MrKaplan: Helping the Red Team to stay Hidden

MrKaplan is a tool aimed to help red teamers to stay hidden and clear as much as traces possible. It works by saving information such as the time it ran, under which user and “reverting” the computer to look like before MrKaplan ran.

Features:

• Stopping event logging.
• Clearing files artifacts.
• Clearing registry artifacts.
• Can run for multiple users.
• Can run as user and as admin (Highly recommended to run as admin).
• Can save timestamps of files.
• Can exclude certian operations and leave artifacts to blue teams.

Usage

• Before you start your operations on the computer, run MrKaplan with begin flag and whenever your finish run it again with end flag.
• DO NOT REMOVE MrKaplan-Config.json file until you rerun with the end flag, otherwise MrKaplan will not be able to use the information.

Switches and their Meaning

As you saw from the help command, there are few options that MrKaplan can run with:

• -Users: This option cannot be run with -RunAsUser, the users option allows to delete artifacts for another users on the current PC (the current user comes by default and there is no need to add it).
• -RunAsUser: This option cannot be run with -Users, the RunAsUsers option allows to delete artifact with only user privileges.
• -EtwBypassMethod: This option cannot be run with -RunAsUser, the EtwBypassMethod option allows to choose which method will be selected to stop event logging (You can read more about it in the Event Logging bypass section).
• -Exclusions: This option allows you to control what evidence won’t be cleaned. Current supported evidences:
  • eventlogs => Do not stop ETW
  • pshistory => Do not overwrite PowerShell history
  • userassist => Do not clear UserAssist registry key
  • bamkey => Do not clear the BAM registry key.
  • inetcache => Do not clear the INet cache folder.
  • windowshistory => Do not clear the windows history folder.
  • officehistory => Do not clear the office history folder.
  • cryptnetcache => Do not clear the CryptNetUrlCache folder.
  • prefetch => Do not clear prefetches.

Running States

• begin: When you want to start your operation use this command with the switches above and MrKaplan will create the fitting config file.
• end: When you want to clean up evidences and finished your operation, run this command with the config file in your current directory.
• timestomp: When you want to timestomp a file in the end of your operations use this command with -StompedFilePath to save the required information.

IOCs

• Powershell process that access to the artifacts mentioned in the wiki page.
• Powershell importing weird base64 blob.
• Powershell process that performs Token Manipulation.
• MrKaplan’s config and the YARA rule.