WinVisor is a hypervisor-based emulator for Windows x64 user-mode executables that leverages the Windows Hypervisor Platform API to provide a virtualized environment for logging syscalls and enabling memory introspection.

Background

Hypervisor basics

WinVisor overview

Virtual CPU

Control registers

Model-specific registers

Global descriptor table

Task state segment

Interrupt descriptor table

Bootloader

Memory paging

Virtual address translation

Page faults

Host/guest memory mirroring

Syscall handling

Fast syscall (SYSCALL)

Legacy syscalls (INT 2E)

Syscall forwarding

Syscall logging

Syscall hooking

Interrupt handling

Hypervisor shared page bug

Demos

Limitations

Safety issues

Non-executable guest memory

Single-thread only

Software exceptions

Conclusion

Project links

A proof-of-concept hypervisor-based emulator for Windows x64 binaries

WinVisor – A hypervisor-based emulator for Windows x64 user-mode executables

Structured threat data is commonly formatted using STIX. To help get this data into Elasticsearch, we’re releasing a Python script that converts STIX to an ECS format to be ingested into your stack.

Preamble

Getting started

Prerequisites

Setup

Operation

Arguments

Examples

STIX file input to STDOUT

STIX file input to ECS file output

STIX file input to ECS file output, defining the Provider field

STIX directory input to ECS file outputs

STIX file input to Elasticsearch output

Summary

About Elastic Security Labs

STIXy Situations: ECSaping your threat data

In this publication, we will walk through this client application’s functionality and how to get started with the tool.

Introduction

Recap

Development

Getting Started

Appendix

Handler Commands

Dancing the night away with named pipes - PIPEDANCE client release

To automate this process and test our protections at scale, we built Detonate, a system that is used by security research engineers to measure the efficacy of our Elastic Security solution in an automated fashion.

What is Detonate?

What does it help us with?

Measuring Efficacy

Supporting existing protections

Threat research

Evaluating new protections

What’s next?

Click, Click… Boom! Automating Protections Testing with Detonate

ICEDID is known to pack its payloads using custom file formats and a custom encryption scheme. We are releasing a set of tools to automate the unpacking process and help analysts and the community respond to ICEDID.

Environment setup

Unpacking the fake GZip

Decrypting the core binary and configuration files

Reading the configuration

Rebuilding the core binary for static analysis

Executing the core binary (Windows only)

Unpacking and rebuilding payloads from the rebuilt core binary

References

A comprehensive tutorial with Elastic Security Labs open source tools

Unpacking ICEDID

The Elastic Container Project provides a single shell script that will allow you to stand up and manage an entire Elastic Stack using Docker. This open source project enables rapid deployment for testing use cases.

The Elastic Stack

Elasticsearch

Kibana

The Elastic Agent

The Elastic Container Project

macOS

Linux

Cloning the project repository

Setting credentials

The shell script

Stage

Start

Stop

Destroy

Restart

Restarting all Elastic Stack components.

Name Command State Ports

Status

Clear

Help

Updating variables

Starting the Elastic Stack

Accessing the Elastic Stack

Enabling the Platinum Features

Creating a Fleet policy

Enabling Elastic’s Prebuilt Detection Rules

Enrolling an Elastic Agent

Test fire some malware

Using Docker to stand up the Elastic Stack

The Elastic Container Project for Security Research

Elastic Security Labs discusses the NETWIRE trojan and is releasing a tool to dynamically extract configuration files.

Key takeaways

Extractor

Analysis

Detection

YARA

Indicators

A tool for the dynamic extraction of NETWIRE configurations based on emulation.

NETWIRE Dynamic Configuration Extraction

Python script to extract the configuration from NETWIRE samples.

Docker

Running it locally

Usage

Configuration extraction tool for the NETWIRE malware.

NETWIRE Configuration Extractor

Python script to extract the configuration and payload from BLISTER samples.

Running it Locally

BLISTER Configuration Extractor

Configuration extractor to dump out hardcoded passwords with BPFDoor.

Overview

BPFDoor Configuration Extractor

Python script to identify hosts infected with the BPFDoor malware.

Permissions

Running Locally

BPFDoor Scanner

Python script that collects Cobalt Strike memory data generated by security events from an Elasticsearch cluster, extracts the configuration from the CS beacon, and writes the data back to Elasticsearch.

Using an Elastic Cloud instance (this is a randomly generated example)

Default output will use localhost:9092, see reference config

Filter by time

Pipe output to other tools

Cobalt Strike Beacon Extractor

Python script to extract the configuration from EMOTET samples.

Configuration extraction tool for the EMOTET malware.

EMOTET Configuration Extractor

Python script to extract the configuration from ICEDID samples.

Configuration extraction tool for ICEDID malware.

ICEDID Configuration Extractor

Python script to extract the payload from PARALLAX samples.

PARALLAX Payload Extractor

Python script to extract the configuration from QBOT samples.

Configuration extraction tool for QBOT malware

QBOT Configuration Extractor

Elastic Security Labs discusses the EMOTET trojan and is releasing a tool to dynamically extract configuration files using code emulators.

Kategorie

Tools

24 Januar 2025

WinVisor – Ein Hypervisor-basierter Emulator für Windows x64-Anwendungen im Benutzermodus

STIXy Situationen: Entkommen Sie Ihren Bedrohungsdaten

Tanzen Sie die ganze Nacht durch mit Named Pipes - PIPEDANCE Client Release

Klick, Klick... Bumm! Automatisiertes Testen von Schutzmaßnahmen mit Detonate

Auspacken von ICEDID

The Elastic Container Project for Security Research

NETWIRE Extraktion dynamischer Konfigurationen

NETWIRE-Konfigurations-Extraktor

BLISTER Konfiguration Extraktor

BPFDoor-Konfigurationsextraktor

BPFDoor Scanner

Cobalt Strike Beacon Extraktor

EMOTET Konfigurations-Extraktor

ICEDID-Konfigurations-Extraktor

PARALLAX Nutzlast-Extraktor

QBOT-Konfigurations-Extraktor

EMOTET Dynamische Konfigurationsextraktion

Extrahieren von Cobalt Strike Beacon-Konfigurationen