Abstract
Windows 11 ships with a nifty feature called Power Automate Desktop, which lets users automate mundane processes. In a nutshell, Users can build custom processes and hand them to Microsoft, which in turn ensures they are distributed to all user machines, executed successfully and reports back to the cloud. You can probably already see where this is going..
In this presentation, we will show how Power Automate Desktop can be repurposed to power malware operations. We will demonstrate the full cycle of distributing payloads, bypassing perimeter controls, executing them on victim machines and exfiltrating data. All while using nothing but Windows baked-in and signed executables, and Office cloud services.
We will then take you behind the scenes and explore how this service works, what attack surface it exposes on the machine and in the cloud, and how Microsoft managed to enable it across their customer base without explicit user consent. We will also point out a few promising future research directions for the community to pursue.
Finally, we will share an open-source command line tool to easily accomplish all of the above, so you will be able to add it into your Red Team arsenal and try out your own ideas.
Official agenda abstract for this talk, sourced from BSides Vienna 0x7E6
Transcript
AI generated from recording.
Introduction and Context
00:00 Presenter: Welcome to No-Code Malware Windows 11 at Your Service.
00:08 Presenter: Hello BSides Orlando.
00:21 Presenter: Hi everyone, I’m excited to be here at BSides Orlando and welcome to No-Code Malware Windows at Your Service.
00:30 Presenter: focusing on how do you use, how do you take Microsoft signed executables,
00:36 Presenter: services and cloud services and turn them into your own malware operations.
00:49 Presenter: Hi everyone, I’m really excited to be here at VisHeads Orlando.
00:57 Presenter: Hi everyone, I’m really excited to be presenting this talk in Visas Orlando even though it’s
01:02 Presenter: virtual. This talk is going to be fun. We’re going to show you how you can take Microsoft
01:08 Presenter: signed executables, local services and cloud services and turn them into your own malware
01:14 Presenter: operation. A little bit about myself. I’ve been in this space of low-code, no-code security
01:23 Presenter: for the last four years now.
01:26 Presenter: About two years ago, I co-founded Zenity,
01:28 Presenter: where a company focused on security for low-code, no-code apps.
01:32 Presenter: I’ve spent a bunch of time at Microsoft,
01:35 Presenter: really all around security with IoT and API
01:39 Presenter: and infrastructure and code application security.
01:42 Presenter: I also lead a project, an OWASP project,
01:45 Presenter: dedicated to low-code, no-code risks.
01:47 Presenter: And so you can find us out there.
01:50 Presenter: There’s a whole bunch of information we are putting forth.
01:53 Presenter: And I write in dark reading again about low code.
01:57 Presenter: If you find the subjects of this talk interesting,
02:00 Presenter: if you want to talk more, please reach out to me on Twitter.
02:04 Presenter: I’d be happy to chat.
02:06 Presenter: So this slide is important because, of course, we love no code.
02:12 Presenter: We think that it’s great.
02:13 Presenter: It’s empowering people to do things that they were not able to do before.
02:16 Presenter: But it needs to be done in a secure way,
02:19 Presenter: and that’s why we are giving this information from the attacker’s perspective.
02:25 Presenter: So here’s what we’re going to start with. The idea is we want to create a malware operation. So from the time that you were able to get initial access to some machine to when you have a full blown malware operation operating and working and you can send commands, they come back to you. There’s a whole bunch of work you need to do. Let’s just figure out what exactly do I mean by malware operation.
RPA Fundamentals and Threat Landscape
02:53 Presenter: So let’s say that you got initial access to some victim machine
02:58 Presenter: That’s really cool, that’s the first part
03:00 Presenter: But now there’s a whole bunch of ops that you need to do
03:04 Presenter: In order to actually take advantage of it
03:08 Presenter: So this is kind of the real world
03:12 Presenter: Where it’s fine that you have initial access
03:14 Presenter: But there’s a lot of things that you need to deal with
03:16 Presenter: So you need to be able to actually run something on that machine
03:21 Presenter: You need to be able to communicate with the command and control, perhaps through a firewall.
03:27 Presenter: You need to be able to exfiltrate data back, again, through a firewall.
03:31 Presenter: You need to be able to avoid detection, either by EDR or by network tools
03:36 Presenter: or any other thing that security teams are putting forth to block you there.
03:41 Presenter: And you also need to remain persistent, because you want to stay where you initially got access to.
03:46 Presenter: So all of those things that are not hacking, they’re actually grant work.
03:52 Presenter: That’s a bunch of operations, a bunch of things that you need to do after the initial access
03:57 Presenter: that are kind of about engineering and creating this architecture where everything is covered up.
04:04 Presenter: The idea behind this talk is to try and find someone else that will solve these things for us,
04:13 Presenter: that will solve all of these operation things for us.
04:18 Presenter: And in order to do that, let me introduce kind of a service
04:24 Presenter: that has been available for quite some time out there, RPA.
04:30 Presenter: So I’m not sure if you’ve heard about this,
04:32 Presenter: but RPA is a new product category, relatively new, a few years.
04:36 Presenter: And the main value proposition is for users to automate mundane tasks.
04:41 Presenter: So this is basically copy and paste integration, processing receipts, onboarding and offboarding users.
04:47 Presenter: Basically, there are three components to this technology.
04:51 Presenter: One is an agent that sits on people’s laptops and it’s actually using the, basically emulating a user.
04:59 Presenter: So performing keyboard operations or mouse operations.
05:04 Presenter: So that’s one thing.
05:05 Presenter: The second piece is the controller.
05:07 Presenter: this is something that is actually able to reach out to the machine, to the user machine,
05:13 Presenter: and the agent within it, send out a command to be executed,
05:17 Presenter: and then after the command is executed, I get the results back.
