtual machines in the Resource Group 

How to run the script

1. Copy the script from the gallery into Visual Studio Code and save it as a .ps1 file
2. Configure the command line at the bottom of the script to suit your needs
3. Run it by pressing F5
4. Enter the credentials of an Azure Admin (or contributor) into the password prompt
5. Select the appropriate Azure subscription, resource group and other parameters

Link to script

• Test various security solutions before implementing them on a production environment
• Learn a new skill or technique by doing it on isolated environment
• Study for a security certification (OSCP, for example)

Hosting your lab

Lab environment

• Windows 10 - Windows workstation joined to Active Directory
• Windows 7 SP1 ENT – Windows workstation joined to Active Directory (Optional, require MSDN subscription)
• Windows Server 2012 R2 - "Applications" Server joined to Active Directory
• Windows Server 2016 – Domain Controller
• Kali Linux

Azure lab costs

Azure lab setup

• Build Azure VM resources
• Create Active Directory Domain
• Add users and computers to your domain

Building the foundation

• https://azure.microsoft.com/en-us/get-started/
• https://azure.microsoft.com/en-us/resources/videos/get-started-with-azure-portal/
• https://azure.microsoft.com/en-us/free/

1.     Creating resource group – The first step is to use a dedicated Resource Group to organize all lab resources in one place.

2.     From the portal (https://portal.azure.com) open Resource Groups and select Add

3.     Specify a name for resource group, and select a geographical location that is near to you

4.     The first resource in our resource group will be the Virtual Network. In Azure, Virtual Machine (VM) is bound to a Virtual Network (VNet), and in addition Virtual Network provides DNS services for the hosts. If you want to use VPN to connect the VMs it is important that the portion of network addresses that you assign to Azure do not conflict with existing on-premises address ranges.

5.     Let's create a network by selecting Virtual Network and then Add

6.     Specify a name to the new Virtual Network and select Address space (Note: You need to create this Virtual Network on the same Resource Group from the previous step)

7.     Now we have a resource group and a Virtual network, and the next step will be creating the Virtual machines inside these resources.

Creating Azure instances

Configuring the Domain Controller (Windows Server 2016)

8.     In Azure portal select Create a resource and then select Windows Server 2016 VM

9.     Configure the following VM properties:

· VM name can be a maximum of 15 characters

· Select user name

· Passwords must be 12 - 123 characters in length and meet Azure passwords complexity requirements

· Select HDD as disk type, and managed disk (you can accept the defaults for all other options)

10.  Select the VM size (Pick DS2_V2 or any other size)

11.  Once your machine is ready, the status will be changed to Running, please click on the Domain Controller machine (in this example: SRV-DC01 machine)

12.  When you at the Virtual Machine page select Networking

13.  find the instance's Network Interface card and click on it

14.  Select IP Configuration

15.  Configure static IP address for the Domain Controller machine – Domain Controller must have a static IP address, you need to configure it using the portal and NOT by editing the IP configuration inside the virtual machine.

16.  Domain Controller' databases must be on non-caching data disk to be supported and to avoid USN rollbacks. We will attach new disk for the database and leave OS disk with default caching.

17.  Go back, and select Disks

18.   Select add data disk

19.  Add new disk (Select 10 GB)

20.  Make sure host caching is set to None

21.  Go back to the resource group and select the Virtual Network under the resource group

22.  Select DNS Servers

23.  Configure the Domain Controller IP address as DNS server on the same Virtual Network you created before

24.  Log on to server and install Active Directory

25.  Select Public IP network and Download RDP file

26.  Log into your Domain Controller

27.  When you logged in, open Computer Management from Server Manager tools, and select Disk Management.

28.  Bring the new data disk online and format the new disk as NTFS volume

29.  Add the Active Directory Domain Services (AD DS) role via Server Manager, and start the DC promotion process

30.  Remember to store the AD files on the data disk (F: in this case) instead of the %systemroot%

31.  Add DNS Server and Active Directory Management tools

32.  Now that you have an Active Directory Domain add some users

33.  Pro-tip: To create "realistic" user accounts in your lab please see the instructions in this post: https://www.darkoperator.com/blog/2016/7/30/creating-real-looking-user-accounts-in-ad-lab?rq=lab

Add additional hosts and join them to the domain

34.  Create additional machines with the following Operating Systems:

1. 1. • • Windows 7 SP1 ENT – Windows workstation joined to Active Directory
        • Windows 10 - Windows workstation joined to Active Directory
        • Windows Server 2012 R2 - "Application" Server joined to Active Directory 
        • Kali Linux

Final Part

You did it!! You should have Active Directory domain with additional 3-4 hosts set up in Azure.

