Written by Jonathan Johnson and Brian Donohue Originally posted: https://redcanary.com/blog/logon-sessions/ Logon sessions can help defenders tell the whole story of everything that happens around, before, and after a suspicious process event. Process telemetry has dominated the detection space since the invention of endpoint detection and response (EDR) tooling. This makes…

Understanding the Basics — Recently I have taken up an interest in WMI internals and thought I would write a blog series on some of my findings. This first release will cover the fundamentals of WMI and how to track back WMI activity to the WMI provider host process (WmiPrvse.exe), the executable responsible for…

A joint blog written by Andrew Schwartz, Charlie Clark, and Jonny Johnson Introduction For the past couple of weeks it has become apparent that Kerberos Relaying has set off to be one of the hottest topics of discussion for the InfoSec community. Although this attack isn’t new and was discovered months…

This blog was originally written by me and posted by Red Canary. Detection engineers are frequently beset with the challenge of detecting a technique for which optics are poor, non-existent, or difficult to collect at scale. Access Token Manipulation (T1134) is a great example of a technique where one such…

Introduction This past week I briefly talked about Process Access data within a talk that Olaf and I gave at ATT&CKCON 3.0 (YouTube link isn’t live yet). During this presentation I talked about the significance of this sub-data source and what it meant to defenders. My portion was heavily focused on…

Introduction The Elastic Research team recently released work surrounding stripping the Windows Defender binary (MsMpEng.exe) of its privileges, making it effectively useless. Being that MsMpEng.exe runs under a Protected Process Light Process (PPL) state, this work led to some research of my own particularly surrounding the ability/inability of impersonating the token…

Introduction In an attempt to understand access tokens at a deeper level as of late, I have come across a couple of members within the TOKEN structure that have connected some dots for me. They are not novel findings, but I hope these findings help someone else, as they have me…

Impossible to spoof, process integrity levels dictate trust between securable objects, offering defenders great visibility into privilege escalation. — This blog was originally written by me and posted by Red Canary. In this second installment of our Better know a data source series, we’re showcasing process integrity levels. Integrity levels define the trust between process/thread and another object (files, processes, threads) and help control what that object can or…

Story was first released on the Red Canary Publication. MSRPC to ATT&CK is a one-stop shop for learning more about Remote Procedure Calls, how adversaries abuse them, and how you can detect related malicious activity. Microsoft Remote Procedure Call (MSRPC) is an interprocess communication protocol mechanism that adversaries can abuse…