Full transcript
0:00How often do you get notifications on your computer? You trust them, right? After all, it's your computer from applications you installed. So, they wouldn't be malicious, would they? But, what if a hacker could fake notifications? I want to show you how. So, I'm on my Windows 11 virtual machine and I'm going to open up the terminal to
0:19have access to PowerShell here. And I'm going to try and query the Windows registry. That's available as a PS Drive or PowerShell Drive when we include the colon right after the hive. It'll access HKCU or HKEY_CURRENT_USER. I'm going to look into software and Microsoft Windows using tab complete to speed this up
0:40here. And I'm looking for notifications and their settings. This is where Microsoft Windows might register different applications that are able to send notifications. We can get a good list here and you can see the Windows system toast startup app, Windows Defender, like your antivirus, Microsoft Edge, and a handful of others. I have Cursor installed and maybe that's some
1:00cool AI shenanigans we could do. But, it's not just in HKCU. Remember, HKCU for the current user is your active user and that could be low privileges. You can make changes to that. You can modify it. But, HKLM for HKEY_LOCAL_MACHINE does require administrator privileges. It's another location though where you might see other apps. Things related to
1:21Skype. And we can kind of join these together. What I'm going to do is actually grab with this all in its parentheses just the PS or PowerShell child name. And I'll do the very same again for HKCU for our current user. So, what if I faked an alert that looked like a regular genuine Microsoft Windows Defender antivirus alert saying, "Ooh,
1:43you have malware on your computer." Or Microsoft Edge needs an update. It's mandatory you click a link. Or Cursor says it's done with whatever AI turn you were working on. So, let's write a script and And to use the PowerShell ISE or the integrated What's that acronym? It's not IDE scripting environment, right? And how about I create just a
2:02little playground to be able to work with this like notifications in PowerShell. Now, we do need a little bit of special sauce here. We're going to have to add a type or add in some C# like managed assembly capabilities. Let me specify the assembly name. And I know it's long and verbose regular Windows stuff, but system.runtime.windows.runtime.
2:23So, we'll have access to like WinRT the Windows runtime. Then you have some boilerplate stuff. windows.ui.notifications. Toast notification manager. There's a whole lot more. I'm going to copy and paste because I cannot store that long boilerplate in my brain. I'll leave a link down below for us to be able to explore that a little bit more, but that
2:43is what we need for some scaffolding. Then we need to choose which application installed do we want to fake a notification from? Back in our PowerShell output, all of these that we saw from the command line are what are called AUMIDs or application user model identifiers. That's the unique ID that Windows assigns to modern applications so it
3:05knows what apps are able to work with notifications or be assigned inside of the start menu. What entries are associated and how these toast or pop-up notifications can relate to applications. So, if we're trying to put our hacker hat on, scheme up and plan how we could fake some notification with a little bit of prompt so it's social
3:25engineering lying to the end user. That way we could have a lure or little deceit to have the user maybe willingly provide their password or credentials. Or they'll go to some website that looks believable because we told them, "Hey, you need to update." So, I'm sure you could tell the way that we end up putting together these toast
3:43notifications is based off of XML or the extensible markup language. We could define what sort of XML in a multi-line string we can use in PowerShell with the double quotes and at sign surrounding them. Could we define a toast notification? I'll walk through the syntax here to create a visual indicator and what will display for our pop-up.