05:21 Presenter: And of course, there’s a management portal that allows you to do this at scale
05:24 Presenter: across multiple different machines.
05:28 Presenter: Now, the crucial piece about this technology is that every one of these points,
05:34 Presenter: points, every one of these services are trusted.
05:39 Presenter: The executables, the agent is trusted on the user side.
05:43 Presenter: The controller that is able to reach out through the network, send the command and get the results is trusted by network security.
05:51 Presenter: And the cloud services are trusted as well.
05:54 Presenter: And so this gives you kind of a feeling into what are we going to do next.
05:59 Presenter: Now, RPA is really everywhere, specifically in the enterprise.
06:05 Presenter: And you’re seeing a bunch of different, kind of the leading RPA vendors in this slide.
06:11 Presenter: These are technologies that are used across the enterprise, and we’ll see this in a moment.
06:18 Presenter: But you can expect these agents to be there on almost every enterprise laptop today.
06:25 Presenter: We’ll see in a moment why.
06:27 Presenter: And so most of this
06:31 Presenter: Let’s continue on
06:32 Presenter: And so RPA can handle everything that we just saw for us
06:38 Presenter: So it’s able to do command and control exfiltration
06:41 Presenter: Defense evasion, persistency cleanup
Technical Deep‑Dive: Power Automate Architecture
06:43 Presenter: These are all things that we will show how to accomplish through RPA
06:47 Presenter: But it will also provide a bunch of other things that we didn’t ask for
06:51 Presenter: Like that are about engineering basically
06:54 Presenter: supporting different OSs, being able to update, handling errors.
06:58 Presenter: And so this is really empowering for us.
07:02 Presenter: And it’s a very, for hackers, and it’s a really good place to leave off the land.
07:09 Presenter: So because there’s a lot of capabilities and they’re trusting.
07:13 Presenter: So you already see where this talk is going.
07:16 Presenter: So now when we are kind of all on board with what we’re going to accomplish,
07:20 Presenter: let’s look at what we’re going to do today.
07:24 Presenter: We just talked about malware operations and what this is.
07:27 Presenter: We’re going to dive deep into what our PA is
07:30 Presenter: to just kind of figure out that we’re all on the same page
07:32 Presenter: and that we understand what this technology does.
07:35 Presenter: Next up, we’ll do a technical deep dive.
07:39 Presenter: How does it work?
07:39 Presenter: How does it accomplish what it does
07:41 Presenter: in order to be able to take advantage of it?
07:43 Presenter: And then we’ll switch gear and actually show
07:45 Presenter: all the things that we have mentioned
07:47 Presenter: that are kind of part of the grant work of malware operations,
07:50 Presenter: how you can do them with our PA.
07:54 Presenter: that does all of this for you without having to know the complexities of RPA
07:57 Presenter: and don’t worry I’m going to also send you home with a few points of things that you can do
08:03 Presenter: to protect your organization
08:07 Presenter: So let’s start with RPA
08:09 Presenter: In order to figure out what RPA does
08:12 Presenter: Let me start off with a story
08:14 Presenter: When I was a teenager me and my friends used to play in a very nerdy game called Tibia
08:19 Presenter: Basically it’s an MMORPG where you basically level up, you play with other characters
08:26 Presenter: It’s a very kind of social game
08:28 Presenter: And we were obsessed with this game, with me and my friends
08:34 Presenter: But actually a lot of the things that we had to do in this game, a lot of the day-to-day
08:41 Presenter: Involved things like fishing
08:43 Presenter: And so what do I mean by fishing?
08:45 Presenter: Basically, you take a worm and you click on the pond and you might get a fish.
08:51 Presenter: And this kind of leveled up your fishing skills and was important.
08:55 Presenter: This was like 90% of my time playing the game.
08:58 Presenter: So you click and you get fish and you click and you get fish and you click and you get fish.
09:03 Presenter: And I mean, it’s nice, but actually it’s really boring.
09:07 Presenter: Because you are basically transforming virtual worms to virtual fish.
09:14 Presenter: this was annoying and kept me away from what I really wanted to do.
09:20 Presenter: So I wanted to find basically an advantage, a creative solution to figure out how to do this
09:26 Presenter: without having to invest the time.
09:28 Presenter: I also wanted to kind of impress my friends and get an advantage over them.
09:32 Presenter: And so I came up with this kind of creative solution.
09:37 Presenter: And this is true, by the way.
09:39 Presenter: I didn’t find the real photo, but I used physical automation.
09:44 Presenter: And so this is an illustration of how this looks like.
09:47 Presenter: Basically, I would put a bunch of books over the keyboard and the mouse overnight.
09:52 Presenter: And then I hoped that by the time morning comes, things would still stay there and I would level up.
09:59 Presenter: This kind of worked some of the time, but most of the time things fell over.
10:04 Presenter: Things didn’t behave as I expected.
10:06 Presenter: And of course, this was very limited in what I was able to do.
10:10 Presenter: And so, but this did trigger my imagination into what is actually possible.
10:16 Presenter: And so in the next iteration, I actually found a few kinds of software that were able to record my keyboard and mouse.
10:26 Presenter: And then just reiterate those steps over time.
10:30 Presenter: And this is kind of, this was very sophisticated for me at the time.
10:34 Presenter: Let’s see how it looks like.
10:36 Presenter: And so you can see that now I am able to do much more than just click.
10:40 Presenter: I can move the mouse around.
10:42 Presenter: I can move the character around.
10:44 Presenter: And so this was a revelation.
10:47 Presenter: This made me basically the hero of my friends
10:49 Presenter: because more than just being able to do this,
10:51 Presenter: I could share it with others.
