Posts

410. Adversaries Want to Be Stealthy, But Make More Noise

Image
Hello everyone! Today, let’s look at an example of how attackers’ attempts to get rid of artifacts can actually add more noise. Moreover, this is a very common example. Our source is a Zscaler report on the new modular remote access trojan Abyssos. Despite being new, the trojan uses a huge number of well-known techniques. For example, as part of implementing the File Deletion technique (T1070.004), the malware executes the following command: cmd.exe /C ping 127.0.0.1 -n 3 >nul & del /F /Q path_to_file Although the malicious file is deleted in this case, the structure of the command is quite distinctive, giving us an opportunity for detection: event_type: "processcreatewin" AND proc_file_path: "cmd.exe" AND cmdline: ("ping" AND "del") Moreover, this is far from the first sample exhibiting a similar behavioral marker, allowing us to detect not only this particular family but many others as well. See you soon!
Post a Comment
Read more

409. Adversaries Abuse Localhost[.]run for Tunneling

Image
Hello everyone! Tunnels. Attackers are coming up with more and more ways to implement them. Today, we’ll take another look at the Protocol Tunneling technique (T1572) . There are plenty of free tunneling services that allow a local service to be exposed to the internet through a public URL. For example, attackers often use Cloudflare Tunnel. However, according to this report , threat actors also used localhost [.] run . You can detect traces of its use, for example, by monitoring communications with lhr [.] life subdomains: event_type: dnsreq* AND dns_rname: "lhr.life" See you soon!
Post a Comment
Read more

408. Adversaries Disable Updates for Compromised Systems

Image
Hello everyone! Today we'll look at how threat actors interfere with updates on compromised systems as part of the Disable or Modify Tools (T1685) technique. This time, our focus is on macOS. Let's open the report on XCSSET activity and scroll to the "Impairing Defenses" section. As you can see, the threat actor uses the following commands to disable specific Apple security update mechanisms: defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist ConfigDataInstall -bool false defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AllowRapidSecurityResponses -bool false The first command disables the delivery of security data updates for XProtect, Gatekeeper, and other Apple security components. The second disables the installation of Rapid Security Responses (RSR). To detect this behavior, we can hunt for modifications to the com.apple.SoftwareUpdate.plist file performed through the defaults utility: event_type: "processcreatemac" ...
Post a Comment
Read more

407. That's How Paper Werewolf Obtains Credentials

Image
Hello everyone! Attackers are often able to extract authentication material from files, so today we'll take a look at the Credentials In Files (T1552.001) technique. According to Kaspersky's report on the activity of the GOFFEE (Paper Werewolf) cluster, the threat actors showed a strong interest in various configuration files containing sensitive information, including: cmd.exe /c type "%APPDATA%\AnyDesk\service.conf" cmd.exe /c type "%USERPROFILE%\OpenVPN\config\avia\avia.ovpn" cmd.exe /c type "%APPDATA%\Kerio\VpnClient\user.cfg" cmd.exe /c dir "%USERPROFILE%\Downloads\Telegram Desktop" Naturally, this kind of activity creates opportunities for proactive threat hunting. For example: event_type: "processcreatewin" AND proc_file_path: "cmd.exe" AND cmdline: ("type" OR "dir") AND cmdline: ("anydesk" OR "openvpn" OR "vpnclient" OR "telegram desktop") See you so...
Post a Comment
Read more

406. Threat Actors Embed Malicious HTA into LNK Files

Image
Hello everyone! Today we'll look at the Execution (TA0002) and Stealth (TA0005) tactics, along with different implementations of the PowerShell (T1059.001) , JavaScript (T1059.007) , and Mshta (T1218.005) techniques. Our examples come from this report  on the activity of Kimsuky (also tracked as Monolithic Werewolf). Let's start with the malicious shortcut files distributed by the attackers. Since the malicious code was embedded directly within the LNK file itself, mshta.exe was launched with the shortcut as its argument, giving us a useful detection opportunity: event_type: "processcreatewin" AND proc_file_path: "mshta.exe" AND cmdline: *.lnk The malicious code acted as a dropper that created the following files on the compromised system: %APPDATA%\Microsoft\Windows\Templates\Templates.js %APPDATA%\Microsoft\Windows\Templates\Templates.ps1 The first file was responsible for launching the second. In this case, we can proactively hunt for this activity by...
Post a Comment
Read more

405. Adversaries Disable Notifications to Maintain Stealth

Image
Hello everyone! It's been a while since we talked about interesting techniques involving Windows Registry modifications. Time to fix that! Today we'll take a look at Cruciferra , a crypter that was analyzed in detail by Proofpoint in a recent report . The malware modifies the following Registry values: ToastEnabled in Software\Microsoft\Windows\CurrentVersion\PushNotifications Balloon in Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ShowInfoTip in Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced These Registry values control various user notifications. By modifying them, attackers can suppress notifications displayed to the victim, including alerts generated by security software. This gives defenders several additional opportunities to detect potentially malicious activity: event_type: "registryvaluesetwin" AND reg_key_path: ("toastenabled" OR "balloon" OR "showinfotip") See you soon!
Post a Comment
Read more

404. Qilin’s Data Exfiltration Toolkit Updated

Image
Hello everyone! Today, data exfiltration has become a standard stage in almost every ransomware attack. While threat actors often rely on the same set of tools, there are occasional exceptions. According to an Arctic Wolf Labs report , operators behind the Qilin ransomware used Proton Drive for data exfiltration. Proton Drive is a cloud storage service developed by the Swiss company Proton and designed with privacy in mind. Its key feature is end-to-end encryption, meaning files are encrypted on the user's device before they are uploaded to the cloud. Of course, Proton Drive can be used legitimately within enterprise environments. However, it can also serve as an early indicator of ransomware activity, making it a useful candidate for threat hunting. event_type: "processcreatewin" AND proc_file_productname: "Proton Drive" See you soon!
Post a Comment
Read more