Comments (6)
invictus-0x90
commented on August 15, 2024
I strongly suggest you don't expose the C3 Web UI to your external IP. If you must connect from an external location I would advise possibly using an SSH tunnel and IP whitelisting
from c3.
jaSzmigi
commented on August 15, 2024
BTW, if you're in need of support with C3 or just want to come and talk with the @mwrlabs #RedTeam then make sure you have signed up to the #BloodHound Slack (https://bloodhoundgang.herokuapp.com) and see us here https://app.slack.com/client/T20LT7NJX/CNL0132BY.
from c3.
007scorpio
commented on August 15, 2024
Has been great tool but now App now being flag by windows defender. Is there a way around ?
…Sent from my iPhone
On 20 Sep 2019, at 1:41 PM, Janusz Szmigielski ***@***.***> wrote:
BTW, if you're in need of support with C3 or just want to come and talk with the @mwrlabs #RedTeam then make sure you have signed up to the #BloodHound Slack (https://bloodhoundgang.herokuapp.com) and see us here https://app.slack.com/client/T20LT7NJX/CNL0132BY.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
from c3.
grzryc
commented on August 15, 2024
Could you provide us with defender event log from the detection?
Go to Event Viewer >> Applications and Services Logs >> Microsoft >> Windows >> Windows Defender >> Operational. Interesting Event ID will probably be one of 1006, 1007, 1015, 1116, 1117, 1120, and send us the Details -> XML View
from c3.
007scorpio
commented on August 15, 2024
These are the logs i found which may relate to the the detection. Note: the
windows ATP blocks the the relay connection. And defender blocks when
peripherialbeacon is added to connect to cobalt strike. Am also trying
possible ways of bypass, if successful will send you my approach and let me
know if you also find a way around it.
Thanks
…On Fri, Oct 11, 2019 at 4:09 AM grzryc ***@***.***> wrote:
Could you provide us with defender event log from the detection?
Go to Event Viewer >> Applications and Services Logs >> Microsoft >>
Windows >> Windows Defender >> Operational. Interesting Event ID will
probably be one of 1006, 1007, 1015, 1116, 1117, 1120
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#5>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AFUPP65U7BCR32DQDDF24ITQOBNGVANCNFSM4IYWMGEQ>
.
--
Log Name: Microsoft-Windows-Windows Defender/Operational
Source: Microsoft-Windows-Windows Defender
Date: 10/9/2019 12:06:33 AM
Event ID: 1151
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: DESKTOP-TA0GPNC
Description:
Endpoint Protection client health report (time in UTC):
Platform version: 4.18.1807.18075
Engine version: 1.1.15100.1
Network Realtime Inspection engine version: 1.1.15100.1
Antivirus signature version: 1.273.933.0
Antispyware signature version: 1.273.933.0
Network Realtime Inspection signature version: 1.273.933.0
RTP state: Enabled
OA state: Enabled
IOAV state: Enabled
BM state: Enabled
Antivirus signature age: 428
Antispyware signature age: 428
Last quick scan age: 4294967295
Last full scan age: 4294967295
Antivirus signature creation time: ?8/?6/?2018 4:17:55 PM
Antispyware signature creation time: ?8/?6/?2018 4:17:53 PM
Last quick scan start time: ?1/?1/?1601 12:00:00 AM
Last quick scan end time: ?1/?1/?1601 12:00:00 AM
Last quick scan source: 0
Last full scan start time: ?1/?1/?1601 12:00:00 AM
Last full scan end time: ?1/?1/?1601 12:00:00 AM
Last full scan source: 0
Product status: 0x00080000
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" />
