Abstract
Win 11 ships with a nifty feature which lets users automate mundane processes. Users can build custom processes and hand them to Microsoft, which in turn ensures they are distributed to all user machines, executed successfully and reports back to the cloud. You can probably see where this is going…
Transcript
AI generated from recording.
Opening Remarks and Speaker Introduction
00:00 Presenter: Thank you everyone for joining us this glorious morning. Next up we have Michael Bergeri with Windows 11 At Your Service.
00:08 Presenter: Thank you. So, first of all, I’d like to say thank you to everyone for skipping early lunch. I really appreciate it. And I’m going to make my best, I’m going to try my best to make it worthwhile for you.
00:23 Presenter: And since this is kind of an intimate setting,
00:25 Presenter: please feel free to just kind of raise your hand
00:27 Presenter: if you have a question during the talk.
00:29 Presenter: Don’t wait until the end.
00:30 Presenter: We can make it a conversation.
00:31 Presenter: I think it will be much more interesting.
Setting the Stage: Attacker Perspective and Goals
00:34 Presenter: Here’s kind of briefly a few points about me.
00:37 Presenter: I’ve been focused on this area of security of no-code apps
00:42 Presenter: or trying to see where they break for about four years now.
00:45 Presenter: I come from a company that’s focused on this space.
00:49 Presenter: I lead an OS group that is dedicated to low-code, no-code,
00:53 Presenter: that these apps represent.
00:56 Presenter: But what we’re going to do today
00:57 Presenter: is we’re going to take an attacker’s perspective.
00:59 Presenter: So let’s just jump into it.
01:01 Presenter: If we don’t get into your questions during this session,
01:05 Presenter: reach out on Twitter.
01:06 Presenter: I’m happy to continue the conversation.
01:09 Presenter: And I promise this is the only slide
01:12 Presenter: that’s going to talk kind of not taking an attacker’s perspective.
01:17 Presenter: Of course, it’s important to mention,
01:19 Presenter: even though this entire talk is going to focus
01:23 Presenter: no code as an attacker.
01:25 Presenter: The idea here is to see how we can use no code in a secure way.
01:29 Presenter: However, having said that, here’s what we’re going to do today.
01:32 Presenter: So there’s a very big difference between initial compromise of a machine
Understanding Malware Operations and Windows 11 RPA
01:39 Presenter: and an entire malware operation.
01:41 Presenter: So in order to set a malware operation,
01:44 Presenter: you need to be able to do many different things.
01:47 Presenter: And let’s just kind of make sure we all understand
01:50 Presenter: what do I mean by malware ops.
01:53 Presenter: this talk, you’ll see how you can do everything that a malware needs to do by using Microsoft
02:00 Presenter: executables, services, and cloud services, which are all baked into Windows.
02:05 Presenter: All right.
02:06 Presenter: So just kind of show we’re all on the same page on what do I mean by malware, what you
02:11 Presenter: will be able to actually accomplish.
02:13 Presenter: Let’s say that you have an initial access to a machine, which is fine.
02:16 Presenter: You might think you’ve won.
02:18 Presenter: But actually in the real world, there’s a bunch of things that would prevent you from kind of getting what you want.
02:24 Presenter: So you need to be able to actually run malware on that machine, right, and not just have the initial access.
02:30 Presenter: You need to be able to communicate through a firewall or any sort of network perimeter because likely this machine is an internal network.
02:40 Presenter: You need to be able to expiltrate data outside.
02:43 Presenter: You need to be able to avoid defenses that might be on the machine itself
02:46 Presenter: or on the network or wherever else.
02:49 Presenter: And, of course, you also want to remain persistent.
02:54 Presenter: You want to avoid defenses.
02:56 Presenter: So there are a bunch of these things that you need to actually accomplish
03:00 Presenter: after you’ve already compromised the machine.
03:02 Presenter: And so all of these things are actually kind of grant work.
03:07 Presenter: They’re kind of engineering.
03:09 Presenter: So you start off with initial access and you want to get to profit, but in the middle of it, there’s a bunch of things that you need to do in order to really get the operation going.
