Block execution of Cobalt Strike beacons

[urochsw]

Dear all.

As tests are showing that block of Cobalt Strike Beacon dooesn work, I really need to know f there is a straight forward way to configure ENS to block this.

We are runnng latest version of ENS and have otherwise a great configuration.

Tests also shows that other vendor actually block the beacons.

It has to be noted that the testers did some effort to evade static detection of the beacons but used the generic beacon shellcode generated by Cobalt Strike. The testers therefore assume that the McAfee solution is not configured to perform runtime scanning of processes.

All help would be very appreciated.

[ueno · Accepted solution]

Hi @urochsw ,

There are no settings in ENS that are specifically designed to handle Cobalt Strike Beacon.

From what you have provided, it seems that a script-related scan is required, so please check if enabling the AMSI setting in the on-access scan will result in the expected behavior.

[How AMSI integration with Threat Prevention improves security]
https://docs.trellix.com/bundle/endpoint-security-10.7.x-product-guide-windows/page/GUID-56D530F2-C0...

You can set AMSI settings in the following policy.

[Endpoint Security Threat Prevention]
　- [On-Access Scan]
　　- [Antimalware Scan Interface]
　　　- [Enable AMSI (provides enhanced script scanning)]
　　　
If you are also using Adaptive Threat Protection, you can also configure AMSI settings in the Adaptive Threat Protection, so please try this as well.

[Endpoint Security Adaptive Threat Protection]
　- [Options]
　　- [Real Protect Scanning]
　　　- [Enable enhanced script scanning (includes AMSI integration)]

[urochsw]

Hi

Many thanks for the input.

I already have the suggested policy settings in use.

This is a tricky one I know, I was hoping for some miracle setting that could be set and then enforced.

I will leave this oen for some time, to see if I can come up with something or if I get some other ideas. 

Regards

[Daveb3d · Accepted solution]

Do you have Real Protect Cloud enabled (and validated it is working.. no proxy/fw  block, etc)?

What about ATD?  There is an awesome, amazing, wonderful detection in there that is really good for it... though I'm a bit partial to it perhaps because I wrote the underlying logic.  😉  

Additionally, there is an Exploit Prevention rule for common named pipes with CobaltStrike that you can enable.

Beyond that, leveraging DAC is a great way to reduce risk, but you'll want to do it with a TIE server. Leveraging the memory injection rules, you can also utilize the reputation to restrict untrusted processes from doing things like host discovery activities, executing OS processes with blank command lines, etc, which are common with malicious activity.  It takes a bit of work, but you can lock down a host better than anything else out there if you put the time into it. 

ENS has for some reason long struggled with CobaltStrike. I'm not sure why when it handles things like Sliver, Empire, and Brute Ratel so well.  

Dave

[urochsw]

Hi Dave 

Great interesting reading.

This together with previous reply will help me.

Thanks

[Daveb3d]

I DM'ed you some rules to play with that should generally crush CobaltStrike (and everything else) when used.  Just be sure to set DAC to contain at Unknown for them to work.  

[urochsw]

Many thanks for this, and many times sorry for late replay.

I will run a test.