Leo Valentic: Hide and Seek in Windows' Closet: Unmasking the WinSxS Hijacking Hideout | CONFidence

### Overview In this presentation at CONFidence, thread researcher Leo Valentic introduces research on abusing Windows side-by-side (WinSxS) binaries via DLL search order hijacking, a technique termed "win SOS." The presentation highlights how attackers and red teamers can execute payloads with stealth without requiring administrative privileges, specialized vulnerabilities, or external third-party software. It also details the search order mechanics, past threat actor usage, a demonstration of gaining a reverse shell, and recommendations for blue teams and SOC analysts to detect this activity.

### Key Topics - **Windows Side-by-Side (WinSxS):** Located at `C:\Windows\WinSxS`, this critical system folder stores necessary files and libraries to support multiple software versions concurrently. Because it preserves various versions over time, it grows very large and contains numerous native binaries. - **DLL Search Order Hijacking:** A well-known technique where an executable searches sequentially for dependencies (application launch directory, `System32`, `System`, `Windows`, current working directory, and path environment variables). By manipulating the current working directory, attackers can force a legitimate system binary to load an arbitrary DLL. - **Threat Actor Precedent:** Multiple advanced persistent threat (APT) groups have historically abused search order hijacking. Notable examples cited include APT41 (Double Dragon) deploying payloads like Wintrm, Aquatic Panda loading libraries and DOT files, the RTM group abusing TeamViewer versions prior to 5.0 to load malicious DLLs, and Whitefly leveraging it to run their loader. - **The "win SOS" Method:** Enhancing classic DLL hijacking by calling legitimate WinSxS executables directly from a user-controlled working directory, completely bypassing the need for elevated permissions or application flaws. The issue was reported to Microsoft, who did not classify it as a security vulnerability.

### Technical Details - **Discovery & Tooling:** The researchers developed an automated helper called "bin finder" to run executables within the WinSxS directory while capturing events using Process Monitor (filtering on operations like `CreateFile`, results `PATH NOT FOUND` / `NAME NOT FOUND`, and paths pointing to the target folder). This surfaced multiple binaries that check the current working directory for missing dependencies. - **Target Binaries & Hijack Examples:** - `ngentask.exe`: Searches for `mscoreesvc.dll` in the current working directory. - `forfiles.exe`: Searches for `cmd.exe` in the current working directory (demonstrated by renaming the inspection tool Hollows Hunter to `cmd.exe`). - `conhost.exe`: Searches for `clipup.exe`. - **Attack Workflow:** 1. An attacker operating as a standard local user creates an arbitrary working directory (e.g., a desktop folder named `not a system folder MS`). 2. The attacker places a custom malicious DLL (such as a crafted `mscoreesvc.dll`) into that directory. 3. Using PowerShell or Command Prompt from inside that working directory, the attacker invokes the legitimate binary path within WinSxS (e.g., `ngentask.exe`). 4. When inspected in tools like Process Explorer, the process appears as a legitimate, signed Microsoft binary with a valid hash, obscuring the malicious DLL loaded from the custom folder. 5. A pre-recorded demo shows this execution successfully establishing a Netcat reverse shell on port 4444 while evading standard antivirus and EDR detections.

### Takeaways - **For Red Teams:** "win SOS" provides an effective, low-privilege execution and stealth technique that avoids signature-based detection by masquerading under legitimate, signed Microsoft executables. - **For Blue Teams & SOC Analysts:** - Do not rely solely on process names, digital signatures, or file hashes, as legitimate WinSxS binaries will appear benign at first glance. - Inspect parent-child process relationships and flag unusual processes launching WinSxS binaries or unexpected child processes spawned by them. - Monitor behavioral telemetry: inspect loaded modules for binaries loading DLLs from atypical or user-writable paths, watch for unexpected network connections initiated by utilities like `ngentask.exe`, and log anomalous file operations using tools like Sysmon.