---
title: EDRバイパス入門
tags: 
author: [Masahiro Kawada](https://www.docswell.com/user/kawakatz)
site: [Docswell](https://www.docswell.com/)
thumbnail: https://bcdn.docswell.com/page/LE31KP5Z75.jpg?width=480
description: EDRバイパス入門 by Masahiro Kawada
published: August 16, 25
canonical: https://www.docswell.com/s/kawakatz/ZJQNPV-2025-08-16-095244
---
# Page. 1

![Page Image](https://bcdn.docswell.com/page/LE31KP5Z75.jpg)

EDRバイパス入門


# Page. 2

![Page Image](https://bcdn.docswell.com/page/8EDX3LD4JG.jpg)

自己紹介
GMOサイバーセキュリティ byイエラエ株式会社
オフェンシブセキュリティ部ペネトレーションテスト一課 シニアエンジニア
川田 柾浩
• 資格
• 著書
ペネトレーションテストの教科書 (ハッカーの技術書)
• その他
https://kawakatz.io/
https://x.com/kawakatz


# Page. 3

![Page Image](https://bcdn.docswell.com/page/V7PP42XV78.jpg)

概要
• 主にWindows端末でのEDR回避手法の例
• HavocベースでCrowdStrike Falcon、Microsoft Defender for Endpoint、Cortex XDRに検知され
ない.exe形式のマルウェアを実装
• 端末内での情報収集等については、今回は対象外


# Page. 4

![Page Image](https://bcdn.docswell.com/page/2JV2XDLRJQ.jpg)

目次
•
•
•
•
•
•
•
•
•
はじめに
macOS vs EDR
Havoc
vs YARA
vs CrowdStrike Falcon
vs Microsoft Defender for Endpoint
vs Cortex XDR
vs その他
おまけ


# Page. 5

![Page Image](https://bcdn.docswell.com/page/5EGRVYX6JL.jpg)

はじめに


# Page. 6

![Page Image](https://bcdn.docswell.com/page/4JQV6M827P.jpg)

EDRとは
EDR (Endpoint Detection and Response)
= (シグネチャベースの検知 + 振る舞い検知) + 検知対応機能
• シグネチャベースの検知
YARAルールによるスキャン
ファイルのハッシュ値の比較
...
• 振る舞い検知
新規プロセスの外部通信
重要ファイル/プロセスへのアクセス
Windows APIの監視
...


# Page. 7

![Page Image](https://bcdn.docswell.com/page/K74M4V2PJ1.jpg)

macOS vs EDR


# Page. 8

![Page Image](https://bcdn.docswell.com/page/LJ1843MXEG.jpg)

macOS vs EDR
macOSでの検知は比較的困難
SIPによる保護が厳しく、OSから取得できるログも比較的限定されているので、プロセスの悪性判
断が難しい
• SIP (System Integrity Protect)
システムファイル/アプリケーションの保護
プロセスの保護 （デバッグ、コードインジェクション、メモリアクセスの制限）
...
ただし、シグネチャベースの検知は問題なく行えるので、最近は各EDRも力を入れてきた印象


# Page. 9

![Page Image](https://bcdn.docswell.com/page/GJWZXP3KJ2.jpg)

macOS vs EDR
• ESF (Endpoint Security Framework)
ProcessMonitor: https://objective-see.org/products/utilities.html


# Page. 10

![Page Image](https://bcdn.docswell.com/page/4EZ16KVN73.jpg)

macOS vs EDR
• ESF (Endpoint Security Framework)
ProcessMonitor: https://objective-see.org/products/utilities.html


# Page. 11

![Page Image](https://bcdn.docswell.com/page/Y76L2Q59JV.jpg)

macOS vs EDR
• ESF (Endpoint Security Framework)
ProcessMonitor: https://objective-see.org/products/utilities.html


# Page. 12

![Page Image](https://bcdn.docswell.com/page/G7512RYDE4.jpg)

macOS vs EDR
• ESF (Endpoint Security Framework)
FileMonitor: https://objective-see.org/products/utilities.html


# Page. 13

![Page Image](https://bcdn.docswell.com/page/9J214DYM7R.jpg)

macOS vs EDR
• ESF (Endpoint Security Framework)
Red Canary Mac Monitor: https://github.com/redcanaryco/mac-monitor


# Page. 14

![Page Image](https://bcdn.docswell.com/page/DEYZM2GP7M.jpg)

macOS vs EDR
• Network Filter Extension
LuLu: https://objective-see.org/products/lulu.html


# Page. 15

![Page Image](https://bcdn.docswell.com/page/VJN3W8GMJ8.jpg)

macOS vs EDR
• Network Filter Extension
LuLu: https://objective-see.org/products/lulu.html


