Bypassing Antivirus for Your Antivirus BypassChances are you have heard about how easy it can be to evade
antivirus. Often, this is because the signatures used by vendors are
too simplistic and can be successfully duped without changing the
functionality of the malware. Have you ever attempted to evade AV? Is
it really that easy? In this blog post, I’ll show you how I adapted
“malicious” (not really) PowerShell script to slip by Windows Defender.
One of my favorite PowerShell commands is iex
(new-objectnet.webclient).downloadstring, which can be used to load a
remotely hosted script directly into memory. This command is often
behind reports of “fileless” malware and is regularly abused by red
teams and criminals alike. AV detection of this method has improved
somewhat recently but plenty of options exist to evade, such as
invoke-obfuscation by @danielhbohannon.
The MITRE ATT&CK framework includes a technique called
“Indicator Removal from Tools” ( href="https://attack.mitre.org/wiki/Technique/T1066"
target="_blank">T1066), which describes how an adversary may alter
a tool after it is detected in an attempt to evade defenses. T1066 is
one reason why alerts for a tool being blocked should not be ignored.
In researching this technique, I found that using my favorite command
with PowerSploit’s href="https://github.com/PowerShellMafia/PowerSploit/blob/master/AntivirusBypass/Find-AVSignature.ps1"
target="_blank">Find-AVSignature.ps1 somewhat ironically resulted
in a Windows Defender block… not-so-ironically, it was released in 2012.
There have been many excellent posts on how to evade AV but, as the
saying goes, “there is more than one way to skin a cat.” To highlight
how ridiculous AV can be, I decided to bypass AV detection of
Find-AVSignature.ps1 while maintaining the spirit of “there is an
easier way,” outlined in target="_blank">@obscuresec’s href="http://obscuresecurity.blogspot.com/2012/12/finding-simple-av-signatures-with.html"
target="_blank">blog post introducing Find-AvSignature.
The key to my method is PowerShell’s built-in Invoke-Webrequest
command (also known by the aliases "iwr," "wget,"
and "curl"). While Windows Defender will block calling
Find-AvSignature.ps1 when attempting to use iex (new-object net.webclient).downloadstring…
...it will NOT block you from performing a wget on the page and then
viewing the page’s content.
Now we’re getting somewhere, but we can’t simply write the contents
to disk. From here, we are going to find out where Defender is
catching the file by writing the file to the disk one line at a time.
After we find the line, we are going to break it into words and then
reverse any variables found in the line. This will require a fairly
simple script:
From the output of the script, we can see that detection takes place
on line 166 (167 for non-programmer types), which reads:
$BytesLeft = $BytesLeft - $count
Surely, we can't change the variable names!
We could simply do a $page.content.replace twice to replace the two
variables but why would we when we can over-complicate this? Let’s add
logic to change the variable names for us by simply reversing the characters.
Now the output reads:
Detection at line 166 (counting from 0 ^,^)
Replaced $BytesLeft with $tfeLsetyB
Replaced $count with $tnuoc
But does Find-AvSignature.ps1 still work? Yes, yes it does….
So, is this only Windows Defender sucking? No, no it is not…
As you can see, it’s not only Windows Defender that is using a
poorly chosen detection string – our small change detection went
across several AV products. This begs some questions: How well does AV
hold up to other techniques? Is that ok because you are covered
elsewhere? More expansively, how well does your firewall, IDS/IPS, and
Sandbox hold up? Could you adjust your defense strategy to compensate?
Before you invest in another security tool to layer over the tons that
you probably already have, ask yourself if it’s really the product or
a change in configuration that is needed.
Verodin SIP prescriptively shows you exactly what change you should
make to optimize your security, so you can find solutions with what
you already have in your network. To learn more, request a href="/content/fireeye-www/en_US/mandiant/security-validation.html" target="_blank">demo.
Source:
Bypassing Antivirus for Your Antivirus Bypass
