Ppl - CraftedSignal Threat Feed

LSASS Protection Policy Disabled via Registry Modification

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

Attackers frequently target the LSASS process to extract credentials and other sensitive information. Windows implements Protected Process Light (PPL) as a defense mechanism to prevent unauthorized access to LSASS. This attack involves modifying specific registry keys to disable this protection, potentially occurring post-exploitation. Once PPL is disabled, attackers can more easily dump credentials, inject malicious code, and perform other actions to escalate their privileges and move laterally within the compromised environment. Disabling LSASS protection is a common step in many credential harvesting attack chains.

Attack Chain

The attacker gains initial access to the system (e.g., through phishing or exploiting a vulnerability).
The attacker escalates privileges to an administrator or SYSTEM level, often leveraging known exploits or misconfigurations.
The attacker modifies the registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ProtectionMode to a value of 0, effectively disabling LSASS PPL. This is often done using tools like reg.exe or PowerShell.
The attacker uses credential dumping tools like Mimikatz or custom scripts to extract credentials from the LSASS process memory.
The attacker uses the stolen credentials to gain access to other systems or resources within the network (lateral movement).
The attacker performs reconnaissance to identify high-value targets and data.
The attacker exfiltrates sensitive data or deploys ransomware to achieve their final objective.

Impact

Disabling LSASS PPL can lead to widespread credential compromise, allowing attackers to gain access to sensitive data and systems within the organization. This can result in significant financial loss, reputational damage, and disruption of business operations. Successful credential dumping can expose domain administrator accounts, effectively giving the attacker complete control over the network. Depending on the scope of access achieved with the compromised credentials, the impact could range from targeted data theft to full-scale ransomware deployment across the network.

Windows Defender Evasion via Protected Process Light (PPL) Manipulation

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

The technique described involves manipulating the Protected Process Light (PPL) mechanism in Windows to evade Windows Defender. PPL is a security feature designed to protect critical system processes. However, by manipulating PPL attributes, an attacker can potentially elevate the privileges of a malicious process, allowing it to bypass security checks and operate undetected. This can lead to arbitrary code execution and system compromise. The reported research, published on Medium, demonstrates a proof-of-concept of this evasion technique, highlighting the potential vulnerability in Windows security architecture and the need for enhanced detection and mitigation strategies.

Attack Chain

Attacker gains initial access to the system (e.g., via phishing or exploiting a software vulnerability).
Attacker elevates privileges to SeDebugPrivilege to allow manipulation of protected processes.
Attacker identifies a target process to inject into (e.g., a legitimate, signed process with a PPL level).
Attacker modifies the PPL attributes of the target process to a less protected level or disables PPL altogether. This may involve direct memory manipulation or other techniques to bypass security checks.
Attacker injects malicious code into the now-vulnerable process. This injected code inherits the process's (modified) PPL attributes.
The injected code executes, bypassing Windows Defender scans due to the manipulated PPL, and performs malicious activities like downloading additional payloads or exfiltrating data.
The attacker establishes persistence through the compromised process or other means.

Impact

Successful exploitation allows attackers to execute arbitrary code with elevated privileges, effectively bypassing Windows Defender. This can lead to complete system compromise, data theft, or deployment of ransomware. While the number of victims and targeted sectors are unknown, the potential impact is significant given the widespread use of Windows Defender in enterprise environments. Successful evasion allows malware to operate undetected, causing significant damage before discovery.