<EventID>1151</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-10-09T07:06:33.939875000Z" />
<EventRecordID>18</EventRecordID>
<Correlation />
<Execution ProcessID="2196" ThreadID="2804" />
<Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
<Computer>DESKTOP-TA0GPNC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Product Name">%%827</Data>
<Data Name="Platform version">4.18.1807.18075</Data>
<Data Name="Unused">
</Data>
<Data Name="Engine version">1.1.15100.1</Data>
<Data Name="NRI engine version">1.1.15100.1</Data>
<Data Name="AVSignature version">1.273.933.0</Data>
<Data Name="ASSignature version">1.273.933.0</Data>
<Data Name="NRI Signature version">1.273.933.0</Data>
<Data Name="RTP state">%%901</Data>
<Data Name="OA state">%%901</Data>
<Data Name="IOAV state">%%901</Data>
<Data Name="BM state">%%901</Data>
<Data Name="Last AV signature age">428</Data>
<Data Name="Last AS signature age">428</Data>
<Data Name="Last quick scan age">4294967295</Data>
<Data Name="Last full scan age">4294967295</Data>
<Data Name="AV signature creation time">?8/?6/?2018 4:17:55 PM</Data>
<Data Name="AS signature creation time">?8/?6/?2018 4:17:53 PM</Data>
<Data Name="Last quick scan start time">?1/?1/?1601 12:00:00 AM</Data>
<Data Name="Last quick scan end time">?1/?1/?1601 12:00:00 AM</Data>
<Data Name="Last quick scan source">0</Data>
<Data Name="Last full scan start time">?1/?1/?1601 12:00:00 AM</Data>
<Data Name="Last full scan end time">?1/?1/?1601 12:00:00 AM</Data>
<Data Name="Last full scan source">0</Data>
<Data Name="Product status">0x00080000</Data>
</EventData>
</Event>
Log Name: Microsoft-Windows-Windows Defender/Operational
Source: Microsoft-Windows-Windows Defender
Date: 10/11/2019 6:51:48 AM
Event ID: 1116
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: DESKTOP-TA0GPNC
Description:
Windows Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Atosev.gen!A&threatid=2147729392&enterprise=0
Name: Behavior:Win32/Atosev.gen!A
ID: 2147729392
Severity: Severe
Category: Suspicious Behavior
Path: behavior:_pid:2180:51347961044742; process:_pid:2180,ProcessStart:132152749072048955
Detection Origin: Unknown
Detection Type: Concrete
Detection Source: Unknown
User:
Process Name: C:\Users\test\Desktop\GatewayX64_GATE-WAY.exe
Signature Version: AV: 1.303.1437.0, AS: 1.303.1437.0, NIS: 1.303.1437.0
Engine Version: AM: 1.1.16400.2, NIS: 1.1.16400.2
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" />
<EventID>1116</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-10-11T13:51:48.911570600Z" />
<EventRecordID>40</EventRecordID>
<Correlation ActivityID="{ffc75b3b-c6ac-4fb7-98e7-74eb9dc03761}" />
<Execution ProcessID="2196" ThreadID="332" />
<Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
<Computer>DESKTOP-TA0GPNC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Product Name">%%827</Data>
<Data Name="Product Version">4.18.1807.18075</Data>
<Data Name="Detection ID">{3D19B054-8A8C-4A0F-A665-C43A64AA3CFA}</Data>
<Data Name="Detection Time">1601-01-01T00:00:00.000Z</Data>
<Data Name="Unused">
</Data>
<Data Name="Unused2">
</Data>
<Data Name="Threat ID">2147729392</Data>
<Data Name="Threat Name">Behavior:Win32/Atosev.gen!A</Data>
<Data Name="Severity ID">5</Data>
<Data Name="Severity Name">Severe</Data>
<Data Name="Category ID">46</Data>
<Data Name="Category Name">Suspicious Behavior</Data>
<Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Atosev.gen!A&threatid=2147729392&enterprise=0</Data>
<Data Name="Status Code">1</Data>
<Data Name="Status Description">
</Data>
<Data Name="State">1</Data>
