Why Continuous Red Teaming is Critical for Defense Against Evolving Threats

---
title: Potential Shadow Copy Deletion via VssAdmin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to delete volume shadow copies using vssadmin.exe, a technique frequently employed by ransomware and red team engagements (including Metasploit modules) to prevent system recovery and forensic analysis.
references:
    - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
    - attack.defense_evasion
    - attack.t1490
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    condition: selection
falsepositives:
    - System administrators managing disk space (rare)
level: high
---
title: Suspicious Shell Spawn from Service Process
id: 87654321-4321-4321-4321-210987654321
status: experimental
description: Detects a shell (cmd, powershell, etc.) spawned by a service control process (svchost.exe or services.exe). This pattern is indicative of a successful exploit of a vulnerable service, a common technique used by Metasploit exploit modules to gain SYSTEM privileges or establish a foothold.
references:
    - https://attack.mitre.org/techniques/T1569/002/
author: Security Arsenal
date: 2026/04/06
tags:
    - attack.execution
    - attack.privilege_escalation
    - attack.t1569.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\svchost.exe'
            - '\services.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    filter:
        - CommandLine|contains: ' -Embedding '
    condition: selection_parent and selection_child and not filter
falsepositives:
    - Legitimate management tools spawning consoles via services (rare)
    - Windows Update components
level: high

// Hunt for potential Metasploit reverse shells
// Detects outbound connections from suspicious processes (LOLBins/PowerShell) 
// to ports commonly used by Metasploit handlers (e.g., 4444, 5552, 8443).
// Metasploit Pro 5.0 lowers the barrier to entry, increasing the likelihood of 
// attackers using default configurations or common evasion modules.
let MetasploitHandlerPorts = dynamic([4444, 4443, 5552, 8000, 8443, 3333, 1234]);
let SuspiciousProcesses = dynamic(["powershell.exe", "cmd.exe", "pwsh.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe"]);
DeviceNetworkEvents
| where ActionType == "ConnectionSuccess"
| where RemotePort in (MetasploitHandlerPorts)
| join kind=inner (
    DeviceProcessEvents
    | where FileName in~ (SuspiciousProcesses)
) on $left.DeviceId == $right.DeviceId, $left.InitiatingProcessId == $right.ProcessId
| project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessAccountName
| summarize Count = count() by Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteIP, RemotePort, InitiatingProcessAccountName
| order by Timestamp desc

-- [File System Hunt] Hunt for Metasploit Framework directories and specific payload DLLs
-- Using glob() to scan filesystem for indicators like 'metsrv.dll', 'msfvenom', etc.
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/**/*', accessor='auto')
WHERE FullPath =~ 'metasploit'
   OR FullPath =~ 'msfconsole'
   OR FullPath =~ 'msfvenom'
   OR FullPath =~ 'meterpreter'
   OR FullPath =~ 'metsrv' -- Meterpreter service DLL
   OR FullPath =~ 'pattern_create'

-- [File System] Check for specific high-risk tool paths using stat()
-- Using stat() to verify presence of known default installation paths
SELECT Path, Size, Mode
FROM stat(path='/opt/metasploit')
UNION ALL
SELECT Path, Size, Mode
FROM stat(path='/root/.msf4')
UNION ALL
SELECT Path, Size, Mode
FROM stat(path='C:\\metasploit')

-- [Process Hunt] Hunt for Ruby processes (Metasploit backend) and suspicious parent/child chains
-- Using pslist() to find processes commonly associated with Red Team frameworks
SELECT Name, Pid, Ppid, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ 'ruby' AND CommandLine =~ 'msf'
   OR Name =~ 'meterpreter'
   OR Exe =~ 'metasploit'

-- [Network Hunt] Hunt for suspicious established connections (Reverse Shells)
-- Using netstat() to find connections on common Metasploit handler ports (e.g., 4444)
SELECT Family, Laddr, Raddr, State, Pid
FROM netstat()
WHERE State = 'ESTABLISHED'
   AND (Raddr.Port IN (4444, 4443, 5555, 6666, 8000, 8080, 53)
        OR Laddr.Port IN (4444, 4443, 5555, 6666, 8000, 8080))