# Page. 16

![Page Image](https://bcdn.docswell.com/page/YE99XKWWE3.jpg)

macOS vs EDR
• Network Filter Extension
LuLu: https://objective-see.org/products/lulu.html
$ sudo log stream --level debug --predicate &#039;subsystem == &quot;com.objectivesee.lulu&quot;&#039;


# Page. 17

![Page Image](https://bcdn.docswell.com/page/GE892RNR7D.jpg)

macOS vs EDR
• Network Filter Extension
Netiquette: https://objective-see.org/products/netiquette.html


# Page. 18

![Page Image](https://bcdn.docswell.com/page/LELW2KP2JR.jpg)

macOS vs EDR
• Unified Logging


# Page. 19

![Page Image](https://bcdn.docswell.com/page/4JM98249EW.jpg)

macOS vs EDR
検知が難しい例
 JavaScript for Automationの検知
※ JavaScript for Automation ≒ WindowsのPowerShell


# Page. 20

![Page Image](https://bcdn.docswell.com/page/PJRG5MW9E9.jpg)

macOS vs EDR
• Apfell
https://github.com/MythicAgents/apfell
JXA (JavaScript for Automation)をベースとしたペイロード


# Page. 21

![Page Image](https://bcdn.docswell.com/page/PEXXKVP3EX.jpg)

macOS vs EDR
• Apfell


# Page. 22

![Page Image](https://bcdn.docswell.com/page/3EKW5QDNED.jpg)

macOS vs EDR
• Apfell


# Page. 23

![Page Image](https://bcdn.docswell.com/page/L731KPRZJ5.jpg)

macOS vs EDR
• vs CrowdStrike (当時)
OSAKitの使用
 NG
.jsファイルをosascriptコマンドで実行
 ペイロードによってはNG


# Page. 24

![Page Image](https://bcdn.docswell.com/page/87DX3LY4EG.jpg)

macOS vs EDR
• vs CrowdStrike (当時)
マルウェアからosascriptコマンドを実行し、標準入力経由でペイロードを渡す


# Page. 25

![Page Image](https://bcdn.docswell.com/page/VJPP426VJ8.jpg)

macOS vs EDR
• vs CrowdStrike (当時)


# Page. 26

![Page Image](https://bcdn.docswell.com/page/2EV2XD3REQ.jpg)

macOS vs EDR
シグネチャベースの検知回避として、独自のMythic Agentを開発するのもあり
• How to create your own mythic agent in C:
https://red-team-sncf.github.io/how-to-create-your-own-mythic-agent-in-c.html
• 1. Agent Message Format:
https://docs.mythic-c2.net/customizing/payload-type-development/create_tasking/agentside-coding/agent-message-format


# Page. 27

![Page Image](https://bcdn.docswell.com/page/57GRVY36EL.jpg)

Havoc


# Page. 28

![Page Image](https://bcdn.docswell.com/page/4EQV6M52JP.jpg)

Havoc
• Havoc
https://github.com/HavocFramework/Havoc
OSSのC2フレームワーク
 BOFを実行する機能を持つ


# Page. 29

![Page Image](https://bcdn.docswell.com/page/KJ4M4V9PE1.jpg)

Havoc
• Havoc
https://github.com/HavocFramework/Havoc
OSSのC2フレームワーク
 BOFを実行する機能を持つ


# Page. 30

![Page Image](https://bcdn.docswell.com/page/LE1843KX7G.jpg)

BOF
• BOF (Beacon Object File)
マルウェアのメインスレッドで実行される
 新規プロセス/スレッドを生成することなくコードを実行可能
 検知回避の観点で大きなメリット
注意事項
 実行中はメインスレッドが占有されるため、長時間の処理には向かない
 BOFがクラッシュするとマルウェアのプロセスが死んでしまう


# Page. 31

![Page Image](https://bcdn.docswell.com/page/GEWZXPDKE2.jpg)

BOF


# Page. 32

![Page Image](https://bcdn.docswell.com/page/47Z16KGNJ3.jpg)

BOF
• COFF (Common Object File Format)
半完成品のコードで、Loaderを用いて初めて実行できる
COFF Loader: https://github.com/trustedsec/COFFLoader


# Page. 33

![Page Image](https://bcdn.docswell.com/page/YJ6L2QY9EV.jpg)

BOF
• COFF (Common Object File Format)
半完成品のコードで、Loaderを用いて初めて実行できる
COFF Loader: https://github.com/trustedsec/COFFLoader