10:53 Presenter: And so this is a nice way to kind of think about RPA.
10:59 Presenter: RPA is a technology that has started as a way to create integrations
11:04 Presenter: by emulating a user one-to-one.
11:06 Presenter: This also means that you can integrate with systems
Building a Malware Operation with RPA
11:10 Presenter: that don’t have proper APIs.
11:12 Presenter: Think about kind of legacy software in a large enterprise.
11:16 Presenter: And so you can just, by being able to use the computer
11:23 Presenter: as a user would, you gain access to the same kind of things
11:27 Presenter: that the user would be able to do.
11:30 Presenter: And so here’s a quick summary about what RPA is.
11:34 Presenter: The idea is to replace this copy and pasting that users do manually.
11:40 Presenter: The building of RPA tasks is very much kind of drag and drop.
11:46 Presenter: It’s supposed to be easy to do by everyone.
11:50 Presenter: You emulate the user actions, and so the mouse and the keyboard.
11:54 Presenter: This also means that you run the same way as the user runs, right?
11:59 Presenter: You run as the user.
12:00 Presenter: So there’s no way, unless you’re doing some behavioral analytics, to distinguish between a user and an RPA bot.
12:07 Presenter: And again, this distinction would be very difficult because this is exactly what the RPA is doing, is emulating user activity.
12:14 Presenter: And also, RPA runs either on user machines, so on user laptops, in order to be able to access the same kind of information that they’re accessing, or on dedicated servers.
12:25 Presenter: And this is actually being used for really heavy lifting within the enterprise.
12:30 Presenter: use cases, for example automating off-boarding and onboarding employees,
12:35 Presenter: submitting financial reports. So there are a bunch of things that enterprises are
12:40 Presenter: doing with RPA that are really creating a lot of value.
12:49 Presenter: So now that we understand why RPA exists and why is it used in the enterprise, why
12:55 Presenter: today in almost every enterprise you’ll find RPA there. Let’s kind of dive
13:00 Presenter: deep a bit, dive a bit deeper and figure out how it works. So that’s
13:09 Presenter: what we’re going to do right now and the rest of this talk from this moment
13:12 Presenter: forward is going to be focused on Microsoft’s RPA, it’s called Power
13:16 Presenter: Automate and all of the things that I’m going to show you are very
13:22 Presenter: similar across different RPA vendors.
13:24 Presenter: It’s not really just a Microsoft problem.
13:26 Presenter: It’s inherent in RPA.
13:29 Presenter: But the reason why we focus on Microsoft
13:32 Presenter: is because Microsoft’s RPA agent
13:35 Presenter: comes built in in Windows 11.
13:38 Presenter: And so if you open up a Windows 11 machine,
13:41 Presenter: a vanilla Windows 11 machine today,
13:44 Presenter: a laptop, a server,
13:45 Presenter: you’ll find Power Automate already there.
13:48 Presenter: And that’s why it’s important
13:49 Presenter: because it’s kind of available for us to use.
13:53 Presenter: Let me show you how this looks like
13:55 Presenter: from a user’s perspective.
13:58 Presenter: And so when you kick off a new vanilla machine,
14:02 Presenter: Windows 11,
14:03 Presenter: just search for Power Automate.
14:05 Presenter: You already find this agent within your machine.
14:11 Presenter: Let’s see if this works.
14:16 Presenter: So I’m going to show you how,
14:19 Presenter: when I execute this agent for the first time.
14:27 Presenter: Okay, so I’m going to Power Automate.
14:30 Presenter: First of all, it’s going to ask me for an email address.
14:33 Presenter: This is a Microsoft address.
14:35 Presenter: And keep in mind, I could plug in any address here.
14:38 Presenter: That’s important to note here.
14:40 Presenter: Once I do that, it connects to Office,
14:42 Presenter: and then you can see a whole bunch of information being populated.
14:45 Presenter: We’ll jump back to it in a moment.
14:46 Presenter: I’m going to create a Hello World application and now you’re seeing the actual
14:52 Presenter: The builder the drag-and-drop interface that allows you to to create our PA bots
14:57 Presenter: I’m going to choose the write to file action and just pick the file that I would like to write on and you will see that very
15:03 Presenter: Quickly I set up a flow which kind of appends a line into into this file. I click on run it runs and
15:11 Presenter: Everything gets executed really easily and the file gets created
15:16 Presenter: So you can see that this is pretty easy and that there are a whole bunch of applications I can use.
15:21 Presenter: You can also see that there are other tasks that are already available because of the integration with Office.
15:27 Presenter: And as you can see, there’s a little trigger there that the thing actually worked.
15:33 Presenter: And so you notice, and I kind of stressed it a few times, that first of all, when you connected, you had to use some sort of an address.
15:46 Presenter: Then afterwards, you got a whole bunch of automations
15:50 Presenter: that were already available there.
15:51 Presenter: So let’s figure out what’s going on there.
15:55 Presenter: This is actually what we saw, right?
15:57 Presenter: So once we plugged into, we added our address
16:02 Presenter: or logged in to Power Automate,
16:05 Presenter: you saw all of these different automations
Command & Control, Exfiltration, and Persistence
16:07 Presenter: that were already available, and those are my automations.
16:11 Presenter: So I created them in advance, but not on the machine.
16:14 Presenter: I created them on the office side.
16:16 Presenter: see that on the environment widget there,
16:21 Presenter: basically, Power Automate is connected to Office,
16:24 Presenter: and it drives all of its automation through Office,
16:26 Presenter: and that’s why you’re actually seeing this.
16:28 Presenter: So this is synced with the cloud.
16:30 Presenter: And so, one thing that you should be asking yourself
16:35 Presenter: is how is this possible?
