Configuração de Ambiente de Laboratório AV/EDR

Inicialmente retirado do Discord da Maldev Academy e adicionados mais recursos.

Notas do Notion : https://an0nud4y.notion.site/AV-EDR-Lab-Env-Setup-130bc870022d8071935cc682d3eb34b9?pvs=4

• Um exemplo de coisas que podem ser usadas para emular certos recursos que EDRs pagos têm:

  • SACL - sysmon

    • https://detect.fyi/sysmon-a-viable-alternative-to-edr-44d4fbe5735a?gi=eb4475ea6b3d
    • https://techcommunity.microsoft.com/t5/windows-server-for-it-pro/active-directory-hunting-set-up-advanced-monitoring-with-sysmon/m-p/3977120
    • Configuração do Sysmon : https://github.com/SwiftOnSecurity/sysmon-config

  • HOOKS

    • bitdefender free : https://otterhacker.github.io/Malware/Function hooking.html
    • HookDetector (Detecta todas as APIs com hook) : https://github.com/matterpreter/OffensiveCSharp/tree/master/HookDetector
    • TelemetrySourcerer (enumera e desabilita fontes comuns de telemetria usadas por AV/EDR, incluindo ETW, User-ModeHooks, Kernel Callbacks) : https://github.com/jthuraisamy/TelemetrySourcerer

  • Detectando syscalls manuais do usermode

    • https://github.com/jackullrich/syscall-detect
    • hookar o processo atual para identificar as execuções de syscalls manuais no windows : https://github.com/paranoidninja/Process-Instrumentation-Syscall-Hook
    • Hunt-Weird-Syscalls : https://github.com/thefLink/Hunt-Weird-Syscalls

  • PROCESS/PESCAN

    • Yapscan - acumule o máximo de regras yara que puder
    • DetectItEasy(DIE) : https://github.com/horsicq/Detect-It-Easy

  • AMSI Provider

    • AMSI Provider : https://github.com/jborean93/AmsiProvider

  • ETW-TI/ETW Provedores/Consumidores -

    • silketw : https://otterhacker.github.io/Malware/ETW.html
    • ETWInspector : https://github.com/jsecurity101/ETWInspector
    • Lista provedores de ETW para um processo : https://github.com/whokilleddb/ETWListicle
    • KrabsETW (Consumidor de ETW da Microsoft) : https://github.com/microsoft/krabsetw
    • BlueKrabsETW (Para blue teams, baseado no KrabsETW da Microsoft) : https://github.com/threathunters-io/bluekrabsetw
    • SealighterTI (Provedor de ETW de Inteligência de Ameaças) : https://github.com/pathtofile/SealighterTI
    • TiEtwAgent (Detecta injeção de memória com base em ETW-TI) : https://github.com/xuanxuan0/TiEtwAgent
    • PyWinTrace (Biblioteca python de ETW) : https://github.com/fireeye/pywintrace
    • EtwExplorer (Exibir manifestos de provedores de ETW) : https://github.com/zodiacon/EtwExplorer
    • TelemetrySourcerer (enumera e desabilita fontes comuns de telemetria usadas por AV/EDR, incluindo ETW, User-ModeHooks, Kernel Callbacks) : https://github.com/jthuraisamy/TelemetrySourcerer
    • MentalTi (Parser de ETWTI) : https://github.com/mannyfred/MentalTi
    • PockETWatcher : https://github.com/olafhartong/PockETWatcher
    • Recursos ETW
      • Contém recursos para aprender e entender EVTX/ETW (Event Tracing for Windows) : https://github.com/nasbench/EVTX-ETW-Resources

  • KERNEL CALLBACKS -

    • Elastic
    • Sysmon
    • TelemetrySourcerer (enumera e desabilita fontes comuns de telemetria usadas por AV/EDR, incluindo ETW, User-ModeHooks, Kernel Callbacks) : https://github.com/jthuraisamy/TelemetrySourcerer

  • Capa - Varredura de Capacidades

  • Rastrear chamadas de API - TinyTracer

    • https://github.com/hasherezade/tiny_tracer

• Colete telemetria do Windows para Maldev

  • Coleta telemetria como , ETW, ETW-TI, Kernel Callbacks, Hooks, Callstacks, DLLs carregadas, PEB) : https://github.com/dobin/RedEdr , RedEDR UI (https://github.com/dobin/RedEdrUi) (Verifique outros projetos do autor)