<Data Name="Source ID">0</Data>
<Data Name="Source Name">%%885</Data>
<Data Name="Process Name">C:\Users\test\Desktop\GatewayX64_GATE-WAY.exe</Data>
<Data Name="Detection User">
</Data>
<Data Name="Unused3">
</Data>
<Data Name="Path">behavior:_pid:2180:51347961044742; process:_pid:2180,ProcessStart:132152749072048955</Data>
<Data Name="Origin ID">0</Data>
<Data Name="Origin Name">%%844</Data>
<Data Name="Execution ID">3</Data>
<Data Name="Execution Name">%%848</Data>
<Data Name="Type ID">0</Data>
<Data Name="Type Name">%%822</Data>
<Data Name="Pre Execution Status">0</Data>
<Data Name="Action ID">9</Data>
<Data Name="Action Name">%%887</Data>
<Data Name="Unused4">
</Data>
<Data Name="Error Code">0x00000000</Data>
<Data Name="Error Description">The operation completed successfully. </Data>
<Data Name="Unused5">
</Data>
<Data Name="Post Clean Status">0</Data>
<Data Name="Additional Actions ID">0</Data>
<Data Name="Additional Actions String">No additional actions required</Data>
<Data Name="Remediation User">
</Data>
<Data Name="Unused6">
</Data>
<Data Name="Signature Version">AV: 1.303.1437.0, AS: 1.303.1437.0, NIS: 1.303.1437.0</Data>
<Data Name="Engine Version">AM: 1.1.16400.2, NIS: 1.1.16400.2</Data>
</EventData>
</Event>
Log Name: Microsoft-Windows-Windows Defender/Operational
Source: Microsoft-Windows-Windows Defender
Date: 10/11/2019 6:52:19 AM
Event ID: 1117
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: DESKTOP-TA0GPNC
Description:
Windows Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:Win32/DefenderTamperingRestore&threatid=2147741622&enterprise=0
Name: VirTool:Win32/DefenderTamperingRestore
ID: 2147741622
Severity: Severe
Category: Tool
Path: regkeyvalue:_hklm\software\policies\microsoft\windows defender\spynet\\DisableBlockAtFirstSeen
Detection Origin: Unknown
Detection Type: Concrete
Detection Source: System
User: NT AUTHORITY\SYSTEM
Process Name: Unknown
Action: Quarantine
Action Status: No additional actions required
Error Code: 0x00000000
Error description: The operation completed successfully.
Signature Version: AV: 1.303.1437.0, AS: 1.303.1437.0, NIS: 1.303.1437.0
Engine Version: AM: 1.1.16400.2, NIS: 1.1.16400.2
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" />
<EventID>1117</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-10-11T13:52:19.546821900Z" />
<EventRecordID>47</EventRecordID>
<Correlation ActivityID="{c535a726-e6fd-437e-8a47-c2dcbbb4de2e}" />
<Execution ProcessID="2196" ThreadID="332" />
<Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
<Computer>DESKTOP-TA0GPNC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Product Name">%%827</Data>
<Data Name="Product Version">4.18.1807.18075</Data>
<Data Name="Detection ID">{7409D3AE-B84E-48AB-B201-9FDAFAFF1A01}</Data>
<Data Name="Detection Time">2019-10-11T13:52:03.685Z</Data>
<Data Name="Unused">
</Data>
<Data Name="Unused2">
</Data>
<Data Name="Threat ID">2147741622</Data>
<Data Name="Threat Name">VirTool:Win32/DefenderTamperingRestore</Data>
<Data Name="Severity ID">5</Data>
<Data Name="Severity Name">Severe</Data>
<Data Name="Category ID">34</Data>
<Data Name="Category Name">Tool</Data>
<Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:Win32/DefenderTamperingRestore&threatid=2147741622&enterprise=0</Data>
<Data Name="Status Code">3</Data>
<Data Name="Status Description">
</Data>
<Data Name="State">2</Data>
<Data Name="Source ID">2</Data>
<Data Name="Source Name">%%820</Data>
<Data Name="Process Name">Unknown</Data>
<Data Name="Detection User">NT AUTHORITY\SYSTEM</Data>