Reusable credentials

Method	Log Type	Reusable credentials
Log to console (+KVM)	Interactive	Yes
RUNAS	Interactive	Yes
Remote desktop	RemoteInteractive	Yes
WinRM+CredSSP	NetworkClearText	Yes
PSExec with explicit credentials	Network+Interactive	Yes
Scheduled Task	Batch	Yes (as LSA secret)
Services	Service	Yes (as LSA secret)
IIS Basic Authentication	NetworkClearText	Yes

         

Protecting credentials

Method	Mitigation
Log to console (+KVM)	Credential Guard (Windows 10/Windows Server 2016)
RUNAS	Credential Guard (Windows 10/Windows Server 2016)
Remote desktop	Remote Credential Guard (Windows 10/Windows Server 2016)
WinRM+CredSSP	Just Enough Administration or Invoke-Command (Windows Server 2012)
PSExec with explicit credentials	Use WINRM (without credSSP)
Scheduled Task	Group Managed Service Account (Windows Server 2012 R2)
Services	Group Managed Service Account (Windows Server 2012 R2)
IIS Basic Authentication	Windows Authentication

  Additional reading:

• https://download.microsoft.com/download/7/7/a/77abc5bd-8320-41af-863c-6ecfb10cb4b9/mitigating%20pass-the-hash%20(pth)%20attacks%20and%20other%20credential%20theft%20techniques_english.pdf
• https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard
• https://docs.microsoft.com/en-us/windows/security/identity-protection/remote-credential-guard
• https://blogs.technet.microsoft.com/motiba/2017/09/21/securing-remote-connections/
• https://blogs.technet.microsoft.com/askpfeplat/2012/12/16/windows-server-2012-group-managed-service-accounts/
• https://docs.microsoft.com/en-us/powershell/scripting/setup/winrmsecurity?view=powershell-6

Warning

"Kill Chain", or What happens during a targeted cybersecurity attack?

• Reconnaissance – an attacker is probing for a weakness or bad configuration
• Weaponization – an attacker is building a payload that can be delivered to the victim (can be a PDF  file or an Office document)
• Delivery- Sending the payload via e-mail, web link or removable media
• Exploit- The payload will execute on the victim's network
• Installation- The payload will download additional remote access tools and install them to maintain persistence
• Command and Control- A channel is created between the victim and the attacker
• Actions- The intended goal is executed (encrypt files, exfiltration of data, etc.)

• Assess your security monitoring tools and practices
• Evaluate Endpoint detection agents

Setup

• PowerShell version 3.0 and above
• Windows 7 (some test cases will work only on Windows 10) and above
• Download Invoke-Adversary.ps1 file from https://github.com/MotiBa/Invoke-Adversary/tree/master 

Usage

• The simplest way to run the script is to open an elevated (run as Administrator) PowerShell ISE window and press F5.

• The script will start and the first thing you need to do is to read the disclaimer and accept the terms by typing yes

• Now you can select any test case by choosing its number on the menu

• Choose which test you want to run by choosing its number on the menu

Screenshots

What are the tactics

Defense Evasion

• Disable network interface - Disables a network adapter and causes loss of network connectivity
• Disable Windows Defender AV – Turn off real-time protection, scanning all downloaded files and attachments, behavior monitoring, network protection and privacy mode
• Add local firewall rule exceptions – Add fictitious rule "Invoke-APT Test Rule" to Windows Advanced Firewall
• Turn off Windows Firewall – Turn off Windows Advanced Firewall
• Clear Security Log - clears the security log using wevtutil command

Persistence Tactics

• Accessibility Features – "Hijack" sethc.exe with cmd.exe using "Image File Execution Options"
• AppInit DLLs – Adds entry for pserver32.dll under AppInit_DLLs
• Application Shimming – Create registry value under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{842562ef-8d28-411d-a67d-ab75ef611fe8}.sdb
• Create local user – A new user (user name is: support_388945a0)
• Create local Administrator – A new user created (user name is: Lost_337fde69_81a9) and added to local Administrators group
• Create New Service – new service (WindowsHealth) is created
• Create New Service (Unquoted Path) – same as previous, just with unquoted path
• Registry Run Keys [HKLM] – New run key under HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
• Registry Run Keys [HKCU] - New run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• Scheduled tasks - new scheduled task (OfficeUpdaterA) is created

