avatarElle Beau ❇︎

Free AI web copilot to create summaries, insights and extended knowledge, download it at here

6344

Abstract

lass="hljs-keyword">Get</span>-EventLog -logname security -InstanceId <span class="hljs-number">4720</span> | <span class="hljs-keyword">Select</span>-<span class="hljs-type">Object</span> *</pre></div><figure id="9247"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*1ogBlqZ-7dNeDpNg7baIUw.png"><figcaption></figcaption></figure><p id="fab0">Our initial assumption was accurate. Now, let’s list the privileges held by the <b><i>‘apt’ </i></b>user. Since we already know this user belongs to the Administrator group, we can confirm this by enumerating the admin group.</p><div id="0989"><pre>net localgroup Administrators</pre></div><figure id="31eb"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*n8AmAAO-wgl9guGrSdE1PQ.png"><figcaption></figcaption></figure><p id="2be9">However, the privileges held by the user <b><i>‘apt’</i></b> remain uncertain. To determine their access level, we will employ the Sysinternals tool called <b><i><a href="https://learn.microsoft.com/en-us/sysinternals/downloads/accesschk">accesschk</a>,’</i></b> which will assist us in identifying the extent of access granted to the ‘apt’ user. Go to the respective folder and this file with the below command attribute.</p><div id="f085"><pre>.\accesschk64<span class="hljs-selector-class">.exe</span> apt -<span class="hljs-selector-tag">a</span> *</pre></div><figure id="9f6f"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*kHHnzdbij_wQaZXIosY8sg.png"><figcaption></figcaption></figure><p id="7afb">Indeed, it’s confirmed that the user ‘apt’ possesses full privileges within the operating system. Our next step is to identify any active sessions associated with this user. To acquire this information, we can leverage system commands, Sysinternals tools, or even examine event logs. For now, we’ll opt for the Sysinternals tool ‘<a href="https://learn.microsoft.com/en-us/sysinternals/downloads/psloggedon">PsLoggedon</a>,’ which will help us determine any active login sessions.</p><figure id="7a36"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*SFoW2OOgM7DZZyVHPuDfSw.png"><figcaption></figcaption></figure><p id="e60d">This observation reveals that the user ‘apt’ has logged into the victim machine through system shares. To determine the origin of this connection, we can utilize the ‘net’ command to gather more information.</p><div id="d661"><pre>net session</pre></div><figure id="9ac1"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*JApyNvTUPHprvRSnyaJE6A.png"><figcaption></figcaption></figure><p id="0b6d">The observation indicates that the attacker’s machine is identified as <b><i>192.168.0.104</i></b>, and the connection to the victim’s machine remains active, suggesting that the attacker is currently on that system.</p><h1 id="0006">Process and Service Information</h1><p id="3547">Now, let’s extract valuable information from processes and services, as critical data is often concealed there. To gather process information, we have two PowerShell cmdlets at our disposal: ‘Get-Process’ and ‘Get-WmiObject Win32_Process.’ I recommend using ‘WmiObject’ because it provides more comprehensive data compared to the first cmdlet. We will retrieve a list of processes running at the time of the investigation.</p><div id="54a8"><pre><span class="hljs-keyword">Get</span>-WmiObject -<span class="hljs-keyword">Class</span> Win32_Process | <span class="hljs-keyword">select</span> ProcessName, ProcessId,CommandLine</pre></div><figure id="ea4e"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*okLiTkQMzF-ji_193xAgCg.png"><figcaption></figcaption></figure><p id="b190">Numerous processes are running, making it challenging to identify anomalies. However, given that user <b><i>VictimA</i></b> has been compromised, we should focus on processes initiated by this user.</p><div id="cca5"><pre>Get-WmiObject -Class Win32_Process | <span class="hljs-built_in">where</span> { <span class="hljs-variable">$_</span>.GetOwner().User -eq <span class="hljs-string">"VictimA"</span> } | <span class="hljs-keyword">select</span> ProcessId, Name, CommandLine</pre></div><figure id="4972"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*sh5NIGAVwx9SSsyg5ED1bg.png"><figcaption></figcaption></figure><p id="66f7">We noticed that some processes initiated by user <b><i>VictimA</i></b> appear suspicious based on their command lines. Let’s investigate the parent-child relationships for these processes using its Process ID.</p><div id="3dd1"><pre><span class="hljs-keyword">Get</span>-WmiObject -<span class="hljs-keyword">Class</span> Win32_Process | <span class="hljs-keyword">where</span> processid -<span class="hljs-keyword">In</span> <span class="hljs-number">7036</span>,<span class="hljs-number">5892</span>,<span class="hljs-number">5776</span>,<span class="hljs-number">9112</span>,<span class="hljs-number">7912</span>,<span class="hljs-number">460</span>,<span class="hljs-number">8864</span> | <span class="hljs-keyword">select</span> ParentProcessId,ProcessId, Name, CommandLine</pre></div><figure id="1b1a"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*5CeYdOtVvcy4bDPKdmxXbA.png"><figcaption></figcaption></figure><p id="ddaa">It has been observed that the <b><i>‘ad.bat’</i></b> file executed a PowerShell command. The purpose of this command was to download a PowerShell script and run it, specifying an IP address and port number as attributes. This suggests that the PowerShell script was designed to establish a reverse connection as part of an attack. The reference image is given from Process Explorer.</p><figure id="aaaa"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*fNdvmFTnbrtYE9MBTCAvdQ.png"><figcaption></figcaption></figure><p id="c8d3">Now that we have collected a significant amount of information about the suspicious processes, let’s shift our focus to the services, where we might find valuable insights. We will gather a list of all actively running services.</p><div id="6cfd"><pre>Get-WmiObject -<span class="hljs-keyword">class</span> <span class="hljs-title class_">Win32_service</span> |<span class="hljs-title">where</span> <span class="hljs-title">State</span> -<span class="hljs-title">eq</span> '<span class="hljs-title">Running</span>'| <span class="hljs

