Windows terminal facing attack simulation method and system
By employing memory disconnection and endpoint injection technologies, the problem of traditional simulation methods being unable to effectively simulate APT attacks has been solved. This allows for the simulation of the lifecycle of advanced threats without affecting process functionality, thereby improving the assessment and response efficiency of enterprise protection capabilities.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- NANJING UNIV OF POSTS & TELECOMM
- Filing Date
- 2024-06-06
- Publication Date
- 2026-08-04
AI Technical Summary
Traditional attack simulation methods cannot effectively simulate the complete lifecycle of APT attacks, and existing technologies struggle to achieve end-point countermeasures against advanced threats without affecting the normal function of the injected process, resulting in insufficient accuracy and comprehensiveness in assessments.
By employing memory chain breaking technology and terminal injection technology, the shellcode is actively executed by obfuscating the target process's stack space and system function functionality. Combined with remote control privilege acquisition and automated attack simulation, a test report is generated.
It enables the simulation of the entire lifecycle of advanced threats without affecting the normal function of the injected process, helping enterprises assess the effectiveness of protective measures, optimize response processes, reduce the detection risk of protective equipment, and significantly shorten testing time.
Smart Images
Figure CN118509238B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network information security, specifically relating to an attack simulation method and system for Windows terminals. Background Technology
[0002] In 2017, intrusion and attack simulation technology was officially introduced into Gartner's Hype Cycle as an emerging security operation technology. With the increasing complexity of security threats, traditional periodic security assessment methods, such as penetration testing, are showing limitations in terms of visibility and timeliness. In contrast, Breach and Attack Simulation (BAS) technology provides enterprises with broader and more real-time defense assessment capabilities through continuous and automated attack simulation.
[0003] By 2021, according to Gartner's "Hyperhythm of Security Operations" report, the importance of BAS technology was reassessed and given a "high" priority rating. Gartner predicted that this technology would become a mainstream cybersecurity defense technology within the next two to five years. In 2022, Gartner reiterated the importance of BAS technology in its report on eight trends in security and risk management.
[0004] The core of BAS technology lies in improving the realism of APT attack simulations while ensuring the effectiveness of covering the ATT&CK matrix. Traditional attack simulation methods typically focus only on specific stages of the APT attack lifecycle, thus reducing the accuracy and comprehensiveness of the assessment. However, APT attacks are not only long-lasting but also exhibit behavioral patterns that closely resemble normal operations, increasing the difficulty of detection. BAS technology, by building predictive models and combining them with various tools (such as vulnerability scanning, automated penetration testing, and malicious traffic detection), improves the realism of simulated APT attacks, thereby helping enterprises prepare in advance and enhance their ability to respond to advanced threats.
[0005] ATT&CK is a knowledge base of adversarial tactics and techniques created and maintained by MITRE. ATT&CK is a curated knowledge base and model of cyberattack behavior, reflecting the attacker's attack lifecycle and the objectives of each stage. It consists of the following core components: Tactics: representing short-term tactical objectives during the attack process; Techniques: describing the means by which the adversary achieves its tactical objectives; Sub-techniques: describing the technical means by which the adversary achieves its tactical objectives at a lower level than techniques.
[0006] BAS (Balanced Attack Strategies) can not only simulate hacker attacks exploiting known vulnerabilities, but also simulate various types of malware, including malicious behaviors such as Trojan infiltration, spread infection, and ransomware encryption. During automated attack simulations, this technology can generate malicious traffic to evaluate the network defense system's detection and response efficiency to abnormal traffic. By simulating real attack scenarios, BAS technology can also assess the response time and efficiency of an enterprise's security team to attacks, as well as the security system's ability to intercept attacks. This not only helps improve an enterprise's network defense capabilities but also enhances its response speed and effectiveness to security threats. With continuous technological advancements and expanding application scope, BAS technology will play an increasingly important role in future network security defense systems. Its comprehensiveness and flexibility make it a powerful tool for assessing and enhancing enterprise network security capabilities. With the continuous improvement of its simulation and assessment capabilities for advanced threats such as APTs, BAS technology will undoubtedly become an important trend in the future development of network security technology. Summary of the Invention
[0007] The present invention aims to provide an attack simulation method and system for Windows terminals, employing a novel memory chain disruption technique to alter the shellcode triggering method. Without affecting the normal functionality of the injected process, the injected process actively executes the shellcode, obfuscating the execution process chain and the stack space of related processes, thus implementing various terminal defense techniques based on the ATT&CK matrix. It can simulate advanced attack methods across various terminal defense approaches, enabling enterprises to assess the effectiveness of current office environment protection measures and optimize specific response processes, shortening response time.