4:05But before I get into the important syntax, I think we got to have a conversation because yeah, this could be some threat actor activity. This could be hacks. This could be anyone maybe taking advantage of your data. So before we go any further, let me tell you about the sponsor today's video, Varonis. Today's world runs on data and modern
4:24threats have one sole objective, steal your data. But no matter where your data lives, Varonis keeps it safe. Varonis is a unified and automated data security platform that extends into AI security, email security, and even 24/7 managed data and detection response. It's a SaaS platform built for the future,
4:46protecting AI systems and the data that fuels them. That means stopping social engineering threats before they hit your inbox and the next generation of database activity monitoring or DAM. Best part is when they find a data threat, they fix it. With Varonis Interceptor, their AI solutions catch business email compromises or phishing
5:07attacks that others just don't. And with the launch of their latest new solution, Varonis Atlas, they provide a complete AI security platform to secure everything you build and run with AI. It's protection across the entire life cycle. AI security posture management, runtime protection, detection and response, security testing, compliance
5:29management, and so much more. You can get started with their completely free data risk assessment. It takes mere minutes to set up and you'll get immediate value with the clear risk-based view of what data matters most and a path to automated remediation. It includes critical findings with security expert recommendations, and you can see the
5:51real power of DAM, Interceptor, and Atlas, and ultimately, how Varonis can protect your organization. Get started with Varonis with my link below in the video description. jh.live/varonis Huge thanks to Varonis for sponsoring this video. All right, back in action here. We're
6:11working on our toast notification from Microsoft Edge, and let's add a little bit of text here to say little lie, Microsoft Edge requires an update. How about a critical security update? We should actually be able to supply three different lines of text. One being the top header, a little bit more
6:31information down below, and then like a source or attribution line. Your internet access is degraded until update is complete. So, now that we've built out our little social engineering lie, we need to actually pop up the notification. And the way that we first got to do that is loading our XML into like a document. That syntax defines a
6:54new object with the Windows data XML DOM XML document. Okay, cool. We got that one. Then, we could go ahead and actually load XML from our new XML variable that we defined just above. From there, we can create the actual toast
7:14takes some more Windows type, so in these square braces here, windows.ui.notifications.toastnotification, and we'll create a new object from it based off of this document that we've just prepared from our XML. Then, we actually need to register with a notifier, like a sort of manager for these Windows UI notifications toast
7:37notification manager, and we will create our toast notifier. You could see there from the actual toast object we just created on the line above. Now with that syntax done, we could have our notifier start to show the toast. And we'll pop up a real Windows notification from Microsoft Edge that says, "Hey, we need
7:59to update with this critical security update." And that create toast notifier function should take in the AUMID. So we know that's going to look like it comes from Microsoft Edge. Then, once those two are created, both our notifier manager and the toast itself, we could just have the notifier and you know what? I guess I'll put the letter I in
8:20there so that's spelled right for once. And we'll show our toast object. And that, maybe 24 lines of code, little bit of white space here and there, we could minify stuff. Again, it's all PowerShell, so putting our hacker head on, we could obfuscate, we could encrypt, we could manipulate this any way that we want. But let me press F5 on
8:39my keyboard. And we got Microsoft Edge with a new notification. So something went wrong, but we did get our pop-up. Looks like we might use an actual template for this binding. So that way we could specify kind of the format that we're looking at. I want toast generic here. Forgot that tidbit I'm po- With that, if I press F5 once again,
9:02there we go. We see our real Microsoft Edge requires a critical security update. We could tighten that up, we could customize this. Maybe we don't have the URL so it doesn't load onto another line. We could have this one dismissed and we'll see the next one pop up. That's a little bit better. But just having this pop-up doesn't really do
9:19anything for us. We want some other actions. Maybe a button that'll open up a web page that we could control and have another credential harvester or malware detonating site. Maybe we could have it run code to actually then ask for credentials. And I know what you're thinking, right? I know folks are going to say, "Well, hey, yeah, this is still
9:35after initial access." Yes, exactly. But, maybe this is leverage with something like ClickFix. Remember, we could just as easily swap out any AUMID, that application user model ID, and rather than something coming from Microsoft Edge, let's say it's something like a real Windows antivirus and Defender notification. Your security is
9:56at risk. Let's pop that one. Nice. And if you're ever curious what those actual notifications might say when you see them, in case you saw them previously and you want to go take a look, you can just click on the bell icon here in your startup to be able to see the action center and past notifications. Looks like it really
10:14genuinely says threats found, please visit the Windows Security Center. And some of these you can't turn notifications off, like Windows Security. Microsoft Edge? Yeah, we could probably clobber that. But anyway, let's get to the fun part. Let's add a button. This can be defined via an action that will add a new section for. And realistically, that's plural, actions
10:34with an S. Because each item itself is an actual action, and we can specify the content. Let's go back to our Microsoft Edge lure just to have that a little bit more clear. Now, our button can say install update. And we can add in other attributes here, like the activation type, and we could say protocol, so that
10:55we could then actually open up a web page or anything that could be accessed via a regular natural native Windows protocol handler. So, we could supply arguments here to maybe go to our attacker controlled website. Or, for our silly simple little proof of concept, right? Let's just go to example.com. I'm more
11:17so interested in showing you a little bit of this process itself than staging a whole like C2 command and control framework or lure site, cuz this could totally be tied together. But, we are missing one critical piece for this single element action entry. You must end that for the XML style with a single forward slash just before the closing
11:37greater than symbol waka waka. Now, when I hit F5, ooh, Microsoft Edge requires a critical security update. Internet access is degraded until update is complete. We could click install update, and that will drag me right on over to example.com. Cutesy, silly, neat-o, maybe that attacker-controlled site could be something that you do some more shenanigans with. Or, just for the sake
11:57of our learning, let's do a little dismiss button where the activation type is instead system, and we could just make the action or argument to be dismiss. Nothing fancy there, that just closes out the pop-up notification. Now, because the arguments here are handled by a Windows protocol, you can't just as easily try to run some command, right?