16:37 Presenter: So if, let’s say that Microsoft is,
16:41 Presenter: so we understand that Microsoft is putting this in,
16:43 Presenter: by default, this agent, in every Windows 11 installation.
16:49 Presenter: And this is connected to Office.
16:50 Presenter: But it’s not like they asked some network admin in the middle
16:53 Presenter: to open up the firewall, right?
16:55 Presenter: This is something that needs to work properly.
16:59 Presenter: So let’s figure out how everything works here.
17:04 Presenter: So on one side, we have Power Automate.
17:07 Presenter: It runs probably on-prem, but on somebody’s machine.
17:10 Presenter: On the other side, we have the Office Cloud Services.
17:13 Presenter: about the communication, let’s just figure out what’s actually happening on the user side, on the
17:19 Presenter: laptop side. So Power Automate is actually more than just one executable. There’s a whole bunch
17:25 Presenter: of executables that are available within the Power Automate framework inside Windows 11.
17:32 Presenter: The two important ones that I’m showing you right now is the Power Automate executable that
17:39 Presenter: It actually runs the command and it runs as the user
17:42 Presenter: in the user context.
17:44 Presenter: So the same kind of permissions, everything like the user.
17:48 Presenter: And the other side is the machine runtime.
17:50 Presenter: It runs on a service account created in your machine
17:54 Presenter: by Microsoft, again, every Windows 11 machine,
17:57 Presenter: and it runs in parallel to the user.
17:59 Presenter: And this is going to be the piece
18:01 Presenter: that actually connects to Office.
18:02 Presenter: We’ll see that in a moment.
18:04 Presenter: Power Automate is also able to automate a browser.
18:09 Presenter: through a whole bunch of browser plugins,
18:13 Presenter: and those are available for browser extensions,
18:15 Presenter: and those are available to every major browser.
18:18 Presenter: So there are dedicated executables that actually handle this,
18:23 Presenter: and so I added them to the picture here as well.
18:26 Presenter: And just kind of so you know,
18:28 Presenter: the only thing that I just showed you right now are these three executables,
18:32 Presenter: but actually, as you can see,
18:34 Presenter: there are a whole bunch of executables that are available
18:36 Presenter: as part of the Power Automate directory,
18:39 Presenter: If you’re looking for a nice place for research and to dive deep, I really recommend this.
18:45 Presenter: There’s a whole bunch of work that could be done here.
18:48 Presenter: And the one thing that is important is that all of these things, as you can see, it’s part of the kind of, it’s already there in program files.
18:57 Presenter: It’s also supported by the EDR, trusted by the EDR.
19:02 Presenter: And so because this is part of Windows 11, Microsoft CDR and others as well are trusting these executables to be okay, to be something that Microsoft has put forth.
19:14 Presenter: So now that we understand what’s happening on the user side, let’s try and understand the network.
19:21 Presenter: So how does this communication actually happen?
19:23 Presenter: happens. Microsoft did not go out to each network security team and ask them to open up the firewall
19:30 Presenter: so every user to be able to directly connect to Office. What exactly is going on here?
19:36 Presenter: The way that this is accomplished is with a cool solution called Azure Service Bus. It used to be
19:42 Presenter: called Azure Relay. Basically, there’s outbound communication going from both sides, from Office
19:46 Presenter: and from the machine runtime, which is actually the user’s laptop. And there’s basically a message
19:53 Presenter: with commands that the agent should be executing.
19:57 Presenter: And so the agent would go out to this queue
20:01 Presenter: once in a while, fetch new commands,
20:04 Presenter: and every time there’s a result,
20:06 Presenter: it would just save it on that queue again.
20:09 Presenter: So that’s the way that the communication
20:10 Presenter: is being established.
20:13 Presenter: And so now that we’re connected
20:15 Presenter: between the agent and the cloud,
20:19 Presenter: let’s try and figure out how does it look like
20:21 Presenter: from the office side.
20:23 Presenter: there. So there’s a very nice
Defense, Detection, and Mitigation Strategies — Part 1
20:26 Presenter: layer in Office that allows you to
20:28 Presenter: look at these agents, understand
20:30 Presenter: what they’re doing. You can see all of the machines
20:32 Presenter: that I have registered into my
20:34 Presenter: malicious tenant.
20:35 Presenter: You can see the version of the agent being installed,
20:38 Presenter: whether it’s working or not. So essentially
20:40 Presenter: this is a management
20:42 Presenter: portal that allows you to view all of
20:44 Presenter: these agents. You can also
20:45 Presenter: run commands directly from the cloud.
20:48 Presenter: So in the same way that you saw me
20:50 Presenter: a moment ago create an automation
20:53 Presenter: created somewhere else and then move it to the cloud and trigger it on some other user’s machine.
21:01 Presenter: You can also view the status of tasks. So you can debug failures, you can check out when things
21:10 Presenter: happened last, you can rerun things. So everything that you need in order to actually manage things,
21:16 Presenter: manage these agents at scale, is available through Microsoft Cloud.
