{"id":4214,"date":"2017-05-01T20:53:37","date_gmt":"2017-05-01T20:53:37","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4214"},"modified":"2018-03-25T18:53:37","modified_gmt":"2018-03-25T18:53:37","slug":"running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2017\/05\/01\/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline\/","title":{"rendered":"Running programs via Proxy &#038; jumping on a EDR-bypass trampoline"},"content":{"rendered":"<p>The parent-child process relationship is very helpful when it comes to defining detection rules and watchlists. For instance, anytime a winword.exe spawns a cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe it is an obvious anomaly that may be a sign of an Office macro-based infection.<\/p>\n<p>However, insert an unexpected process in-between and the rule\/watchlist fails. Perhaps for this reason, it would be nice to have EDR rulesets that can refer not only to parents, but also to ancestors of the process.<\/p>\n<p>Since this relationship is prone to manipulation let&#8217;s\u00a0 have a look at a couple of possible examples:<\/p>\n<ul>\n<li>\n<pre>rundll32 url.dll, OpenURL file:\/\/c:\\windows\\system32\\calc.exe<\/pre>\n<\/li>\n<li>\n<pre>rundll32 url.dll, OpenURLA file:\/\/c:\\windows\\system32\\calc.exe<\/pre>\n<\/li>\n<li>\n<pre>rundll32 url.dll, FileProtocolHandler calc.exe<\/pre>\n<\/li>\n<li>\n<pre>rundll32 zipfldr.dll, RouteTheCall calc.exe<\/pre>\n<\/li>\n<\/ul>\n<p>Running any of these commands will launch calc.exe with the rundll32.exe as a parent.<\/p>\n<p>Obviously, rundll32.exe is an obvious\u00a0 bad guy too. What about we copy it first?<\/p>\n<pre>copy c:\\windows\\system32\\rundll32.exe %appdata%\\Adobe\\adobe.exe<\/pre>\n<p>Now, we can launch:<\/p>\n<ul>\n<li>\n<pre>%appdata%\\adobe\\adobe.exe url.dll, OpenURL file:\/\/c:\\windows\\system32\\calc.exe<\/pre>\n<\/li>\n<li>\n<pre>%appdata%\\adobe\\adobe.exe url.dll, OpenURLA file:\/\/c:\\windows\\system32\\calc.exe<\/pre>\n<\/li>\n<li>\n<pre>%appdata%\\adobe\\adobe.exe url.dll, FileProtocolHandler calc.exe<\/pre>\n<\/li>\n<li>\n<pre>%appdata%\\adobe\\adobe.exe zipfldr.dll, RouteTheCall calc.exe<\/pre>\n<\/li>\n<\/ul>\n<p>And get the very same result, this time, with the parent process being adobe.exe.<\/p>\n<p>If you know any other EXE\/DLL combo that can act as a proxy, I&#8217;d be grateful if you could let me know. Thanks!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The parent-child process relationship is very helpful when it comes to defining detection rules and watchlists. For instance, anytime a winword.exe spawns a cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe it is an obvious anomaly that may be a sign of an &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2017\/05\/01\/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[43,52,46,64],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4214"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=4214"}],"version-history":[{"count":2,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4214\/revisions"}],"predecessor-version":[{"id":4216,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4214\/revisions\/4216"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=4214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=4214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=4214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}