<Data Name="Unused3">
</Data>
<Data Name="Path">regkeyvalue:_hklm\software\policies\microsoft\windows defender\spynet\\DisableBlockAtFirstSeen</Data>
<Data Name="Origin ID">0</Data>
<Data Name="Origin Name">%%844</Data>
<Data Name="Execution ID">0</Data>
<Data Name="Execution Name">%%812</Data>
<Data Name="Type ID">0</Data>
<Data Name="Type Name">%%822</Data>
<Data Name="Pre Execution Status">3</Data>
<Data Name="Action ID">2</Data>
<Data Name="Action Name">%%809</Data>
<Data Name="Unused4">
</Data>
<Data Name="Error Code">0x00000000</Data>
<Data Name="Error Description">The operation completed successfully. </Data>
<Data Name="Unused5">
</Data>
<Data Name="Post Clean Status">0</Data>
<Data Name="Additional Actions ID">0</Data>
<Data Name="Additional Actions String">No additional actions required</Data>
<Data Name="Remediation User">NT AUTHORITY\SYSTEM</Data>
<Data Name="Unused6">
</Data>
<Data Name="Signature Version">AV: 1.303.1437.0, AS: 1.303.1437.0, NIS: 1.303.1437.0</Data>
<Data Name="Engine Version">AM: 1.1.16400.2, NIS: 1.1.16400.2</Data>
</EventData>
</Event>
Log Name: Microsoft-Windows-Windows Defender/Operational
Source: Microsoft-Windows-Windows Defender
Date: 10/9/2019 12:06:37 AM
Event ID: 2001
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: DESKTOP-TA0GPNC
Description:
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.273.933.0
Update Source: Microsoft Malware Protection Center
Signature Type: AntiVirus
Update Type: Full
User: NT AUTHORITY\NETWORK SERVICE
Current Engine Version:
Previous Engine Version: 1.1.15100.1
Error code: 0x80072ee7
Error description: The server name or address could not be resolved
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" />
<EventID>2001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-10-09T07:06:37.923054700Z" />
<EventRecordID>25</EventRecordID>
<Correlation />
<Execution ProcessID="2196" ThreadID="2792" />
<Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
<Computer>DESKTOP-TA0GPNC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Product Name">%%827</Data>
<Data Name="Product Version">4.18.1807.18075</Data>
<Data Name="Current Signature Version">
</Data>
<Data Name="Previous Signature Version">1.273.933.0</Data>
<Data Name="Update Source Index">6</Data>
<Data Name="Update Source">%%851</Data>
<Data Name="Unused">
</Data>
<Data Name="Domain">NT AUTHORITY</Data>
<Data Name="User">NETWORK SERVICE</Data>
<Data Name="SID">S-1-5-20</Data>
<Data Name="Signature Type Index">1</Data>
<Data Name="Signature Type">%%800</Data>
<Data Name="Update Type Index">1</Data>
<Data Name="Update Type">%%803</Data>
<Data Name="Current Engine Version">
</Data>
<Data Name="Previous Engine Version">1.1.15100.1</Data>
<Data Name="Error Code">0x80072ee7</Data>
<Data Name="Error Description">The server name or address could not be resolved </Data>
<Data Name="Update State Index">1</Data>
<Data Name="Update State">%%852</Data>
<Data Name="Source Path">https://go.microsoft.com/fwlink/?LinkID=870379&clcid=0x409&arch=x64&eng=1.1.15100.1&avdelta=1.273.933.0&asdelta=1.273.933.0&prod=77BDAF73-B396-481F-9042-AD358843EC24&ostype=0&signaturetype=0&beta=0&plat=4.18.1807.18075</Data>
</EventData>
</Event>
Log Name: Microsoft-Windows-Windows Defender/Operational
Source: Microsoft-Windows-Windows Defender
Date: 10/11/2019 6:52:20 AM
Event ID: 2010
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: DESKTOP-TA0GPNC
Description:
Windows Defender Antivirus used Dynamic Signature Service to retrieve additional signatures to help protect your machine.