21:21 Presenter: One thing that I still want to touch on
21:24 Presenter: Is the trust component here
21:26 Presenter: How is trust being established
21:28 Presenter: Between office and the users
21:31 Presenter: And the user agent
21:34 Presenter: Without kind of
21:37 Presenter: Other than the authentication
21:39 Presenter: So the messages that are put on these
21:42 Presenter: So once the registration part happens
21:47 Presenter: And you saw me do this a moment ago
21:50 Presenter: key being created on the machine side and the public key is being sent through that mechanism
21:55 Presenter: to office. And then with this private public key, the Azure service bus, the messages can
22:04 Presenter: contain, can be signed. And when they’re signed, keep in mind that they have two things. One
22:10 Presenter: is the RPA task, which is actually kind of what needs to be done, but they also have
22:17 Presenter: local credentials and this is important. This means that the machine runtime agent can run
22:23 Presenter: things on behalf of the user that already exists in that machine but
22:31 Presenter: it can also run tasks as any other user and so this is how this process is
22:38 Presenter: being done in a secure way. And so in a nutshell users can build customer
22:47 Presenter: Microsoft. Microsoft then ensures
22:49 Presenter: that these processes are distributed
22:51 Presenter: across all of the different machines
22:53 Presenter: that are registered to
22:55 Presenter: your tenant, executed successfully
22:57 Presenter: and then report back to the
22:59 Presenter: cloud. And so I think you can
23:01 Presenter: realize what I’m about to do next
23:03 Presenter: so let’s just do it.
23:05 Presenter: The next part would be
23:07 Presenter: how do you take everything that we have learned
23:09 Presenter: so far and build a malware
23:11 Presenter: operation out of it.
23:14 Presenter: And so
23:15 Presenter: Let’s recall our wish list. These are the things that we wanted to do and we’re going to go one by one
23:21 Presenter: And achieve each and every one of them with Power Automate.
23:25 Presenter: And so let’s start. The first thing we need to do is to set up that malicious tenant. We need to set up
23:32 Presenter: an office deployment
23:34 Presenter: That would be the one we are using to manage all of those agents. And so you can see that very easily here
23:40 Presenter: I created a tenant, this is free, you don’t need a license, you don’t need to provide
23:44 Presenter: a credit card, so this is kind of very easy.
23:48 Presenter: And once you create a tenant, when you go to the Power Automate interface, you’ll see
23:54 Presenter: that it points you to install new machines, or basically to onboard new machines in your
23:58 Presenter: tenant.
23:59 Presenter: So, how exactly is it happening?
24:06 Presenter: We actually saw this earlier
24:07 Presenter: So there was a quick UI there
24:10 Presenter: You sign in and you can add in your own email
24:13 Presenter: And remember I alluded to the fact that you can run
24:17 Presenter: You can plug in any account here
24:19 Presenter: This is exactly the point
24:20 Presenter: You can see that I’m inserting an account
24:22 Presenter: That is part of my malicious office deployment
24:28 Presenter: But of course, doing this with UI is kind of fishy. We don’t really need to do that once we have initial access to somebody’s machine. We want to hide.
24:40 Presenter: And so fortunately for us, Microsoft provides a nice script, silently register a new machine, that allows you through PowerShell or through command line to register a machine to your own tenant.
24:55 Presenter: And by the way, even if the machine is already registered to somebody else’s tenant, to the actual organization tenant, it doesn’t matter.
25:02 Presenter: It can be registered to two tenants in the same time and nobody else, and those won’t know about each other.
25:09 Presenter: And so this is really cool.
25:12 Presenter: It kind of solves our problem, right?
25:14 Presenter: Once you do that, you will be able to see the Windows, the machine that you’ve just registered in the Power Automate Management interface.
25:25 Presenter: And so this is the way that we onboard new users, i.e. this is the way that we infect a new machine.
25:31 Presenter: One thing that you might have noticed there is that this script needs to be run as an administrator,
25:40 Presenter: which of course is not that great, right?
25:44 Presenter: As a hacker, this is very limiting.
25:46 Presenter: And so we try to poke around and see whether we can get it to run as a user and not just as an administrator.
25:55 Presenter: And actually it just worked.
25:57 Presenter: So we just tried and it worked.
25:59 Presenter: And so you can also run this executable as a user.
26:05 Presenter: It will register your,
26:07 Presenter: and it will still register the machine
26:09 Presenter: to the malicious tenant.
26:12 Presenter: And so we have, so once we have that,
26:16 Presenter: the machine is registered to my malicious organization.
26:20 Presenter: And now in order to actually run something
26:22 Presenter: on that organization, on that infected machine,
26:26 Presenter: here’s what I have to do.
26:27 Presenter: So I trigger something from the cloud.
26:30 Presenter: I create this automation from the cloud
26:33 Presenter: that chooses a specific desktop flow
26:36 Presenter: that’s the name of the payload that I would like to run.
26:39 Presenter: It asks me for the credentials, as we’ve mentioned earlier,
26:44 Presenter: the local credentials, which, again, we assume you already have
26:47 Presenter: because you have the initial access.
26:48 Presenter: And then it distributes the payload
26:51 Presenter: Then you basically choose the payload
26:53 Presenter: And it will distribute it to the machine
26:56 Presenter: And of course you can run this on one machine
26:59 Presenter: Or you can run this on many machines
27:00 Presenter: One thing that is important to question here
27:04 Presenter: Is what about this user, Alex G
27:07 Presenter: What happens if they’re already logged into their machine?
27:10 Presenter: What happens if they’re actually using it right now?
27:12 Presenter: So how would it look like from the user’s machine?
27:15 Presenter: From the user’s side?
27:18 Presenter: RPA has already taken care of this
27:20 Presenter: or Microsoft has already taken care of this
27:22 Presenter: so there are two versions of RPA
27:24 Presenter: attended and unattended
Defense, Detection, and Mitigation Strategies — Part 2
27:25 Presenter: basically if the
27:27 Presenter: attended means that
27:29 Presenter: if the user already has a session
27:32 Presenter: ongoing within the local machine
27:34 Presenter: you just join that session and you run
27:36 Presenter: with the user on the same session
27:38 Presenter: of course it means that you can steal secrets
27:40 Presenter: you can do everything that the user does
27:42 Presenter: and the other part is
27:44 Presenter: the other option is unattended RPA
27:46 Presenter: this creates a new session
27:48 Presenter: discards of it when it’s done.
