T1574.013 KernelCallbackTable

> Sub-technique of: T1574

High-Level Description

Adversaries may abuse the <code>KernelCallbackTable</code> of a process to hijack its execution flow in order to run their own payloads. The <code>KernelCallbackTable</code> can be found in the Process Environment Block (PEB) and is initialized to an array of graphic functions available to a GUI process once <code>user32.dll</code> is loaded.

An adversary may hijack the execution flow of a process using the <code>KernelCallbackTable</code> by replacing an original callback function with a malicious payload. Modifying callback functions can be achieved in various ways involving related behaviors such as Reflective Code Loading or Process Injection into another process.

A pointer to the memory address of the <code>KernelCallbackTable</code> can be obtained by locating the PEB (ex: via a call to the <code>NtQueryInformationProcess()</code> Native API function). Once the pointer is located, the <code>KernelCallbackTable</code> can be duplicated, and a function in the table (e.g., <code>fnCOPYDATA</code>) set to the address of a malicious payload (ex: via <code>WriteProcessMemory()</code>). The PEB is then updated with the new address of the table. Once the tampered function is invoked, the malicious payload will be triggered.

The tampered function is typically invoked using a Windows message. After the process is hijacked and malicious code is executed, the <code>KernelCallbackTable</code> may also be restored to its original state by the rest of the malicious payload. Use of the <code>KernelCallbackTable</code> to hijack execution flow may evade detection from security products since the execution can be masked under a legitimate process.

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)
• Defense Evasion (TA0005)

Platforms: Windows

What to Check

• ] Identify if KernelCallbackTable technique is applicable to target environment
• ] Check Windows systems for indicators of KernelCallbackTable
• ] Verify mitigations are bypassed or absent (1 known mitigations)
• ] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to KernelCallbackTable by examining the target platforms (Windows).

1. Assess Existing Defenses: Review whether mitigations for T1574.013 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

1. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1040 Behavior Prevention on Endpoint

Some endpoint security solutions can be configured to block some types of behaviors related to process injection/memory tampering based on common sequences of indicators (ex: execution of specific API functions).

Detection

Detection Strategy for Hijack Execution Flow through the KernelCallbackTable on Windows.

Risk Assessment

| Finding | Severity | Impact | | ---------------------------------------- | -------- | ----------- | | KernelCallbackTable technique applicable | High | Persistence |

CWE Categories

| CWE ID | Title | | ------- | ----------------------------- | | CWE-276 | Incorrect Default Permissions |

References

• FinFisher exposed
• NtQueryInformationProcess
• Windows Process Injection KernelCallbackTable
• Lazarus APT January 2022
• Atomic Red Team - T1574.013
• MITRE ATT&CK - T1574.013