Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRE
T//
NOFORN
Pique Analysis Report
20150821-263-NMehata-Theories on Persistence
Ra
y
theon Blackbird Technolo
g
i
es,
Inc. 1 21 Au
g
ust 2015
Use or disclosure of data contained on this sheet is su
bje
ct to the restrictions on the title
page
of this document.
SECRE
T/
/
NOFORN
1.0 (U) Analysis Summary
(S//NF) This summarizes what appears to be a briefing slide deck on persistence. The content of
the briefing deck is truly a mixed bag of basic generalized persistence techniques, fairly
sophisticated persistence methods, and theoretical persistence methods that are complex in the
extreme. The latter category pushes the scope of effort to research and implement beyond PoC
recommendations. The middle category, fairly sophisticated persistence methods, holds some
promise for multiple PoC recommendations but we recommend we convene a specific meeting
of the Pique team to discuss and triage each, which include:
File replacement replace autostart service .DLL in registry, then on start-up actively proxy
invocations of DllMain() and ServiceMain(). Or replace existing COM control in
HKCR\CLSID\{GUID}\InprocServer32, subclass the control’s methods, and proxy
File displacement rather than replace a file on disk, modify a registry key (ServiceDll,
InprocServer32 default value, or equivalent), the proxy instantiation
File displacement via loader preference (Windows .DLL search order), .DLL search order
favors the local directory over system32. The shell (explorer.exe) is in C:\Windows, not
system32.
Other subsystems to consider:
Print spooler drivers
Winlogon, LSA, Crypto providers, and authentication providers
.NET assemblies
Input method editors
Sidebar gadgets
MIME types, and protocol handlers
Plug-ins
Subsystems with their own stacks:
Windows messages
Image codecs
Directshow filters
WFP drivers
Filesytem filters
Any driver with IRP_MJ handlers
(S//NF) We recommend a specific meeting be called to discuss each of these approaches to
persistence to determine which makes most sense for PoC development consideration as all have
potential.

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh