Finding active defense opportunities in a pentest report

Pentest reports tell a story. The story of how the team managed to break into your environment. In my experience, a critical component usually missing from these reports is the rationale behind the choices made by the pentesters who ran the assessment.

• Why did they go after a particular account?
• Why did they target a specific set of servers?
• Why did they choose one lateral movement technique over the other?

Asking why allows you to deconstruct choices that real threat actors might make in your environment. Having a sense of those choices will give you some active defense opportunities.

Let me demonstrate this with a little thought experiment. Let’s consider a pentest where the objective was to demonstrate access to the customer database. Here’s what the pentesters broadly did:

1. Established a C2 using PowerShell.
2. Enumerated the Active Directory domain for users and groups, specifically privileged groups.
3. Enumerated the domain to find computers.
4. Attempted privilege escalation techniques and compromised the domain admin.
5. Scanned a subset of computers to identify the customer DB.
6. Used the domain admin account to login to the database server.
7. Logged into the Customer DB.

In each of these steps, the pentesters made some choices. As you’ll now see, deconstructing these choices can help build better defenses.

Deconstructing the pentest report to find Active Defense plays

The Active Defense matrix was released by MITRE to provide a framework for identifying opportunities where adversary behavior can be influenced to enable defenders to easily spot threats.

The foundation of the Active Defense approach rests on three principles:

1. Beat the human behind the software
2. Do simple things the adversary does not anticipate to encourage or complicate their operation.
3. Make sure the things you do allows the corresponding telemetry to stand out i.e. collect more effective telemetry.

So let’s begin by deconstructing each of the 7 steps in the report to identify Active Defense opportunities

#1 – C2 using PowerShell

Why PowerShell? 

1. Sophisticated off the shelf tooling
2. PowerShell logging & blocking not widely implemented
3. Great obfuscation capabilities

Active Defense Opportunity

Block PowerShell to force the adversary to use non-PowerShell options.

Advantage

Since PowerShell usage for C2 is fairly common, it reduces the risk of being hit with commodity malware that uses PowerShell even today.

MITRE Shield Technique: Security Controls

#2 – Enumerated the domain for users and groups

Why enumerate the users?

1. Find privileged group members of groups like Domain and Enterprise Admin. Successful compromise of DA / EA will almost certainly result in customer DB access down the line, so it’s important to know who they are.
2. Run keyword searches across attributes like username, SPN, description, etc. to find accounts that can be used for SQL logins. Example ‘SQL’, ‘DB’, ‘etc’. This will be useful down the line when it’s time to figure out how to login to the database, regardless of whether you have domain admin credentials or not.

Active Defense Opportunity

Setup attractive decoy accounts, assign attractive privileges, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts. This has the added advantage of detecting password spraying regardless of intensity and staggering strategies.

Advantage

Gain insight into enumeration activities being conducted against the domain from a user perspective.

(Note: Don’t ever use these accounts for any operations. There are ways to make this opsec safe)

MITRE Shield Technique: Decoy Account

#3 – Enumerated the domain for computers

Why enumerate the computers?

1. Run keyword searches across attributes like hostname, SPN, description, etc. to find accounts that could be SQL servers. Example ‘SQL’, ‘DB’, ‘etc’. This will be useful down the line when it’s time to figure out where the DB is located.

Active Defense Opportunity

Setup decoy computers, assign attractive hostnames to databases, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts.

Advantage

Gain insight into enumeration activities being conducted against the domain from a computer perspective.

MITRE Shield Technique: Decoy System

#4 – Privilege Escalation

Why Privilege Escalation?

1. Get to a higher level of privilege. In this case, the target privilege level is the database/server administrator on the customer database.
2. Escalated privileges can allow you admin access to one, few, many, or all systems on the network.
3. With high privileges, you have the opportunity to log in to more systems and steal credentials.

Let’s assume that Kerberoasting was the privilege escalation technique that worked. In this case, let’s also assume that the service account was a domain admin.

Why Kerberoasting?

1. It targets service accounts i.e. accounts that have an SPN attribute configured.
2. Service account passwords never expire.
3. Sometimes, service accounts are granted DA privileges. At the very least, they have admin privileges somewhere.
4. Some service accounts are so old that no one remembers they exist and have weak passwords.
5. It’s really difficult to detect on the wire.
6. Logs related to service ticket operations are not logged by default. If they are, it is difficult to tell the difference between legitimate and malicious service ticket operations.