Options

-title">select</span> <span class="hljs-title">name</span>,<span class="hljs-type">processid</span>,<span class="hljs-type">status</span>,<span class="hljs-type">started</span>,<span class="hljs-type">state</span>,<span class="hljs-type">pathname</span></pre></div><figure id="1a9a"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*WVIZinER8JAbBjd-6vzfgg.png"><figcaption></figcaption></figure><p id="7bd7">No suspicious findings so far, but I’d like to take a closer look at the running services associated with the Process IDs we identified during our process investigation.</p><div id="2ff9"><pre>Get-WmiObject -<span class="hljs-keyword">class</span> <span class="hljs-title class_">Win32_service</span> |<span class="hljs-title">where</span> <span class="hljs-title">State</span> -<span class="hljs-title">eq</span> '<span class="hljs-title">Running</span>' |<span class="hljs-title">where</span> <span class="hljs-title">processid</span> -<span class="hljs-title">In</span> 7036,<span class="hljs-type">5892</span>,<span class="hljs-type">5776</span>,<span class="hljs-type">9112</span>,<span class="hljs-type">7912</span>,<span class="hljs-type">460</span>,<span class="hljs-type">8864|</span> <span class="hljs-title">select</span> <span class="hljs-title">name</span>,<span class="hljs-type">processid</span>,<span class="hljs-type">status</span>,<span class="hljs-type">started</span>,<span class="hljs-type">state</span>,<span class="hljs-type">pathname</span></pre></div><figure id="4c35"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*6CV3yOovqZM7JUBwaHnxYA.png"><figcaption></figcaption></figure><p id="49a9">Nothing suspicious was observed!!</p><h1 id="7870">Network Information</h1><p id="f2ac">As we’re aware of the reverse connection, our next step is to confirm its presence or establishment. To achieve this, we will utilize the <b><i>‘netstat</i></b>’ utility. Our first action is to retrieve a list of all connections.</p><figure id="786e"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*Ap9HOX5ljV59a3JvaZHSVQ.png"><figcaption></figcaption></figure><p id="11b0">Now, we’ll inspect the established connections and identify their owners. In our particular instance, we noted a connection on port 4444, and it’s associated with PowerShell, which is indicated by the PID 7912. This confirmation implies that a Command and Control session has been established on <b><i>192.168.0.108</i></b>.</p><figure id="0027"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*z-wRQ1UG_jCLSdxaYQPCdw.png"><figcaption></figcaption></figure><p id="b7dd">We’ll now examine the nature of communication between the compromised machine and the C2C server, which typically functions as a Master-Slave relationship. To inspect this interaction, we’ll employ Wireshark</p><figure id="5026"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*a_g9T6ZW98cMgq_iPdOznA.png"><figcaption></figcaption></figure><h1 id="c47c">Autorun and schedule task information</h1><p id="ab11">As we approached the final phase of our live forensics on the Windows machine, our attention was drawn to the C2C (Command and Control) connection, where the server was attempting to add a .bat file to the registry to establish persistence on the system. Before delving into the registry path, we conducted a preliminary check to see if any applications were located in the startup locations. Unfortunately, we did not discover any malicious applications in these areas.</p><figure id="bf7a"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*1_Ng1FqB8eP4KK8XE_jOxA.png"><figcaption></figcaption></figure><p id="43dd">At this point, our attention is directed towards the startup commands within the registry. We’ve noticed that a registry key has been added, and the associated file is named “sd.bat.”</p><div id="93c4"><pre>gwmi <span class="hljs-title class_">Win32</span>_StartupCommand</pre></div><figure id="2a07"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*6C5wTI9ysapfJD6q5WY_OA.png"><figcaption></figcaption></figure><p id="3a9e">We’ll make an effort to gather more detailed information regarding this specific startup location to gain deeper insights into the activity. This confirms that the activity recorded in network forensics has been successfully executed, and persistence has been maintained.</p><div id="f52f"><pre>gwmi Win32_StartupCommand | <span class="hljs-keyword">where</span> name -eq <span class="hljs-string">"APT"</span> | <span class="hljs-keyword">select</span> *</pre></div><figure id="8544"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*lfQO-8KyGLRyWen8Hg44-g.png"><figcaption></figcaption></figure><p id="bdef">We will now check if any other persistence activity has been observed via scheduled tasks. Unfortunately, no suspicious activity has been found.</p><div id="0fac"><pre><span class="hljs-keyword">Get</span><span class="hljs-operator">-</span>ScheduledTask <span class="hljs-operator">|</span> <span class="hljs-keyword">where</span> state <span class="hljs-operator">-</span>eq <span class="hljs-string">'Ready'</span></pre></div><figure id="cfb5"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*EihxglbQgcwtDh4rC5VPbQ.png"><figcaption></figcaption></figure><h1 id="51e5">Indicator of Attack</h1><p id="f3aa">- New user APT has been created — <b>Initial Access (T1078.003)</b>

