LOGMQ - Living off the Gartner Magic Quadrant

LOGMQ - Living off the Gartner Magic Quadrant

Speakers: Denis Andzakovic, Principal Security Consultant, Pulse Security

Conference: CHCon

YouTube: https://www.youtube.com/watch?v=Cs5X2ifSfVE

Overview

In his compelling CHCon talk, "LOGMQ - Living off the Gartner Magic Quadrant," Denis Andzakovic, Principal Security Consultant at Pulse Security, challenges conventional notions of malware by demonstrating how legitimate, widely trusted security software—specifically Endpoint Detection and Response (EDR) and Digital Forensics and Incident Response (DFIR) tools—can be weaponized and repurposed as highly effective remote access trojans (RATs). This presentation shifts the focus from identifying malicious binaries to understanding the inherent dangers of powerful, legitimate functionality when wielded by an adversary.

Andzakovic highlights the limitations of traditional red teaming, which often yields binary outcomes without deep insight into control failures. Instead, he advocates for an engineering-centric approach to security testing, emphasizing meticulous benchmarking of detection controls. His research reveals that many leading EDR solutions, including those lauded in the Gartner Magic Quadrant, offer robust remote shell capabilities that can be exploited for persistent, privileged access, often without triggering standard malware detections.

The talk serves as a critical wake-up call for defenders, urging them to move beyond superficial understandings of security tools. It underscores the importance of thorough threat modeling, understanding software's true capabilities, and rigorously testing security controls against sophisticated misuse scenarios. By demonstrating how "living off the land" extends to living off the security vendor's own tools, Andzakovic provides actionable insights for improving organizational cybersecurity posture against increasingly clever adversaries.

Background

▶ Watch: Introduction: Red Teaming vs. Scientific Benchmarking (0:00)

The genesis of this research stems from Pulse Security's experience with traditional red teaming exercises. While entertaining, these engagements often felt like "live-action roleplay," relying on luck for success and failing to provide deep, actionable insights into control effectiveness. Denis Andzakovic and his team recognized that a more scientific, engineering-driven approach was necessary to measure precisely where security controls fail across the entire MITRE ATT&CK framework. This methodology involves benchmarking everything from commodity malware to bespoke, never-before-seen implants.

For their internal red team operations, Pulse Security developed Renfield, a custom, cross-platform remote access trojan written in 2019/2020. Renfield is intentionally barebones, offering a basic command-line interface and job control. Its simplicity allows for rapid agent replacement if detection occurs, ensuring operational continuity. However, Andzakovic acknowledged that Renfield lacked the "fancy" features—like a file explorer or memory dumping capabilities—found in more sophisticated tools, sparking a desire for enhanced functionality.

The pivotal inspiration for this talk came from the SANS Defa Summit in 2024, where a presentation by Orin and Amnon detailed incident response against three threat actors. Threat Actor Alpha particularly captured Andzakovic's attention because they achieved command and control (C2) by deploying and leveraging a legitimate EDR agent. This ingenious technique resonated with a long-standing idea on Andzakovic's research list: using signed, trusted, and well-known executables—like EDR or CI/CD agents—as implants by either reversing their protocols or, more simply, deploying the entire legitimate tool and using its built-in remote shell functionality. This approach highlights a growing trend where attackers utilize legitimate software, such as TeamViewer, Screen Connect, or SSH, not by exploiting vulnerabilities, but by using their intended remote access features for malicious purposes. The core problem shifts from the software itself to the identity and intent of the operator behind the keyboard.

Key Findings

▶ Watch: Demo: Deploying WAZA EDR as an implant (8:45)

Andzakovic's research yielded several critical findings that challenge conventional security paradigms:

