hydeel

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

FireEye Sunburst KQL Detections

FireEye released a very interesting article regarding a third-party compromise of Solarwinds, the detections that are possible in Defender for Endpoint are listed below

Blog post

All FireEye detections

DeviceEvents

Base64 Patterns - Learning Aid

Base64 Code	Mnemonic Aid	Decoded*	Description
`JAB`	🗣 Jabber	`$.`	Variable declaration (UTF-16), e.g. `JABlAG4AdgA` for `$env:`
`TVq`	📺 Television	`MZ`	MZ header
`SUVY`	🚙 SUV	`IEX`	PowerShell Invoke Expression
`SQBFAF`	🐣 Squab favorite	`I.E.`	PowerShell Invoke Expression (UTF-16)
`SQBuAH`	🐣 Squab uahhh	`I.n.`	PowerShell Invoke string (UTF-16) e.g. `Invoke-Mimikatz`
`PAA`	💪 "Pah!"	`<.`	Often used by Emotet (UTF-16)

	# Attempts to demangle all mangled symbols in the current program using the Rust
	# mangling schemes, and replace the default symbol and function signature
	# (if applicable) with the demangled symbol.
	#
	# License: MIT OR Apache-2.0
	#@author Jack Grigg <thestr4d@gmail.com>
	#@category Symbol

	import string

	import http.server
	import http.cookiejar
	import io
	import socket
	from http import HTTPStatus

	import ssl
	import os
	import zlib
	server_address = ('0.0.0.0', 4443)

	# Author: Matt Graeber
	# Company: Red Canary

	# To start a trace, run the following from an elevated command prompt: logman start AMSITrace -p Microsoft-Antimalware-Scan-Interface Event1 -o AMSITrace.etl -ets
	# To stop the trace, run the following: logman stop AMSITrace -ets

	# Example usage: Get-AMSIEvent -Path .\AMSITrace.etl

	function Get-AMSIEvent {
	param (

	#!/bin/bash
	if [ $# -eq 0 ]
	then
	echo $'Usage:\n\tcheck-smb-v3.11.sh TARGET_IP_or_CIDR'
	exit 1
	fi

	echo "Checking if there's SMB v3.11 in" $1 "..."

	nmap -p445 --script smb-protocols -Pn -n $1 \| grep -P '\d+\.\d+\.\d+\.\d+\|^\\|.\s+3.11' \| tr '\n' ' ' \| replace 'Nmap scan report for' '@' \| tr "@" "\n" \| grep 3.11 \| tr '\|' ' ' \| tr '_' ' ' \| grep -oP '\d+\.\d+\.\d+\.\d+'

	# Get-BitLockerRecovery.ps1
	# Written by Bill Stewart (bstewart AT iname.com)

	# Version history:
	#
	# 1.2 (2024-07-01)
	# * Updated code formatting.
	# * Changed PasswordID to PasswID.
	#
	# 1.1 (2019-09-12)

	import axios from "axios";
	import jwt from "jsonwebtoken";
	import mem from "mem";
	import fs from "fs";

	const loadServiceAccount = mem(function(){
	// This is a string containing service account credentials
	const serviceAccountJson = process.env.GOOGLE_APPLICATION_CREDENTIALS;
	if (!serviceAccountJson) {
	throw new Error("Missing GCP Credentials");