[0008] To achieve the above objectives, the technical solution adopted by the present invention is as follows:
[0009] An attack simulation method for Windows terminals includes the following steps:
[0010] Deploy a central server to listen for connection requests and establish connections;
[0011] Select and adjust the execution logic between attack simulation techniques;
[0012] Terminal process injection is achieved through memory disconnection technology and terminal injection technology;
[0013] Obtain remote control access to the device and automate the execution of attack simulation techniques;
[0014] The results are sent back to the central server for analysis and evaluation of the attack simulation effect, and a test report is automatically generated.
[0015] Furthermore, attack simulation techniques include: rights protection techniques, credential theft techniques, lateral movement techniques, and defense evasion techniques; terminal injection techniques include: APC injection, Early Bird injection, hollow injection, automatic API addressing injection, DLL side-loading injection, DLL reflection injection, threadless injection, callback function injection, and Syscall injection.
[0016] Furthermore, the execution logic between attack simulation techniques is selected and adjusted, including:
[0017] Based on threat intelligence, attackers can be profiled and attack simulation techniques can be freely selected.
[0018] According to the expected script, the implementation sequence of attack simulation techniques is set to simulate the complete lifecycle of advanced threats and intrusions.
[0019] Furthermore, terminal process injection is achieved through memory disconnection technology and terminal injection technology, specifically including:
[0020] The shellcode used for memory disconnection and the shellcode used for communication with the central server are written into the target process. In the terminal injection behavior model, the model of requesting target process memory, writing shellcode, and creating a new execution thread or process is changed to requesting target process memory and writing shellcode.
[0021] Specifically, the shellcode that disrupts memory connections includes: obfuscating the system functions of the target process, tampering with the contents of the RCX and RDX registers, interfering with the input and output of the stack POP and PUSH instructions, and enabling the target process to actively jump to execute the shellcode that communicates with the central server at a predetermined time while it is executing its own functions normally, thereby gaining remote control of the target machine.
[0022] Furthermore, the specific steps of the memory disconnection technique include:
[0023] S1. Reload a clean Ntdll.dll file from the disk using window memory, and use assembly code to locate the function pointer hLoad of the LoadLibrary API;
[0024] S2. Reverse the process of Windows executing the GetProcAddress function and implement a function GetProcAddressB with the same effect for subsequent use in finding APIs in various DLL files;
[0025] S3. From a DLL file that has been loaded by the target process ProcessA, use the self-implemented GetProcAddressB to locate the memory address B of the exported function A, read the first eight bytes of content from B and save it.
[0026] S4. By reverse engineering the Windows callback functions, including TpWorkerFactory and TpAllocWork, the function pointer hLoad obtained at the beginning is passed as a parameter. Since the parameters accepted by each Windows callback function are inconsistent, and some do not support directly passing LoadLibrary as a parameter, it is necessary to use assembly code to follow the x64 calling convention, intervene in the contents of the RCX and RDX registers, replace the CPU, actively change the contents of the passed parameter, and write it as a function pointer.
[0027] S5. Allocate several bytes of space to ProcessA and write them into the pre-loader. The pre-loader is written in assembly code and implements the functions of opening a new stack frame, executing Shellcode for C&C remote control, and restoring the eight bytes of content read from B. This ensures that the Shellcode executes smoothly and does not interfere with the normal execution of the original API. Since each API is triggered by a callback function, a clean stack space will be allocated, and the target process ProcessA will execute the subsequent pre-loader and Shellcode. Existing protection devices cannot detect abnormal behavior through stack analysis and ETW events.
[0028] Furthermore, permission maintenance technologies include:
[0029] A technique that utilizes SMB or RPC protocols to create and modify the registry or scheduled tasks, and is used to call executable files on a schedule;
[0030] Techniques that utilize existing Windows tools or components to create and modify the registry or scheduled tasks for the purpose of scheduling executable files.