03:19 Presenter: And what we’re going to show is how you can accomplish all of this operation, all of these kind of intermediary sections here.
03:26 Presenter: All right.
03:26 Presenter: So the best thing that we could hope for is to have a SaaS platform that would do all of these things for us, right?
Deep Dive into Microsoft Power Automate (RPA) Architecture
03:34 Presenter: Because today there’s pretty much SaaS for everything.
03:37 Presenter: So I’m going to introduce to you today something called RPA.
03:42 Presenter: Not sure if you’ve heard of it, but RPA, Robotic Process Automation,
03:46 Presenter: it’s basically a service that’s actually running on users’ laptops,
03:50 Presenter: and it is impersonating users in order to create business automations.
03:56 Presenter: So, for example, you move your mouse, you click things on your keyboard,
04:00 Presenter: it would record these things and then replay them.
04:03 Presenter: And it is used, for example, to integrate with legacy systems
04:06 Presenter: have an API. Now, the crucial piece about robotic process automation is it’s composed of these three
04:12 Presenter: separate kind of things. One is the electional agent that runs either on a user’s laptop or on
04:19 Presenter: some server. There’s a controller that’s able to operate to reach out through the network into those
04:25 Presenter: machines and send the payload and exfiltrate back or get back the results. And of course, there’s a
04:31 Presenter: management platform on the SaaS side. The crucial piece here is that all of these are trusted.
04:36 Presenter: trusted, I mean that the
04:38 Presenter: EDRs trust them, the network security
04:40 Presenter: trust them, they all operate
04:43 Presenter: in
04:44 Presenter: boxes that have been
04:46 Presenter: pre-approved. And so if we use
04:48 Presenter: this specific, you can see where I’m
04:50 Presenter: going with this, right? This is an infrastructure
04:53 Presenter: to run code
04:55 Presenter: on users’ laptop and
04:57 Presenter: then get the results back
04:58 Presenter: and all of this is being facilitated
05:00 Presenter: through, well, this is
05:02 Presenter: actually just using RPA, but
05:04 Presenter: just in a creative way and for malicious purposes.
05:07 Presenter: And so one important thing to note is that RPA is already pretty much everywhere in the enterprise.
05:13 Presenter: You’ll find these are kind of the large vendors, but there are others.
05:17 Presenter: And you’ll find that this is pretty prolific.
05:20 Presenter: And RPA will do much more than we initially wanted.
05:25 Presenter: It will actually take care of a bunch of engineering things for us.
05:28 Presenter: So handling errors, being able to support different types of OSs, different versions, being able to update the malware on the fly.
05:37 Presenter: All of those things would be handled by RPA itself.
05:41 Presenter: And so just one simple thing to understand about what RPA is.
05:48 Presenter: So essentially, it’s about replacing this copy and paste that users are doing in order to move data between two places.
05:55 Presenter: There’s kind of a nice drag-and-drop builder,
05:57 Presenter: and it emulates users’ actions.
05:59 Presenter: This is crucial.
06:00 Presenter: This is running as the user in the context of that user,
06:05 Presenter: and there’s no real easy way to distinguish between a user
06:08 Presenter: and what this thing is actually doing.
06:10 Presenter: All right.
06:11 Presenter: And it’s also kind of in terms of use cases,
06:15 Presenter: there are actually valid use cases for this,
06:17 Presenter: again, mainly integration with legacy systems.
06:20 Presenter: Okay, that’s enough kind of intro.
06:23 Presenter: Now we’re going to see how we can actually use RPA to accomplish what we wanted.
06:29 Presenter: So here’s what we’re going to do today.
06:31 Presenter: We’re going to start with, we’ve already gone through kind of very briefly the motivation and what RPA is.
06:40 Presenter: And we’re going to go through a technical deep dive to see how RPA actually works.
Exploiting RPA for Remote Code Execution and C2
06:45 Presenter: Then we’ll see how we can abuse RPA for remote code execution as a C2 server.
06:50 Presenter: and then we’re going to introduce a tool that will allow you to do all of that yourself.
06:55 Presenter: So let’s start with a deep dive.
06:57 Presenter: And from this point in the talk, I’m going to focus specifically on Microsoft’s RPA.
07:04 Presenter: And the reason behind it is that it’s already included in every Windows 11 machine.
07:09 Presenter: So just take a fresh vanilla Windows 11 machine.
07:12 Presenter: You’ll find this already there.
07:14 Presenter: By the way, if you’ve uninstalled it, they will install it back
07:17 Presenter: with all of the kind of default applications that you have there.
07:20 Presenter: So this is malware that’s already installed in Windows 11 machines,
07:25 Presenter: and that’s why I’m going to focus here.
07:27 Presenter: Of course, this is not just a problem about Microsoft.
07:31 Presenter: It’s larger than that.
07:32 Presenter: It’s the entire industry.
07:33 Presenter: However, the fact that this is already there on Windows machines is crucial
07:37 Presenter: because, again, Microsoft EDR, for example, will trust it.
07:40 Presenter: This is bundled in.
07:42 Presenter: So let’s see this in action.
07:46 Presenter: Let’s see how it works.
07:46 Presenter: So from a user’s perspective, if I go to a vanilla Windows 11 machine,
07:51 Presenter: I’ll search for Power Automate.
07:53 Presenter: I encourage you to do that if you have a Windows machine with you.
07:56 Presenter: You’ll find this Power Automate executable.
07:59 Presenter: And once you click on it, you’ll get into…
08:03 Presenter: Let’s see if I can get this to work.
08:11 Presenter: All right.
08:12 Presenter: So this is just going to show you that kind of a small video of me opening up the RPA agent.
08:18 Presenter: So you can see I have a small kind of UI there.
08:20 Presenter: It’s asking me for an email.
08:22 Presenter: This is actually a user for my office account.
08:25 Presenter: Crucially, I can put any office account here.
08:27 Presenter: So it could be kind of a malicious office account as well.
08:30 Presenter: Once I do that, I get a bunch of tasks that are fetched from the cloud.
08:35 Presenter: You will see that again in a moment that I’ve already pre-configured.
08:38 Presenter: And this is the drag and drop interface that Microsoft allows you to use in order to create those agents, those drag and drop, those RPA agents.
08:48 Presenter: And here I’m doing something kind of really silly.
08:51 Presenter: I’m just going to open up a file and then write something to that file.
08:54 Presenter: And you can see, so I click play and it works.
08:58 Presenter: And then in a moment you’ll see that there’s a file there.
09:00 Presenter: But the crucial thing is that the agent is doing all of that.
09:04 Presenter: And there are a bunch of operations that are, all of these things are provided by this platform, by the RPA platform.
09:11 Presenter: It is able to operate with the OS and do things on a user’s behalf.
09:16 Presenter: Now, one thing you might have noticed is that once I connected and once I plugged in my account into this agent,
09:26 Presenter: it synced with the cloud and provided me a bunch of these tasks that I’ve already created.
09:34 Presenter: payloads that I have pre-created.
09:38 Presenter: This is actually going to Office.
09:40 Presenter: This is communicating with Office.
09:41 Presenter: Again, my Office.
Silent Registration and Persistence Techniques
09:42 Presenter: It could be just kind of my malicious version of Office.
09:48 Presenter: And it’s communicating with Office and actually fetching all of those payloads for us.
09:53 Presenter: And so one of the things that we should try and understand is how does this communication work?
09:59 Presenter: Because if you think about it, because this is prepackaged within Windows 11,
10:05 Presenter: nobody has asked a network admin to open a port somewhere in order for this to actually work.
10:11 Presenter: This has to work out of the box in every type of environment with every type of network configuration.
10:16 Presenter: And so we need to understand what is going on here.
10:19 Presenter: So here’s kind of a high-level view of it.
10:23 Presenter: On one side, there’s Power Automate.
10:25 Presenter: There’s somebody’s laptop.
10:26 Presenter: And on the other side, there’s the cloud.
