Metasploit Framework

The result is a certificate being issued with the privileges of that AD security group, and all groups it is a member of, even if the requester is not part of those groups.

Initially, the graph only showed a sequence of three executables starting from javaw.exe to conhost.exe... The updated sequence now includes: javaw.exe > rundll32.exe > icacls.exe > java.exe > conhost.exe > conhost.exe > java.exe > conhost.exe > phNGgjyA.exe

MITRE ATT&CK Mapping Technique ID Evidence Command and Scripting Interpreter: Unix Shell T1059.004 Extensive bash usage for tool installation, payload generation

The actors were observed using the below tools to exploit victims.

The result is a certificate being issued with the privileges of that AD security group, and all groups it is a member of, even if the requester is not part of those groups.

One of the most common underlying techniques used by C2 operators and frameworks is process injection... Sliver utilizes process injection as a core part of many default commands or capabilities, such as: migrate, spawndll, sideload, msf-inject, execute-assembly, getsystem.

The result is a certificate being issued with the privileges of that AD security group, and all groups it is a member of, even if the requester is not part of those groups.

By leveraging misconfigurations in ADCS implementations, threat actors are able to escalate their privileges and impersonate high-value domain accounts, up to and including domain admins, possibly leading to full domain compromise.

Generate a 32 bit raw shellcode in whatever framework you want... Run: cat payload.bin | base64 -w 0 ... Copy the base64 encoded payload into the code variable below

The presence of the dropped executable in a temporary directory further supports the conclusion that this file is indeed malicious and designed to evade detection.

One of the most common underlying techniques used by C2 operators and frameworks is process injection... Sliver utilizes process injection as a core part of many default commands or capabilities, such as: migrate, spawndll, sideload, msf-inject, execute-assembly, getsystem.

The result is a certificate being issued with the privileges of that AD security group, and all groups it is a member of, even if the requester is not part of those groups.

This expanded chain of processes highlights the file’s ability to use various legitimate system utilities, such as rundll32.exe and icacls.exe, to execute its payloads and maintain persistence, demonstrating its sophistication in evading detection.

The updated sequence now includes: javaw.exe > rundll32.exe > icacls.exe > java.exe > conhost.exe > conhost.exe > java.exe > conhost.exe > phNGgjyA.exe

Through these techniques, threat actors abuse certificate templates which don’t require manager approval and include enrollment rights for low privileged users / groups.

It can be used to detect misconfigurations, but also to issue certificates utilizing a large range of escalation techniques and leveraging them for domain authentication.

C2 Tracker is a free-to-use-community-driven IOC feed that uses Shodan and Censys searches to collect IP addresses of known malware/botnet/C2 infrastructure.

By clicking on Executable content was dropped or overwritten, we can examine which executable file was dropped after executing the malicious JAR file. Upon investigation, we discover that the file \phNGgjyA.exe was dropped into the directory C:\Users\admin\AppData\Local\Temp~spawn6969498444498001177.tmp.dir