[0031] Furthermore, credential theft techniques include:
[0032] A technique for dumping LSASS using the Windows Shrinkring mechanism, IFEO mechanism, and existing APIs;
[0033] A technique for stealing browser credentials using a white-process architecture based on terminal injection technology;
[0034] A technique for stealing browser credentials using a black process based on terminal injection technology.
[0035] Furthermore, lateral movement technologies include:
[0036] This technology utilizes named pipes and anonymous pipes, based on SMB and RPC protocols, to obtain control permissions for other terminal machines in the target test scenario.
[0037] Furthermore, defensive evasion techniques include:
[0038] Software and hardware-level paralysis techniques targeting the AMSI mechanism;
[0039] Software-level paralysis techniques targeting the ETW mechanism;
[0040] Process deception techniques for process chain analysis include: parent process deception and process hiding.
[0041] An attack simulation system for Windows terminals, comprising:
[0042] Remote control architecture, used to achieve remote control communication via C&C architecture;
[0043] The terminal process injection module is used to change the conventional process injection behavior model by using memory disconnection technology on top of the original process injection method.
[0044] A sample generation module with hash obfuscation is used to produce test samples carrying the digital signature of specified commercial software, thus avoiding static feature scanning.
[0045] The intrusion simulation scenario orchestration module is used to mimic real persistent advanced threat behavior;
[0046] The intrusion simulation detection report generation module is used to output a protection capability assessment report;
[0047] The remote control architecture specifically includes:
[0048] Using PowerShell engine technology, you can freely call any API and module within PowerShell to bypass the process chain and command execution monitoring of endpoint protection devices;
[0049] The controller and the agent communicate through a central communication server.
[0050] The communication protocol uses TCP, and the communication content is serialized and then encrypted with AES. After arriving at the target machine, it is decrypted and deserialized to restore the original data, which is used to bypass commercial traffic analysis equipment.
[0051] Compared with the prior art, the beneficial effects of the present invention are as follows:
[0052] 1. This invention updates the conventional process injection behavior model by implementing memory chain breaking technology, upgrades various terminal countermeasures, and remote command execution no longer depends on newly created execution processes. It is all implemented in the memory space of the current process, and the execution logic of post-penetration can be freely arranged to simulate persistent advanced threats. It helps enterprises to conduct targeted self-checks to see if there are any loopholes in their protection capabilities. The C&C architecture supports internal penetration testing exercises and helps enterprises to gradually optimize their response processes.
[0053] 2. The various terminal countermeasures implemented in this invention, through test samples generated by the system, can help enterprises effectively evaluate the detection depth and breadth of various protective devices, lowering the technical threshold. The automated testing process of this system can significantly reduce the time cost required for testing equipment;
[0054] 3. Conventional memory injection techniques typically involve obtaining a process handle, allocating memory space, writing shellcode, and creating a new thread / process to execute the shellcode. However, the memory disconnection technique of this invention omits the last step. Furthermore, from the perspective of the protection device, all injection mechanisms are executed by the target process, which significantly reduces the risk. Attached Figure Description
[0055] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:
[0056] Figure 1 A flowchart of an attack simulation method for Windows terminals provided in an embodiment of the present invention;
[0057] Figure 2 This is an example of an attack simulation system for Windows terminals according to an embodiment of the present invention, with specific optional test technology interface diagrams.
[0058] Figure 3 This is a screenshot of the attack simulation system for Windows terminals in this embodiment of the discovery, showing the system connecting back to the central server after the sample is run and executing post-penetration commands.
[0059] Figure 4 The image shows the evaluation results exported after testing Crowd Strike, which is an attack simulation system for Windows terminals according to an embodiment of the present invention.
[0060] Figure 5 This is a comparison chart of the detection rates of the Crowd Strike, Cortex, and Microsoft XDR detection methods according to embodiments of the present invention. Detailed Implementation
[0061] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments.
[0062] The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings:
[0063] like Figure 1 As shown, this embodiment provides an attack simulation method for Windows terminals, including an implementation method for generating samples and conducting tests. This implementation method includes the following steps:
[0064] 1. Deploy a central server and establish a connection.
[0065] Upload the central server program to the VPS (Virtual Private Server) and run it.
[0066] The central server starts running and listens for incoming connection requests.
[0067] Enter the IP address and listening port of the central server in the console, and send the UserName and Password information to it. After the central server verifies the information, the two parties will handshake to establish a connection.
[0068] 2. Select the testing technology and generate test samples.