Current Signature Version: 1.303.1437.0
Signature Type: AntiSpyware
User: \
Current Engine Version: 1.1.16400.2
Dynamic Signature Type: Signature update
Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\eb9cb392e6bbabd3cb27aef05581d627cd6f1fca
Dynamic Signature Version: 0.0.0.0
Dynamic Signature Compilation Timestamp: ?10/?11/?2019 1:52:20 PM
Persistence Limit Type: Duration
Persistence Limit: 150196224
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" />
<EventID>2010</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-10-11T13:52:20.116778600Z" />
<EventRecordID>49</EventRecordID>
<Correlation />
<Execution ProcessID="2196" ThreadID="4820" />
<Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
<Computer>DESKTOP-TA0GPNC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Product Name">%%827</Data>
<Data Name="Product Version">4.18.1807.18075</Data>
<Data Name="Current Signature Version">1.303.1437.0</Data>
<Data Name="Unused">
</Data>
<Data Name="Unused2">
</Data>
<Data Name="Unused3">
</Data>
<Data Name="Unused4">
</Data>
<Data Name="Domain">
</Data>
<Data Name="User">
</Data>
<Data Name="SID">
</Data>
<Data Name="Signature Type Index">2</Data>
<Data Name="Signature Type">%%801</Data>
<Data Name="Unused5">
</Data>
<Data Name="Unused6">
</Data>
<Data Name="Current Engine Version">1.1.16400.2</Data>
<Data Name="Unused7">
</Data>
<Data Name="Unused8">
</Data>
<Data Name="Unused9">
</Data>
<Data Name="Unused10">
</Data>
<Data Name="Unused11">
</Data>
<Data Name="Unused12">
</Data>
<Data Name="Dynamic Signature Type Index">1</Data>
<Data Name="Dynamic Signature Type">%%863</Data>
<Data Name="Persistence Path">C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\eb9cb392e6bbabd3cb27aef05581d627cd6f1fca</Data>
<Data Name="Dynamic Signature Version">0.0.0.0</Data>
<Data Name="Dynamic Signature Compilation Timestamp">?10/?11/?2019 1:52:20 PM</Data>
<Data Name="Persistence Limit Type Index">2</Data>
<Data Name="Persistence Limit Type">%%870</Data>
<Data Name="Persistence Limit Value">150196224</Data>
</EventData>
</Event>
Log Name: Microsoft-Windows-Windows Defender/Operational
Source: Microsoft-Windows-Windows Defender
Date: 10/11/2019 6:52:04 AM
Event ID: 1116
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: DESKTOP-TA0GPNC
Description:
Windows Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:Win32/DefenderTamperingRestore&threatid=2147741622&enterprise=0
Name: VirTool:Win32/DefenderTamperingRestore
ID: 2147741622
Severity: Severe
Category: Tool
Path: regkeyvalue:_hklm\software\policies\microsoft\windows defender\spynet\\DisableBlockAtFirstSeen
Detection Origin: Unknown
Detection Type: Concrete
Detection Source: System
User: NT AUTHORITY\SYSTEM
Process Name: Unknown
Signature Version: AV: 1.303.1437.0, AS: 1.303.1437.0, NIS: 1.303.1437.0
Engine Version: AM: 1.1.16400.2, NIS: 1.1.16400.2
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" />
<EventID>1116</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-10-11T13:52:04.647796600Z" />
<EventRecordID>43</EventRecordID>
