Cyberdefense/DeepBlueCLI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Disable Mimikatz token::elevate detection; I thought I was on to a cool detect, but sadly it's just Windows operating normally with excessive privileges.

Browse Source
This commit is contained in:
Joshua Wright
2019-05-06 14:40:17 -04:00
parent 612cde1cf3
commit d500632c50
1 changed files with 21 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
DeepBlue.ps1
View File

@ -137,26 +137,27 @@ function Main {
#$adminlogons($username)+=($securitysid) #$adminlogons($username)+=($securitysid)
} }
# This unique privilege list is used by Mimikatz 2.2.0 # This unique privilege list is used by Mimikatz 2.2.0
If ($privileges -Match "SeAssignPrimaryTokenPrivilege" ` # Disabling due to false-positive with MS Exchange.
-And $privileges -Match "SeTcbPrivilege" ` # If ($privileges -Match "SeAssignPrimaryTokenPrivilege" `
-And $privileges -Match "SeSecurityPrivilege" ` # -And $privileges -Match "SeTcbPrivilege" `
-And $privileges -Match "SeTakeOwnershipPrivilege" ` # -And $privileges -Match "SeSecurityPrivilege" `
-And $privileges -Match "SeLoadDriverPrivilege" ` # -And $privileges -Match "SeTakeOwnershipPrivilege" `
-And $privileges -Match "SeBackupPrivilege" ` # -And $privileges -Match "SeLoadDriverPrivilege" `
-And $privileges -Match "SeRestorePrivilege" ` # -And $privileges -Match "SeBackupPrivilege" `
-And $privileges -Match "SeDebugPrivilege" ` # -And $privileges -Match "SeRestorePrivilege" `
-And $privileges -Match "SeAuditPrivilege" ` # -And $privileges -Match "SeDebugPrivilege" `
-And $privileges -Match "SeSystemEnvironmentPrivilege" ` # -And $privileges -Match "SeAuditPrivilege" `
-And $privileges -Match "SeImpersonatePrivilege" ` # -And $privileges -Match "SeSystemEnvironmentPrivilege" `
-And $privileges -Match "SeDelegateSessionUserImpersonatePrivilege") { # -And $privileges -Match "SeImpersonatePrivilege" `
$obj.Message = "Mimikatz token::elevate Privilege Use" # -And $privileges -Match "SeDelegateSessionUserImpersonatePrivilege") {
$obj.Results = "Username: $username`n" # $obj.Message = "Mimikatz token::elevate Privilege Use"
$obj.Results += "Domain: $domain`n" # $obj.Results = "Username: $username`n"
$obj.Results += "User SID: $securityid`n" # $obj.Results += "Domain: $domain`n"
$pprivileges = $privileges -replace "`n",", " -replace "\s+"," " # $obj.Results += "User SID: $securityid`n"
$obj.Results += "Privileges: $pprivileges" # $pprivileges = $privileges -replace "`n",", " -replace "\s+"," "
Write-Output($obj) # $obj.Results += "Privileges: $pprivileges"
} # Write-Output($obj)
# }
# This unique privilege list is used by Metasploit exploit/windows/smb/psexec (v5.0.4 tested) # This unique privilege list is used by Metasploit exploit/windows/smb/psexec (v5.0.4 tested)
# # Disabling due to false-positive with MS Exchange Server # # Disabling due to false-positive with MS Exchange Server
# If ($privileges -Match "SeSecurityPrivilege" ` # If ($privileges -Match "SeSecurityPrivilege" `