# Page. 34

![Page Image](https://bcdn.docswell.com/page/GJ512RGD74.jpg)

BOF
• COFF (Common Object File Format)
半完成品のコードで、Loaderを用いて初めて実行できる
COFF Loader: https://github.com/trustedsec/COFFLoader


# Page. 35

![Page Image](https://bcdn.docswell.com/page/LE31KPPQ75.jpg)

BOF
• Various BOF collection
https://github.com/crypt0p3g/bof-collection


# Page. 36

![Page Image](https://bcdn.docswell.com/page/8EDX3LLWJG.jpg)

Shellcode
”Windows Shellcode” ≠ Shellcode (Position-Independent Code)


# Page. 37

![Page Image](https://bcdn.docswell.com/page/V7PP422X78.jpg)

Shellcode
”Windows Shellcode” ≠ Shellcode (Position-Independent Code)
Reflective
DLL
Loader
DLL


# Page. 38

![Page Image](https://bcdn.docswell.com/page/2JV2XDD3JQ.jpg)

Reflective DLL Loader
メモリ上に存在するDLLを読み込む技術 (Position-Independent Code)
payloads/Shellcode/


# Page. 39

![Page Image](https://bcdn.docswell.com/page/5EGRVYYYJL.jpg)

DLL
Reflective DLL Loaderから読み込まれるDLLでHavocのメイン機能を実装
payloads/Demon/


# Page. 40

![Page Image](https://bcdn.docswell.com/page/4JQV6MM67P.jpg)

Shellcode Runner
• 実行ファイル(.exe)形式
• 検知回避のため、独自実装のものを使用
• AIで生成したものから開始


# Page. 41

![Page Image](https://bcdn.docswell.com/page/K74M4VVMJ1.jpg)

Shellcode Runner


# Page. 42

![Page Image](https://bcdn.docswell.com/page/LJ18433YEG.jpg)

まとめ
• Reflective DLL Loader
• DLL
• Shellcode Runner


# Page. 43

![Page Image](https://bcdn.docswell.com/page/GJWZXPP1J2.jpg)

vs YARA


# Page. 44

![Page Image](https://bcdn.docswell.com/page/4EZ16KKX73.jpg)

YARA
EDRでもシグネチャベースの検知に用いられるパターンマッチングルール
• vs Havoc
https://github.com/elastic/protections-artifacts/blob/main/yara/rules/Windows_Trojan_Havoc.yar


# Page. 45

![Page Image](https://bcdn.docswell.com/page/Y76L2QQPJV.jpg)

vs YARA


# Page. 46

![Page Image](https://bcdn.docswell.com/page/G7512RRPE4.jpg)

vs YARA
Windows_Trojan_Havoc_9c7bb863
0x0:$a1: 56 48 89 E6 48 83 E4 F0 48 83 EC 20 E8 0F 00 00 00 48 89 F4 5E C3
0x2ea:$a2: 65 48 8B 04 25 60 00 00 00
https://defuse.ca/online-x86-assembler.htm


# Page. 47

![Page Image](https://bcdn.docswell.com/page/9J214DDZ7R.jpg)

vs YARA
Windows_Trojan_Havoc_9c7bb863
0x0:$a1: 56 48 89 E6 48 83 E4 F0 48 83 EC 20 E8 0F 00 00 00 48 89 F4 5E C3
0x2ea:$a2: 65 48 8B 04 25 60 00 00 00


# Page. 48

![Page Image](https://bcdn.docswell.com/page/DEYZM22N7M.jpg)

vs YARA
Windows_Trojan_Havoc_9c7bb863
0x0:$a1: 56 48 89 E6 48 83 E4 F0 48 83 EC 20 E8 0F 00 00 00 48 89 F4 5E C3
0x2ea:$a2: 65 48 8B 04 25 60 00 00 00


# Page. 49

![Page Image](https://bcdn.docswell.com/page/VJN3W88VJ8.jpg)

vs YARA
Windows_Trojan_Havoc_9c7bb863
0x0:$a1: 56 48 89 E6 48 83 E4 F0 48 83 EC 20 E8 0F 00 00 00 48 89 F4 5E C3
0x2ea:$a2: 65 48 8B 04 25 60 00 00 00


# Page. 50

![Page Image](https://bcdn.docswell.com/page/YE99XKKVE3.jpg)

vs YARA
Windows_Trojan_Havoc_9c7bb863
0x0:$a1: 56 48 89 E6 48 83 E4 F0 48 83 EC 20 E8 0F 00 00 00 48 89 F4 5E C3
0x2ea:$a2: 65 48 8B 04 25 60 00 00 00
https://defuse.ca/online-x86-assembler.htm