<Correlation ActivityID="{3d8bc065-2825-4b8e-925b-d516c1d9fa01}" />
<Execution ProcessID="2196" ThreadID="4008" />
<Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
<Computer>DESKTOP-TA0GPNC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Product Name">%%827</Data>
<Data Name="Product Version">4.18.1807.18075</Data>
<Data Name="Detection ID">{7409D3AE-B84E-48AB-B201-9FDAFAFF1A01}</Data>
<Data Name="Detection Time">2019-10-11T13:52:03.685Z</Data>
<Data Name="Unused">
</Data>
<Data Name="Unused2">
</Data>
<Data Name="Threat ID">2147741622</Data>
<Data Name="Threat Name">VirTool:Win32/DefenderTamperingRestore</Data>
<Data Name="Severity ID">5</Data>
<Data Name="Severity Name">Severe</Data>
<Data Name="Category ID">34</Data>
<Data Name="Category Name">Tool</Data>
<Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:Win32/DefenderTamperingRestore&threatid=2147741622&enterprise=0</Data>
<Data Name="Status Code">1</Data>
<Data Name="Status Description">
</Data>
<Data Name="State">1</Data>
<Data Name="Source ID">2</Data>
<Data Name="Source Name">%%820</Data>
<Data Name="Process Name">Unknown</Data>
<Data Name="Detection User">NT AUTHORITY\SYSTEM</Data>
<Data Name="Unused3">
</Data>
<Data Name="Path">regkeyvalue:_hklm\software\policies\microsoft\windows defender\spynet\\DisableBlockAtFirstSeen</Data>
<Data Name="Origin ID">0</Data>
<Data Name="Origin Name">%%844</Data>
<Data Name="Execution ID">0</Data>
<Data Name="Execution Name">%%812</Data>
<Data Name="Type ID">0</Data>
<Data Name="Type Name">%%822</Data>
<Data Name="Pre Execution Status">0</Data>
<Data Name="Action ID">9</Data>
<Data Name="Action Name">%%887</Data>
<Data Name="Unused4">
</Data>
<Data Name="Error Code">0x00000000</Data>
<Data Name="Error Description">The operation completed successfully. </Data>
<Data Name="Unused5">
</Data>
<Data Name="Post Clean Status">0</Data>
<Data Name="Additional Actions ID">0</Data>
<Data Name="Additional Actions String">No additional actions required</Data>
<Data Name="Remediation User">
</Data>
<Data Name="Unused6">
</Data>
<Data Name="Signature Version">AV: 1.303.1437.0, AS: 1.303.1437.0, NIS: 1.303.1437.0</Data>
<Data Name="Engine Version">AM: 1.1.16400.2, NIS: 1.1.16400.2</Data>
</EventData>
</Event>
Log Name: Microsoft-Windows-Windows Defender/Operational
Source: Microsoft-Windows-Windows Defender
Date: 10/11/2019 6:51:49 AM
Event ID: 1117
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: DESKTOP-TA0GPNC
Description:
Windows Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Atosev.gen!A&threatid=2147729392&enterprise=0
Name: Behavior:Win32/Atosev.gen!A
ID: 2147729392
Severity: Severe
Category: Suspicious Behavior
Path: behavior:_pid:2180:51347961044742; process:_pid:2180,ProcessStart:132152749072048955
Detection Origin: Unknown
Detection Type: Concrete
Detection Source: Unknown
User: NT AUTHORITY\SYSTEM
Process Name: C:\Users\test\Desktop\GatewayX64_GATE-WAY.exe
Action: Quarantine
Action Status: No additional actions required
Error Code: 0x00000000
Error description: The operation completed successfully.
