# Bohops A blog about cybersecurity research, education, and news This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Abusing .NET Core CLR Diagnostic Features (+ CVE-2023-33127) DevFeed: [Abusing .NET Core CLR Diagnostic Features (+ CVE-2023-33127)]() Original publisher: [Read original article]() Author: bohops Published: 2023-11-27T12:51:30Z Content type: article Language: en Sources: [Bohops]() Topics: [.NET](), [net core](), [.NET Framework](), [Windows](), [configuration](), [Microsoft](), [debugging](), [API]() Tags: [api](), [configuration](), [debugging](), [microsoft](), [net](), [net-core](), [net-framework](), [uncategorized](), [windows]() ### AI overview This article examines how diagnostic features of the .NET Common Language Runtime can be abused, focusing on open-source .NET on modern Microsoft Windows systems. It discusses runtime configuration knobs, registry and environment-variable settings, configuration files, and the CLR profiling API, with defensive guidance and mitigation information referenced at the end. ### Source excerpt Introduction Background .NET is an ecosystem of frameworks, runtimes, and languages for building and running a wide range of applications on a variety of platforms and devices. The .NET Framework was initially released in the early 2000s as Microsoft's implementation of the Common Language Infrastructure (CLI) specification. In 2016, Microsoft released .NET Core, the first [...] ## No Alloc, No Problem: Leveraging Program Entry Points for Process Injection DevFeed: [No Alloc, No Problem: Leveraging Program Entry Points for Process Injection]() Original publisher: [Read original article]() Author: bohops Published: 2023-06-09T00:53:46Z Content type: tutorial Language: en Sources: [Bohops]() Topics: [Processes](), [Operating system](), [Code](), [modules]() Tags: [code](), [microsoft](), [modules](), [process](), [uncategorized]() ### AI overview This technical article examines process injection techniques that leverage program entry points, including the AddressOfEntryPoint in Portable Executable files. It describes approaches intended to avoid explicit memory allocation and direct thread creation or thread-context manipulation. ### Source excerpt Introduction Process Injection is a popular technique used by Red Teams and threat actors for defense evasion, privilege escalation, and other interesting use cases. At the time of this publishing, MITRE ATT&CK includes 12 (remote) process injection sub-techniques. Of course, there are numerous other examples as well as various and sundry derivatives. Recently, I was [...] ## Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion (Part 2) DevFeed: [Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion (Part 2)]() Original publisher: [Read original article]() Author: bohops Published: 2022-08-22T23:48:27Z Content type: article Language: en Sources: [Bohops]() Topics: [.NET](), [Endpoint Security & XDR](), [Processes](), [Windows](), [SIEM, Security, Observability]() Tags: [assembly](), [code](), [events](), [logs](), [monitoring](), [net](), [powershell](), [processes](), [research](), [uncategorized]() ### AI overview This article revisits .NET CLR Usage Logs and examines two additional tampering techniques that can prevent log creation, including discretionary ACL blocking. It also discusses how monitoring Usage Log creation events can help identify suspicious processes that loaded the .NET CLR. ### Source excerpt Introduction Last year, I blogged about Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion. In that part 1 post, we covered: Recently, I revisited the research topic to close the loop on some outstanding research and figured I would share. In this post, we'll recap .NET Usage Logs, highlight two other tampering techniques, [...] ## Unmanaged Code Execution with .NET Dynamic PInvoke DevFeed: [Unmanaged Code Execution with .NET Dynamic PInvoke]() Original publisher: [Read original article]() Author: bohops Published: 2022-04-02T16:45:49Z Content type: tutorial Language: en Sources: [Bohops]() Topics: [.NET](), [C#](), [Code](), [Endpoint Security & XDR]() Tags: [c-sharp](), [code](), [endpoint-security](), [interop](), [native](), [net](), [security](), [uncategorized]() ### AI overview This developer article explains classic P/Invoke in .NET and introduces Dynamic PInvoke, a technique for calling and executing native code differently from managed code. It discusses limitations, .NET executable structure, and possible defensive-evasion implications. ### Source excerpt Yes, you read that correctly - "Dynamic Pinvoke" as in "Dynamic Platform Invoke" Background Recently, I was browsing through Microsoft documentation and other blogs to gain a better understanding of .NET dynamic types and objects. I've always found the topic very interesting mainly due to its relative obscurity and the offensive opportunities for defensive evasion. [...] ## Analyzing and Detecting a VMTools Persistence Technique DevFeed: [Analyzing and Detecting a VMTools Persistence Technique]() Original publisher: [Read original article]() Author: bohops Published: 2021-10-08T03:42:18Z Content type: tutorial Language: en Sources: [Bohops]() Topics: [Persistence](), [configuration](), [Batch file](), [Process](), [Windows](), [Utility Software]() Tags: [batch](), [configuration](), [payload](), [persistence](), [process](), [script](), [uncategorized](), [utilities](), [windows]() ### AI overview This article analyzes a VMware Tools persistence technique on Windows virtual machines. It explains how VMwareToolBoxCmd.exe and the tools.conf file can configure batch scripts to run during VM power-state operations, and discusses detection strategies. The demonstrated payload runs as a child process of vmtoolsd. ### Source excerpt Introduction It is always fun to reexplore previously discovered techniques or pick back on old research that was put on the wayside in hopes to maybe finding something new or different. Recently, I stood up an ESXi server at home and decided to take a quick peak at the VMware directory structure after installing the [...] ## CVE-2021-0090: Intel Driver & Support Assistant (DSA) Elevation of