Service & Monitoring

[Aurillium]

To increase efficiency and stability, a Windows service could be created which handles all LunaJuice instances on a machine, and can remotely inject into processes if a privileged user asks. This service could also behave like an EDR and do some basic monitoring with configurable rules to set up logging for suspicious activity even before it gets triggered by a SIEM. This way the SIEM handles complex tasks, whereas LunaJuice handles simple tasks and speeds up processing of important events (LunaJuice is a reflex, the SIEM is the brain).

Considerations

• Security
  • The service would need to be highly secure so non-privileged users couldn't take advantage of the controller
  • Would need to be secured over the network as well, could AD help?
• Language
  • Due to complexity, C# would likely be a better choice than C++ for this component.
• Project restructuring
  • For this to work well, the existing loader should be mostly converted into shared code which could be used as a static library from a new loader, and be compiled to a DLL for the service and other utilities
  • It is important that LunaJuice can still be used on its own

[Aurillium]

Current plan

Use WCF to create a server and client in C#. The client leverages a new library (C++), which is dynamically linked to it and contains most of the current LunaLoader code. LunaLoader will statically link the same library (enabling it to be used on its own).

The clients and server will run as services on their respective computers. Individual injected programs will still act as their own servers (so the whole service isn't required for using LunaJuice, and LunaLoader can still access processes directly), but these will be used via the main service on each computer, or by LunaLoader. The main server will be able to interact with all clients and client programs (via client) and request an injection into any process on the host. Clients will be identified primarily by hostname and IP for easy integration with SIEM software.

WCF will handle security and make networking simpler, and C# will allow easier access to AD.

[Aurillium]

Progress update: basic RPC functionality exists, WCF starting soon

Important Features Missing

• [ ] LoadLibrary hooking to secure implant
• [ ] RPC authentication/encryption
• [ ] Download registry from implant
• [ ] Improve performance on hooked functions via threading

All of these features must be added before a release can be created