Huntress Shows API-Hash Changes Can Evade Cobalt Strike and Metasploit Detection
Summary
Huntress researchers found that changing API-hashing logic in Cobalt Strike and Metasploit shellcode evaded many tested detections. They also developed a YARA rule targeting the hashing routine rather than fixed hashes.
Key points
- The researchers found that default ROR13 API hashes in Cobalt Strike and Metasploit shellcode were used by vendors as detection indicators.
- Changing the rotation value from 13 to 15 produced new hashes while preserving shellcode functionality in the researchers’ tests.
- A Huntress script automates hash replacement using a randomized rotation value from 1 to 255; it requires raw shellcode without encoders.
- In VirusTotal tests, modified samples received substantially fewer detections; additional changes to generic shellcode indicators resulted in zero detections in the tested sample set.
- The researchers created a YARA rule that detects code associated with the hashing routine, rather than relying only on known API-hash values.
- The rule detected all tested modified and unmodified samples, but the article cautions that more complex changes to the hashing routine could evade it.
Article Details
- Attack Vectors
- The research demonstrates modifying the ROR-based API hashing logic and corresponding hashes in Cobalt Strike and Metasploit shellcode to evade hash-based detections while preserving shellcode functionality.
- The researchers also modified generic shellcode indicators by moving the initial CLD instruction and changing the case of a library name in a LoadLibraryA argument.
- Defensive Notes
- Huntress recommends detecting the ROR-based hashing code blocks rather than relying only on known API hash values; its YARA rule detected the tested modified and unmodified payloads.
- The article recommends continuously testing and updating detection logic, threat hunting across multiple log sources, and checking network traffic even when antivirus raises no alert.
MITRE ATT&CK
People
Products
AntiscanWe then checked the same with Antiscan and found that we had also hit zero detections for our Cobalt Strike shellcode—whereas a non-modified copy had 13 detections.VirusTotalWe then did a before and after check on a Cobalt Strike HTTP payload using Virustotal, and found that 15 vendors failed to detect the shellcode after these changes were made.
Tools
BlobRunnerUsing a combination of netcat and the BlobRunner tool from OAlabs, we did an extra check to confirm that our shellcode still worked and would “call out” as expected.Cobalt StrikeHomeBlogHackers No Hashing: Randomizing API Hashes to Evade Cobalt Strike Shellcode DetectionMetasploit FrameworkProgramming Interface (API) hashing techniques commonly used in popular malware (particularly Metasploit and Cobalt Strike), the Huntress ThreatOps Team found that hackers are sticking to the default settingsmsfvenomIn particular, we found that most Cobalt Strike, Msfvenom and Metasploit use exactly the same hashing logic for resolving API hashes. Since they utilize the same logic, they produce the same hashes for any givennetcatUsing a combination of netcat and the BlobRunner tool from OAlabs, we did an extra check to confirm that our shellcode still worked and would “call out” as expected.PEStudioleaves the API present in the import table of the file. This import table can be easily viewed within PeStudio or any other analysis tool and looks like the screenshot below. Note we can also see the other APIs thatspeakeasyWe then confirmed that our code was still able to function as expected. This process was vastly sped up using the Speakeasy tool from FireEye.YARAdetection tooling. We have included a script that automates a large portion of this process, as well as a YARA rule which will detect most modifications made using this technique.