• Legitimate EDRs as RATs: A primary discovery is that most leading EDR solutions, including all those examined from the Gartner Magic Quadrant, inherently possess remote shell capabilities that can be repurposed as highly privileged remote access trojans. This functionality, often marketed as a "powerful management utility," allows for NT AUTHORITY\SYSTEM or root-level command execution across an entire fleet of endpoints.
• Waza's Intentional Design: While other EDRs offer straightforward remote shells, the open-source EDR Waza requires more "crowbar" effort to achieve command execution. This is a deliberate design choice by Waza's contributors, who recognized the inherent dangers of providing arbitrary remote script execution and opted for a more restricted approach to mitigate the risk of console compromise.
• DFIR Tools for Stealthy Data Exfiltration: Legitimate digital forensics and incident response (DFIR) tools like WinPM, Magnet Forensics DumpIt, and FDK Imager can be effectively used to dump entire physical memory images or full disk snapshots. This allows for the exfiltration of sensitive data, such as NTLM hashes from LSASS.exe, often bypassing EDR detections that are tuned to spot specific credential dumping techniques.
• AI's Blind Spot: Initial attempts to use AI to summarize the malicious potential of these tools often failed, classifying them simply as "legitimate security software" and dismissing any concerns. This highlights a critical branding problem where the perceived legitimacy of software can obscure its inherent dangers, even for advanced analytical tools.
• EDR Console as the New "Jump Box": The research emphasizes that compromise of an EDR or Managed Detection and Response (MDR) console is akin to gaining full administrative access across an entire organization's endpoints. This raises significant concerns about the authentication mechanisms, access controls, and overall security posture surrounding these powerful, often cloud-based, management interfaces.
• The "Who's Behind the Keyboard" Paradigm: The central takeaway is that the "goodness" or "evilness" of software is often secondary to the intent of the operator. Legitimate tools, by their very nature, are designed to be powerful; their misuse depends entirely on who gains control.

Technical Deep Dive

▶ Watch: Gartner Magic Quadrant EDRs offer full remote shells (18:00)

The technical core of Andzakovic's presentation centers on demonstrating practical methods for weaponizing legitimate security tools, starting with a detailed walk-through using Waza, an open-source EDR system.

Waza as a Remote Access Trojan

Andzakovic illustrates how Waza can be leveraged as an implant, despite its developers' intentional efforts to limit such functionality.

1. Deployment: The process begins with deploying a standard Waza agent onto a target Windows 11 machine. This is achieved using a WinRM-based exploit with shared local administrator credentials (e.g., user:chcon). The agent is downloaded from packages.waza.com and installed via msiexec to the %TEMP% directory.
2. Achieving Command Execution: Waza's user interface does not natively expose a remote shell. To bypass this, Andzakovic utilizes Waza's Active Response API call, specifically active response run command.

• The "Crowbar" Technique: Through Process Monitor (Procmon) analysis, it's observed that when a command with an exclamation mark prefix is sent via the active response run command API, the Waza agent first searches for the specified executable in its active response bin directory and then traverses the standard Windows PATH environment variables.
• w.cmd Helper Script: To exploit this, a custom helper script named w.cmd is dropped onto the target system in a directory included in the Windows PATH. This script is crucial:
• It reads JSON input from the Waza server, which contains the parameters for the command to be executed.
• It then executes cmd.exe with the provided arguments.
• Finally, it serializes the command output back into JSON and writes it to a file. This file is subsequently picked up by the Waza agent and shipped back to the Waza server as log data.

1. Result: This method successfully demonstrates arbitrary command execution on the target as the NT AUTHORITY\SYSTEM user, the highest privilege level on a Windows machine. Commands like dir, ipconfig /all, and whoami /all are executed, and their outputs are retrieved via the Waza console's logging interface.

Gartner Magic Quadrant EDRs

Andzakovic then expands his analysis to leading commercial EDR solutions, revealing that many provide explicit, intentional remote shell capabilities:

• CrowdStrike: Offers a PowerShell console directly in the cloud, running with NT AUTHORITY\SYSTEM privileges on agents.
• Microsoft Defender for Endpoint: Allows execution of commands via a remote shell. While scripts typically need to be signed, this requirement can be disabled by an administrator.
• SentinelOne: Explicitly markets a "full remote shell" capability, citing its utility as a powerful management tool for fleets.
• Palo Alto Networks Cortex: Provides three distinct remote shells: cmd.exe, PowerShell, and a Python console, offering significant flexibility for agent orchestration.
• Trend Micro: Features a "remote access formally shell session task" that operates across its various agents.
• Sophos: Offers a "full command line" that operates with privileged administrator rights, allowing virtually any action an administrator could perform.

The stark conclusion is that 100% of the Gartner Magic Quadrant EDR vendors examined provide remote access Trojan-like capabilities, often by design.

