Last updated
Last updated
Defender also has the ability to inspect the command line arguments of a process and can prevent it from starting if it has malicious content. A common place you may find this is with the built-in pth command.
We can see from the console log that this expands to:
However, you will get an access denied error when Mimikatz tries to call CreateProcessWithLogonW.
It's not entirely obvious on the surface that this is caused by Defender, but you can see the alert in both in the GUI and via Get-MpThreatDetection. The "CmdLine" prefix gives away the origin of the detection. In this case, it's the echo x > \\.\pipe\ pattern as this is synonymous with named pipe impersonation (also obvious from the title of the alert).
Bypassing or disabling kernel-level callbacks is out of scope for RTO. The easiest workaround is to find a way to achieve the same goal but in a way that doesn't involve the same command line arguments. For pass-the-hash, we can simply start an arbitrary process and steal its token manually.
The reason this returns an access denied (i.e. error code 5) is because the enforcement is coming from the Windows Defender driver in the kernel. This driver receives when new processes are being created, which contain a structure. The eagle-eyed will spot the CreationStatus member, which is the NTSTATUS value to return. The driver can simply set this to STATUS_ACCESS_DENIED to prevent the process from starting, and that error code propagates down to the caller.