27:50 Presenter: And so we can do both of these things.
27:53 Presenter: And so you can see that RPA has already taken care
27:56 Presenter: of many edge cases for us.
27:59 Presenter: And even more than that,
28:01 Presenter: we have already showed you three things
28:03 Presenter: that we wanted to do.
28:04 Presenter: So deploying malware,
28:06 Presenter: that’s just running the script, the Microsoft script.
28:08 Presenter: Defense of Asian, well, this is obvious.
28:10 Presenter: All of these services, the executables,
28:13 Presenter: the cloud services, they are all trusted.
28:16 Presenter: They are trusted by Microsoft,
28:18 Presenter: by other security vendors,
28:20 Presenter: and so the phase evasion is already there.
28:22 Presenter: And with persistency, keep in mind,
28:24 Presenter: we haven’t installed anything new on the machine.
28:26 Presenter: This was already there.
28:28 Presenter: And so you can always just run the command back
28:31 Presenter: from the cloud and run things on the machine,
28:34 Presenter: even if somebody tries to kind of,
28:38 Presenter: because there’s nothing really to remove.
28:41 Presenter: So next up, we are going to see command and control.
28:46 Presenter: We did see a couple of these of payloads that we sent forth
28:50 Presenter: But let’s kind of figure out what kind of payloads we can send and how can we make it kind of generic
28:57 Presenter: So now we’re going to see once we already have a machine infected
29:02 Presenter: We can already send commands out
29:04 Presenter: Let’s see what actually we can do
29:07 Presenter: So here’s just a simple example, data exfiltration
29:11 Presenter: So this is a simple automation
29:13 Presenter: I’m giving this automation as inputs the target file
29:18 Presenter: Some file, some local file I’d like to exfiltrate
29:21 Presenter: And then I’m getting back the content of that file
29:24 Presenter: And you can see that there’s also an error handling here
29:26 Presenter: But that’s kind of very, very simple
29:29 Presenter: Let’s just make sure we understand how this works
29:32 Presenter: First of all, from the cloud side
29:33 Presenter: You can see that I can run this automation
29:36 Presenter: I give the input a target file
29:39 Presenter: And then I just get it back
29:41 Presenter: Let’s make sure we understand
29:44 Presenter: How exactly does this data exfiltration work
29:46 Presenter: To make sure that we won’t get caught
29:48 Presenter: And so if you recall
29:50 Presenter: The architecture
29:52 Presenter: Let’s
29:54 Presenter: Figure out what’s happening over this architecture
29:56 Presenter: So creating those instructions
29:58 Presenter: Basically creating
30:00 Presenter: The payload happens
30:02 Presenter: With us
30:04 Presenter: Directly with office
30:05 Presenter: And so we reach out to office
30:06 Presenter: We give out this payload
30:08 Presenter: And then we give out the command
30:11 Presenter: to a specific machine.
30:12 Presenter: That command goes through the Azure service box,
30:15 Presenter: the Azure service bus, this channel of communication
30:19 Presenter: between the user machine and office.
30:21 Presenter: And it’s been executed, it reaches the machine runtime,
30:26 Presenter: which will execute it with one of the Power Automate agents
30:28 Presenter: depending on the user.
30:30 Presenter: Once the information has been collected,
30:33 Presenter: it will be written again on the secure communication
30:36 Presenter: between Azure service bus.
30:38 Presenter: And so you can see that from the enterprise perspective,
30:41 Presenter: perspective you really cannot catch this because it’s going to Microsoft
30:46 Presenter: trusted services. And so what so we I just showed you data exfiltration but
30:54 Presenter: actually we want more than that we want to be able to run every command that
30:58 Presenter: we would want on the user’s machine. Let’s see how to do that. So here’s the
31:04 Presenter: first version of code execution basically there are there’s a bunch of
31:11 Presenter: utilities within Power Automate that allow you to basically run a command on the machine. So you can see that I’m
31:17 Presenter: getting as input a command and I can run it as PowerShell, as Python, as JavaScript, so there are a bunch of options.
31:24 Presenter: And so using this I can send any payload that I lack into the machine.
31:29 Presenter: The problem is that once I execute this
31:33 Presenter: I get caught by the EDR. And why? Well, because I just run a
31:39 Presenter: a malicious payload in this example,
31:42 Presenter: trying to use Mimikatz.
31:44 Presenter: And of course, this can be called by the EDR.
31:48 Presenter: I mean, EDRs are monitoring this.
31:51 Presenter: Essentially, there are two parts here.
31:53 Presenter: So the part that is trusted is this drag and drop interface.
31:58 Presenter: What the agent, the ARP agent is actually doing.
32:01 Presenter: But once you go to other processes,
32:03 Presenter: once you spawn a command prompt,
32:05 Presenter: Well, of course, this is something that EDRs are especially worried about, so it makes sense that we get caught.
32:14 Presenter: So the question then becomes, what can we do if we stay in this trusted zone?
32:22 Presenter: Can we take better advantage of the trusted zone to actually execute what we wanted to execute?
32:28 Presenter: Because the trusted zone, what we already have there, does have some logic, right?
32:33 Presenter: It needs to choose the right kind of interpreter or compiler
32:38 Presenter: Or something that we’re using to actually run the code
32:42 Presenter: And so what can we do to take more advantage of this?
32:48 Presenter: And so let’s see how it works
32:52 Presenter: When we run this
32:56 Presenter: When we created this payload
32:58 Presenter: You can see that there are a whole bunch of commands
33:00 Presenter: Of operations that we used
33:03 Presenter: in order to create it.
33:05 Presenter: And so the question becomes, what payloads are available?
33:09 Presenter: What can we do with them?