# Page. 51

![Page Image](https://bcdn.docswell.com/page/GE892RR47D.jpg)

GSレジスタ
スレッド情報にアクセスするためのレジスタ
GS: 0x30 =&gt; TEB (Thread Environment Block)
GS: 0x60 =&gt; PEB (Process Environment Block) … ①
TEB (GS: 0x30) + 0x60 =&gt; PEB … ②


# Page. 52

![Page Image](https://bcdn.docswell.com/page/LELW2KKVJR.jpg)

vs YARA
Windows_Trojan_Havoc_9c7bb863
0x0:$a1: 56 48 89 E6 48 83 E4 F0 48 83 EC 20 E8 0F 00 00 00 48 89 F4 5E C3
0x2ea:$a2: 65 48 8B 04 25 60 00 00 00
https://defuse.ca/online-x86-assembler.htm


# Page. 53

![Page Image](https://bcdn.docswell.com/page/4JM9822NEW.jpg)

vs YARA
Windows_Trojan_Havoc_9c7bb863
0x0:$a1: 56 48 89 E6 48 83 E4 F0 48 83 EC 20 E8 0F 00 00 00 48 89 F4 5E C3
0x2ea:$a2: 65 48 8B 04 25 60 00 00 00


# Page. 54

![Page Image](https://bcdn.docswell.com/page/PJRG5MM4E9.jpg)

vs YARA
• Before
• After


# Page. 55

![Page Image](https://bcdn.docswell.com/page/PEXXKVVZEX.jpg)

vs YARA
Windows_Trojan_Havoc_88053562
0xffcb:$a: 48 81 EC F8 04 00 00 48 8D 7C 24 78 44 89 8C 24 58 05 00 00 48 8B AC 24 60 05
00 00 4C 8D 6C 24 78 F3 AB B9 59 00 00 00 48 C7 44 24 70 00 00 00 00 C7 44 24 78 68 00 00
00 C7 84 24 B4 00 00 00


# Page. 56

![Page Image](https://bcdn.docswell.com/page/3EKW5QQVED.jpg)

vs YARA
Windows_Trojan_Havoc_88053562
0xffcb:$a: 48 81 EC F8 04 00 00 48 8D 7C 24 78 44 89 8C 24 58 05 00 00 48 8B AC 24 60 05
00 00 4C 8D 6C 24 78 F3 AB B9 59 00 00 00 48 C7 44 24 70 00 00 00 00 C7 44 24 78 68 00 00
00 C7 84 24 B4 00 00 00


# Page. 57

![Page Image](https://bcdn.docswell.com/page/L731KPKQJ5.jpg)

vs YARA


# Page. 58

![Page Image](https://bcdn.docswell.com/page/87DX3L3WEG.jpg)

vs YARA
sudo ./havoc server --profile profiles/havoc.yaotl -v --debug --debug-dev


# Page. 59

![Page Image](https://bcdn.docswell.com/page/VJPP424XJ8.jpg)

vs YARA
Windows_Trojan_Havoc_88053562
0xffcb:$a: 48 81 EC F8 04 00 00 48 8D 7C 24 78 44 89 8C 24 58 05 00 00 48 8B AC 24 60 05
00 00 4C 8D 6C 24 78 F3 AB B9 59 00 00 00 48 C7 44 24 70 00 00 00 00 C7 44 24 78 68 00 00
00 C7 84 24 B4 00 00 00


# Page. 60

![Page Image](https://bcdn.docswell.com/page/2EV2XDX3EQ.jpg)

vs YARA
Windows_Trojan_Havoc_88053562
0xffcb:$a: 48 81 EC F8 04 00 00 48 8D 7C 24 78 44 89 8C 24 58 05 00 00 48 8B AC 24 60 05
00 00 4C 8D 6C 24 78 F3 AB B9 59 00 00 00 48 C7 44 24 70 00 00 00 00 C7 44 24 78 68 00 00
00 C7 84 24 B4 00 00 00


# Page. 61

![Page Image](https://bcdn.docswell.com/page/57GRVYVYEL.jpg)

vs YARA


# Page. 62

![Page Image](https://bcdn.docswell.com/page/4EQV6M66JP.jpg)

vs YARA


# Page. 63

![Page Image](https://bcdn.docswell.com/page/KJ4M4V4ME1.jpg)

vs YARA


# Page. 64

![Page Image](https://bcdn.docswell.com/page/LE18434Y7G.jpg)

vs YARA
Windows_Trojan_Havoc_88053562
0xffcb:$a: 48 81 EC F8 04 00 00 48 8D 7C 24 78 44 89 8C 24 58 05 00 00 48 8B AC 24 60 05
00 00 4C 8D 6C 24 78 F3 AB B9 59 00 00 00 48 C7 44 24 70 00 00 00 00 C7 44 24 78 68 00 00
00 C7 84 24 B4 00 00 00