[0069] like Figure 2 As shown, the console allows users to select the specific technologies to be tested and arrange the execution logic between various test technologies. Using the connection established in step 1, a test sample is requested from the central server. The central server generates a corresponding executable file A.exe based on its own IP address and listening port, which is then sent to the console as the test sample. A.exe integrates 64-bit Windows shellcode, which uses asynchronous HTTP requests to establish a communication connection with the central server. Specifically, A.exe will use the user's... Figure 2The selected process injection technique in the interface writes shellcode for memory disconnection and shellcode for communication with the central server into the target process. The memory disconnection shellcode primarily obfuscates the target process's system functions, modifies the contents of the RCX and RDX registers, and interferes with the input / output of stack POP and PUSH instructions. This allows the target process to execute its own functions normally, but at a predetermined time, it will actively jump to execute the shellcode for communication with the central server, thereby gaining remote control of the target machine. The shellcode is written into the target process's memory space. Because it's based on memory disconnection technology, the test sample omits steps such as creating new execution threads or processes from the original process injection behavior model. The model has changed from allocating target process memory, writing shellcode, and creating new execution threads or processes to allocating target process memory and writing shellcode. Therefore, protection devices can only identify this intrusion method by relying on their ability to detect specific injection techniques, thus effectively verifying the actual protection capabilities of the terminal.
[0070] 3. Run the sample and connect back to the central server.
[0071] like Figure 3As shown, after the sample runs, it uses the process injection technology integrated in step 2 to bypass the detection of various security devices within the enterprise and establish a connection with a central server located on the Internet. The sample then continues to test the various post-penetration techniques selected in step 2, automatically executing the aforementioned information gathering, privilege escalation, credential theft, and lateral movement techniques, and sends the results back to the central server. The central server parses the data and forwards the content to the console. The console then displays the relevant information about the sample's execution on the main interface. As an example, the sample implements the WFP-based network monitoring module blinding technology and the white-process browser credential theft technology unique to this method. After obtaining remote control privileges on the target machine, the sample actively executes the WFP-based network monitoring module blinding technology. Conventional blinding techniques generally require loading a driver to enter the kernel space. However, the network monitoring module blinding technology integrated in this method only requires administrator privileges to remove the security device's monitoring capability for the current terminal's network inbound and outbound traffic. Therefore, the security device's agent process believes that the current host has no external communication behavior. Based on this, due to the implementation of the memory disconnection technique, the Chrome.exe process on the target machine is infected and actively executes shellcode to communicate with the central server. When the infected Chrome.exe process executes the browser stealing module, the protection device will consider it as Chrome.exe performing normal browser data read and write operations, and therefore allows it to proceed. Subsequently, the sample executes the integrated privilege escalation technology in step 2 to obtain stable remote control capabilities for the current device. After successful execution, the result is displayed and transmitted to the central communication server as a phase achievement. Next, the integrated lateral movement technology selected in step 2 is executed. Those skilled in the art should understand that this disclosure is not limited by the execution order of the actions described in the present description, and the expected post-penetration techniques and their execution order can be freely combined and arranged in the sample generation stage of step 2. Compared with traditional testing methods, this method has stronger protection breakthrough capabilities and is closer to the attack techniques implemented by APT (Advanced Persistent Threat) organizations.
[0072] 4. Output the evaluation results to help determine whether the protection is effective.
[0073] If the test sample successfully reconnects and the results are displayed in the output, export the results to generate something similar to the following. Figure 4 The assessment form indicates whether the corresponding technology was successfully implemented. If it was successfully implemented and there are no corresponding alarms from the internal protection devices, it proves that there are no effective protection measures and the protection capabilities need to be upgraded.
[0074] like Figure 5The figure shows a comparison of the detection rates of this method and existing methods when facing Crowd Strike, Cortex and Microsoft XDR. The detection data of existing products comes from the 2023 MITRE ATT&CK evaluation results.