Signature Version: AV: 1.303.1437.0, AS: 1.303.1437.0, NIS: 1.303.1437.0
Engine Version: AM: 1.1.16400.2, NIS: 1.1.16400.2
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" />
<EventID>1117</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-10-11T13:51:49.480559800Z" />
<EventRecordID>41</EventRecordID>
<Correlation ActivityID="{ee1086a6-0b21-4e09-b41c-80d6c77f01cc}" />
<Execution ProcessID="2196" ThreadID="4008" />
<Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
<Computer>DESKTOP-TA0GPNC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Product Name">%%827</Data>
<Data Name="Product Version">4.18.1807.18075</Data>
<Data Name="Detection ID">{3D19B054-8A8C-4A0F-A665-C43A64AA3CFA}</Data>
<Data Name="Detection Time">1601-01-01T00:00:00.000Z</Data>
<Data Name="Unused">
</Data>
<Data Name="Unused2">
</Data>
<Data Name="Threat ID">2147729392</Data>
<Data Name="Threat Name">Behavior:Win32/Atosev.gen!A</Data>
<Data Name="Severity ID">5</Data>
<Data Name="Severity Name">Severe</Data>
<Data Name="Category ID">46</Data>
<Data Name="Category Name">Suspicious Behavior</Data>
<Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Atosev.gen!A&threatid=2147729392&enterprise=0</Data>
<Data Name="Status Code">3</Data>
<Data Name="Status Description">
</Data>
<Data Name="State">2</Data>
<Data Name="Source ID">0</Data>
<Data Name="Source Name">%%885</Data>
<Data Name="Process Name">C:\Users\test\Desktop\GatewayX64_GATE-WAY.exe</Data>
<Data Name="Detection User">
</Data>
<Data Name="Unused3">
</Data>
<Data Name="Path">behavior:_pid:2180:51347961044742; process:_pid:2180,ProcessStart:132152749072048955</Data>
<Data Name="Origin ID">0</Data>
<Data Name="Origin Name">%%844</Data>
<Data Name="Execution ID">3</Data>
<Data Name="Execution Name">%%848</Data>
<Data Name="Type ID">0</Data>
<Data Name="Type Name">%%822</Data>
<Data Name="Pre Execution Status">3</Data>
<Data Name="Action ID">2</Data>
<Data Name="Action Name">%%809</Data>
<Data Name="Unused4">
</Data>
<Data Name="Error Code">0x00000000</Data>
<Data Name="Error Description">The operation completed successfully. </Data>
<Data Name="Unused5">
</Data>
<Data Name="Post Clean Status">0</Data>
<Data Name="Additional Actions ID">0</Data>
<Data Name="Additional Actions String">No additional actions required</Data>
<Data Name="Remediation User">NT AUTHORITY\SYSTEM</Data>
<Data Name="Unused6">
</Data>
<Data Name="Signature Version">AV: 1.303.1437.0, AS: 1.303.1437.0, NIS: 1.303.1437.0</Data>
<Data Name="Engine Version">AM: 1.1.16400.2, NIS: 1.1.16400.2</Data>
</EventData>
</Event>
Log Name: Microsoft-Windows-Windows Defender/Operational
Source: Microsoft-Windows-Windows Defender
Date: 10/11/2019 6:52:05 AM
Event ID: 1117
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: DESKTOP-TA0GPNC
Description:
Windows Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Atosev.gen!A&threatid=2147729392&enterprise=0
Name: Behavior:Win32/Atosev.gen!A
ID: 2147729392
Severity: Severe
Category: Suspicious Behavior
Path: behavior:_pid:2180:51347961044742; file:_C:\Users\test\Desktop\GatewayX64_GATE-WAY.exe
Detection Origin: Local machine
Detection Type: Generic
Detection Source: System
User: NT AUTHORITY\SYSTEM
Process Name: Unknown
Action: Quarantine
Action Status: No additional actions required
Error Code: 0x00000000
Error description: The operation completed successfully.
