Recon

Local Recon

Common host recon commands could trigger alerts if they are chained due to behavior analysis capabilities. Examples of these commands are:

Commands to AvoidThe Red Team Vade Mecum

WMI queries are not usually flagged, and logging for them is disabled by default. We can use wmic to issue WMI queries to get info about the host:

WMIC commandsThe Red Team Vade Mecum

Host recon via direct windows APIs are usually not detected as this minimizes, an example of what we can do is this:

HANDLE hToken;
PTOKEN_USER userInfo;
DWORD Length = 0;
WCHAR username[1024] = { 0 };
WCHAR domain[1024] = { 0 };

ImpersonateSelf(SecurityDelegation);

OpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, true, &hToken);

if (!GetTokenInformation(hToken, TokenUser, userInfo, 4096, &Length))
    return 0;

LookupAccountSid(NULL, userInfo->User.Sid, username, &Length, domain, &Length, ...

Domain/Remote Recon

DNS recon(fierce, nslookup etc.) as well as SAMR protocol recon like "net user /domain" will be caught to due the amount of traffic it sends to the DC(where ATA is running). It's also pretty abnormal for these commands to be ran by a regular user too.

We can subvert the detection of DNS recon by just limiting the amount of commands we run, but there are better and more efficient ways to gather info.

One way to get information about the domain, is to enumerate remotely by adding /NODE:"SERVER" to your wmic queries.

Ex.

wmic /NODE:"SERVER" /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get *

Using LDAP to gather AD info can reduce the likelihood of detection as this flagging this type of traffic would lead to a high number of false positives due to the fact that this is normal/common traffic.

Powerview, and Bloodhound(use ExcludeDC flag to avoid communication to DC to avoid being detected by ATA.) can all be used to achieve domain enumeration. In fact, as long as we just avoid communication with the DC, we can enumerate however we want because ATA has no telemetry over these communications.