offensive security
Preventing 3rd Party DLLs from Injecting into your Malware
It is possible to launch a new process in such a way that Windows will prevent non Microsoft signed binaries from being injected into that process. This may be useful for evading some AVs/EDRs that perform userland hooking by injecting their DLLs into running process.
UpdateProcThreadAttribute
First method of achieving the objective is brought to us by UpdateProcThreadAttribute and one of the attributes it allows us set -
PROC_THREAD_ATTRIBUTE_MITIGATION_POLICYBelow code shows how to create a new notepad process with a mitigation policy that will not allow any non MS Signed binaries to be injected to it:
1
#include "pch.h"
2
#include <iostream>
3
#include <Windows.h>
4
​
5
int main()
6
{
7
PROCESS_INFORMATION pi = {};
8
STARTUPINFOEXA si = {};
9
SIZE_T attributeSize = 0;
10
11
InitializeProcThreadAttributeList(NULL, 1, 0, &attributeSize);
12
PPROC_THREAD_ATTRIBUTE_LIST attributes = (PPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, attributeSize);
13
InitializeProcThreadAttributeList(attributes, 1, 0, &attributeSize);
14
​
15
DWORD64 policy = PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON;
16
UpdateProcThreadAttribute(attributes, 0, PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY, &policy, sizeof(DWORD64), NULL, NULL);
17
si.lpAttributeList = attributes;
18
​
19
CreateProcessA(NULL, (LPSTR)"notepad", NULL, NULL, TRUE, EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, &si.StartupInfo, &pi);
20
HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, attributes);
21
​
22
return 0;
23
}
Copied!
Compiling and executing the above code will execute notepad.exe with a process mitigation policy that prevents non Microsoft binaries from getting injected into it. This can be confirmed with process hacker:
Below GIF shows the mitigation policy in action - non MS signed binaries are blocked, but a Microsoft binaries are let through:
Non Microsoft DLL being prevented from loading
It is worth mentioning that this is exactly what the
blockdlls does under the hood in Cobalt Strike.SetProcessMitigationPolicy
While playing with the first method, I stumbled upon a
SetProcessMitigationPolicy API that allows us to set the mitigation policy for the calling process itself ratther than for child processes as with the first technique:mitigationpolicy.cpp
1
PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY sp = {};
2
sp.MicrosoftSignedOnly = 1;
3
SetProcessMitigationPolicy(ProcessSignaturePolicy, &sp, sizeof(sp));
Copied!
In my limited testing, using
SetProcessMitigationPolicy did not prevent a well known EDR solution from injecting its DLL into my process on process creation. A quick debugging session confirmed why - the mitigation policy gets applied after the DLL has already been injected. Once the process has been initialized and is running, however, any further attempts to inject non Microsoft signed binaries will be prevented:If you've successfully abused
SetProcessMitigationPolicy, I would like to hear from you.Detection
I am sure there are better ways (if you know, I would like to hear), but here's the idea - use a powershell's
Get-ProcessMitigation cmdlet to enumerate the processes that run with MicrosoftSignedOnly mitigation set, investigate, baseline, repeat:1
get-process | select -exp processname -Unique | % { Get-ProcessMitigation -ErrorAction SilentlyContinue -RunningProcesses $_ | select processname, Id, @{l="Block non-MS Binaries"; e={$_.BinarySignature|select -exp MicrosoftSignedOnly} } }
Copied!
Below shows how the notepad.exe only allows MS Signed binaries to be injected into its process:
References
UpdateProcThreadAttribute function (processthreadsapi.h) - Win32 apps
docsmsft
SetProcessMitigationPolicy function (processthreadsapi.h) - Win32 apps
docsmsft
Cobalt Strike 3.14 – Post-Ex Omakase Shimasu - Cobalt Strike Research and Development
Cobalt Strike Research and Development