33:11 Presenter: So this is just a little snapshot of things
33:15 Presenter: that are available within,
33:18 Presenter: kind of as ready-made operations.
33:20 Presenter: So you can use crypto to encrypt files
33:24 Presenter: or to encrypt content.
33:29 Presenter: You can trigger HTTP calls,
33:31 Presenter: You can communicate with AD, with Windows services, with other processes.
33:34 Presenter: You can look at files and folders.
33:36 Presenter: You can automate a browser, which we’ll see in a moment.
33:39 Presenter: You can take screenshots.
33:40 Presenter: You can use the mouse and the keyboard and record them.
33:43 Presenter: So key logging is easy.
33:45 Presenter: You can copy the clipboard or change the clipboard.
33:48 Presenter: And so I’m sure your mind is racing right now with the kinds of things that you are able to do.
33:53 Presenter: Basically, these are all of the primitives that you need to accomplish most of the things that an attacker would like to do.
33:58 Presenter: And so let’s see a few of those in action.
34:01 Presenter: So let’s start with a simple example.
34:05 Presenter: NoCodeRansomware.
34:06 Presenter: So here’s this example.
34:08 Presenter: I’m basically focused on a specific directory.
34:13 Presenter: I’m going to crawl the directory and the subdirectories.
34:15 Presenter: And then I’m going to replace each file with an encrypted file.
34:19 Presenter: You can see the automation here is, again, pretty simple.
Defense, Detection, and Mitigation Strategies — Part 3
34:23 Presenter: There’s a bit of error handling and a bunch of for loops.
34:25 Presenter: but basically I just go deeper and deeper
34:29 Presenter: into the directory hierarchy
34:31 Presenter: and encrypt each one of the files.
34:33 Presenter: Let’s see a quick demo.
34:39 Presenter: So this is the cloud side.
34:41 Presenter: I’m providing the encryption key, the directory,
34:44 Presenter: and how deep do I want this to actually go.
34:48 Presenter: So deep within the directory structure.
34:51 Presenter: The flow is running.
34:53 Presenter: The command is right now being sent
34:55 Presenter: that is going to run this on the infected machine.
34:58 Presenter: And you can see that it’s already run
35:00 Presenter: and it’s giving me information about the actual execution.
35:04 Presenter: On the machine side, you can see
35:07 Presenter: so you can see that the files are actually encrypted.
35:11 Presenter: So this is, as you can see, very easy to actually accomplish.
35:19 Presenter: Okay.
35:20 Presenter: One thing that we haven’t discussed so far
35:25 Presenter: is the fact that there are a bunch of logs
35:27 Presenter: that this agent on the local side is generating.
35:31 Presenter: So the agent, the local RPA agent,
35:34 Presenter: is generating a bunch of information about what it’s doing.
35:37 Presenter: Of course, we would like to clean those up.
35:39 Presenter: And it’s kind of easy because it’s very,
35:42 Presenter: because we already know where this agent
35:44 Presenter: is actually storing information.
35:46 Presenter: And so this automation simply cleans up after ourselves.
35:51 Presenter: So we just go to every location
35:52 Presenter: where we know that the agent is storing information,
35:56 Presenter: permanently deleting those files.
35:58 Presenter: So we saw data exfiltration,
36:01 Presenter: we saw ransomware,
36:02 Presenter: and we saw cleanup.
36:04 Presenter: One thing that I kind of hinted on earlier
36:08 Presenter: is that RPA or Power Automate
36:11 Presenter: is also able to automate the browser.
36:15 Presenter: And so by automating the browser,
36:17 Presenter: of course we can jump,
36:18 Presenter: we can continue on our attack to other locations.
36:21 Presenter: So let’s see how it looks like.
36:25 Presenter: is very easy, we’d like to basically steal tokens
36:29 Presenter: for authenticated tokens,
36:32 Presenter: because we’re running as the user from the browser.
36:34 Presenter: So here’s the idea, we open the browser
36:37 Presenter: kind of in a way that the user won’t notice,
36:39 Presenter: we go to a specific location, in this case,
36:42 Presenter: we’re going to flow.microsoft.com
36:44 Presenter: to steal a Microsoft token for that user,
36:46 Presenter: and then we simply extract the token.
36:49 Presenter: And so let’s see this in action.
36:51 Presenter: Here’s the automation, so I’m going to launch a new browser,
36:55 Presenter: send out a few keystrokes to make sure that we get to the right page and that we can kind of
37:02 Presenter: fetch its content. And then I’m just going to parse the results and fetch the authentication
37:07 Presenter: token out of it. And in this case, you’re seeing Chrome app opens up on a Microsoft website
37:14 Presenter: and the token gets exfetrated back as an output variable. Now, of course, we don’t want the
37:20 Presenter: browser to pop up in such a way. Remember, we’re running as a user in the user session to steal
37:26 Presenter: So there’s a very easy parameter we can change here
37:29 Presenter: to have the browser opened in a minimized version
37:32 Presenter: so the user won’t notice.
37:34 Presenter: Let’s see how it happens from the cloud side.
37:37 Presenter: And so from the cloud side, we create a new request
37:40 Presenter: that basically sends this payload to the infected machine.
37:44 Presenter: Again, you saw this earlier.
37:45 Presenter: So the payload is being sent through the trusted channel,
37:48 Presenter: reaches the agent, the agent’s verified
37:50 Presenter: that it actually runs successfully.
37:52 Presenter: and from the infected user side, nothing happens.
37:58 Presenter: Because, well, we created this in a way
38:00 Presenter: that it won’t actually do anything on the user side.
38:03 Presenter: And so you can see that this is very powerful.