12:19To detonate or fire off cmd.exe or PowerShell or mshta or things that might give you a little bit more. You could, if you totally wanted to, have things that work with a protocol handler. So, just silly stupid dumbo, we could see calculator pop. And if you were on an old machine where like MSDT, the Microsoft Deployment Toolkit, didn't
12:38have the patch fix from sometime ago, maybe you could get code execution that way. We could play with creating our own protocol handler though, since this is all working off the assumption that look, you have code execution. You are running locally on the target of the victim computer. Let me keep playing though. Like, I want to show you a
12:56couple other things you could do from here. You can customize this. Let's say like, "Hey, someone sent you a message." And we could modify the hint style so that some of the text that you supply could actually look like a subtitle. Maybe you put this into Microsoft Teams or Slack, Discord, whatever. We can even add an image here. And you can have a
13:17lot of flexibility in where you can put different pictures or images in the toast notification. Like, we could even override the application logo. We could add a sort of crop here to make it look like a circle surrounding it. So, it's a regular old person profile picture. And I have not yet played with if we could put the source in like a base 64
13:37embedded thing, so it remains self-contained. But again, if you're working off the operation oh, you own this machine already or you've got local access, you could stage or put any other files you want on there. Let me get Nam Sack as a good picture to use. We'll put him as ben.jpeg. That's fine. Now, back in our actions, we could actually put a
13:55little input field like a text entry to look like oh, we're sending a message right there and then. You can add an ID there if you want to keep track of it for any other display or formatting after the fact. Just kind of giving it a name, but then you could actually control whether this is just a text
14:09entry or even like a select drop down. And we could have a placeholder there, so it looks like an input. Remember, we should be closing out with our forward slashes. I almost missed it on that one just above. Now, let's add an action. Let's do just another quick open the browser, but we could even add a another
14:28hint now for an input ID that we might tie a button like send to. We can put that for the reply text input, right? And we'll add another button just to simply dismiss. How about that? Remember, that should be a system activation type. And for the end, we can just simply say dismiss. Fingers crossed. Let me F5 this.
14:49Ooh. Again, say you put Microsoft Teams, Discord, Slack. The handler for you sending any input does need to be managed via COM, like the Component Object Model stuff in Windows. I don't think we need to fall down the rabbit hole in that direction. Like right now, obviously, clicking send, it doesn't know what to do with it. I'll leave that
15:10as an exercise for the reader. But again, with this setup, you could add progress bars or drop down select choices. We don't have to crop it as a circle if if want to make something look like a real application icon. We could even add like a hero image. So, there's a big banner just at the very top.
15:28Placement can be hero. We don't need a crop here, but let me find a funny picture. Cat meme. What do we got here? Uh oh. Oh oh, we got to get that one. All right, can I save that? cat.png. Go. Anyway, there are a lot more things you
15:48can do with this with the Windows and Microsoft documentation. I'll include a link to all of these in the video description down below so that you could see how else you could manipulate, tweak, experiment, and play with some of the toast visualizations that we're working with here. And even more of the actions that you could be able to do and
16:07run and uh configure. It's kind of fun to play around with and you can kind of make sense of the different activation types or after activation behaviors, things you could tag on to this. But, remember you kind of need to have things situated with like a protocol. So, if we wanted to get real code execution, part of me wonders if back in our PowerShell
16:26commands here, could I manipulate the registry? And I'm going to use cmd.exe DOS commands with this. I know I should be using like PowerShell commandlets, but whatever. Let's say we could add something to HKCU. And we're not going to include the colon because these are just regular CMD commands. HKCU is again your current user. So, you have
16:45privileges and permissions to be able to write to this. So, can we create our own kind of class here for a toast notification that we might want to create? Creating this thing if it doesn't exist, adding data for a URL handler. We can just say that is a new toast protocol that we create. Let's force the creation of that. Let's do the
17:07very same, specifying a value this time as not the like empty or beginning initial value, but we could say that is a URL protocol. It doesn't need any data set. We can leave that as an empty string. But now we could literally add a command to this to stage what should happen when it is invoked. That needs to
17:27be created as its own key entry with the data here. And we'll see if we can give it like a giant path to be able to have PowerShell run with the sort of handler that we could create. And I'm just putting like a our own little script to be able to play with it in C:\Windows\Tasks as just another
