4

I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain.

Rather than standing up my own AD controller and fake domain every time I want to test with a different domain name, I was hoping to write a PowerShell script to fake information on the local system to look like it was joined to an arbitrary domain.

I tried editing the registry values in HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, but the system still showed as a workgroup system.

Is there any way to make Windows (and therefore Windows malware) think it's a member of a domain, without actually joining a domain?

1
  • I concur with the existing answer for the most part. However, have you considered Samba? AFAIK the Samba devs have meanwhile even been able to work with some folks at MS and AFAIK it is possible to run it as a full-fledged DC. Since you can peek into the Samba sources, it should be possible to figure out which knobs to turn in order to change the domain name after initial configuration. You could even create the initial Samba AD by joining it as AD into an existing domain. AD LDS might be (but I'm not 100% sure) another option.
    – 0xC0000022L
    Jun 30 at 8:18

1 Answer 1

1

I'd say no, there are too many changes when a system is joined to an AD domain, and therefore many ways that the malware could verify the existence of the AD domain. A couple off the top of my head:

  • running services on the client
  • DNS queries
  • services reachable on the domain controller
  • LDAP queries
  • changes to the client registry
  • timesync settings

.. you get the idea. I think you would have to spend more time faking the domain membership based on what each piece of malware is looking for, than it would take to run up a DC. If you have a Windows server VM snapshotted, you could just run dcpromo each time, or even better, automate the whole deployment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.