Detecting Access Token Manipulation

The presentation discusses techniques for credential theft and how to detect them using user land hooks and ETW providers.

• Credential theft techniques include Pass the Ticket, Overpass the Hash, and Net Only.
• ETW providers can be used to enrich the data set and detect techniques not currently detected with standard methods.
• Frida is a binary instrumentation framework that allows for custom and scriptable detection logic on the fly.
• An anecdote is given about the limitations of ETW for detecting Kerberos-related attacks.
• The presentation concludes with a discussion on how to detect these techniques using user land hooks and ETW providers.

The presenter discusses the limitations of ETW for detecting Kerberos-related attacks, noting that there is better logging on domain controllers but the purpose of the presentation was to find client-side manipulation style attacks. The presenter also notes that there are some gaps in what can be natively detected, and that user land hooks and ETW providers can be used to enrich the data set and detect techniques not currently detected with standard methods.

Windows access token manipulation attacks are well known and abused from an offensive perspective, but rely on an extensive body of arcane Windows security internals: logon sessions, access tokens, UAC, and network authentication protocols, such as Kerberos and NTLM, to name a few. Furthermore, some of this information is not easily found and can be complex for defensive practitioners to get to grips with, resulting in brittle detections and making it hard to identify the signal from the noise. This presentation aims to demystify how access tokens work in Windows environments and show how attackers abuse legitimate Windows functionality to move laterally and compromise entire Active Directory domains. Most importantly, it will cover how to catch attackers in the act, and at scale, across enterprises. In doing so, defense practitioners will understand the key signals to identify access token manipulation within their own environments in order to detect and respond to these types of attacks. The presentation will be heavy on Windows internals/APIs, undocumented tips and tricks, and reveal how red teaming and attack tools really work their magic.