{"id":4327,"date":"2017-10-02T20:41:30","date_gmt":"2017-10-02T20:41:30","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4327"},"modified":"2017-10-02T20:41:30","modified_gmt":"2017-10-02T20:41:30","slug":"sysmon-doing-lines","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2017\/10\/02\/sysmon-doing-lines\/","title":{"rendered":"Sysmon doing lines"},"content":{"rendered":"

This is just an experiment I ran today to see if I could fool sysmon (or more specifically: any program that parses sysmon logs, or users viewing the sysmon logs in the Event Viewer) into doing an extra line, or two… .<\/p>\n

What if…<\/p>\n

…the command line of the spawn process (calculator in this case) looked like a part of the Event Log itself? Something along these lines :<\/p>\n

calc\r\n\r\n CurrentDirectory: C:\\non-existing\\\r\n User: test-pc\\user\r\n LogonGuid: {15a1393e-e37e-58de-0000-0020e0940300}\r\n LogonId: 0x394E0\r\n TerminalSessionId: 1\r\n IntegrityLevel: High\r\n Hashes: SHA1=2E391131F9B77A8EC0E0172113692F9E2CCCEAF0\r\n ParentProcessGuid: {15a1393e-97f2-59d2-0000-0010a4d8a500}\r\n ParentProcessId: 666\r\n ParentImage: C:\\windows\\system32\\calc.exe<\/pre>\n
Obviously, you can’t run it from a command line, you need a program to run it for you using the CreateProcess API.<\/p>\n
The result would be like this:<\/p>\n
\"\"<\/a>So… when the data is previewed, the user can (at least for a moment) believe the calc.exe was indeed spawn by the process ID 666 and parent process is calc.exe (which on its own is kinda difficult), and the current directory is c:\\non-existing.<\/p>\n
Programs exporting logs into CSV\/TXT could get potentially fooled too as the injected data lines up with expected logs and a possible state machine parsing them could be fooled; one could potentially inject a number of such fake logs and potentially disturb the log parsing process and create some funny, non-existing process-tree scenario.<\/p>\n","protected":false},"excerpt":{"rendered":"
This is just an experiment I ran today to see if I could fool sysmon (or more specifically: any program that parses sysmon logs, or users viewing the sysmon logs in the Event Viewer) into doing an extra line, or … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,52,19,46,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4327"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=4327"}],"version-history":[{"count":5,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4327\/revisions"}],"predecessor-version":[{"id":4333,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4327\/revisions\/4333"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=4327"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=4327"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=4327"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}