# Page. 65

![Page Image](https://bcdn.docswell.com/page/GEWZXPX1E2.jpg)

vs YARA
Windows_Trojan_Havoc_ffecc8af
0x181ff:$commands_table: 0B 00 00 00 00 00 00 00 20 64 2B A4 02 00 00 00 64 00 00 00 00 00
00 00 00 34 2B A4 02 00 00 00 15 00 00 00 00 00 00 00 70 4A 2B A4 02 00 00 00 10 10 00 00
00 00 00 00 30 5A 2B A4 02 00 00 00 ...


# Page. 66

![Page Image](https://bcdn.docswell.com/page/47Z16K6XJ3.jpg)

vs YARA
Windows_Trojan_Havoc_ffecc8af
0x181ff:$commands_table: 0B 00 00 00 00 00 00 00 20 64 2B A4 02 00 00 00 64 00 00 00 00 00
00 00 00 34 2B A4 02 00 00 00 15 00 00 00 00 00 00 00 70 4A 2B A4 02 00 00 00 10 10 00 00
00 00 00 00 30 5A 2B A4 02 00 00 00 ...


# Page. 67

![Page Image](https://bcdn.docswell.com/page/YJ6L2Q2PEV.jpg)

vs YARA
Windows_Trojan_Havoc_ffecc8af
0x181ff:$commands_table: 0B 00 00 00 00 00 00 00 20 64 2B A4 02 00 00 00 64 00 00 00 00 00
00 00 00 34 2B A4 02 00 00 00 15 00 00 00 00 00 00 00 70 4A 2B A4 02 00 00 00 10 10 00 00
00 00 00 00 30 5A 2B A4 02 00 00 00 ...


# Page. 68

![Page Image](https://bcdn.docswell.com/page/GJ512R2P74.jpg)

vs YARA
Windows_Trojan_Havoc_ffecc8af
0x181ff:$commands_table: 0B 00 00 00 00 00 00 00 20 64 2B A4 02 00 00 00 64 00 00 00 00 00
00 00 00 34 2B A4 02 00 00 00 15 00 00 00 00 00 00 00 70 4A 2B A4 02 00 00 00 10 10 00 00
00 00 00 00 30 5A 2B A4 02 00 00 00 ...


# Page. 69

![Page Image](https://bcdn.docswell.com/page/9E214D4ZJR.jpg)

vs YARA
0x76:$hash_ldrloaddll: 43 6A 45 9E
0x7528:$hash_ldrloaddll: 43 6A 45 9E
0x13969:$hash_ntaddbootentry: 76 C7 FC 8C
0x89:$hash_ntallocatevirtualmemory: EC B8 83 F7
0x788c:$hash_ntallocatevirtualmemory: EC B8 83 F7
0x7b36:$hash_ntfreevirtualmemory: 09 C6 02 28
0x7b55:$hash_ntunmapviewofsection: CD 12 A4 6A
0x7ad9:$hash_ntwritevirtualmemory: 92 01 17 C3
0x77d2:$hash_ntsetinformationvirtualmemory: 39 C2 6A 94
0x7b74:$hash_ntqueryvirtualmemory: 5D E8 C0 10
0x7a5d:$hash_ntopenprocesstoken: 99 CA 0D 35
0x78e9:$hash_ntopenthreadtoken: D2 47 33 80


# Page. 70

![Page Image](https://bcdn.docswell.com/page/D7YZM2MNJM.jpg)

vs YARA


# Page. 71

![Page Image](https://bcdn.docswell.com/page/VEN3W8WVE8.jpg)

vs YARA


# Page. 72

![Page Image](https://bcdn.docswell.com/page/Y799XKXV73.jpg)

vs YARA


# Page. 73

![Page Image](https://bcdn.docswell.com/page/G7892R24JD.jpg)

vs YARA


# Page. 74

![Page Image](https://bcdn.docswell.com/page/L7LW2K2VER.jpg)

vs YARA


# Page. 75

![Page Image](https://bcdn.docswell.com/page/4EM9828N7W.jpg)

vs YARA
OK


# Page. 76

![Page Image](https://bcdn.docswell.com/page/PERG5M5479.jpg)

vs CrowdStrike Falcon


# Page. 77

![Page Image](https://bcdn.docswell.com/page/P7XXKVKZ7X.jpg)