[0075] Specifically, each part of the technology in the detailed implementation method includes:
[0076] Windows terminal process injection technology based on memory chaining alters conventional process injection behavior by modifying existing methods. Specific implementation techniques include novel APC injection, EarlyBird injection, hollow injection, automatic API addressing injection, DLL side-loading injection, DLL reflection injection, threadless injection, callback function injection, and Syscall injection. Memory chaining is a novel technique that obfuscates the stack and function call flow, thereby interfering with the detection and scanning of security software. As is well known, advanced terminal protection devices track and analyze the process stack space to determine if abnormal function calls are occurring. If abnormal stack allocation is detected, the behavior is promptly blocked and an alert is issued. For example, conventional Syscall injection techniques, because the memory region initiating the Syscall call is clearly different from that of a normal process, can be detected with almost no false positives using stack tracing technology. Memory chaining technology can effectively counter such detection methods. Specifically, first, a clean Ntdll.dll file is reloaded from disk using window memory, and assembly code is used to locate the function pointer hLoad of the LoadLibrary API. Then, the process of Windows executing the GetProcAddress function is reverse-engineered, and a function GetProcAddressB with the same effect is implemented to subsequently find APIs in various DLL (Dynamic-link library) files. Next, from a DLL file already loaded by the target process ProcessA, the self-implemented GetProcAddressB is used to locate the memory address B of exported function A, and the first eight bytes of content from B are read and saved. Then, by reverse-engineering Windows callback functions such as TpWorkerFactory and TpAllocWork, the function pointer hLoad obtained at the beginning is passed as a parameter. It should be noted that since the parameters accepted by various Windows callback functions are inconsistent, and some do not support directly passing LoadLibrary as a parameter, it is necessary to use assembly code to follow the x64 calling convention, intervene in the contents of registers such as RCX and RDX, replace the CPU, actively change the contents of the passed parameter, and write it as a function pointer. Finally, allocate several bytes of space in the ProcessA process and write them to the preload loader.This loader, written in assembly code, implements the functions of allocating a new stack frame, executing shellcode for C&C remote control, and restoring the eight bytes read from point B. This ensures the shellcode executes smoothly without interfering with the normal execution of existing APIs. Since each API is triggered by a callback function, a clean stack space is allocated, and the target process (ProcessA) executes the subsequent pre-execution loader and shellcode entirely. Therefore, existing protection devices cannot detect abnormal behavior through stack analysis and ETW events, thus bypassing the protection. Conventional memory injection techniques typically involve obtaining a process handle, allocating memory space, writing shellcode, and creating a new thread / process to execute the shellcode. The memory disconnection technique omits the last step, and from the perspective of the protection device, all injection mechanisms are executed by the target process (ProcessA), significantly reducing the risk.
[0077] After gaining remote control privileges, this involves automatically implementing selective testing post-exploitation techniques. These techniques include privilege escalation techniques, specifically those utilizing SMB or RPC protocols to create and modify the registry or scheduled tasks to invoke executable files on a schedule; and methods utilizing existing Windows tools or components to create and modify the registry or scheduled tasks to invoke executable files on a schedule.
[0078] Credential theft techniques include various methods of stealing information related to LSASS credentials and browser credentials, such as Lsass Shtinkering, Windows API Dump Lsass, Callback API Dump, Mirror Handle Dump Lsass, IFEO Dump Lsass, and obtaining browser credentials through white-process technology.
[0079] Lateral movement technology, specifically, includes technologies that utilize named pipes and anonymous pipes, based on SMB and RPC protocols, to obtain control permissions for other terminal machines in the target test scenario.
[0080] Defense evasion techniques include AMSI software and hardware level blinding, ETW software level blinding, parent process deception, overloaded Ntdll unhooking, and new network monitoring module blinding based on WFP (Windows Filter Platform). This method can completely disable the agent process's ability to monitor incoming and outgoing traffic to the terminal while the agent process of the protection device is still alive.
[0081] Kernel countermeasures, specifically implemented through techniques including Syscall, paralyzing kernel callback functions based on driver vulnerability exploitation, and terminal EDR blinding techniques;
[0082] Hash obfuscation technology generates test samples with random hashing characteristics, which is used to circumvent static scanning by endpoint protection devices.
[0083] Shellcode generation technology combines the above technologies to package shellcode into an executable file.
[0084] This is a remote communication and control technology based on a PowerShell engine and C&C architecture. Specifically, when the console communicates with the injected process through a central communication server, the control commands issued no longer require the creation of new CMD / Powershell processes for execution. Unlike BOF (Browser Override) technology, which can only bypass monitoring using specific pre-implemented APIs, this solution can call any API and module within PowerShell without generating additional processes, effectively resisting analysis of process chains and executed commands by security devices. The effectiveness of the sample can be judged by comparing the alarm status of internal security devices and whether the sample establishes a network connection with the central communication server. Because it supports remote control, the system can achieve continuous control after penetration testing, suitable for internal enterprise penetration testing and adversarial drills.
