Sustavi za zaštitu krajnjih točaka i zaobilaženje zaštite

master's thesis

• Title (english): Evading protection in endpoint detection and response systems
• Author: Zdravko Petričušić
• Mentor: Marin Vuković (mentor)
• Committee member: Marin Vuković (predsjednik povjerenstva)
• Committee member: Dragan Jevtić (član povjerenstva)
• Committee member: Miljenko Mikuc (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2024-07-10, Croatia

Abstract

Kroz ovaj rad pružen je pregled u arhitekturalnu složenost operacijskog sustava Windows te interne procese i mehanizme povezane uz autentikaciju korisnika. Kako se korisničke vjerodajnice i ostali osjetljivi kriptografski materijali nalaze u radnoj memoriji glavnog autentikacijskog procesa, lsass.exe, pregledane su postojeće metode napada na sam proces koje za cilj imaju ekstrakciju vjerodajnica iz virtualne memorije procesa. Radi boljeg razumijevanja razloga za unaprjeđenje prethodno korištenih tehnika, pružen je pregled principa rada sigurnosnih sustava poput antivirusa ili EDR sustava kroz prizmu Windows Defender sigurnosnog rješenja. Konačno, rad je predstavio dvije moderne metode za ekstrakciju vjerodajnica, MalSecLogon te NtSystemDebugControl, koje zaobilaze navedeno sigurnosno rješenje te uspješno ekstrahiraju osjetljive podatke iz memorije.

Abstract (english)

This paper provided insight into the architectural complexitz of the Windows operating system and the internal processes and procedures related to user authentication. Since user credentials and other sensitive cryptographic materials are located within the virtual memory of the central authentication process, lsass.exe, the paper reviewed existing methods of attacking the process itself with the end goal of extracting user credentials from process memory. To better understand the need to move toward more modern attack vectors, an EDR internals overview was given as inspected through the prism of the Windows Defender security solution. Finally, the paper presented two modern methods to extract user credentials, MalSecLogon and NtSystemDebugControl, which bypass the mentioned security solution and successfully extract the credential data.

• Keywords: Windows; autentikacija; LSASS; EDR; Windows Defender; MalSecLogon; NtSystemDebugControl; Mimikatz
• Keywords (english): Windows; authentication; LSASS; EDR; Windows Defender; MalSecLogon; NtSystemDebugControl; Mimikatz
• Language: croatian
• URN:NBN: urn:nbn:hr:168:756362
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2024-10-12 21:51:49