17:42location we could write to with the arguments being added to it so that it could genuinely run a command. We're just staging our own extra scaffolding to get code execution based off of anything that we might want to use via now a toast: protocol handler custom made that we'll create. Again, if you were to stage a whole payload to be able
18:02to build this thing, whether that's put together via ClickFix, which could include the capability to have the XML and pop-up toast notification appear, you could put this all together. Obviously, the more tweaks and modifications that we make, like even trying to drop oh a sort of handler for our protocol, even our new fake maybe our own created method to be able to get
18:23code execution reliably via just a notification, we're putting more parts and pieces breadcrumbs on the file system, right? Slapping something like this into C:\Windows\Task or anything else that you leave as artifacts on disk might not be best as the opsec for your own engagements or work if you even were to do this, right? It's fun for our learning, but I wonder
18:45if we can even get this to work now with our own custom handler. Let's change that to now be a protocol and we can just say like open. Let's make the arguments be our specific new toast protocol and we wanted maybe what? Open PowerShell was what we added support for? Ooh, two forward slashes and open-shell is what we want. So that
19:07those match. So that the handler knows how to handle the protocol handle that you create. Can I do this? Will this work? F5. Did you wire the funds? Cat picture open. Do we get PowerShell? That's kind of cool though. Now, obviously, you can tweak and tune this, right? This is just the kind of proof of concept. Do we have the capability to
19:29run code and commands? There's notepad. Remember, your payload would need to stage setting up that custom protocol handler, setting up this XML, but maybe you build this out to something kind of nifty. Maybe you fake it, make it look like cursor. Maybe you make it look like Discord or Slack or Teams or Adobe Acrobat Reader. You could fake
19:51notifications from any application you really want. I was thinking, you know, maybe it would be a cool little project to put together sort of like a WYSIWYG interface, what you see is what you get, and you could just naturally create and look at XML for building out what you wanted for your display notification. I thought maybe that'd be a cool little AI
20:08project, but look, no, uh looks like Windows already has a notifications visualizer that you could use to build something like this if you're curious. Apparently available in the Windows Store. other projects that I saw that did this just as well. Burnt Toast is apparently a module for creating and displaying toast notifications. A little bit old, but maybe still interesting if
20:29it's some other cool tools in your toolkit. We'll leave a link to that in the video description here. And of course, I want to give credit where credit is due. Kind of the idea for this video and a lot that I walked through and showcased here was truthfully from the Purple Team or ippurple.team website. Big shout out to those folks.
20:44This was kind of cool to even introduce me to a lot of some of this stuff. That provided a lot of the syntax, referenced some other tools that might be worthwhile. Folks have been building out even beacon object files to be able to do this sort of thing. They showcased a couple other directions or other ways that you could actually enumerate other
21:00model ID here. And then they go through kind of the same stuff. Realistically, I wanted to follow along with their reference and guide, but they have some with their reference and guide, but they have some neat, kind of cutesy ideas and fun stuff here. Even had a little C# capability and a .NET assembly to be able to work with this, maybe inside of
21:17a Havoc Demon or any of your own C2 tooling. So, giving them some love, big shout-out. I What I love, especially in this being purple teaming, is that they do cover a lot of the detection capabilities. Looks like Microsoft provides an ETW, or Event Tracing for Windows provider. It's a little bit limited, though. If you wanted to drill
21:35down into some of the DLLs that do actually get loaded or spawn any Sysmon event IDs or even other Windows event log notifications, you absolutely could. Looks like they have a Sigma rule here. Looks like they're tracking even things specifically in the Windows event log, or you could see stuff in registry. So, genuinely, this is the better end of the
21:53resource and reference for you. We'll absolutely be sure to include that in the video description. Big shout-out, big thanks. I think they're doing some real cool stuff. So, question for you. Would you trust a notification from your computer and your installed applications, and maybe they tweak and tune, oh, I don't know, maybe Google Chrome says your cache is corrupted and
22:14you got to run whatever tool. Claude Code Codex, whatever AI thing says, "I am done. I finished the work." and you click into it to get back in action. What if it was a lie? What if some hackers got in the middle of it? Because, yes, they totally can. You can just fake notifications from other applications. Thanks so much for
22:30watching, everybody. Please do give some love to our sponsors, link below in the video description. Please do all those YouTube algorithm things, like, comment, subscribe, and I'll see you in the next video.