{"id":963,"date":"2022-03-27T17:02:18","date_gmt":"2022-03-27T15:02:18","guid":{"rendered":"https:\/\/pentester.blog\/?p=963"},"modified":"2022-03-27T18:23:25","modified_gmt":"2022-03-27T16:23:25","slug":"introduction-a-elk-security-et-detection-cobalt-strike","status":"publish","type":"post","link":"https:\/\/hacktarus.fr\/?p=963","title":{"rendered":"Introduction \u00e0 ELK Security et d\u00e9tection Cobalt Strike"},"content":{"rendered":"\n<p>Ce post est une toute petite introduction \u00e0 l&rsquo;EDR ELK Security (de la suite Elastic) et un test rapide de d\u00e9tection des beacons standard Cobalt Strike.<\/p>\n\n\n\n<p>Il est possible de tester toutes les fonctionnalit\u00e9s de la suite Elastic y compris celles de s\u00e9curit\u00e9 comme le Machine Learning et son EDR pour 30 jours alors let&rsquo;s go !<\/p>\n\n\n\n<p>Pleins de tutos fourmillent sur Internet, ci-joint quelques liens que j&rsquo;ai utilis\u00e9 pour monter ce LAB en VM :<\/p>\n\n\n\n<p>A noter qu&rsquo;Elastic vous permet aussi de tester leur solution sur une instance Cloud.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>https:\/\/techviewleo.com\/install-elastic-stack-7-elk-on-debian\/<\/li><li>https:\/\/www.stefan-hechler.de\/it\/elastic-guide-install-the-easy-way-fleet-management\/<\/li><li>https:\/\/www.youtube.com\/watch?v=11PWoDIc10I<\/li><\/ul>\n\n\n\n<p>Voici la configuration de mon LAB au niveau de l&rsquo;EDR ELK :<\/p>\n\n\n\n<p>Comme tous les EDR vous pouvez choisir d&rsquo;\u00eatre en mode <em>D\u00e9tection <\/em>uniquement ou en mode <em>D\u00e9tection et Pr\u00e9vention<\/em>.<\/p>\n\n\n\n<p>J&rsquo;ai d&rsquo;abord choisi de tester le mode <em>D\u00e9tection <\/em>uniquement :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1462\" height=\"322\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/ELK-3.png\" alt=\"\" class=\"wp-image-966\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>J&rsquo;ai ensuite activ\u00e9 un maximum de <em>Rules <\/em>:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1882\" height=\"726\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/ELK-5.png\" alt=\"\" class=\"wp-image-968\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Ensuite j&rsquo;ai d\u00e9ploy\u00e9 l&rsquo;agent EDR sur une machine Windows 10 :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1006\" height=\"144\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/ELK-6.png\" alt=\"\" class=\"wp-image-969\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Du c\u00f4t\u00e9 de la VM Windows 10, on note la pr\u00e9sence de l&rsquo;EDR ELK dans les services :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"902\" height=\"90\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/W10-1.png\" alt=\"\" class=\"wp-image-970\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Afin de ne pas bloquer les beacons de base Cobalt Strike j&rsquo;ai volontairement d\u00e9sactiv\u00e9 l&rsquo;antivirus, dans mon cas Windows Defender :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1074\" height=\"728\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/W10-3.png\" alt=\"\" class=\"wp-image-971\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>OK maintenant on pr\u00eat pour les tests.<\/p>\n\n\n\n<p>Je lance mon team server Cobalt Strike et je g\u00e9n\u00e8re un fichier malveillant de type HTA que je d\u00e9pose sur la VM Windows 10 victime :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"156\" height=\"67\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/W10-2.png\" alt=\"\" class=\"wp-image-972\"\/><\/figure>\n\n\n\n<p>Maintenant je clique sur evil.hta et je passe du c\u00f4t\u00e9 de l&rsquo;EDR pour voir ce qu&rsquo;il se passe : la menace est bien d\u00e9tect\u00e9e, on peut voir les d\u00e9tails de la chaine d&rsquo;ex\u00e9cution :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1149\" height=\"188\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/ELK-8.png\" alt=\"\" class=\"wp-image-973\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1206\" height=\"466\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/ELK-9.png\" alt=\"\" class=\"wp-image-974\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1254\" height=\"640\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/ELK-10.png\" alt=\"\" class=\"wp-image-975\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Vu que je suis en mode <em>Detection only <\/em>la connexion entre l&rsquo;agent Cobalt Strike et mon TeamServer n&rsquo;est pas coup\u00e9e, je peux donc lancer des commandes \u00e0 distance comme par exemple lister les processus de la machine Windows 10 :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"650\" height=\"428\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/CS-2.png\" alt=\"\" class=\"wp-image-976\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>C\u00f4t\u00e9 EDR je n&rsquo;ai cependant pas not\u00e9 de d\u00e9tection suppl\u00e9mentaire li\u00e9e \u00e0 cette action..<\/p>\n\n\n\n<p>Faisons un autre test, cette fois en passant en mode <em>Detection and Prevention<\/em> avec notification de l&rsquo;utilisateur :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1446\" height=\"470\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/ELK-12.png\" alt=\"\" class=\"wp-image-978\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>C\u00f4t\u00e9 Cobalt Strike je g\u00e9n\u00e8re cette-fois un beacon http sous forme d&rsquo;ex\u00e9cutable (artifact.exe) :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"390\" height=\"230\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/CS-3.png\" alt=\"\" class=\"wp-image-977\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Je d\u00e9pose ensuite cet ex\u00e9cutable sur la VM Windows 10 et pareil je le lance et j&rsquo;observe, on obtient une nouvelle alerte :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1766\" height=\"679\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/W10-5.png\" alt=\"\" class=\"wp-image-979\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Et cette fois le beacon Cobalt Strike est stopp\u00e9 dans sa course gr\u00e2ce \u00e0 la pr\u00e9vention, c\u00f4t\u00e9 utilisateur on a bien une notification :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"742\" height=\"254\" src=\"https:\/\/hacktarus.fr\/wp-content\/uploads\/2022\/03\/W10-6.png\" alt=\"\" class=\"wp-image-980\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Ce qui int\u00e9ressant avec ce type de LAB c&rsquo;est qu&rsquo;on peut s&rsquo;en servir comme sandbox pour une analyse dynamique des malwares et observer les feux d&rsquo;artifice des d\u00e9tections \ud83d\ude42<\/p>\n\n\n\n<p>Voila, ceci conclut cette petite introduction \u00e0 l&rsquo;EDR ELK Security.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ce post est une toute petite introduction \u00e0 l&rsquo;EDR ELK Security (de la suite Elastic) et un test rapide de d\u00e9tection des beacons standard Cobalt Strike. Il est possible de tester toutes les fonctionnalit\u00e9s de la suite Elastic y compris celles de s\u00e9curit\u00e9 comme le Machine Learning et son EDR pour 30 jours alors let&rsquo;s &hellip; <a href=\"https:\/\/hacktarus.fr\/?p=963\" class=\"more-link\">Continuer la lecture de <span class=\"screen-reader-text\">Introduction \u00e0 ELK Security et d\u00e9tection Cobalt Strike<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-963","post","type-post","status-publish","format-standard","hentry","category-malware"],"_links":{"self":[{"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/posts\/963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=963"}],"version-history":[{"count":14,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/posts\/963\/revisions"}],"predecessor-version":[{"id":992,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=\/wp\/v2\/posts\/963\/revisions\/992"}],"wp:attachment":[{"href":"https:\/\/hacktarus.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hacktarus.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}