CrowdStrike Falcon
• トップクラスのEDR
• MLを用いた静的解析など
• インジェクション系の関数も注力的に監視
=&gt; シンプルにShellcodeを実行するのがベスト
• ADに関する攻撃も結構見てくれる印象
• OverWatchも優秀
=&gt; かゆいところに手が届いて良い


# Page. 78

![Page Image](https://bcdn.docswell.com/page/37KW5Q5V7D.jpg)

CrowdStrike Falcon


# Page. 79

![Page Image](https://bcdn.docswell.com/page/LJ31KP1QE5.jpg)

CrowdStrike Falcon
• CrowdStrike
• Normal


# Page. 80

![Page Image](https://bcdn.docswell.com/page/8JDX3LXW7G.jpg)

CrowdStrike Falcon


# Page. 81

![Page Image](https://bcdn.docswell.com/page/VEPP42PXE8.jpg)

CrowdStrike Falcon
• Mini-Filter


# Page. 82

![Page Image](https://bcdn.docswell.com/page/27V2XD237Q.jpg)

CrowdStrike Falcon
• Mini-Filter


# Page. 83

![Page Image](https://bcdn.docswell.com/page/5JGRVYRY7L.jpg)

CrowdStrike Falcon
• WFP (Windows Filtering Platform) Filter


# Page. 84

![Page Image](https://bcdn.docswell.com/page/47QV6MV6EP.jpg)

vs CrowdStrike
Shellcode Runnerに対するMachine Learningの検知


# Page. 85

![Page Image](https://bcdn.docswell.com/page/KE4M4VMM71.jpg)

vs CrowdStrike


# Page. 86

![Page Image](https://bcdn.docswell.com/page/L718438YJG.jpg)

vs CrowdStrike


# Page. 87

![Page Image](https://bcdn.docswell.com/page/G7WZXPZ172.jpg)

vs CrowdStrike


# Page. 88

![Page Image](https://bcdn.docswell.com/page/4JZ16K1XE3.jpg)

vs Microsoft Defender for Endpoint


# Page. 89

![Page Image](https://bcdn.docswell.com/page/YE6L2QLP7V.jpg)

Microsoft Defender for Endpoint
• トップクラスのEDR
• Microsoft製品で統一している会社で広く導入
• CrowdStrikeとは味が違うけど良い


# Page. 90

![Page Image](https://bcdn.docswell.com/page/GE512R1PJ4.jpg)

vs Microsoft Defender for Endpoint


# Page. 91

![Page Image](https://bcdn.docswell.com/page/97214D1ZER.jpg)

vs Microsoft Defender for Endpoint


# Page. 92

![Page Image](https://bcdn.docswell.com/page/DJYZM2ZNEM.jpg)

vs Microsoft Defender for Endpoint


# Page. 93

![Page Image](https://bcdn.docswell.com/page/V7N3W83V78.jpg)

vs Microsoft Defender for Endpoint


# Page. 94

![Page Image](https://bcdn.docswell.com/page/YJ99XK9VJ3.jpg)

Sleep Mask
• Sleep中にShellcodeを暗号化してシグネチャベースの検知を回避
Cobalt Strike: Sleep Mask Kit、BeaconGate + Sleepmask-VS
Havoc: Sleep Technique
sleep mask
shellcode


# Page. 95

![Page Image](https://bcdn.docswell.com/page/GJ892R94ED.jpg)

vs Microsoft Defender for Endpoint


# Page. 96

![Page Image](https://bcdn.docswell.com/page/LJLW2KWV7R.jpg)

vs Microsoft Defender for Endpoint


# Page. 97

![Page Image](https://bcdn.docswell.com/page/47M9829NJW.jpg)

vs Cortex XDR


# Page. 98

![Page Image](https://bcdn.docswell.com/page/P7RG5MG4J9.jpg)

Cortex XDR
• トップクラスのEDR
• 日本企業では少しレア
• YARAでのスキャンが凶悪
=&gt; YARAでスキャンされないようにしたい


# Page. 99

![Page Image](https://bcdn.docswell.com/page/PJXXKVXZJX.jpg)

vs Cortex XDR
プロセスメモリ中のShellcodeに対する検知


# Page. 100

![Page Image](https://bcdn.docswell.com/page/3JKW5QWVJD.jpg)

vs Cortex XDR
プロセスメモリ中のShellcodeに対する検知


# Page. 101

![Page Image](https://bcdn.docswell.com/page/LE31KPWQ75.jpg)

vs Cortex XDR
• PART 3: How I Met Your Beacon – Brute Ratel
https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/
As we can see, the DLLs highlighted are all the DLLs that are loaded when
the badger is injected. This list includes the loading of winhttp.dll and
wininet.dll, which are not necessarily nefarious but are traditional
loads for an egress beacon. There are however a number of less common
DLLs loaded, such as dbghelp.dll, credui.dll samcli.dll and logoncli.dll
amongst others.
This behaviour allows us to create a signature for the image loads and
leads to a high signal indicator that can be hunted for through image
load telemetry.