• Testes gratuitos de produtos EDR/AV

  • Microsoft Defender For Endpoint
    • https://medium.com/@hackenbacker/creating-a-defender-for-endpoint-lab-for-free-695044b75bd6
    • https://learn.microsoft.com/en-us/defender-endpoint/defender-endpoint-trial-user-guide
  • Sophos XDR (teste gratuito)
  • Elastic EDR
    • https://github.com/sherifabdlnaby/elastdocker
    • https://otterhacker.github.io/Malware/Elastic EDR.html
    • https://github.com/peasead/elastic-container
    • https://www.youtube.com/watch?v=1luhjL7TN9U
  • TrendMicro
  • McAfee MVISION
  • Avast
  • openEDR - Comodo Free EDR
  • Wazuh : https://github.com/wazuh/wazuh
  • Huntress Managed EDR - (15 dias de teste gratuito, sem cartão de crédito necessário, 3 relatórios de incidentes altos/críticos por analistas de SOC em tempo real) : https://www.huntress.com/edr-free-trial

• EDRs de código aberto

  • RedEDR : https://github.com/dobin/RedEdr
  • SimpleEDR - Hooking manual de DLL para encontrar oportunidades de detecção : https://github.com/Helixo32/SimpleEDR
  • CrimsonEDR : https://github.com/Helixo32/CrimsonEDR
  • OpenEDR : https://github.com/ComodoSecurity/openedr/
  • InjDrv : https://github.com/wbenny/injdrv
  • MyDumbEDR : https://github.com/sensepost/mydumbedr
  • BestEDROfTheMarket : https://github.com/Xacone/BestEdrOfTheMarket
  • JonMon : https://github.com/jsecurity101/JonMon
  • SylantStrike : https://github.com/CCob/SylantStrike
  • Whids : https://github.com/0xrawsec/whids
  • Escreva seu próprio EDR
    • https://blog.whiteflag.io/blog/from-windows-drivers-to-a-almost-fully-working-edr/
    • https://youtube.com/playlist?list=PLc2_LEyTNutFkUliQMTZ_FHl8kNx3f5-E&si=8kHcC_FIxccHBR5H
    • https://sensepost.com/blog/2024/sensecon-23-from-windows-drivers-to-an-almost-fully-working-edr/

• Comparação de EDRs de código aberto por @dobin

  

• Scanners de eventos de carregamento de imagem

  • Hunt-Weird-ImageLoads : https://github.com/thefLink/Hunt-Weird-ImageLoads

• Scanners de memória de processos

  • PE-sieve : https://github.com/hasherezade/pe-sieve
  • Moneta : https://github.com/forrest-orr/moneta
  • YapScan : https://github.com/fkie-cad/yapscan
  • MalMemDetect : https://github.com/waldo-irc/MalMemDetect
  • Patriot : https://github.com/joe-desimone/patriot
  • Hunt-Sleeping-Beacons : https://github.com/thefLink/Hunt-Sleeping-Beacons
  • YaraMemoryScanner : https://github.com/BinaryDefense/YaraMemoryScanner
  • Scanners específicos para detecção de beacon do Cobalt Strike
    • BeaconEye : https://github.com/CCob/BeaconEye
    • BeaconHunter : https://github.com/3lp4tr0n/BeaconHunter
  • EtwTi-FluctuationMonitor - Fazer VirtualAlloc(RWX) altera o bitmap do CFG de acordo e, depois de VirtualAlloc(RW), o CFG permanece o mesmo : https://github.com/jdu2600/EtwTi-FluctuationMonitor
    • https://github.com/jdu2600/CFG-FindHiddenShellcode
    • https://github.com/jdu2600/Etw-SyscallMonitor
  • TiEtwAgent (Detecta injeção de memória com base em ETW-TI) : https://github.com/xuanxuan0/TiEtwAgent

• Bypass de detecção de assinatura

  • ThreatCheck : https://github.com/PACHAKUTlQ/ThreatCheck
  • AvRed : https://github.com/dobin/avred

Configuração da Máquina de Desenvolvimento de Malware

• Evite usar o Windows se estiver preocupado com a telemetria do Windows enquanto escreve seu malware.
• Tiny11Builder (Para remover muitos componentes desnecessários do Windows, incluindo telemetria) (Retirado de aqui) : https://github.com/ntdevlabs/tiny11builder

Internals/Telemetria/Benchmarking/Funcionamento de AV/EDR