feat(intel-driven): third-party risk tests — 3CX supply-chain (56475cb3) + ScreenConnect RMM abuse (208ef54b) - #65
Open
ubercylon8 wants to merge 5 commits into
Open
feat(intel-driven): third-party risk tests — 3CX supply-chain (56475cb3) + ScreenConnect RMM abuse (208ef54b)#65ubercylon8 wants to merge 5 commits into
ubercylon8 wants to merge 5 commits into
Conversation
…tests Third-party risk test pair brainstormed with user: - 56475cb3 — 3CX 3CXDesktopApp cascading supply-chain (Lazarus/UNC4736), 4-stage: DLL side-load, dormancy evasion, ICO-stego C2 config, ICONIC browser collection. F0RT1KA-signed orchestrator plays the trusted app. - 208ef54b — ScreenConnect unsanctioned RMM abuse (Black Basta), 3-stage: silent MSI install, service+relay attempt, follow-on exfil. Real signed vendor MSI embed; local-validation only, no live relay or committed secrets. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…t (208ef54b) Multi-stage Windows test for "living off trusted software" RMM abuse (Black Basta; ScreenConnect / ConnectWise). T1199 framing + 3 stages: T1219 silent vendor-MSI install, T1543.003 service creation + relay attempt, T1567.002 follow-on collection + cloud-storage exfil. - Schema v2.0 InitLogger, RubricVersion v2.1, score 8.4/10 - gzip-embedded signed stages (modern 8-step build_all.sh) + cleanup util - Strict positive-evidence exit codes (Bug Prevention Rules 5 & 8): block only on msiexec 1625 / confirmed quarantine; ambiguous -> 999; no catch-all-to-126; unreachable relay/exfil failures are benign - Full artifact suite: README/info/references, KQL/YARA/Sigma/Elastic/LC detection rules, defense guidance + hardening.ps1, SAFETY.md, kill chain - No secrets committed; relay/exfil are RFC2606 .invalid placeholders MANUAL BUILD GATE: the vendor ScreenConnect MSI is NOT committed (licensing). build_all.sh stops with explicit instructions until the user stages screenconnect_embedded.msi in the test dir (git-ignored). Non-MSI code compiles clean (windows/amd64); orchestrator cannot link until the MSI + stage .gz binaries exist. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Multi-stage F0RT1KA test (56475cb3-febc-45ac-a0af-39bc5ca1c15f) simulating the March 2023 3CX 3CXDesktopApp trojan (Lazarus / UNC4736): a trusted, validly signed vendor app behaving anomalously. Orchestrator (F0RT1KA-signed, playing the 3CXDesktopApp role) + 4 gzip-embedded signed stages: - T1574.002 DLL side-loading (d3dcompiler_47.dll / ffmpeg.dll from a writable app dir) - T1497 sandbox/dormancy evasion (VM/uptime/domain-join checks; intended 7-day sleep logged, not slept) - T1027.003 / T1071.001 steganographic C2 config (real benign DNS+HTTPS shaped like the raw.githubusercontent.com ICO IOC; embedded ICO-appended AES config decoded locally; no real payload retrieved) - T1555.003 / T1217 ICONIC browser credential collection against decoys in ARTIFACT_DIR (never real credentials) Schema v2.0, RubricVersion v2.1 (scored 7.3/10, not yet lab-detonated). Exit-code discipline per Bug Prevention Rule 8 (block codes only on positive evidence; ambiguous/benign failures -> 999; no default-to-blocked). All writes confined to LOG_DIR / ARTIFACT_DIR; only benign GitHub-CDN egress. Includes full deliverable suite: README, info card, references, detection rules (KQL/YARA/Sigma/Elastic EQL/LimaCharlie D&R), defense guidance, Windows hardening PS1, and kill-chain diagram. Binary 13.62 MB (Yellow tier, justified). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… event Stage 1 previously copied notepad.exe -> 3CXDesktopApp.exe and dropped fake MZ-sentinel DLLs beside it; notepad has no import dependency on them, so no module-load event ever fired -- the signature 3CX telemetry was missing. Now the signed stage binary copies ITSELF to 3CXDesktopApp.exe (Authenticode preserved), plants real benign Microsoft-signed system DLLs under the companion names (System32 d3dcompiler_47.dll verbatim; winmm.dll as ffmpeg.dll), and relaunches in --sideload-host mode where it syscall.LoadLibrary's them from its own dir -- a genuine signed-process image-load from a user-writable path. The suspicious property is path + loader identity; the DLLs are MS's own benign binaries (no payload). Rule 8 classification preserved (access-denied on load or planted-DLL-disappears => block; otherwise benign). Re-scored v2.1 7.3 -> 7.6 (API fidelity 1.7 -> 2.0); corrected stale info-card claim that only 2 of 5 detection formats existed (all 5 present). Telemetry sub-score (2c) still capped pending lab detonation. New SHA1 19dba609. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Detonated 3CX on the win lab (Win11 Pro, Defender RTP ON) 2026-07-07: - Exit 101 (unprotected); all 4 stages reached and succeeded. - Stage-1 side-load image-load CONFIRMED: child --sideload-host reported LOADED d3dcompiler_47.dll / LOADED ffmpeg.dll (0 LOADFAIL) -- validates the strengthened side-load emits genuine module-load telemetry. - No Defender reaction, no quarantine; classification correct per Rule 8. v2.1 criterion 4 (all stages reached in lab) now met -> 2c telemetry cap lifted (1.3 -> 1.6; held < 2.0 as custom detection rules were not confirmed to fire). Total 7.6 -> 7.9. Added Lab Detonation Results section to info card; updated README note and TestMetadata.Score. Rebuilt (SHA1 eeae2047) -- behaviorally identical to the detonated build 19dba609, only the Score constant changed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two new Windows-only intel-driven tests assessing third-party / supply-chain risk, each brainstormed and spec'd before build. Both simulate the anomalous use of a trusted, signed component — the detection challenge is that every artifact the endpoint sees is legitimately signed.
56475cb3208ef54bDesign specs:
docs/superpowers/specs/2026-07-07-3cx-cascading-supply-chain-design.md,docs/superpowers/specs/2026-07-07-screenconnect-rmm-abuse-design.md.3CX (
56475cb3) — complete4-stage kill chain: DLL side-load (T1574.002) → dormancy/sandbox evasion (T1497) → steganographic ICO C2 config (T1027.003 / T1071.001) → ICONIC-style browser collection (T1555.003). Framing: T1195.002. F0RT1KA-signed orchestrator plays the trusted app; no real 3CX binary, no cert forgery, benign egress, decoys only.
Stage 1 was strengthened in this PR to emit a genuine side-load image-load event: a signed
3CXDesktopApp.exe(copy of the signed stage binary)LoadLibrarys real, benign Microsoft-signed DLLs planted under the companion names (d3dcompiler_47.dll,ffmpeg.dll) from its own user-writable directory. Previously it launchednotepad.exe, which had no import dependency on the dropped files, so no module-load ever fired. Re-scored 7.3 → 7.6 (API fidelity 1.7 → 2.0).ScreenConnect (
208ef54b) — scaffolded, one manual gate3-stage chain: silent MSI install (T1219) → service creation + relay attempt (T1543.003) → follow-on exfil (T1567.002). Framing: T1199. Embeds a real signed vendor MSI (Tailscale-precedent), local-validation only — relay points at an unreachable URL, no live relay, no committed secrets. Includes
cleanup_utility.go(uninstalls agent + removes service).Build gate: the ConnectWise ScreenConnect MSI is a local, git-ignored build asset (
screenconnect_embedded.msi) staged out-of-band;build_all.shstep 0 stops with instructions if absent.Not yet done (tracked, not blocking review)
winlab (Defender ON) — neither has been run end-to-end on an instrumented sensor yet, so the v2.1 telemetry-signal-quality sub-score is capped for both. ScreenConnect installs a real service → snapshot the VM first.Safety
All writes confined to
ARTIFACT_DIR/LOG_DIR; block codes only on positive evidence (Bug Prevention Rule 8); no malicious payloads. ScreenConnect genuinely installs software + a Windows service — the explicitly-approved core premise of that test, documented in itsSAFETY.mdwith snapshot-first mitigation.Full 5-format detection suites (KQL/YARA/Sigma/Elastic EQL/LimaCharlie D&R), defense guidance + hardening, and kill-chain diagrams included for both.
🤖 Generated with Claude Code