Privilege (EoP) DevFeed: [CVE-2021-0090: Intel Driver & Support Assistant (DSA) Elevation of Privilege (EoP)]() Original publisher: [Read original article]() Author: bohops Published: 2021-08-07T16:30:24Z Content type: article Language: en Sources: [Bohops]() Topics: [intel](), [Utility Software](), [bug](), [Software](), [Windows](), [Web](), [web browser]() Tags: [browser](), [bug](), [configuration](), [cve](), [driver](), [intel](), [local](), [mount](), [payload](), [software](), [technical](), [uncategorized](), [web](), [windows]() ### AI overview This technical advisory examines a local privilege-escalation vulnerability in Intel Driver & Support Assistant version 20.8.30.6 and likely earlier versions. It describes how an unprivileged user can alter download and data-folder settings and potentially use a reparse point to cause a privileged file-copy operation and execute unintended code. ### Source excerpt TL;DR Intel Driver & Support Assistant (DSA) is a driver and software update utility for Intel components. DSA version 20.8.30.6 (and likely prior) is vulnerable to a local privilege escalation reparse point bug. An unprivileged user has nominal control over configuration settings within the web-based interface. This includes the ability to configure the folder location [...] ## Abusing and Detecting LOLBIN Usage of .NET Development Mode Features DevFeed: [Abusing and Detecting LOLBIN Usage of .NET Development Mode Features]() Original publisher: [Read original article]() Author: bohops Published: 2021-05-30T16:24:30Z Content type: tutorial Language: en Sources: [Bohops]() Topics: [.NET](), [configuration](), [Environment Variables](), [Development](), [Filesystems](), [Windows]() Tags: [configuration](), [debugging](), [development](), [environment-variables](), [files](), [microsoft](), [net](), [uncategorized](), [windows]() ### AI overview This article explains how .NET development-mode configuration can be abused to turn executables into living-off-the-land binaries by overriding Global Assembly Cache path lookups. It also discusses defensive detection considerations and shows the roles of configuration files and the DEVPATH environment variable. ### Source excerpt Background As discussed in this previous post, Microsoft has provided valuable (explicit and implicit) insight into the inner workings of the functional components of the .NET ecosystem through online documentation and by open-sourcing .NET Core. .NET, in general, is a very powerful and capable development platform and runtime framework for building and running .NET managed [...] ## Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion DevFeed: [Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion]() Original publisher: [Read original article]() Author: bohops Published: 2021-03-16T04:08:58Z Content type: article Language: en Sources: [Bohops]() Topics: [Endpoint Security & XDR](), [Logging](), [.NET](), [Security](), [Threat Hunting & Intel](), [Machine Learning, Security Attacks]() Tags: [code](), [endpoint-security](), [logging](), [net](), [process](), [processes](), [security](), [uncategorized]() ### AI overview This article examines how .NET CLR Usage Logs can help defenders detect and investigate .NET execution, including assembly injection into process memory. It describes how the CLR creates Usage Log files and discusses tampering techniques intended to evade endpoint detection, along with monitoring opportunities for identifying that tampering. ### Source excerpt Introduction In recent years, there have been numerous published techniques for evading endpoint security solutions and sources such as A/V, EDR and logging facilities. The methods deployed to achieve the desired result usually differ in sophistication and implementation, however, effectiveness is usually the end goal (of course, with thoughtful consideration of potential tradeoffs). Defenders can [...] ## Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe DevFeed: [Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe]() Original publisher: [Read original article]() Author: bohops Published: 2020-11-02T00:43:57Z Content type: article Language: en Sources: [Bohops]() Topics: [Windows](), [Microsoft](), [SDKs](), [Software](), [configuration]() Tags: [configuration](), [microsoft](), [sdk](), [software](), [software-development](), [uncategorized](), [windows]() ### AI overview This article examines wfc.exe, fsi.exe, and fsianycpu.exe in the context of Microsoft's recommended Windows Defender Application Control block rules. It describes their potential as LOLBIN bypass enablers and discusses testing WDAC policy enforcement without merging the block rules. ### Source excerpt Introduction In Part One, I blogged about VisualUiaVerifyNative.exe, a LOLBIN that could be used to bypass Windows Defender Application Control (WDAC)/Device Guard. The technique used for circumventing WDAC was originally discovered by Lee Christensen, however, it was not previously disclosed like a handful of others on the Microsoft Recommended Block Rules list. If you are [...] ## Exploring the WDAC Microsoft Recommended Block Rules: VisualUiaVerifyNative DevFeed: [Exploring the WDAC Microsoft Recommended Block Rules: VisualUiaVerifyNative]() Original publisher: [Read original article]() Author: bohops Published: 2020-10-15T03:24:58Z Content type: article Language: en Sources: [Bohops]() Topics: [Windows](), [Security](), [integrity](), [vulnerability](), [Exploit]() Tags: [microsoft](), [security](), [uncategorized](), [vulnerability](), [windows]() ### AI overview The article examines VisualUiaVerifyNative as an overlooked binary in Microsoft's WDAC Recommended Block Rules. It discusses WDAC application-control policies, code-integrity bypass techniques, and the role of block rules in mitigating residual risk. ### Source excerpt Introduction If you have followed this blog over the last few years, many of the posts focus on techniques for bypassing application control solutions such as Windows Defender Application Control (WDAC)/Device Guard and AppLocker. I have not been blogging as much lately but wanted to get back into the rhythm and establish a similar theme [...]