-- [User Context] Identify non-system users running high-risk tools
-- Using pslist() and lookupSID() to correlate processes with SIDs
SELECT P.Pid, P.Name, P.Exe, P.Username, U.Name, U.Domain
FROM pslist() AS P
LEFT JOIN lookupSID(Sid=P.UserSid) AS U
WHERE (P.Name =~ 'ruby' OR P.Name =~ 'python' OR P.Name =~ 'perl')
   AND U.Name NOT IN ('SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE', 'root')

# Requires Administrator privileges to run most checks
# Check if running as Admin, otherwise warn and exit
If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Warning "This script must be run as Administrator to perform patch verification and hardening changes."
    exit
}

# ---------------------------------------------------------
# SECTION 1: Hunt for Metasploit Installation Artifacts
# ---------------------------------------------------------
Write-Host "Checking for Metasploit Framework Installation Artifacts..." -ForegroundColor Cyan

# Metasploit Pro 5.0 usually installs to 'C:\metasploit' or similar paths.
# Look for the main console process or the installer directory.
$msfPaths = @("C:\metasploit", "C:\Progra~1\Metasploit", "C:\Progra~2\Metasploit")
$msfFound = $false

foreach ($path in $msfPaths) {
    if (Test-Path $path) {
        Write-Host "[!] WARNING: Potential Metasploit directory found at: $path" -ForegroundColor Red
        $msfFound = $true
    }
}

# Check for running msfconsole or ruby processes associated with MSF
$msfProcesses = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.ProcessName -like "*msf*" -or $_.ProcessName -like "*ruby*" }
if ($msfProcesses) {
    Write-Host "[!] WARNING: Potential Metasploit processes detected:" -ForegroundColor Red
    $msfProcesses | Select-Object ProcessName, Id, Path
} else {
    Write-Host "[+] No active Metasploit processes detected." -ForegroundColor Green
}

# ---------------------------------------------------------
# SECTION 2: Verify Patch Status for MSF 5.0 Era Exploits
# ---------------------------------------------------------
Write-Host "`nVerifying Patches for Critical Exploits (EternalBlue, BlueKeep)..." -ForegroundColor Cyan

# Check for MS17-010 (EternalBlue) - Primary MSF exploit for years
# Vulnerable if OS is Win7/2008R2/2012 and specific KBs are missing
$os = Get-WmiObject -Class Win32_OperatingSystem
$kbList = Get-HotFix -ErrorAction SilentlyContinue | Select-Object -ExpandProperty HotFixID

$ms17Patched = $false
# Common KBs that patched MS17-010
$ms17Kbs = @("KB4012212", "KB4012213", "KB4012214", "KB4012215", "KB4012216", "KB4012606", "KB4013198", "KB4013429", "KB4015217", "KB4015438", "KB4015546", "KB4015547", "KB4015548", "KB4015549", "KB4015550", "KB4015551", "KB4015552", "KB4015553", "KB4015554", "KB4016635", "KB4019213", "KB4019214", "KB4019215", "KB4019216", "KB4019263", "KB4019472", "KB4019474", "KB4022719", "KB4023709", "KB4022723", "KB4023701", "KB4023706", "KB4023707", "KB4022715", "KB4023698")

$foundKb = $false
foreach ($kb in $ms17Kbs) {
    if ($kbList -contains $kb) { $foundKb = $true; break }
}

if ($foundKb) {
    Write-Host "[+] System appears patched against MS17-010 (EternalBlue)." -ForegroundColor Green
} elseif ($os.Caption -match "Windows 10|Windows Server 2016|Windows Server 2019") {
    # Win10/2016+ usually shipped with it or got it via cumulative updates easily
    Write-Host "[i] OS is Windows 10/Server 2016+. MS17-010 likely patched via cumulative updates." -ForegroundColor Gray
} else {
    Write-Host "[!] CRITICAL: System appears VULNERABLE to MS17-010 (EternalBlue). MSF 5.0 exploits this easily." -ForegroundColor Red
}

