Attack, Detection, and Reversal of a Covenant Grunt.

Today I will illustrate the installation of a Covenant grunt on a system through PowerShell. This will be detected by Windows Defender, which I will then bypass with an AMSI bypass script. Finally, I will show how to write a detection rule for finding the grunt and show how to reverse engineer the grunt with CyberChef to find the C2 server. https://twitter.com/bripwn CyberChef: https://gchq.github.io/CyberChef/ CyberChef Recipe for Reversal of a Covenant Grunt: Regular_expression('User defined','[a-zA-Z0-9 /+]{50,}',true,true,false,false,false,false,'List matches') From_Base64('A-Za-z0-9+/=',true,false) Raw_Inflate(0,0,'Adaptive',false,false) Remove_null_bytes() Extract_IP_addresses(true,false,false,false,false,false) Covenant: https://github.com/cobbr/Covenant AMSI Bypass: https://amsi.fail