last-byte/persistencesniper

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte

PersistenceSniper

PersistenceSniper is a Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. It is also available on Powershell Gallery and it is digitally signed with a valid code signing certificate. The tool is under active development with new releases coming out by the week, so make sure to use the up-to-date version. Official Twitter/X account @PersistSniper.

The Why

Why writing such a tool, you might ask. Well, for starters, I tried looking around and I did not find a tool which suited my particular use case, which was looking for known persistence techniques, automatically, across multiple machines, while also being able to quickly and easily parse and compare results. Sure, Sysinternals' Autoruns is an amazing tool and it's definitely worth using, but, given it outputs results in non-standard formats and can't be run remotely unless you do some shenanigans with its command line equivalent, I did not find it a good fit for me. Plus, some of the techniques I implemented so far in PersistenceSniper have not been implemented into Autoruns yet, as far as I know. Anyway, if what you need is an easy to use, GUI based tool with lots of already implemented features, Autoruns is the way to go, otherwise let PersistenceSniper have a shot, it won't miss it 😉

The How

To learn how to use PersistenceSniper properly, head to the Project's Wiki.

Persistence techniques implemented so far

The persistence techniques implemented so far are detailed in the Detections Page of PersistenceSniper's Wiki.

Credits

Most of this tool is based on the work of other skilled researchers, so it's right to give credit where credit's due. This project wouldn't be around if it weren't for:

• Hexacorn and his never-ending Beyond good ol' Run key series;
• Grzegorz Tworek and his amazing persistence-info.github.io website;
• All the other researchers who disclosed cool and unknown persistence techniques.

Furthermore, these people contributed to the project:

• Riccardo Ancarani
• Cecio
• Vadim
• fkadibs
• suinswofi
• Antonio Blescia
• Strassi

I'd also like to give credits to my fellow mates at @APTortellini for the flood of ideas that helped it grow from a puny text-oriented script to a full-fledged Powershell module.

License

This project is under the Commons Clause version of the MIT License license. TL;DR: you can copy, modify, distribute and perform the work for whatever reason, excluding commercial purposes, all without asking permission.

persistencesniper's Issues

Forensic

Any chance this could be made to point towards a mounted image? Great project!!

Parse-NetUser function is not locale-agnostic

Thank you for your great tool

I found that on non-English Windows localisation, I have false positives from the first and the last line (a record per word). The screenshot below shows current users and a different line on the bottom.

I suggest to rewrite Parse-NetUser function filter out anything above ------, empty lines and don't parse the last line. E.g. on next line parse previous line if any. This would harden this function and won't rely on English locale messages.

To translate some messages:
Konta użytkowników dla - User accounts for
Gość - Guest
Domyślny użytkownik - Default user
Polecenie zostało wykonane pomyślnie. - The command completed

Green boxes on a screenshot hide private information like username and computer name.

[INFO] Creation of PKGBUILD for BlackArch Windows category

Hey, I created an Arch Linux package of PersistenceSniper for blackarch-windows and blackarch-defensive categories in order to be installed by pacman -S persistencesniper and then deployed to a Windows environment.

It will be available when the PR will be merged in few days.

You can find the PR here: BlackArch/blackarch#3822

Cheers

AV

Working offline

Hi,
Would it be difficult and is it planned to support offline data like disk images?
Kind regards
Laurent

[Feature Request] Hunting persistence in OS Disk images.

Amazing tool, has helped me multiple times. Thank you for making it.
I just had a feature request, while for active system this tool does wonders, can it be moded to also support disk images of OS drive? I believe some persistence techniques will be visible work in such a case but still would be a big help for DFIR people dealing with just a device image. Let me know if this is possible/in works I can help although I'm not very good at powershell still more hands might help.

Again thanks a lot.

Digital Signature

In regulated environments it may be difficult to run the script given it's not digitally signed. Would be great if you added that as a feature. Thanks!

RunAndRunOnce Method does not detect powershell.exe entries

Hi,

awesome project! I found a bug though, that might be rooted in the way you reference the lolbas project, because this project is missing "powershell.exe" as a lolbin 🤔 🤣

Setup

PersistenceSniper ModuleVersion = '1.15.0'

PSVersion                      5.1.22621.2506
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.22621.2506
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Current Behavior

I created two Run Keys under the current user (Skype and SymantecEndpointProtection)

I ran the Persistence Sniper as "Administrator". You can see a modified output that I used for debugging. It states, that the binary is considered safe. This output is given if the Get-IfSafeExecutable is true.

The Get-IfSafeExecutable has an additional LolBas check. This checks if the prop value contains a lolbas binary. The problem is, that powershell.exe is not in this list. Since it is a Builtin Binary and the lolbas check fails, the binary is considered safe.

Expected Behavior

The output of the PersistenceSniper should display the registry key "Skype".

Additional Details

I get the same invalid behavior if I use the -IncludeHighFalsePositivesChecks switch.

Possible solutions

• add powershell.exe to lolbas project
• implement powershell.exe in the Get-ifLolBin list manually
• implement a Get-ifCmdInterpreter with powershell.exe, cmd.exe as blacklist to always report persistence using such command line interpreters.

Unable to detect ghosttasks

Hi, love the tool.

I have a vm with a working ghosttask loaded (restarted and all that, and confirmed the ghosttask is functioning). I can see it in my regedit \tasks, and I can see it doesn't have a SD, as expected. I can see it doing the action I made it do.

Running the latest PersistenceSniper v1.16.0, I can't seem to detect it. I see a bunch of other false-positives, so the tool itself is working, but no output relating to ghosttask.

Case sensitive comparisons

The code in this module makes significant use of .Contains to look for sub-strings. For example:

$exePath.Contains('powershell') -or $exePath.Contains('cmd')

However, the .Contains method of System.String is case-sensitive and, in win PS (.NET Framework), has no overloads available to make ignore case.

This use of .Contains will yield false and you'll miss things:

$exePath = 'c:\somepath\PowerShell.exe'
$exePath.Contains('powershell')

I suggest one of:

• Use a PS operator such as -match. For example: $exePath -match 'powershell'
• Convert incoming strings to the same case for the purpose of comparison. For example: $exePath.ToLower().Contains...
• Substitute use of this method for another that supports case insensitive comparisons. For example: $exePath.IndexOf('powershell', [StringComparer]::OrdinalIgnoreCase) -gt -1

Powershell console history

Feature request to add a way to output the contents of powershell console history that can show the attackers commands.
https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html

Dependency

The module in PS gallery and details here does not indicate any dependency. However, when attempting to import the module of PS version 4 indicates that PersistenceSniper requires PS version 5. Please clarify