Credential Access

1. Mimikatz – Logonpasswords – Download mimikatz to a random file name and execute it with the following arguments "privilege::debug" "sekurlsa::logonpasswords" "exit" (credit: https://twitter.com/gentilkiwi)
2. PowerShell Mimikatz – Run Invoke-Mimikatz.ps1  (credit: https://twitter.com/josephbialek?lang=en)
3. PowerShell Encoded Mimikatz - Run Invoke-Mimikatz.ps1 with encoded PowerShell command line
4. Capture Lsass Memory Dump – Using Windows Error Reporting to capture lsass memory (credit: https://twitter.com/mattifestation)
5. Capture Lsass Memory Dump (Prodump) - Download Prodump to a random file and capture lsass memory
6. Copy Local SAM File (via Invoke-NinjaCopy) – Run Invoke-NinjaCopy to copy C:\Windows\System32\config\sam file (credit: https://twitter.com/josephbialek?lang=en)

Discovery Tactics

1. Account Discovery – running net commands to discover local and domain users and groups
2. Network Service Scanning – ports scan (1-1024) on user selected host
3. System Owner Discovery – whoami command
4. System Time Discovery – Running "net time" and "w32tm.exe /tz" commands
5. Service Discovery – List of all services
6. Network Connections Discovery – netstat

Command and Control

1. Commonly used Ports – Trying to connect to user selected host
2. Uncommonly used Ports - Trying to connect to user selected host using uncommon ports  (credit: Florian Roth)
3. Web Service – Create a new post at pastebin and upload BITS service information
4. DNS - Well-Known Blacklisted IP Address – Resolving top 10 malicious IP addresses (credit: Florian Roth)
5. Connect - Well-Known Blacklisted IP Address – Connecting to top 10 malicious IP addresses (credit: Florian Roth)

Execution

1. PSExec (random file name) – Rename PSEec to random file name and execute it (credit:  https://twitter.com/markrussinovich)
2. PSExec (Remote) – Running psexec on user selected host
3. PowerShell API call – Native API call from PowerShell
4. Self Delete (batch file) – self deleting batch file
5. WMI Process Execution - use the WMI command-line (WMIC) utility

Collection

1. Screen Capture – screen capture (credit: https://www.pdq.com/blog/capturing-screenshots-with-powershell-and-net/)

AppLocker ByPasses

1. Regsvr32 - Regsvr32 technique (credit: https://twitter.com/subTee)

Getting Started

• On Windows 10 Open PowerShell and run the following command (reboot is required)

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux

• Download Kali Linux from the Windows Store and launch it

• Now that we are in the Kali Linux instance, create a username and a password using the wizard
• Update the image by running the following commands:
  • export LANG=C
  • sudo apt-get update
  • sudo apt-get dist-upgrade
  • sudo apt-get clean
• Setup Metasploit (Penetration Testing Tools)
  • Due to the store image being trimmed down, in order to install Metasploit you will need to download it
  • Your Anti-Virus may identify the tools as malware, you can define exceptions in your Anti-Virus settings for the following folder: %LocalAppData%\Packages\KaliLinux.<Package_ID>\LocalState
  • Run the following command:
    • sudo apt-get install metasploit-framework
  • Once it has completed you are able to then run Metasploit using the following command
    • msfconsole

Resources

• Official blog post: https://www.kali.org/news/kali-linux-in-the-windows-app-store/
• Windows Subsystem for Linux (WSL) frequently Asked Questions: https://docs.microsoft.com/en-us/windows/wsl/faq 

Kerberoasting technique

• https://adsecurity.org/?p=3458
• https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/

Kerberoasting detection

• Excessive requests to different resources with small time difference (second or two)
• Kerberos TGS service tickets are requested with RC4 encryption (Type 0x17)

1. Azure subscription and Azure Security center enabled for the domain controllers
2. Enable collection of security event data in your Log Analytics workspace
3. Define custom alerts in Security Center

Define a detection logic

• First step: Execute the following query in Log Analytics:

Search “Security” | Where EventID==4769

• Now, we want to create alerts based on specific criteria in the 4769 events rather than alerting on all events that are collected. This can be achieved by creating custom fields and then defining alert rules based on querying these fields.

