IN NTDLL I TRUST - PROCESS REIMAGING AND ENDPOINT SECURITY SOLUTION BYPASS

No ratings

Presented at HackinParis 2019 by

Eoin Carroll

The Mitre Att&ck framework defense evasion techniques such as Process Hollowing and Process Doppelganging exploit legitimate features of the Windows OS to impersonate process executable binaries. These techniques have been weaponized in recent ransomware attacks such as SynAck. McAfee ATR have discovered a new defense evasion technique we have named, Process Reimaging.This technique is equivalent in capability and impact to Process Hollowing or Process Doppelganging within the Mitre Attack Defense Evasion Category, only much easier to execute. The Windows Operating System has inconsistencies in how it determines executing process image binaries, which impacts Endpoint Security Solution’s (such as Microsoft Defender), ability to detect the correct binaries loaded in malicious processes.We have developed a proof of concept which exploits this inconsistency, by hiding the physical location of a process EXE to bypass Windows Defender. The PoC allowed us to persist a malicious process (post exploitation) which does not get detected by Windows Defender.The Process Reimaging technique cannot be detected by Windows Defender until it has a signature for the malicious file and blocks it on disk before process creation.