# Check for CVE-2019-0708 (BlueKeep) - Major RDP vulnerability popular in MSF 5
$blueKeepKbs = @("KB4499417", "KB4499180", "KB4506994", "KB4507433", "KB4512486", "KB4512488")
$blueKeepFound = $false
foreach ($kb in $blueKeepKbs) {
    if ($kbList -contains $kb) { $blueKeepFound = $true; break }
}

if ($blueKeepFound) {
    Write-Host "[+] System appears patched against CVE-2019-0708 (BlueKeep)." -ForegroundColor Green
} elseif ($os.Caption -match "Windows 7|Windows Server 2008 R2|Windows XP|Windows Server 2003") {
    Write-Host "[!] CRITICAL: Legacy OS detected. Verify BlueKeep patch manually. MSF 5.0 contains working exploits for this." -ForegroundColor Red
} else {
    Write-Host "[i] OS is generally immune to BlueKeep (Win 8+)." -ForegroundColor Gray
}

# ---------------------------------------------------------
# SECTION 3: Harden Against MSF Payloads and Vectors
# ---------------------------------------------------------
Write-Host "`nHardening System against Metasploit Payloads..." -ForegroundColor Cyan

# 1. Disable SMBv1 (Vector for EternalBlue and WannaCry)
$smbv1 = Get-SmbServerConfiguration -ErrorAction SilentlyContinue
if ($smbv1.EnableSMB1Protocol -eq $true) {
    Write-Host "[!] Vulnerability: SMBv1 is ENABLED. Metasploit often targets SMBv1." -ForegroundColor Red
    Write-Host "[*] Attempting to disable SMBv1..." -ForegroundColor Yellow
    try {
        Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
        Write-Host "[+] SMBv1 disabled successfully." -ForegroundColor Green
    } catch {
        Write-Host "[-] Failed to disable SMBv1. Run manually." -ForegroundColor Red
    }
} else {
    Write-Host "[+] Hardening: SMBv1 is already disabled." -ForegroundColor Green
}

# 2. Enable PowerShell Script Block Logging (Detects obfuscated MSF PowerShell payloads)
# Metasploit 'powershell' payloads use obfuscation; this log is crucial for forensics.
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
$regName = "EnableScriptBlockLogging"
$currentVal = (Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue).$regName

if ($currentVal -ne 1) {
    Write-Host "[!] Hardening: Script Block Logging is not enforced. Enabling..." -ForegroundColor Yellow
    if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null }
    Set-ItemProperty -Path $regPath -Name $regName -Value 1 -Type DWord
    Write-Host "[+] Script Block Logging enabled. Obfuscated MSF scripts will now be logged to Event Viewer." -ForegroundColor Green
} else {
    Write-Host "[+] Hardening: Script Block Logging is already active." -ForegroundColor Green
}

# 3. Disable LLMNR (Link-Local Multicast Name Resolution)
# MSF modules often use 'auxiliary/spoof/nbns/nbns_response' to capture hashes.
$llmnrPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient"
$llmnrName = "EnableMulticastResolver"
$llmnrVal = (Get-ItemProperty -Path $llmnrPath -ErrorAction SilentlyContinue).$llmnrName

if ($llmnrVal -ne 0) {
    Write-Host "[!] Hardening: LLMNR is enabled. This allows MSF NetBIOS spoofing attacks." -ForegroundColor Yellow
    if (-not (Test-Path $llmnrPath)) { New-Item -Path $llmnrPath -Force | Out-Null }
    Set-ItemProperty -Path $llmnrPath -Name $llmnrName -Value 0 -Type DWord
    Write-Host "[+] LLMNR disabled. Reduced risk of credential theft via spoofing." -ForegroundColor Green
} else {
    Write-Host "[+] Hardening: LLMNR is already disabled." -ForegroundColor Green
}

Write-Host "`nScript execution completed." -ForegroundColor Cyan