Signature Version: AV: 1.303.1437.0, AS: 1.303.1437.0, NIS: 1.303.1437.0
Engine Version: AM: 1.1.16400.2, NIS: 1.1.16400.2
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" />
<EventID>1117</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-10-11T13:52:05.070960700Z" />
<EventRecordID>44</EventRecordID>
<Correlation ActivityID="{99e1b8c8-7763-4995-babd-9dcc9e34e47d}" />
<Execution ProcessID="2196" ThreadID="332" />
<Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
<Computer>DESKTOP-TA0GPNC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Product Name">%%827</Data>
<Data Name="Product Version">4.18.1807.18075</Data>
<Data Name="Detection ID">{18514E6B-2EA0-454A-B667-70389BC66422}</Data>
<Data Name="Detection Time">2019-10-11T13:51:49.536Z</Data>
<Data Name="Unused">
</Data>
<Data Name="Unused2">
</Data>
<Data Name="Threat ID">2147729392</Data>
<Data Name="Threat Name">Behavior:Win32/Atosev.gen!A</Data>
<Data Name="Severity ID">5</Data>
<Data Name="Severity Name">Severe</Data>
<Data Name="Category ID">46</Data>
<Data Name="Category Name">Suspicious Behavior</Data>
<Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Atosev.gen!A&threatid=2147729392&enterprise=0</Data>
<Data Name="Status Code">3</Data>
<Data Name="Status Description">
</Data>
<Data Name="State">2</Data>
<Data Name="Source ID">2</Data>
<Data Name="Source Name">%%820</Data>
<Data Name="Process Name">Unknown</Data>
<Data Name="Detection User">NT AUTHORITY\SYSTEM</Data>
<Data Name="Unused3">
</Data>
<Data Name="Path">behavior:_pid:2180:51347961044742; file:_C:\Users\test\Desktop\GatewayX64_GATE-WAY.exe</Data>
<Data Name="Origin ID">1</Data>
<Data Name="Origin Name">%%845</Data>
<Data Name="Execution ID">0</Data>
<Data Name="Execution Name">%%812</Data>
<Data Name="Type ID">2</Data>
<Data Name="Type Name">%%823</Data>
<Data Name="Pre Execution Status">3</Data>
<Data Name="Action ID">2</Data>
<Data Name="Action Name">%%809</Data>
<Data Name="Unused4">
</Data>
<Data Name="Error Code">0x00000000</Data>
<Data Name="Error Description">The operation completed successfully. </Data>
<Data Name="Unused5">
</Data>
<Data Name="Post Clean Status">0</Data>
<Data Name="Additional Actions ID">0</Data>
<Data Name="Additional Actions String">No additional actions required</Data>
<Data Name="Remediation User">NT AUTHORITY\SYSTEM</Data>
<Data Name="Unused6">
</Data>
<Data Name="Signature Version">AV: 1.303.1437.0, AS: 1.303.1437.0, NIS: 1.303.1437.0</Data>
<Data Name="Engine Version">AM: 1.1.16400.2, NIS: 1.1.16400.2</Data>
</EventData>
</Event>
from c3.
invictus-0x90
commented on August 15, 2024
Hi, that looks like Defender is flagging on the Gateway exe which I have seen before. It's usually because Defender doesn't like it's behaviour. Consider not using defender where you have the gateway deployed?
What do you mean by "ATP blocks the the relay connection" - which connection? is it blocking the relay talking over Slack or UNCShareFile?
"defender blocks when peripherialbeacon is added to connect to cobalt strike" - the log you provide above doesn't show this. Can you explain more please?
from c3.
Related Issues (20)
- Network Error HOT 3
- Issues with SendHttpRequest function in SlackApi.h HOT 1
- Update dependency 'vis' HOT 1
- No longer works with Covenant after update HOT 4
- O365 Outlook/OneDrive missing header and Base64 error for O365 Task HOT 2
- UP
- Request should be recreated following access_token refresh
- Failed to open Session Handle (Windows 7 / Server 2008)
- Controller error: Gateway <ID> already connected HOT 1
- Exception caught HOT 6
- GetLdrpHandleTlsOffsetData for 21H1?
- Early function return in LoadPe() fails to release memory in error branch
- Custom Payload
- Install.sh (client) -- cd: too many arguments.
- Link to Tutorial is Broken HOT 1
- question HOT 3
- Network Error HOT 1
- Throwing exception: unable to create channel HOT 2
- OneDrive365RestFile channel: "Cannot refresh token: Bad Request" HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from c3.