Mastodawn

By making minor changes to command-line arguments, it is possible to bypass EDR/AV detections.

My research, comprising ~70 Windows executables, found that all of them were vulnerable to this, to varying degrees.

Here’s what I found and why it matters 👉 https://wietze.github.io/blog/bypassing-detections-with-command-line-obfuscation

Bypassing Detections with Command-Line Obfuscation

Defensive tools like AVs and EDRs rely on command-line arguments for detecting malicious activity. This post demonstrates how command-line obfuscation, a shell-independent technique that exploits executables’ parsing “flaws”, can bypass such detections. It also introduces ArgFuscator, a new tool that documents obfuscation opportunities and generates obfuscated command lines.

Show thread

Oriel Jutty

Mar 24

@wietze After looking at the "Linux and macOS" section", my main takeaway is that apparently a lot of defensive software was written by muppets.

For example, take option reordering, option separator insertion, and option separator deletion. All of these are about classic unix option syntax as implemented by getopt():

Options can be reordered (foo -a -b -c is equivalent to foo -c -b -a).
Multiple options in a row (all starting with -) can be bundled together (foo -a -b -c is equivalent to foo -abc).
Options that take an argument do so either from the rest of the command-line parameter or (if that is an empty string) the next parameter (foo -s bar is equivalent to foo -sbar).

Why would you not take that into account in your detection tools?

Similarly, character deletion springs from the idea that long option names can be abbreviated as long as they're unique. GNU's getopt_long automatically provides this feature (as do other libraries). Again, this is not a rare or obscure feature.

Any "detection" bypassed by these tricks focuses too much on superficial syntax and not what the command-line arguments actually mean. But in cases where attackers abuse trusted tools ("lolbins", etc), we know exactly what those tools are and how they work. (After all, they're standard system tools and that's why we trust them!) So on the defenders' side, why would we not model the tools' command-line interface precisely and instead rely on crude substring matching?

Getopt Long Options (The GNU C Library)

Show thread

Wietze

@barubary Your analysis is spot on. EDR vendors have used the same "command-line arguments are one big string, YOLO!" model for ages and it simply doesn't work well for exactly these reasons. I hope vendors take notice and do more to interpret/parse/preprocess command-line arguments going forward.