10:29 Presenter: laptop itself. So Power Automate is actually using two separate executables here that are running
10:35 Presenter: under two different services on the machine. You can see that one of the, so there’s the Power
10:42 Presenter: Automate executable that runs on the user’s own context. And there’s also another service account
10:48 Presenter: that is created locally, which runs this machine runtime. The machine runtime is going to be the
10:53 Presenter: thing that is going to communicate with Office. And these two can communicate. The machine runtime
10:59 Presenter: can also spin up Power Automate agents on new user sessions.
11:04 Presenter: So you can provide it with a username and password, a local one,
11:07 Presenter: and it will start a session for that user and then use Power Automate to run things there.
11:16 Presenter: All right.
11:18 Presenter: Power Automate is also able to work with a browser, to automate a browser.
11:22 Presenter: And this is done through extensions.
11:24 Presenter: again Edge would come
11:26 Presenter: once you use Power Automate
11:28 Presenter: Edge would have this pre-installed
11:29 Presenter: and then it allows the agent
11:32 Presenter: to control whatever you have on the browser
11:34 Presenter: of course again because this is running on a user
11:36 Presenter: context you can steal whatever the user
11:38 Presenter: has in their browser context
11:39 Presenter: which of course opens up a whole wide
11:42 Presenter: range of opportunities
11:43 Presenter: and so there are executables
11:45 Presenter: there that are related to
11:47 Presenter: communicating with the browsers
11:49 Presenter: and actually I’ve only
11:52 Presenter: talked about three different
11:54 Presenter: executables that are prepackaged, but you can see in this picture that there are a whole
11:57 Presenter: bunch more of them.
11:58 Presenter: And if you’re looking for an area that could be fun kind of to play around with, I strongly
12:05 Presenter: encourage you to look into it.
12:06 Presenter: Just like a few months ago, somebody found the NRC here in one of those.
12:11 Presenter: So go ahead.
12:14 Presenter: So that’s kind of one side.
12:16 Presenter: And the thing to note is that all of these executables, they won’t be stopped by the
12:20 Presenter: EDR because the EDR has to trust them.
12:24 Presenter: of Windows. All right. The next thing is how does the thing communicate with the cloud? How does it
12:29 Presenter: work in a way that can go through the network boundary, the corporate network boundary,
12:36 Presenter: without asking for permissions? Any ideas? Okay. So this is kind of, they’re actually using a nice
12:48 Presenter: feature or a nice service by Azure called Azure Service Bus or Azure Relay. Essentially,
12:54 Presenter: outbound communication channel, and then they are querying a queue on a schedule,
Payload Delivery and Data Exfiltration via RPA
13:00 Presenter: which means that they are able to go through anything because usually people don’t block outbound communication.
13:06 Presenter: And so this is the way in which Office and this machine can work.
13:09 Presenter: Again, this is going to be the way for us to push payloads in and to exfiltrate data out.
13:18 Presenter: Okay.
13:18 Presenter: Once you connect your Power Automate agent, once you go through what I showed you a few minutes ago with the video,
13:27 Presenter: you get a nice little UI that shows you all of the machines that you have connected to your account.
13:32 Presenter: You can see the status of those machines, which ones are connected or not,
13:36 Presenter: how many jobs are executed on each one of those machines.
13:41 Presenter: Of course, you can run tasks from the cloud.
13:43 Presenter: So this is me going to the Microsoft UI with my malicious Microsoft tenant.
13:50 Presenter: And then I can just click on run some automation on somebody’s machine, a machine that I’ve pre-registered, and I can run that on the machine.
13:59 Presenter: And once I do that, I get status for the tasks.
14:02 Presenter: I can debug errors.
14:03 Presenter: I mean, there are a whole bunch of engineering features here that can help me make sure that my malware is operating successfully.
14:11 Presenter: Okay.
14:14 Presenter: Now that we understand how Power Automate works
14:17 Presenter: and how it’s able to actually do what it’s supposed to do,
14:22 Presenter: let me show you how you can use it as a hacker.
14:25 Presenter: So what we’re going to do is show you all of the things on our wish list,
14:30 Presenter: on our malware operation wish list,
14:32 Presenter: and how they can be accomplished with this Microsoft agent.