DFIR Tools for Credential Dumping and Data Exfiltration

Beyond EDRs, Andzakovic explores how legitimate DFIR tools can be abused for stealthy data exfiltration and credential dumping:

• LSASS Memory Dumping: The constant cat-and-mouse game of detecting and bypassing LSASS.exe memory dumping techniques is a significant challenge. Andzakovic proposes using forensic tools that are designed to capture entire physical memory images.
• Tools Utilized: WinPM, Magnet Forensics DumpIt, and FDK Imager are highlighted. These tools, while legitimate, are often not blocked by EDRs, though some may generate alerts.
• Process: After acquiring a full memory dump (e.g., 6.2 GB compressed, 18 GB uncompressed from DumpIt), the attacker can exfiltrate it. If necessary, a small patch to the meroc FS driver might be required to handle specific memory regions. Once exfiltrated, tools like Pikatz or Mimikatz can be used offline to extract NTLM hashes and other authentication data.
• Disk Imaging: The same principle applies to disk images. By opening a physical block device, an attacker can acquire a complete hard disk snapshot. This allows for offline extraction of sensitive files like NTDS.dit, system, or security hives, which are typically protected by the operating system.
• Comprehensive Host Replication: The combination of a full memory image and a complete disk snapshot provides an attacker with everything needed to spin up an exact replica of the compromised host in a test lab (e.g., using QEMU). This enables thorough, unhurried offline analysis, allowing the attacker to retrieve any forgotten data, browser cookies, or other artifacts without further interaction with the live system.

This section underscores that the most dangerous "malware" might not be custom-written code, but rather legitimate, signed, and trusted tools wielded by an adversary.

Demo / Proof of Concept

▶ Watch: WAZA's intentional design to limit dangerous features (20:15)

The core of the presentation's technical demonstration focused on weaponizing Waza as a remote access trojan, visually illustrating the concepts discussed.

The demonstration began with a Waza server running on Andzakovic's laptop, displaying the typical EDR dashboard with critical, high, and medium severity alerts. Crucially, he pointed out that no active response configuration was enabled by default in this "next-next-accept-defaults" Docker Compose installation of Waza.

The target system was a Windows 11 virtual machine. Andzakovic's custom exploit script, named wasop, was used to initiate the compromise. This script leveraged WinRM with a simulated weak local administrator credential (user:chcongo). The wasop script performed the following actions:

1. Executed an msiexec command to download the Waza agent directly from packages.waza.com and install it silently on the Windows 11 machine.
2. Started the newly installed Waza agent service.
3. Copied the custom helper script, w.cmd, to a directory within the Windows PATH on the target machine.

Once the agent was deployed and running, the Waza server dashboard showed one active agent connected. Since the Waza UX does not expose direct remote shell functionality, Andzakovic pivoted to using the Waza API via the browser's developer tools. He manually invoked the active response run command API call, passing specific arguments to w.cmd.

The commands demonstrated were:

• w.cmd dir
• w.cmd ipconfig /all
• w.cmd whoami /all

The results were then observed in the Waza console's "Discover" section, filtering for parameters.extra_args. The console successfully displayed the directory listing, IP configuration details, and the whoami output, clearly showing that commands were executed as the NT AUTHORITY\SYSTEM user. This conclusively demonstrated the successful use of Waza as a high-privilege remote access Trojan.

While the demo primarily focused on Waza, the subsequent discussion of Gartner Magic Quadrant EDRs and DFIR tools served as a conceptual proof-of-concept, backed by the speaker's extensive experience and the explicit documentation from the vendors themselves, confirming the widespread existence of these remote execution capabilities. The talk's humor regarding "Renfield's branding problem" further underscored the point that the line between legitimate tool and malware is often blurred by context and perception.

Defensive Implications

▶ Watch: Key takeaway: Understand software's actual functionality (29:30)

Andzakovic’s talk carries profound defensive implications, urging a paradigm shift from traditional malware detection to a more holistic understanding of software capabilities and access control.