# Page. 102

![Page Image](https://bcdn.docswell.com/page/8EDX3LKWJG.jpg)

vs Cortex XDR


# Page. 103

![Page Image](https://bcdn.docswell.com/page/V7PP42KX78.jpg)

vs Cortex XDR


# Page. 104

![Page Image](https://bcdn.docswell.com/page/2JV2XDV3JQ.jpg)

vs Cortex XDR


# Page. 105

![Page Image](https://bcdn.docswell.com/page/5EGRVYLYJL.jpg)

vs Cortex XDR


# Page. 106

![Page Image](https://bcdn.docswell.com/page/4JQV6MY67P.jpg)

vs Cortex XDR


# Page. 107

![Page Image](https://bcdn.docswell.com/page/K74M4VWMJ1.jpg)

vs Cortex XDR


# Page. 108

![Page Image](https://bcdn.docswell.com/page/LJ1843YYEG.jpg)

Proxy Loading
別スレッドからLoadLibraryW関数を呼び出し、Call Stackが綺麗な状態を保つ
• RtlRegisterWait
• RtlCreateTimer
• RtlQueueWorkItem


# Page. 109

![Page Image](https://bcdn.docswell.com/page/GJWZXPG1J2.jpg)

Proxy Loading (RtlRegisterWait)
• RtlRegisterWait
登録したイベントがシグナル状態かタイムアウトした場合に、callback関数が呼び出される
ThreadPool: 非同期タスクやcallback関数を効率よく実行するための仕組み
 Worker Thread: 関数を実行するためのスレッド
 Wait Thread: イベント等の待機状態を監視し、原則Worker Threadで関数を実行
Instance-&gt;Win32.RtlRegisterWait(
&amp;Timer,
Event,
C_PTR( Instance-&gt;Win32.LoadLibraryW ), // callback関数
NameW, // 引数
0, // 待機時間
WT_EXECUTEONLYONCE | WT_EXECUTEINWAITTHREAD
// callback関数実行後に登録解除 | Wait Threadでcallback関数を実行
)


# Page. 110

![Page Image](https://bcdn.docswell.com/page/4EZ16KLX73.jpg)

Proxy Loading (RtlRegisterWait)
• Havoc
payloads/Demon/src/core/Win32.c


# Page. 111

![Page Image](https://bcdn.docswell.com/page/Y76L2QWPJV.jpg)

Proxy Loading (RtlRegisterWait)
• Havoc


# Page. 112

![Page Image](https://bcdn.docswell.com/page/G7512RMPE4.jpg)

Proxy Loading (RtlRegisterWait)


# Page. 113

![Page Image](https://bcdn.docswell.com/page/9J214D9Z7R.jpg)

Proxy Loading (RtlRegisterWait)
ls C:\Users\kawada\


# Page. 114

![Page Image](https://bcdn.docswell.com/page/DEYZM24N7M.jpg)

Proxy Loading (RtlRegisterWait)


# Page. 115

![Page Image](https://bcdn.docswell.com/page/VJN3W8YVJ8.jpg)

vs Cortex XDR
OK


# Page. 116

![Page Image](https://bcdn.docswell.com/page/YE99XKPVE3.jpg)

Call Stack Spoofing
関数呼び出し時にCall Stackを偽装する技術


# Page. 117

![Page Image](https://bcdn.docswell.com/page/GE892RD47D.jpg)

Call Stack Spoofing
関数呼び出し時にCall Stackを偽装する技術


# Page. 118

![Page Image](https://bcdn.docswell.com/page/LELW2KMVJR.jpg)

Call Stack Spoofing
関数呼び出し時にCall Stackを偽装する技術


# Page. 119

![Page Image](https://bcdn.docswell.com/page/4JM982YNEW.jpg)

Call Stack Spoofing
関数呼び出し時にCall Stackを偽装する技術


# Page. 120

![Page Image](https://bcdn.docswell.com/page/PJRG5M94E9.jpg)

Call Stack Spoofing
• Havoc


# Page. 121

![Page Image](https://bcdn.docswell.com/page/PEXXKVQZEX.jpg)