[0085] The communication protocol uses TCP. The sample serializes all transmitted content and then encrypts it using AES. The serialization format is: [MessageType, Id, UserName, Password, Model, Content]. After receiving the communication content, the central communication server decodes it to determine the message type and forwards it to the corresponding console. Finally, the console decrypts and deserializes the message, displaying the result on the main console interface.
[0086] The execution order of each test sample can be freely edited in the console, conforming to the logical sequence of penetration testing and simulating the operational habits of a real attacker. After each sample completes its run, an evaluation report can be automatically generated to assist in assessing the effectiveness of the protection.
[0087] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.
Claims
1. An attack simulation method for Windows terminals, used by enterprises to assess the effectiveness of current protective measures in the office environment, characterized in that... Includes the following steps: Deploy a central server to listen for connection requests and establish connections; Select and adjust the execution logic between attack simulation techniques; Terminal process injection is achieved through memory disconnection technology and terminal injection technology; Specifically, terminal process injection is achieved through memory disconnection technology and terminal injection technology, including: The shellcode used for memory disconnection and the shellcode used for communication with the central server are written into the target process. In the terminal injection behavior model, the model of requesting target process memory, writing shellcode, and creating a new execution thread or process is changed to requesting target process memory and writing shellcode. Specifically, the shellcode that causes memory chain disruption includes: obfuscating the system function functions of the target process, tampering with the contents of the RCX and RDX registers, interfering with the input and output contents of the stack POP and PUSH instructions, and enabling the target process to actively jump to execute the shellcode that communicates with the central server at a predetermined time while it is executing its own function normally, thereby gaining remote control of the target machine. The specific steps of the memory disconnection technique include: S1. Reload a clean Ntdll.dll file from the disk using window memory, and use assembly code to locate the function pointer hLoad of the LoadLibrary API; S2. Reverse the process of Windows executing the GetProcAddress function and implement a function GetProcAddressB with the same effect for subsequent use in finding APIs in various DLL files; S3. From a DLL file that has been loaded by the target process ProcessA, use the self-implemented GetProcAddressB to locate the memory address B of the exported function A, read the first eight bytes of content from B and save it. S4. By reverse engineering the Windows callback functions, including TpWorkerFactory and TpAllocWork, the function pointer hLoad obtained at the beginning is passed as a parameter. Since the parameters accepted by each Windows callback function are inconsistent, and some do not support directly passing LoadLibrary as a parameter, it is necessary to use assembly code to follow the x64 calling convention, intervene in the contents of the RCX and RDX registers, replace the CPU, actively change the contents of the passed parameter, and write it as a function pointer. S5. Allocate several bytes of space in ProcessA and write them into the pre-loader. The pre-loader is written in assembly code and implements the functions of opening a new stack frame, executing the shellcode for C&C remote control, and restoring the eight bytes of content read from B. This ensures that the shellcode executes smoothly and does not interfere with the normal execution of the original API. Since each API is triggered by a callback function, a clean stack space will be allocated, and the target process ProcessA will execute the subsequent pre-loader and shellcode. Existing protection devices cannot detect abnormal behavior through stack analysis and ETW events. Obtain remote control access to the device and automate the execution of attack simulation techniques; The results are sent back to the central server for analysis and evaluation of the attack simulation effect, and a test report is automatically generated.
2. The method according to claim 1, characterized in that, Attack simulation techniques include: rights protection techniques, credential theft techniques, lateral movement techniques, and defense evasion techniques; terminal injection techniques include: APC injection, Early Bird injection, hollow injection, automatic API addressing injection, DLL side-loading injection, DLL reflection injection, threadless injection, callback function injection, and Syscall injection.
3. The method according to claim 1, characterized in that, Select and adjust the execution logic between attack simulation techniques, including: Based on threat intelligence, attackers can be profiled and attack simulation techniques can be freely selected. According to the expected script, the implementation sequence of attack simulation techniques is set to simulate the complete lifecycle of advanced threats and intrusions.