1. Attacker Class Analysis and Threat Modeling: Defenders must move beyond generic threat models. It's crucial to conduct detailed attacker class analysis and threat modeling for all critical software, especially security tools. This involves understanding precisely what a piece of software can do, who owns it, and critically, who has access to its management console and associated credentials. This includes internal IT administrators, Managed Detection and Response (MDR) providers, and any third-party integrators.
2. EDR Console as a High-Value Target: The EDR console is no longer just a management interface; it's the new "privileged office network jump box." A compromise of this console, whether through weak passwords, lack of MFA, or stolen refresh tokens from browser caches, grants an attacker NT AUTHORITY\SYSTEM or root-level command execution across the entire fleet. Defenders must secure these consoles with the highest level of scrutiny, akin to securing domain controllers.
3. Benchmarking and Continuous Validation: Relying on marketing claims or assumptions about security controls is insufficient. Organizations must implement rigorous, continuous benchmarking of their EDR and other security systems. This means testing how these systems behave not just against known malware, but against the misuse of legitimate tools. Understanding the precise points where detection fails and where edge cases exist is paramount for effective defense.
4. Beyond EDR: The principle extends beyond EDR. Any powerful, legitimate software—such as ETL tools, CI/CD agents, or AI-enabled testing agents—that connects to a cloud platform and allows arbitrary command execution or has broad access to sensitive data (e.g., session cookies) represents a potential attack vector. Defenders need to scrutinize the actual functionality of all deployed software, not just its advertised purpose.
5. Educating Users and Stakeholders: There's a significant knowledge gap within organizations. Most users are unaware that administrators (or attackers masquerading as them) could silently monitor their work, keylog their PCs, or execute commands with root privileges via legitimate tools. While admins typically don't misuse these powers, the technical possibility exists. Socializing this understanding within the organization, including with non-technical users, can foster a more security-aware culture.
6. Collaborative Improvement: Andzakovic emphasizes that "just do patching" or "just do the basics" are often patronizing and shortsighted recommendations. Instead, the industry needs to foster collaboration and collective understanding. Offensive security practitioners have a responsibility to dissect these systems, identify misuse scenarios, and communicate actionable intelligence to defenders and builders. The shared goal is to improve cybersecurity through measurement, metrics, and data-driven defense-in-depth, rather than focusing solely on "cool" or "amusing" attack techniques.
7. Don't Disable Security Systems: Importantly, Andzakovic cautions against turning off EDR systems immediately. This would be counterproductive. The goal is not to abandon these critical tools, but to acknowledge their dangerous functionality and ensure that the defenses around them are robust and suitable for the threats they introduce when misused.

Key Takeaways

• Legitimate tools are the new malware: Security solutions like EDRs and DFIR tools, by design, possess powerful remote access and data exfiltration capabilities that can be repurposed by adversaries for persistent, privileged access without triggering traditional malware detections.
• Context over code: The focus of defense must shift from identifying "malicious software" to understanding "who's behind the keyboard" and the intent of the operator. The same functionality can be legitimate or malicious depending on its user.
• Gartner Magic Quadrant EDRs offer explicit RAT capabilities: All commercial EDRs examined, including industry leaders, provide direct remote shell or command execution features, often marketed as fleet management utilities, confirming a widespread, intentional design choice.
• EDR consoles are critical attack surfaces: The compromise of an EDR or MDR management console grants an attacker NT AUTHORITY\SYSTEM or root-level control over an entire organization's endpoints, making these consoles high-value targets requiring the utmost security.
• Rigorous threat modeling and benchmarking are essential: Organizations must conduct deep threat modeling for all powerful software and continuously benchmark their security controls against misuse scenarios to understand true detection capabilities and failure points.
• Collaboration and shared understanding are key: Improving cybersecurity requires offensive and defensive practitioners to collaborate, share knowledge, and collectively understand the nuanced details of technology to build stronger, data-driven defenses.

About the Speaker(s)

Denis Andzakovic is a Principal Security Consultant at Pulse Security, an offensive security consultancy. With over 15 years of professional experience, Denis specializes in identifying vulnerabilities across networks, applications, organizations, and systems. His work at Pulse Security encompasses security research as a service, attacker emulation, and penetration testing. Andzakovic is a strong advocate for an engineering-centric approach to cybersecurity, emphasizing scientific processes and detailed measurement over traditional, less predictable red teaming methodologies. He is dedicated to improving the collective understanding of technology and fostering collaboration within the cybersecurity industry to achieve tangible security improvements.