14:36 Presenter: All right.
14:37 Presenter: I’m going to start very simply.
14:40 Presenter: I’m just going to start by creating a Microsoft malicious tenant.
14:44 Presenter: This is pretty easy.
14:45 Presenter: You can just create your own tenant with a few clicks.
14:48 Presenter: You don’t need to pay anything.
14:51 Presenter: You don’t need to put in a credit card.
14:53 Presenter: It’s very easy.
14:55 Presenter: Once you do that, you have your own version of Office,
14:58 Presenter: so your own tenant inside of Office.
15:00 Presenter: Here I called it Pantosa as a joke for Microsoft.
15:03 Presenter: And then you can start to register machines into this tenant,
15:09 Presenter: to do the infection.
15:11 Presenter: So how do we infect a new machine
15:13 Presenter: with this type of malware?
15:16 Presenter: Well, we’ve actually seen this, right?
15:17 Presenter: There’s this little UI thing.
15:19 Presenter: When I go to a new machine,
15:20 Presenter: I can open up the UI
15:22 Presenter: and then I need to register.
15:24 Presenter: And when I enter a user here,
15:26 Presenter: I’m just going to enter the user
15:27 Presenter: for my malicious tenant.
15:28 Presenter: Now, of course, using a UI to do that
15:32 Presenter: wouldn’t be really a very good malware, right?
15:36 Presenter: So in order to do this silently,
15:39 Presenter: will want to be able to avoid the UI.
15:42 Presenter: And the question is, can we do that?
15:44 Presenter: Can we bypass this UI and maybe operate directly with the internal APIs?
15:49 Presenter: Well, we don’t really need to because this is provided by Microsoft.
15:53 Presenter: So there is a script that’s bundled into Windows as well.
15:57 Presenter: You can see the title here, silently register a new machine.
16:00 Presenter: And when you do that, this is available through command line or PowerShell,
No‑Code Ransomware and Advanced Automation Capabilities
16:04 Presenter: where when you do that, you provide your own malicious tenant.
16:07 Presenter: You can provide a malicious user within that tenant.
16:11 Presenter: And from that moment on, the agent is connected to your own malicious tenant.
16:15 Presenter: Now, one question somebody asked me once is,
16:18 Presenter: what happens if the agent is already registered, if people are already using this?
16:23 Presenter: So fortunately, you can register a few different tenants with the same machine.
16:27 Presenter: Okay, so there won’t be any conflicts.
16:30 Presenter: And if the user opens up this Power Automate agent on their machine,
16:33 Presenter: it will still allow them to log in.
16:38 Presenter: they will not see the fact that it’s already registered
16:40 Presenter: because I’ve used this silent registration script.
16:43 Presenter: All right.
16:44 Presenter: So this is infection.
16:45 Presenter: This is just once I have initial access,
16:47 Presenter: the only thing I need to do is run this script and that’s it.
16:50 Presenter: Once I have that, the machine is registered to the list of machines
16:55 Presenter: that I have on my Microsoft tenant.
16:58 Presenter: And now one thing that’s important about this silent registration script
17:03 Presenter: is the fact that I’m not sure if you’ve noticed,
17:07 Presenter: an admin for this PowerShell,
17:09 Presenter: which actually makes this kind of weaker, right?
17:14 Presenter: So one of the things we wanted to do
17:16 Presenter: is make sure that is see if we are able to bypass this
17:19 Presenter: to run this as a user.
17:20 Presenter: And so we did something very sophisticated.
17:23 Presenter: We tried and it just worked.
17:26 Presenter: So this script, even though it’s advertised
17:29 Presenter: to only work for admins, it works for everybody.
17:32 Presenter: Microsoft is aware of this process and of this thing
17:34 Presenter: and are working on solving it.
17:37 Presenter: hasn’t been solved yet.
17:39 Presenter: All right.
17:40 Presenter: Once I have this agent,
17:42 Presenter: this machine,
17:42 Presenter: registered to my malicious tenant,
17:44 Presenter: the next thing I need to do
17:45 Presenter: is just trigger the workload
17:48 Presenter: from the cloud.
