However, Symantec Endpoint Protection will stop attempting to restart the ccSvcHst.exe process for several minutes if the process is killed multiple times in a row. To give Symantec Endpoint Protection some credit, it has some form of tamper protection capabilities as it will try to restart the ccSvcHst.exe process almost immediately after the process is killed.
An attacker with Local Administrator credentials, remote access, and a single command can disable Symantec Endpoint Protection by killing the process ccSvcHst.exe. In the case of Symantec Endpoint Protection, their implementation of tamper protections is a bit lacking. I emphasize the term typically because modern EDR solutions should have built-in tamper protection technologies that prevent an attacker from disabling the security product, despite an attacker having Local Administrator access or full control over a system. Tamper ProtectionĪn attacker with Local Administrator access to a system can typically perform any action they want on that system, such as performing sensitive operating system-related actions or disabling host-based security products as described in this Cylance post. Specifically, the compromised account credentials provided remote administrative access to hosts running legacy operating systems that used Symantec Endpoint Protection, which is un/fortunately easy to disable with Local Administrator access.Īccess to legacy systems running Symantec Endpoint Protection allowed us to continue the Red Team engagement without having to further interact with CrowdStrike Falcon. The password guessing attacks led to the compromise of credentials for an account that had Local Administrator privileges over a limited number of systems in the environment. Luckily, CrowdStrike Falcon provided enough wiggle room that we were able to use tools to perform password guessing attacks against domain user accounts. Our progress was affected enough that it forced us to focus on how to bypass CrowdStrike, rather than focusing on arguably more important aspects of the engagement such as identifying security misconfigurations and/or gaps in alerting and response. CrowdStrike Falcon gave us a difficult time by preventing several tools, techniques, and procedures (TTPs) from working that we had previous success with on prior engagements in terms of evading CrowdStrike Falcon.
The beginning of this engagement was particularly frustrating as the client used CrowdStrike Falcon for the primary EDR solution in their environment. In this edition of Bypassing Defenses, we’ll highlight how we were able to bypass the Endpoint Detection and Response (EDR) solution Symantec Endpoint Protection on a recent Red Team engagement, enabling the execution of known malicious tools without detection or prevention.
0 kommentar(er)