4. The method according to claim 2, characterized in that, Rights protection and maintenance techniques include: A technique that utilizes SMB or RPC protocols to create and modify the registry or scheduled tasks, and is used to call executable files on a schedule; Techniques that utilize existing Windows tools or components to create and modify the registry or scheduled tasks for the purpose of scheduling executable files.
5. The method according to claim 2, characterized in that, Credential theft techniques include: A technique for dumping LSASS using the Windows Shrinkring mechanism, IFEO mechanism, and existing APIs; A technique for stealing browser credentials using a white-process architecture based on terminal injection technology; A technique for stealing browser credentials using a black process based on terminal injection technology.
6. The method according to claim 2, characterized in that, Lateral movement technologies include: This technology utilizes named pipes and anonymous pipes, based on SMB and RPC protocols, to obtain control permissions for other terminal machines in the target test scenario.
7. The method according to claim 2, characterized in that, Defense and evasion techniques include: Software and hardware-level paralysis techniques targeting the AMSI mechanism; Software-level paralysis techniques targeting the ETW mechanism; Process deception techniques for process chain analysis include: parent process deception and process hiding.
8. An attack simulation system for Windows terminals, used by enterprises to assess the effectiveness of current protective measures in the office environment, characterized in that... include: Remote control architecture, used to achieve remote control communication via C&C architecture; The terminal process injection module is used to change the conventional process injection behavior model by using memory disconnection technology on top of the original process injection method. Specifically: Based on any of the existing new APC injection, EarlyBird injection, hollow injection, automatic API addressing injection, DLL side-loading injection, DLL reflection injection, threadless injection, callback function injection, and Syscall injection methods, the Shellcode used for memory disconnection and the Shellcode used for communication with the central server are written into the target process. In terms of the terminal injection behavior model, the model of requesting target process memory, writing Shellcode, and creating a new execution thread or process is changed to requesting target process memory and writing Shellcode, thus changing the conventional process injection behavior model. Specifically, the shellcode that causes memory chain disruption includes: obfuscating the system function functions of the target process, tampering with the contents of the RCX and RDX registers, interfering with the input and output contents of the stack POP and PUSH instructions, and enabling the target process to actively jump to execute the shellcode that communicates with the central server at a predetermined time while it is executing its own function normally, thereby gaining remote control of the target machine. The specific steps of the memory disconnection technique include: S1. Reload a clean Ntdll.dll file from the disk using window memory, and use assembly code to locate the function pointer hLoad of the LoadLibrary API; S2. Reverse the process of Windows executing the GetProcAddress function and implement a function GetProcAddressB with the same effect for subsequent use in finding APIs in various DLL files; S3. From a DLL file that has been loaded by the target process ProcessA, use the self-implemented GetProcAddressB to locate the memory address B of the exported function A, read the first eight bytes of content from B and save it. S4. By reverse engineering the Windows callback functions, including TpWorkerFactory and TpAllocWork, the function pointer hLoad obtained at the beginning is passed as a parameter. Since the parameters accepted by each Windows callback function are inconsistent, and some do not support directly passing LoadLibrary as a parameter, it is necessary to use assembly code to follow the x64 calling convention, intervene in the contents of the RCX and RDX registers, replace the CPU, actively change the contents of the passed parameter, and write it as a function pointer. S5. Allocate several bytes of space in ProcessA and write them into the pre-loader. The pre-loader is written in assembly code and implements the functions of opening a new stack frame, executing the shellcode for C&C remote control, and restoring the eight bytes of content read from B. This ensures that the shellcode executes smoothly and does not interfere with the normal execution of the original API. Since each API is triggered by a callback function, a clean stack space will be allocated, and the target process ProcessA will execute the subsequent pre-loader and shellcode. Existing protection devices cannot detect abnormal behavior through stack analysis and ETW events. A sample generation module with hash obfuscation is used to produce test samples carrying the digital signature of specified commercial software, thus avoiding static feature scanning. The intrusion simulation scenario orchestration module is used to mimic real persistent advanced threat behavior; The intrusion simulation detection report generation module is used to output a protection capability assessment report; The remote control architecture specifically includes: Using PowerShell engine technology, you can freely call any API and module within PowerShell to bypass the process chain and command execution monitoring of endpoint protection devices; The controller and the agent communicate through a central communication server. The communication protocol uses TCP, and the communication content is serialized and then encrypted with AES. After arriving at the target machine, it is decrypted and deserialized to restore the original data, which is used to bypass commercial traffic analysis equipment.