  • User APT added to the admin group — <b>Privilege Escalation (T1098)</b>
  • The user ‘APT’ has logged into the victim’s machine using network services from the IP address 192.168.0.104 — <b>Lateral Movement (T1021.002)</b>
  • PowerShell commands were executed from a batch file, with the aim of downloading a PowerShell script and running it, providing an IP address and port number as inputs. This indicates the establishment of a reverse shell. — <b>Execution (T1059)</b>
  • I noticed a batch file added to HKU<user>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, indicating that this file will be executed upon user VictimA’s login. — <b>Persistence (T1547.001)</b></p><h1 id="afc0">Conclusion</h1><p id="3dda">The process we’ve discussed in this blog is not exhaustive, and there are other artifacts that can also be observed. We’ll aim to cover those in the next blog.</p></article></body>

Mass Shooters: What’s Really Driving Them?

It’s all about gaining power in the pecking order

Photo by Jay Heike on Unsplash

A mass shooting is an event when someone shoots at four or more people from a group that he has targeted and tries to kill them. One takes place almost every other day in America. Sometimes, every day. Some mass shootings make the national news and some don’t, but the high profile ones prompt discussions about things like mental health, violent video games, and gun restrictions.

Some mass shootings are related to dysfunctional family dynamics and some are related to criminal activity. But none of the discussions about mass public killings, the kind most often in the news, recognizes the root issue or asks why disaffected young white men are attracted to this dark path. They are overwhelmingly the demographic that is perpetrating this type of mass shooting. I believe what is actually driving this epidemic is our society’s patriarchal dominance hierarchy and the attempts of these young men who commit public mass killings to try to make their place in it.

Patriarchy commonly refers to a society where men have historically exercised primacy and power over women, but patriarchy is more broadly a social system that stratifies the entire society, with gender being only one variable. It is a pyramid-shaped hierarchy where a few elites occupy the top positions, and everyone else vies for the remaining rungs, often by stepping on those around them. This dynamic infuses all elements of our culture.

In the United States, nearly everyone at the apex of power and privilege is a white man. But, the vast majority of white men do not experience that elite status. Remember, it’s a pyramid. The ones who aren’t at the apex may feel bullied, downtrodden, and disaffected. They may feel friction between what they’ve been told is owed them, and what they can actually access. Some men may automatically and subconsciously dominate others because they don’t know how to opt-out of that system or how to resolve that friction. Mark Greene, of The Good Men Project, speaks of this paradigm as the man box.

Our dominant culture of masculinity, also called man box culture (a term based on the pioneering work of Paul Kivel and Tony Porter), enforces a performance of masculinity that has zero upper limits on the assertion of dominance. Man box culture is designed to enforce a bullying, hierarchical social order. It trains boys and men to accept bullying from those above them even as they are encouraged to dish it out to those below. And how much bullying is enough? ‘Whatever you can get away with,’ is the rule.