Active Defense Opportunity

1. Setup a decoy kerberoastable account, assign attractive usernames to databases (e.g. SQLAdmin), add a SQL-related SPN (e.g. MSSQLSvc/custdb.domain.com), and write a rule to capture Event ID 4769 for the decoy account.
2. Remove the real domain admin service account from being kerberoastable or downgrade its privileges.

Advantage

Makes the adversary believe they have obtained hashes to the customer database SQL service account while at the same time removing the risk of kerberoasting a real domain admin account.

A similar approach can be used for other popular privilege escalation techniques.

1. Tomcat Manager exploit – Plan a decoy system with Tomcat manager and monitor for connections and interactions towards this system.
2. LLMNR poisoning – Use a tool like Conveigh to send decoy broadcasts over the subnet and monitor for responses to these broadcasts.
3. Credential Dumping – Use Invoke-runas to plant fake domain admin credentials in memory using the /netonly technique.

There are many techniques available for privilege escalation, and some of them lend themselves well to an Active Defense approach. However, in cases where that doesn’t work, focus on what the adversary intends to accomplish with those privileged credentials.

MITRE Shield Technique: Decoy Account, Decoy System, Security Controls

#5 – Scanned a subset of computers to identify the customer DB

Why Scan?

1. Check if the database server is reachable from the target list compiled in #3.
2. Check if the database port is open.
3. Check if any banners reveal which might be the customer database.
4. Check for default passwords on SQL servers for the ‘sa’ account.

Active Defense Opportunities

1. Plant a decoy SQL server on the network. Alert when you see port enumeration.
2. Make the real customer database accessible only from certain machines.

Advantage

Even a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database.

MITRE Shield Technique: Network Diversity, Decoy Diversity, Network Manipulation

#6 – Used the domain admin account to login to the customer database server

Why log in to the customer database server?

1. With domain admin privileges, you can extract credentials from memory from the customer database.
2. Helps you compromise the logged-on SQL administrator account (whether it’s a user or service doesn’t matter).

Active Defense Opportunities

1. Implement a standard operating procedure to prevent a domain admin from ever logging into the database server. Implement the corresponding rule for this server alone in your SIEM.
2. Plant decoy SQL administrator credentials in memory.

Advantage

Even a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database

MITRE Shield Technique: Standard Operating Procedure, Decoy Credentials

#7 – Login to the database itself

Unfortunately, if the adversary has reached this point, detection difficulty increases. This is because, from an analytics perspective, you are looking for a legitimate account, logging into a legitimate database, and running possibly legitimate queries. However, there are still things we can do.

Active Defense Opportunities

1. Setup query auditing on the SQL server for accounts with DB admin rights.
2. Hunt for non-standard queries in the hope of spotting the adversary running ‘select *’ operations and join operations to fully extract the customer database.

MITRE Shield Technique: Hunting, System Activity Monitoring

Apply Active Defense Approach to any use case

I present an abstracted approach to applying Active Defense use cases. It has 4 pieces:

1. Deceive – Can I do something to trick the adversary en route to/on the system?
2. Standardize – Can I define how a particular system must be used/controlled?
3. Analyze – Can I bubble-up anomalies against the system I am protecting?
4. Control – Can I make it more difficult to reach and compromise the system?

You can use the above as a combination to assess a use case beyond just analyzing pentest reports. The pentest report was just a means for me to present my idea.

Closing Notes

I would like you to note a few things.

1. Use of the Active Defense approach covers the kill-chain and encourages you to think about the ‘why’ to build better defenses and how your network, endpoints, and active directory are all interconnected.
2. It reduces complexity otherwise introduced by large scale data analytics across GBs of logs a day.
3. The active defense approach is not limited to decoys alone, but it is a significant component.
4. You don’t have to baseline and standardize operating procedures across everything. Just the stuff that matters to you.
5. You can tighten your hunt use cases with Active Defense, making hunting a lot more productive.
6. You can take a targeted approach to apply controls, rather than spray controls all over the network that costs time and requires effort.