38:08 Presenter: So there are a whole bunch of things
38:10 Presenter: that we can actually do in order to,
38:13 Presenter: basically everything that you would have wanted to do
38:15 Presenter: with data, as an attacker,
38:19 Presenter: you can actually do with no code primitives.
38:22 Presenter: And so we saw command and control, data exfiltration, cleanup,
38:25 Presenter: we saw harvesting credentials through browsers,
38:28 Presenter: but there are actually a bunch of other ideas we didn’t have time to implement,
38:32 Presenter: like creating a keylogger or any other thing.
38:35 Presenter: So please feel free to kind of play around with it on your own.
38:40 Presenter: And in order to make it easier for you to play around with it on your own,
38:44 Presenter: let me introduce PowerPoint.
38:47 Presenter: So PowerPoint is a tool that abstracts away all of the complexities that I’ve just described
38:54 Presenter: of how do you affect these machines, how do you send the information out there, how do
38:58 Presenter: you set up that office account, so you can use all of these tools as part of your Red
39:03 Presenter: Team arsenal.
39:05 Presenter: PowerPoint also handles a bunch of things for you, so we handle errors for you, we also
39:10 Presenter: allow you to create, to run all of these payloads through an HTTP trigger, an HTTP webhook,
39:17 Presenter: so an HTTP endpoint, rather than being the need to actually go and log into office.
39:25 Presenter: So here’s how it looks like.
39:27 Presenter: Basically, you post to the HTTP endpoint that is created for you.
39:32 Presenter: You choose the infected machine and the user you want to run as.
39:40 Presenter: the actual payload that you’d like to run
39:41 Presenter: and the parameters, and you’ll just get back
39:44 Presenter: all of the output as a,
39:46 Presenter: all of the results of that payload as output,
39:49 Presenter: as the return side of the request.
39:53 Presenter: There’s also a convenience layer in Python
39:56 Presenter: that you can use to make your life even easier,
39:58 Presenter: so you can execute commands,
40:03 Presenter: and run all of the payloads that you saw here today,
40:06 Presenter: and actually others as well.
40:07 Presenter: We’re fortunate enough that there’s a kind of a small community that has started to be built around PowerPoint.
40:13 Presenter: So check it out.
40:15 Presenter: You’ll also find all of the instructions of how to set it up on your tenant.
40:19 Presenter: And of course, the idea here is to use this tool basically to, first of all, to learn yourself about the space.
40:27 Presenter: After that, to kind of teach others and gain the attention of management.
40:31 Presenter: And of course, to build defenses around these capabilities.
40:37 Presenter: to what we did today.
40:40 Presenter: We saw what RPA is.
40:42 Presenter: We saw that RPA is available in every organization,
40:44 Presenter: and we did a very technical deep dive
40:46 Presenter: to figure out how exactly does it work
40:49 Presenter: and accomplish what it needs to do.
40:51 Presenter: And the important thing here is
40:53 Presenter: it doesn’t require the acceptance of management,
40:58 Presenter: or it can just be plugged in there
41:01 Presenter: by the vendors themselves.
41:03 Presenter: We saw that you can use RPA
41:07 Presenter: to remote code execution as a service
41:10 Presenter: to take care of all of the grant work for you.
41:13 Presenter: You can distribute payloads, execute them,
41:16 Presenter: make sure they run successfully,
41:18 Presenter: and everything works through trusted services,
Defense, Detection, and Mitigation Strategies — Part 4
41:20 Presenter: trusted executables, we haven’t installed anything new,
41:24 Presenter: and so this would be very difficult to catch.
41:26 Presenter: You also saw that the no-code primitives
41:28 Presenter: that are provided by RPA are actually pretty good,
41:32 Presenter: so there are a whole bunch of things
41:33 Presenter: that you can do with those primitives.
41:37 Presenter: which is a way to do all of that,
41:39 Presenter: but without having to deal with the complexity of RPA itself.
41:44 Presenter: And instead you can run with command lines
41:46 Presenter: and Python interface.
41:48 Presenter: And the last thing I want to do
41:50 Presenter: before we finish off this talk,
41:53 Presenter: is to send you home with a few things
41:56 Presenter: that you can do to protect your organization right now.
41:59 Presenter: And so, these are concrete things that I encourage you to do.
42:04 Presenter: First of all, you should monitor for every event of registering this Power Automate agent silently on user machines.
42:14 Presenter: So there are a couple of executables that I’m stressing out and pointing to here.
42:19 Presenter: Every usage of those executables should be monitored and logged.
42:25 Presenter: And more than that, if you can create a detection that identifies usage of those executables with a tenant ID that is not your own organization’s tenant ID, like the malicious tenant that I created for this research, this would be a very critical sign that somebody is actually trying to use these methods to hack your organization.
42:51 Presenter: I also encourage you to review Microsoft’s documentation around Power Automate and try to, there are a whole bunch of things that they are suggesting here to basically try and reduce your risk.
43:03 Presenter: and there’s a bunch of information about no code
43:07 Presenter: and the risks around them.
43:09 Presenter: There’s a whole bunch of things that I’ve added here.
43:13 Presenter: This entire talk was focused on how an attacker
43:16 Presenter: can take advantage of RPA,
43:17 Presenter: but actually users that are using RPA
43:20 Presenter: are also exposing organizations to a whole bunch of risks.
43:25 Presenter: This is the subject of another talk,
43:28 Presenter: so I’ll leave it for another day.
43:31 Presenter: thank you very much for listening
43:33 Presenter: and tuning into this talk
43:36 Presenter: I’d be very happy to continue
43:37 Presenter: to make this
43:39 Presenter: a conversation later on
43:41 Presenter: so please reach out to me
43:42 Presenter: thank you very much and have a great conference