Although not all men buy into this paradigm, patriarchal masculine culture is rooted in stoicism, competitiveness, dominance, and aggression. It is a more deeply ingrained part of male socialization, but women participate in hierarchy too, for example, in the dynamic known as mean girls. Some have argued that men are just biologically programmed for these traits, but current anthropological data disagrees.

The idea of archaeological excavation as a way to extract the maximum information from a site — whether or not it contained archaeological treasures — took hold only much later. In fact, it was not until after World War II that archaeology as a systematic inquiry into the life, thought, technology, and social organization of our forebears truly began to come into its own.

These archaeological discoveries — deriving from what the British archaeologist James Mellaart calls a veritable archaeological revolution — open up the amazing world of our hidden past. They reveal a long period of peace and prosperity when our social, technological, and cultural evolution moved upward: many thousands of years when all the basic technologies on which civilization is built were developed in societies that were not male dominant, violent, and hierarchic.

Eisler, Riane. The Chalice and the Blade . HarperOne. Kindle Edition.

21st Century hunter-gatherer societies such as the Ju/’hoansi of Africa’s Kalahari desert are largely peaceful and egalitarian. Most anthropologists believe that Paleolithic hunter-gatherers probably lived the same way. Combine that with supporting archeological data from all pre-patriarchal societies, and the clear picture is that violence and constant striving for dominance is not, in fact, intrinsic to males or inevitable for society.

Pervasive violence and aggressive, coercive domination are relatively new parts of human culture, only appearing in the last 6–9 thousand years when Proto-Indo-European tribes overtook the “peaceful, matrilinear (hereditary through the female line), matrifocal, though egalitarian cultures of ‘Old Europe’, replacing it with a patriarchal warrior society.”

Earlier, cooperative societies were far from Utopian, but highly stratified classes and violent domination were not part of the social fabric. Today, ruthlessly jousting for better position and punishing those who resist their assigned place in the pyramid is a common way of not only keeping other people in their perceived place, it is also a way to rise in the hierarchy. American society still embraces the vestiges of Social Darwinism, with its underpinnings of might makes right and the survival of the fittest.

Social Darwinism has resulted in America becoming something like the modern world’s grimmest dystopia — a place where kids massacre each other every few days, and no one cares enough to lift a finger to help them. Why is that? Because the endpoint of Social Darwinism brings us to the darkest place of all. It is being a more savage predator than the next person that is the only guarantee of “fitness”.

How Social Darwinism Destroyed America From The Inside

Disaffected, alienated young white men who will never ascend the higher rungs of the dominance hierarchy still want to make their mark in it. Overwhelmingly, they want to be recognized, lionized and seen as powerful. The intensive media coverage of major mass shootings beginning with Columbine in 1999 has led to copycatting now known as the Columbine Effect.

Twelve school rampage shootings were recorded between 1999 and 2007 after Columbine took place. Eight of which (67%) directly referred to Columbine, either in the shooters own admission or in notes and written materials left behind. All shooters were male and in the shootings at Conyers, Georgia, Fort Gibson, Oklahoma, East Greenwich, New York, Red Lake, Minnesota, Hillsborough, North Carolina and Virginia Tech University, copycat traits were found with evidence that these involved imitations of the Columbine attacks. In the school shootings which took place outside of the United States, six out of the eleven found had direct references to Columbine.

The FBI reported that Eric Harris and Dylan Klebold planned the Columbine attack to be much more than a mass shooting. They intended the attack to be a massive bombing dwarfing the one in Oklahoma City. Fortunately, they were bad at wiring fuses and their bombs never detonated.

It wasn’t just “fame” they were after — Agent Fuselier bristles at that trivializing term — they were gunning for devastating infamy on the historical scale of an Attila the Hun. Their vision was to create a nightmare so devastating and apocalyptic that the entire world would shudder at their power.”

Ruthlessly killing people you consider beneath you, instilling fear into others like them, and making a big name for yourself (maybe even an international name), this is what mass shooters hope to achieve. It’s an attempt to climb the dominance hierarchy by relating to others only as competitors in a brutal pecking order to prove fitness to survive. Understanding the root cause of mass shootings shines a light on our need for a less domination-oriented and hierarchical culture. It is essential to teach young men, in particular, how to connect, empathize, and cooperate, thus breaking the cycle of automatic domination.

The piece above explores public mass shootings, which may have some similarities but also many differences from the mass shootings that are family killings or felony killings (ones with a criminal motive, such as gang killings or drug deals gone wrong). Here is more about the breakdown between the three types:

News
Gun Violence
Life
Mass Shootings
Hierarchy
Recommended from ReadMedium