General Discussion

[The-Viper-One]

General discussion for any questions you might have around PsMapExec

[ThatTotallyRealMyth]

I really love pme and the idea behind it especially the execution is amazing! I've introduced it to all my co workers and am trying to convince them to start deploying it more often on engagements but I keep getting pushbacks on "opsec". You reckon you could give us some insights & advice on how pme could be modified to be more opsec friendly as its creator, what are some obvious things you know about that come to mind when thinking of making it quieter?

[The-Viper-One]

Hi @ThatTotallyRealMyth

Thanks for reaching out. Certainly makes my day to hear people enjoying this project.

As PME was developed from the ground up as a penetration testing tool to expand available windows tradecraft it was never initially developed with OPSEC and stealth in mind. As such it is a "noisy" tool.

Broadly, I would say these are the noisiest things it does (Assuming we have no concerns about the host system its running from):

LDAP Queries are performed in bulk on initial target selection

$searcher = New-Searcher
$searcher.PropertiesToLoad.AddRange(@("dnshostname", "operatingSystem"))
$searcher.Filter = "(&(objectCategory=computer)(operatingSystem=*windows*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))"

This is initially quite noisy as we are potentially pulling quite a bit of data over LDAP. Especially in larger enterprises. However, successive runs that utilize LDAP after this, do not need to query the domain again. This also avoids repeatedly querying systems over SMB or LDAP to obtain host metadata like OS versions.

There are certainly ways to make the initial LDAP collection quieter at the expense of time and accuracy. For example, PME could collect at a highly reduced rate, specifically using LDAPS if available and use techniques such as "OU Walking" as to not perform such large "base searches" over LDAP.

Other factors such as code execution methods. The WMI and SMB techniques employed by PME are somewhat unique in execution but from a behaviour perspective will certainly trip on some EDRs. I have been toying with these lately to try and make it more effective against EDR systems but this is challenging to say the least. WinRM is just WinRM essentially, PME runs Invoke-Command on remote systems. Funnily enough, this is the best way of performing code execution with PME as it looks most "natural".

In other aspects, the OPSEC of PME is also down to the operator. There is nothing stopping the operator from just blasting Mimikatz against 10,000 domain systems.

This is potentially a large topic of conversation, if you can let me know specific concerns you might have I am happy to expand further either here or over Discord.

[ThatTotallyRealMyth]

Super insightful stuff! Im keen to keep seeing it all get better. I am happy to chat more about it on discord and maybe even help add some features over the coming month as I finish exams at uni and have picked up powershell again. my discord handle is the same as my github; if you've got the time, would love to hear more about pme and potential advice you've got for me on how to better use