By Maj. Anthony Rose
AFIT Graduate Student
Department of Electrical & Computer Engineering

Due to its widespread use and ease of integration on Windows systems, the .NET Framework has become an essential tool for adversaries, especially Advanced Persistent Threats (APTs). The versatility and accessibility make it a prime target for exploitation, with many APTs leveraging it through tools like PowerShell and C#.

A significant aspect of the .NET Framework is the Dynamic Language Runtime (DLR), which serves as a potential attack vector. The DLR allows for language-agnostic compilation, enabling tools built within the .NET framework to interact with various functions, irrespective of the language, as long as it’s supported by .NET. While beneficial for developers, this flexibility also offers adversaries a potential avenue for exploitation.

Figure 1: Architecture diagram of the DLR and CLR interactions with compilers and the operating system services [1].

One such exploitation technique is the Bring Your Own Interpreter (BYOI). This method allows developers to embed dynamic languages into .NET, seamlessly integrating various languages. Turla, a suspected Russian APT, has used this technique for evasion purposes and deployed a tool called IronNetInjector. This tool, which uses IronPython (a .NET variant of Python), is designed to reflectively load .NET assemblies, making it a potent tool in the hands of adversaries.

The Antimalware Scan Interface (AMSI) plays a crucial role in defending Windows systems. It serves as a primary line of defense, scanning scripts for potential threats before execution. However, the dynamic nature of languages like IronPython poses challenges for AMSI, allowing for potential evasion techniques. One such method involves bypassing AMSI using IronPython, which has been demonstrated to be effective in evading traditional security measures.

The .NET framework’s design supports many programming languages, allowing them to share libraries seamlessly. While beneficial for developers, this design choice also provides adversaries with potential attack paths. The DLR interacts directly with dynamic languages and has been a focal point for many adversaries. Tools leveraging languages like PowerShell and C# can access functionalities within the DLR, potentially without the user’s knowledge.

AMSI’s role in this ecosystem is paramount. It serves as a versatile interface that integrates with any antimalware product, enhancing overall malware protection. However, its effectiveness is under scrutiny, especially with tools like IronNetInjector in play. This tool, associated with the Russian APT Turla, is designed to bypass modern Windows detections and deploy custom implants.

Embedding dynamic languages within the DLR is a legitimate feature of .NET. This method allows for embedding third-party dynamic languages into .NET and provides adversaries with a powerful evasion technique. One such tool that leverages this technique is IronNetInjector from Turla. IronNetInjector is named due to its IronPython implementation and serves as a wrapper for hosting their NetInjector loader. Its primary objective is to load unmanaged code implant, ComRAT. While not entirely clear, its deployment method is believed to involve a .NET assembly, providing Turla with a versatile deployment option.

Figure 2: Turla's IronNetInjector attack path using C#, IronPython, .NETInjector, and ComRAT [1].

In conclusion, the .NET Framework, while designed to offer developers a versatile and integrated platform, also presents potential vulnerabilities that adversaries can exploit. The continuous evolution of Tactics, Techniques, and Procedures (TTPs) by APTs underscores the need for robust and adaptive defense mechanisms. The weaponization of tools like IronNetInjector and the potential bypass of security measures like AMSI highlight the challenges in cyberspace.

[1] A. Rose, S. Graham, and J. Krasnov, “IronNetInjector: Weaponizing .NET Dynamic Language Runtime Engines” Digital Threats: Research and Practice. May 2023.