Call Stack Spoofing
• Havoc
SpoofFunc(
Instance-&gt;Modules.Kernel32,
IMAGE_SIZE( Instance-&gt;Modules.Kernel32 ),
Instance-&gt;Win32.WaitForSingleObjectEx,
NtCurrentProcess(),
C_PTR( TimeOut ),
FALSE
);


# Page. 122

![Page Image](https://bcdn.docswell.com/page/3EKW5Q9VED.jpg)

Call Stack Spoofing
• Havoc


# Page. 123

![Page Image](https://bcdn.docswell.com/page/L731KP9QJ5.jpg)

Call Stack Spoofing
• Havoc


# Page. 124

![Page Image](https://bcdn.docswell.com/page/87DX3LGWEG.jpg)

Call Stack Spoofing
※ コメントは追記したもの


# Page. 125

![Page Image](https://bcdn.docswell.com/page/VJPP423XJ8.jpg)

Call Stack Spoofing


# Page. 126

![Page Image](https://bcdn.docswell.com/page/2EV2XD43EQ.jpg)

Call Stack Spoofing


# Page. 127

![Page Image](https://bcdn.docswell.com/page/57GRVY1YEL.jpg)

Call Stack Spoofing


# Page. 128

![Page Image](https://bcdn.docswell.com/page/4EQV6MD6JP.jpg)

Call Stack Spoofing


# Page. 129

![Page Image](https://bcdn.docswell.com/page/KJ4M4VZME1.jpg)

vs その他


# Page. 130

![Page Image](https://bcdn.docswell.com/page/LE1843RY7G.jpg)

vs カスタムルール
CrowdStrikeの例
• Process Creation
• File Creation
• Network Connection
• Domain Name


# Page. 131

![Page Image](https://bcdn.docswell.com/page/GEWZXP11E2.jpg)

vs カスタムルール


# Page. 132

![Page Image](https://bcdn.docswell.com/page/47Z16KPXJ3.jpg)

vs SACL
• SACL (System Access Control List)
純粋なファイルアクセスを監視することが可能


# Page. 133

![Page Image](https://bcdn.docswell.com/page/YJ6L2QMPEV.jpg)

vs SACL
• SACL (System Access Control List)
純粋なファイルアクセスを監視することが可能


# Page. 134

![Page Image](https://bcdn.docswell.com/page/GJ512RZP74.jpg)

vs SACL
• SACL (System Access Control List)
純粋なファイルアクセスを監視することが可能


# Page. 135

![Page Image](https://bcdn.docswell.com/page/LE31KP9675.jpg)

vs SACL


# Page. 136

![Page Image](https://bcdn.docswell.com/page/8EDX3LGMJG.jpg)

vs Sysmon
詳細な調整が可能な玄人向けツール
https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon


# Page. 137

![Page Image](https://bcdn.docswell.com/page/V7PP423Q78.jpg)

vs Sysmon
詳細な調整が可能な玄人向けツール
https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon


# Page. 138

![Page Image](https://bcdn.docswell.com/page/2JV2XD4PJQ.jpg)

おまけ


# Page. 139

![Page Image](https://bcdn.docswell.com/page/5EGRVY1QJL.jpg)

検知パターン
端末内での検知例
• オペレーションミス
不適切な方法でのSAM/SYSTEM/SECURITYファイルのダンプ
不適切なプロセスを用いた外部/内部への通信
• 検知ロジック更新
AMSIの検知回避手法に対する検知強化
Machine Learning/シグネチャの検知ロジック更新
• カスタムルール
Chromeのデバッグモード起動
定期的な/不審な通信先への外部通信


# Page. 140

![Page Image](https://bcdn.docswell.com/page/4JQV6MDW7P.jpg)

検知後
• クリーンアップ
感染したアカウントのセッション/認証情報無効化
感染した端末のクリーンアップ
横展開先の端末/サーバのクリーンアップ
攻撃者が取得した認証情報/アクセス権等の無効化
...
• 検知強化
マルウェアの形式、ファイル名、通信先、永続化手法
フィッシングの経路、シナリオ、環境構成


# Page. 141

![Page Image](https://bcdn.docswell.com/page/K74M4VZ1J1.jpg)

今後
•
•
•
•
他形式のマルウェア開発
通信先の選定
AMSI/ETW等の検知機能の回避
横展開時のマルウェア実行方法
•
•
•
•
•
Cookies/Login Dataおよび暗号鍵の取得
UACの突破
SAM/SYSTEM/SECURITYファイルのダンプ
プロセスメモリのダンプ
Mimikatz等の機能/関数の抽出/検知回避


# Page. 142

![Page Image](https://bcdn.docswell.com/page/LJ1843R5EG.jpg)

終


