Execution Interception Doubt

[metalforlife]

@egemen post:13

You mean loading a DLL into memory? CIS is not supposed to or even designed to detect if you load a DLL into the process space of an application normally(without hooking or memory injection) except for rundll32.exe(Even this is going to change in the future versions).

By setting image execution control to aggressive and adding *.dll to execution list, you can receive alerts for DLLs but this is not really recommended/intended to be used and we will discontinue this ability in the future versions.

However, if you have a way to execute a standalone executable and bypass the image execution control, that means a flaw and let me know.

Egemen

First of all, I am not even sure if my query is related to the quote above. Well, at least, this has what put the question into my head. What I want to ask is, can in anyway, CIS’s execution interception be bypassed? What I understand from Egemen’s explanation is that it is possible to execute a .dll file if it was embedded(?) into an .exe file? Which means that although you will get an alert for the launch of the .exe file, the .dll file will run unnoticed? But he explains in the 2nd paragraph that by adding “*.dll” to the list of executables in “Image Execution Control” it is possible to get an alert for this too. In this case, I should be getting two alerts, one for the launch of the .exe file and the other for the .exe file trying to execute the .dll file, right?

If my interpretation is completely of the mark and has nothing to do with what the discussion was about, then just a simple yes or no to the main question - Is it possible to bypass CIS’s execution interception - will suffice? If my interpretation was at least half-right, then I would like a baseline explanation, so that I can understand the subject at least at the base.

[wj32]

@metalforlife post:1

First of all, I am not even sure if my query is related to the quote above. Well, at least, this has what put the question into my head. What I want to ask is, can in anyway, CIS’s execution interception be bypassed? What I understand from Egemen’s explanation is that it is possible to execute a .dll file if it was embedded(?) into an .exe file? Which means that although you will get an alert for the launch of the .exe file, the .dll file will run unnoticed? But he explains in the 2nd paragraph that by adding “*.dll” to the list of executables in “Image Execution Control” it is possible to get an alert for this too. In this case, I should be getting two alerts, one for the launch of the .exe file and the other for the .exe file trying to execute the .dll file, right?

If my interpretation is completely of the mark and has nothing to do with what the discussion was about, then just a simple yes or no to the main question - Is it possible to bypass CIS’s execution interception - will suffice? If my interpretation was at least half-right, then I would like a baseline explanation, so that I can understand the subject at least at the base.

Think about what a DLL is: a file containing code plus some support data to be able to load it properly (imports, exports, relocations, etc.). Nothing will stop a program from implementing its own DLL loader and performing the work of LdrLoadDll itself. Loading a DLL is not dangerous at all because the code runs in the security context and address space of the program. Think of a DLL as a shortcut for doing something. If a programmer wants to read a file, they use ReadFile in kernel32.dll. But nothing stops them from calling the kernel directly using the sysenter instruction. However, it’s easier (and more portable) to use ReadFile, so that’s what they use.

It’s (almost) impossible to bypass execution control. Here’s how you create a process:

1. Open the EXE file.
2. Create a section object from it (a section maps a file into memory among other things).
3. Tell the kernel to create the process from the section object. The kernel sets up the process with the EXE.

CIS intercepts programs at step 2. It’s technically possible to fork the current process using NtCreateProcess and then do some black magic to put an EXE into the process, but it would be very difficult. I’m sure CIS has some sort of safeguard against this anyway.