17:49 Presenter: I set up a connection
17:50 Presenter: to the specific machine,
17:51 Presenter: and then I can distribute
17:52 Presenter: the payload from the machine
17:54 Presenter: to the specific,
17:56 Presenter: from the cloud
17:56 Presenter: to the specific machine.
17:57 Presenter: So this is a C2 server, right?
18:01 Presenter: The agent is going to Azure Relay.
18:04 Presenter: It’s looking for payloads.
18:06 Presenter: And then every time
18:07 Presenter: that I can put there through this UI,
Tool Release and Practical Deployment Guidance
18:10 Presenter: it will execute them on the machine.
18:12 Presenter: And I’m going to skip a couple of slides here
18:14 Presenter: because I know we’re kind of out of time
18:18 Presenter: or reaching that point.
18:21 Presenter: But let’s see what we have done so far,
18:23 Presenter: and we haven’t done much,
18:25 Presenter: is one, we’re able to deploy this malware,
18:27 Presenter: so we’re able to infect a machine.
18:29 Presenter: We’re able to avoid defenses by definition
18:32 Presenter: because, again, I’ve only used bundled-in executables
18:37 Presenter: that are operating with Microsoft Cloud.
18:39 Presenter: And of course, persistency is easy as well
18:42 Presenter: because, again, this is all things that are used by Microsoft.
18:45 Presenter: So they are in charge of making sure that
18:47 Presenter: if the laptop is rebooted or something,
18:50 Presenter: then we are still, this agent is still working.
18:53 Presenter: Of course, if somebody resets the machine
18:57 Presenter: kind of permanently, then we would be out.
19:01 Presenter: What I’m going to show you now
19:02 Presenter: is what kind of actual payloads we can do with this.
19:05 Presenter: So we’re already in a machine.
19:07 Presenter: we can start to see what this agent can actually accomplish for us.
19:14 Presenter: Okay, let’s start with something very simple.
19:17 Presenter: Let’s say I want to do data exfiltration.
19:19 Presenter: So I want to steal a specific file from this machine.
19:23 Presenter: This is a very simple automation that I’ve just built here.
19:26 Presenter: I’m just opening up a file, storing its content in the output of this job.
19:31 Presenter: And once I run this from the cloud side, I give it an input of the specific file that I want, and the output would just be the bytes of that file.
19:42 Presenter: Now, one thing that we need to make sure we understand is how this data actually goes out.
19:49 Presenter: And so just as a reminder, this is operating through the trusted communication channel that Microsoft has established for us.
19:57 Presenter: payload is going through the trusted communication channel,
20:00 Presenter: and data exfiltration goes down the same route.
20:03 Presenter: So it would be very difficult for you to actually catch this data exfiltration ongoing.
20:10 Presenter: The next thing I want you to see is code execution.
20:15 Presenter: So what if we want to run just kind of whatever we want?
20:19 Presenter: So one thing we could try is to use the functions that are provided by this agent
20:25 Presenter: to actually run scripts.
20:27 Presenter: You can run Python, you can run command line
20:30 Presenter: or any other thing.
20:31 Presenter: But that would, of course, trigger if we,
20:33 Presenter: in this instance here, I’m running Mimikatz.
20:35 Presenter: That would, of course, trigger the defender, right?
20:39 Presenter: Because that part is not trusted.
20:41 Presenter: You’re just running a script.
20:43 Presenter: So instead of running the script,
20:46 Presenter: what if we stay in the trusted zone?
20:49 Presenter: What if instead of running a script,
20:51 Presenter: an executable, a payload, something,
20:52 Presenter: we build our entire payload with no code,
20:56 Presenter: with this drag and drop interface.
Defensive Measures and Closing Remarks
20:57 Presenter: So the question becomes, what can we do with it?
21:01 Presenter: How advanced is this language?
21:03 Presenter: Or what are the primitives that we have
21:05 Presenter: in order to actually build things on our own?
21:08 Presenter: And the answer to that is that these agents
21:10 Presenter: are very, very, very powerful.
