Description: Canarytokens can be closely tied into your OS, with the Sensitive Command Token, we can watch for attackers using invasive commands on Windows hosts.

Follow the steps below to create the Sensitive Command Token.

Windows Error Reporting: This Token makes use of the underlying Windows function SilentProcessExit to trigger. SilentProcessExit relies on Windows Error Reporting infrastructure (WerSvc) to handle the termination of monitored processes and in turn, raise alerts. If Windows Error Reporting is disabled, SilentProcessExit loses the ability to communicate with it, preventing the Token from firing.

A note on how this Token is deployed when the .reg file is run:

When we create the registry keys for the Sensitive Command Token, we make the following changes to the registry.
1. We add a key in [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MONITOREDPROCESS.exe]
This will match the name of the process that you wish to monitor.

2. We add 1 value to the above key

GlobalFlag = dword:00000200

3. We create an additional key.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\FILENAME.exe]

4. This with 2 values.

"ReportingMode"=dword:00000001

5. This enables us to run a process in response to the command of interest exiting.

"MonitorProcess" - Sensitive Command Trigger.

The Sensitive Command Trigger, executes cmd.exe and powershell.exe to send a DNS lookup alert to your console. The command removes any spaces and non-DNS allowable characters. The command also collects the username and computername so when the alert triggers you know which user ran the command on which endpoint.

Step 1:

Log in to your Console.

Step 2:

Hover over the Canarytokens tile and click on Add a new Canarytoken. 

Step 3:

Click on the Create a new token dropdown, then select the Sensitive Command Token.

Step 4:

Enter a helpful reminder, then enter the process name you'd like the Token to trigger on.

Enter the name of the process that you want to monitor for execution (e.g., wmic.exe, whoami.exe, klist.exe, nltest.exe)

Step 5:

Your Token has now been created and is ready for download. Click on the Download Token button to grab the registry file we'll use to deploy the Token.

Step 6:

Import the downloaded registry file by running the reg import command twice, once to insert registry keys to monitor 64-bit process executions, and second time for 32-bit:

reg import <canarytoken>.reg /reg:64
reg import <canarytoken>.reg /reg:32

Step 7:

The Token is now active, and when a monitored command is run....

Alert:

An alert is generated in your Console.

You're done! ;-)