A Process is No One: Hunting for Token Manipulation

on YouTube ↗54m

" summary

A hypothesis-driven hunt targets access token manipulation by instrumenting 11 Windows hosts with PowerShell remoting, running custom collectors get_access_token and get_kerberos_tgt, and analyzing results. Collection returns 633 tokens and 76 Kerberos TGTs; filtering removes 529 primary tokens and isolates 49 impersonation tokens and 26 mismatched tickets. Drilling into logon-session processes exposes an encoded PowerShell command that decodes to a meterpreter payload, proving the method finds real post‑exploit activity and validates the focused collection approach.

AI-written summary · about

" chapters (43)

1. 0:00Introduction
2. 1:43What is Hunting
3. 3:03Normal Hunt Cycle
4. 4:31Hypothesis Driven Hunting
5. 5:04Benefits
6. 5:59HypothesisDriven Hunting
7. 6:50Hacker Lifecycle
8. 7:21Mitre Attack Framework
9. 8:08Tactics Techniques Procedures
10. 9:49Tactics
11. 10:48Procedures
12. 11:24Why is this useful
13. 13:02What is this process
14. 13:13Building the hunt hypothesis
15. 14:14Identifying the tactic
16. 15:34Identifying the procedures
17. 17:44Scope
18. 18:24Documentation
19. 19:27Conclusion
20. 19:49Benefit
21. 22:16Tactics and Techniques
22. 23:16Access Token Manipulation
23. 25:33Windows Authentication
24. 28:34Access tokens
25. 29:48Token types
26. 30:42General overview
27. 31:05Token impersonation
28. 32:14Visualization
29. 32:38Create a Process
30. 34:03Make an Impostor Token
31. 35:25Create a New logon session
32. 36:32Collection Requirements
33. 37:17Collecting Access Tokens
34. 38:05Get Access Token
35. 38:28Impersonation
36. 39:32GetSystem
37. 40:00Kerberos ticket granting ticket
38. 40:36Get Kerberos ticket granting ticket
39. 41:27Make token attack
40. 41:57Scope of analysis
41. 42:39Excluded factors
42. 43:15Demo
43. 53:25Questions

" related talks

• 29mWhy You Need to Detect More Than PtHMatt Hathaway, Jeff Myers · Black Hat USA 2014
• 51mAbusing Microsoft Kerberos: Sorry You Guys Don't Get ItBenjamin Delpy, Alva Duckwall · Black Hat USA 2014
• 38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse ThemAlfred Alvarado, Timothy Hux · RSA Conference 2023
• 25mInvestigating PowerShell AttacksRyan Kazanciyan, Matt Hastings · Black Hat USA 2014
• 37mThreat Hunting in Active Directory EnvironmentAnurag Khanna, Thirumalai Natarajan Muthiah · Black Hat Asia 2021
• 58mHacking in 2016 - How is our systems broken?Chris Dale · NDC Oslo 2016
• 49mPowerShell for Security Incident ResponseLee holmes, Joe Bialek · PowerShell Summit North America 2014
• 45mYou « try » to detect mimikatzV. Le Toux · Hack In Paris 2019