__________ _____ . .
_____ \ ____ ____ __ __ ____ / _ \ ______ ______ ____ _ | | | ..
| // _ \ / __| | _/ __ \ / /\ \ / // __// __ \ / | __ | |< | |
| | ( <> ) // > | /\ / / | \ \ _ \ /| Y Y \ _\ \ |_ |
|| /_/_ /|/ _ > _| /____ >____ >___ >|| / /____/ |
/ // / / / / / / / /
___ ___ __
/ | \ __ __ / | ___________
/ ~ \ | / \ __/ __ _ __
\ Y / | / | \ | \ /| | /
_| /|/|| /| _ >|
/ / /
Rogue Assembly Hunter 是一个用于发现正在运行的进程中“有趣”的 .NET CLR 模块的实用工具。
.NET 是一个功能强大且能力丰富的开发平台和运行时框架，用于构建和运行 .NET 托管应用程序。在过去几年中，.NET 已被红队（及类似团队）采用，用于实现支持进攻性行动的技术。特别是，从进攻性 PowerShell 转向 .NET 对许多人来说是一个合乎逻辑的飞跃，因为 PowerShell v5+ 中增加了监控和机会性可见性。因此，.NET 进攻性工具和技术已成功用于规避基于主机的防御能力、绕过应用程序控制以及构建/搭建/交付/执行恶意代码（类似于 PowerShell）。
从防御角度来看，微软正在采取更多措施来对抗 .NET 相关威胁并最小化 .NET 的整体攻击面。例如，微软在 .NET Framework 4.8 中增加了 AMSI 检查能力，而 WDAC/WLDP 机制也非常有效。从检测/响应角度来看，进一步了解 .NET 生态系统内部情况总是有利于发现对抗 .NET 威胁的新方法。
2017 年，Joe Desimone (@dez_) 撰写了一篇精彩的文章，名为 Hunting For In-Memory .NET Attacks。该文章至今仍具有现实意义，概述了现代 .NET 攻击向量以及用于检测的按需和基于事件的技术。伴随该文章，Joe 发布了一个工具 (Get-ClrReflection)，用于主动检测（并检索）内存中缺少适当磁盘引用的 .NET CLR 模块。受 Joe 工作的启发，并利用 CLRMD 运行时诊断库（以及随后的 mscordacwks.dll 数据访问能力）的内省能力，Rogue Assembly Hunter 旨在：
--checks 和 --sleep 开关进行调优（尤其是在“监视”模式下）。在某些情况下，由于执行速度（例如 execute-assembly 和临时进程）可能难以“捕获”特定程序集加载。[*] Parameters:
--mode=<.> : Required | Select analysis mode. Options include sweep, process, and watch.
--hunt=<.> : Optional | Select the hunt scan type to find interesting CLR modules. Specify all (default), memory-only, unusual-dir,
sig-status, imposter-file, or list.
--export=<.> : Optional, Experimental | Specify a file path to export loaded CLR modules for in-memory hunt scans and imposter-file hunt scans
(e.g. --hunt=memory-only/imposter-file/all).
--pid=<.> : Optional | Specify a targeted process by PID. Must be used with --mode=process parameter/value.
--checks=<.> : Optional | Specify a value for scan cycles. This may help reduce race condition misses during scans but could also repeat result output.
Default value is 1.
--sleep=<.> : Optional | Specify a value for sleep seconds. This may help reduce race condition misses during scans by delaying the check cycle.
Default value is 0 seconds.
--debug : Optional | Display exception information (e.g. process connect errors).
--nobanner : Optional | Suppress the display banner. Useful for executing with the PowerShell script or for use cases that leverage automation.
--suppress : Optional | Do not scan the RogueAssemblyHunter process during --mode=sweep or --mode=watch.
--help : Optional | Show this help. This will override any other cmdline parameters and exit the application. *This is the default without parameters.
[*] Modes (--mode=)
- sweep : Scan/iterate through all processes (Note: Only processes of like architecture/'bitness' will be successfully scanned. Compile to run for x86/x64/etc.).
- process : Scan a single process. Use with --pid=<PID>.
- watch : Scan new processes when created. Adjust scan attributes with --checks and --sleep. (Note: This is experimental. Race conditions are likely.)
[*] Hunts (--hunt=)
- all : Default value. Analyze with all hunt options (Except 'list').
- memory-only : Memory hunt. Analyze CLR modules that are not backed by disk.
- unusual-dir : Unusual directory hunt. Analyze CLR modules loaded outside of 'normal' directories.
Edit '_huntUnusualDirectoryFilter' to customize.
- sig-status : File signature hunt. Analyze CLR modules with anomalous signature status (e.g. unsigned). Note: This is experimental. False positives are possible.
Edit '_huntSigExclusionsFilter' to customize.
- imposter-file : Unexpected CLR module hunt. Analyze CLR module with suspicious disk file backing. Experimental.
- list : Iterate through all CLR modules and list accordingly.
[*] Example Usage
- Example 1 : Scan processes and run through all hunts for accessible 64-bit processes (except 'list') -
RogueAssemblyHunter_x64.exe --mode=sweep
- Example 2 : Scan processes, list all CLR modules in accessible 32-bit managed processes, and show error information -
RogueAssemblyHunter_x86.exe --mode=sweep --hunt=list --debug
- Example 3 : Watch for new processes, scan all CLR modules (if managed and 64-bit), do not scan the RogueAssemblyHunter process, and do 2 checks with a 3 second delay between -
RogueAssemblyHunter_x64.exe --mode=watch --suppress --checks=2 --sleep=3
- Example 4 : Scan single process by PID, list in-memory only CLR module findings, and export CLR modules to specified path -
RogueAssemblyHunter_x86.exe --mode=process --pid=4650 --hunt=memory-only --export=c:\evilassemblies\
- Example 5 : Scan processes, list in-memory only CLR module findings for accessible 64-bit processes, do no scan RogueAssemblyHunter process, and do not show title banner -
RogueAssemblyHunter_x64.exe --mode=sweep --hunt=memory-only --suppress --nobanner
为了方便，项目包含一个 PowerShell 脚本和两个编译好的二进制文件（RogueAssemblyHunter_x64.exe 和 RogueAssemblyHunter_x86.exe），位于 Release 文件夹中。您可以根据需求修改它们（例如，部署、嵌入、检查、休眠等）。
示例用法：
以扫描模式运行 Invoke-RogueAssemblyHunter 并检查所有狩猎选项
cd c:\path\to\RogueAssemblyHunter
import-module .\Invoke-RogueAssemblyHunter.ps1
Invoke-RogueAssemblyHunter
以监视模式运行 Invoke-RogueAssemblyHunter 并检查所有狩猎选项
cd c:\path\to\RogueAssemblyHunter
import-module .\Invoke-RogueAssemblyHunter.ps1
Invoke-RogueAssemblyHunter -ScanMode watch
SHA256 哈希值：
e804711a8b6469f1b13b388de47dfa6dde1c85279d365db7b6e19e1644990fa6 Invoke-RogueAssemblyHunter.ps1
cc985d918e566671aa209142abc55bd798ca6c1a18730b785ac8c18d489736c3 RogueAssemblyHunter_x64.exe
ae3aead43871e263cd8465d5356c4daaae0635714321f872c931ec825008287a RogueAssemblyHunter_x86.exe