21:13 Presenter: These are just a few examples,
21:15 Presenter: but you can trigger HTTP calls,
21:19 Presenter: you can encrypt files,
21:20 Presenter: You can communicate with Active Directory, Windows services, processes.
21:26 Presenter: You can look into files and folders.
21:27 Presenter: You can automate the browser.
21:29 Presenter: You can take screenshots.
21:30 Presenter: You can control the mouse and the keyboard.
21:33 Presenter: You can control the clipboard.
21:34 Presenter: This is basically everything you want, right?
21:37 Presenter: And as long as you build your payload with this drag-and-drop interface,
21:41 Presenter: Microsoft will execute it for you, and you won’t go out of the trusted zone.
21:47 Presenter: I’m going to show you just one example, and then I’m going to skip forward because, unfortunately, we’re running out of time.
21:53 Presenter: But here’s kind of a very quick example of no-code ransomware.
21:57 Presenter: This is iterating through a directory and going through subdirectories and then using the encryption function,
22:05 Presenter: which is provided by this agent, in order to actually kind of override the file.
22:11 Presenter: And again, this is being done.
22:13 Presenter: This entire thing is running in a Microsoft executable.
22:17 Presenter: very difficult to try to remove this without removing Power Automate as a whole.
22:24 Presenter: I’m going to jump a few steps forward to show you.
22:30 Presenter: So again, there are many things.
22:32 Presenter: Once I have kind of arbitrary execution, I can do pretty much whatever I want.
22:38 Presenter: And everything that we wanted to do would be available through this agent.
22:43 Presenter: And so one thing that I want to leave you off with is a way for you to actually use this when you go back home.
22:51 Presenter: And so I’m going to – so there’s a tool that I’ve released about six months ago called PowerPoint.
23:01 Presenter: And this tool basically does everything that I showed you here in this talk.
23:05 Presenter: So once you take this tool – let me switch here.
23:09 Presenter: Once you use this tool, it’s available here on this link,
23:14 Presenter: it will accomplish all of these different things for you.
23:17 Presenter: So you’ll be able to infect a specific machine.
23:19 Presenter: You will be able to exfiltrate data.
23:21 Presenter: All of the payloads are prepackaged.
23:24 Presenter: And in order to use it, all you need to do is actually just set up a Microsoft tenant for yourself.
23:30 Presenter: So if you’re interested, we’re just approaching a release of another version of this tool,
23:36 Presenter: which is going to be much more convenient and robust.
23:39 Presenter: If you’re interested, check it out and start the repo.
23:42 Presenter: You’ll get the notification.
23:44 Presenter: So the one thing I have to do before I finish off
23:48 Presenter: is help you defend yourself from this thing
23:50 Presenter: because otherwise I’ve just created harm.
23:53 Presenter: And so here’s what you need to do.
23:56 Presenter: The first thing and the most important thing
23:57 Presenter: that could stop this entire attack
23:59 Presenter: is to monitor the usage of this prepackaged
24:02 Presenter: silent registration executable.
24:04 Presenter: You can see the name here.
24:06 Presenter: The number one thing you should be looking for
24:09 Presenter: that isn’t yours, that should be a giant red flag.
24:13 Presenter: There is also a way if you’re using,
24:15 Presenter: if you have a way to change group policies
24:18 Presenter: and pre-install them on every machine,
24:21 Presenter: you can actually limit which tenants can be registered
24:25 Presenter: to use this Power Automate agent.
24:28 Presenter: And other than that, there’s a bunch more information
24:31 Presenter: about this specific attack and other attacks
24:33 Presenter: related to the no-code infrastructure
24:36 Presenter: that Microsoft has and others as well.
24:37 Presenter: There are a couple links here.
24:39 Presenter: And all of these, kind of the slides, the links, everything,
24:43 Presenter: will be available on this link up there.
24:47 Presenter: So there’s a bunch more information.
24:49 Presenter: Thank you very much for being with me over lunch.
24:53 Presenter: It’s been great fun.
24:56 Presenter: Last to Michael.