• Click on one event below and make sure that you’ve selected the fields you want to filter by. Than highlight the area that you want to use as the example for your data. In my case, I’ve highlighted the value after “TicketEncryptionType”. When the value is highlighted name the field with a name that would be easily understood  for anyone working with Log Analytics.

Define custom alerts in Azure Security Center

search "security" | where EventID == 4769 and TicketEncryptionType_CF == "0x17"

Final Thought

• Use complex and long passwords for service accounts, and rotate them frequently
• Better option, if feasible, is to use Group Managed Service Accounts - random and complex passwords that can be automatically rotated by Active Directory

I wrote a quick script, based on Paulo Marques's post

Script code is here, just remember to change YOUR_Domain_Name

The full list is here (updated on 12/2/2018 and probably subject to change)

• A baseline computer with the following:
  • Sysmon installed and Sysmon XML configuration file
  • Group Policy Administration tools installed
  • Group Policy editing permissions on the target GPO

Let's start with Microsoft Cybersecurity posture

• Detect – Install and configure Sysmon to capture the relevant events
• Respond - Investigate and respond to Sysmon events

Sysmon Configuration file

A sample configuration file for enterprises based on my research and real-life deployments can be found in My GitHub repository.

How to deploy a Sysmon configuration file in an enterprise?

1. Open Group Policy Editor, navigate to Computer Configuration, Preferences, Windows Settings and Registry
2. Select Registry Wizard and New
3. Navigate to HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Parameters and check the following items: HashingAlgorithm, Options and Rules

Prepare for security investigations

• Download and extract Sysinternals Suite file
• You can also download the latest version of specific files from https://live.sysinternals.com

Investigate suspicious process

• Have no icon, description or company name
• Run from Windows directory or user profile
• Started with wrong parent
• Misspelled process
• Unsigned executables
• Packed executables
• Host suspicious DLLs or services
• Have open TCP/IP endpoints
• Include strange URLs, strings in the executable

1. Run Sigcheck and search for any unsigned executables or VirusTotal's flagged executables:
   sigcheck -vt -vr -e -u -s c:\
2. Run streams to detect alternate data streams:
   streams -s c:\
3. Using PowerShell review the content of the Windows directory, and search for files with non-standard date-time:
   Get-ChildItem -recurse | Where-Object { !$_.PsIsContainer } | Sort-Object -Descending { $_.CreationTime }

Sysmon Events Activity Guide

Event ID 2 - A process changed a file creation time

• Is the source computer running an organization-approved ZIP extractor or web browser? If yes, you may ignore this alert because these applications are known to change file timestamps
• Extract the following items from the event:
  • Image -path is not Windows or ProgramFiles -Use Investigate suspicious processes section above
  • TargetFileName -Use Investigate suspicious process table above
    

Event ID 4 - Sysmon service state changed

• The Sysmon Service state was changed to "Stopped"? If an attacker has privileges, Sysmon monitoring can be disabled by killing the Sysmon service. Investigate why the service had stopped by searching the System event log for events with "Service Control manager" source in the System log

Event ID 6 - Driver loaded

• Is the driver loaded is part of an organization-approved device drivers list? If yes, you may ignore this alert
• Extract the following items from the event:
  • ImageLoaded – check if the path is not Windows or Windows\System32\Drivers - Use Investigate suspicious process table above

Event ID 8 - CreateRemoteThread

• Extract the following items from the event:
  • SourceImage -path is not Windows or ProgramFiles -Use Investigate suspicious processes table above
  • TargetImage -image is lsass, password manages, browsers or other sensitive accounts

Event ID 9 - RawAccessRead

• Extract the following items from the event:
  • Image -path is not Windows or ProgramFiles - Use Investigate suspicious process table above
    

Event ID 10 - ProcessAccess

• Extract the following items from the event:
  • SourceImage -path is not Windows or ProgramFiles -Use Investigate suspicious processes table above
  • TargetImage -image is lsass, password manages, browsers or other sensitive accounts

Event ID 15 - FileCreateStreamHash

• Extract the following items from the event:
  • SourceImage -path is not Windows or ProgramFiles -Use Investigate suspicious processes table above

    

• By using Sysinternals streams we can check which files have alternate data-streams.