Know Your Adversary

Hello everyone! Attackers are increasingly using legitimate web services to host malicious files, and today we'll take a look at another example: Storj. According to this report, the attackers used malvertising to distribute the OXLOADER loader. To host the malicious payloads, they relied on the Storj service, for example: link[.]storjshare[.]io/raw/jwwvr4oskkkjsgevt774ta62ehya/ruslan/aBsvwbdas.exe As with other services of this kind, you can look for suspicious interactions with them using a query like: event_type: "dnsreq" AND dns_rname: "storjshare.io" Or you can simply block access to the service altogether - in that case, users won't be able to download the malicious files. See you soon!

Hello everyone!  Let's take a look at another example of how threat actors use interesting folders for masquarading as part of the Match Legitimate Resource Name or Location (T1036.005) technique.  Today's example is SmartRAT . If we look at the report, we'll immediately notice that the malware actively uses the following folders:  %APPDATA%\Microsoft\Diagnosis\ETW\  %ProgramData%\Microsoft\Diagnosis\ETW\  For example, the malware could create a service using the following command: "C:\Windows\system32\sc.exe" create MicrosoftEdgeUpdateCore binPath= "C:\ProgramData\Microsoft\Diagnosis\ETW\MicrosoftEdgeUpdateCore.exe" start= auto obj= LocalSystem DisplayName= "Windows Diagnostics ETW Service"  These are certainly not the most common locations for malware deployment, which makes them good candidates for threat hunting:  event_type: "processcreatewin" AND proc_file_path: "Microsoft\\Diagnosis\\ETW" See you soon!

Hello everyone! Today we'll talk about stealth and persistence in a compromised system, focusing on the following technique: Hidden Window (T1564.003) . I'm sure that searching for suspicious values in the Run registry key is part of your Threat Hunting routine. But sometimes attackers, while trying to stay hidden, actually help us detect malicious activity. For example, EtherRAT wrote to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth the following value: "C:\Windows\System32\conhost.exe" --headless "C:\Users\Bruno\AppData\Local\Adobe\Components\e8b3\node-v18.17.0-win-x64\node.exe" "C:\Users\Bruno\AppData\Local\Adobe\Components\e8b3\97f04949151a3819.js" As you can see, the attackers used conhost.exe with the --headless parameter to hide the window. But how often would such a command chain be legitimately written to the Run key? Of course, almost never. That gives us another detection opportunity: event_type: ...

Hello everyone! To be honest, after nearly 400 posts, finding something interesting in public reports has become a bit more challenging. Nevertheless, it’s still possible, and today we’ll once again talk about Exfiltration to Cloud Storage (T1567.002) . This time, the post is sponsored by our partners at Akira , and the following excerpt from a report caught my attention: “Next, the threat actor used the Microsoft Edge browser to access Bing, and search for the term ‘eayupload’ before settling on Easyupload.io, a website that provides access to file uploads via drag-and-drop.” As you can see, the attackers used yet another cloud storage service to upload the data they had collected. Access to such services can be proactively blocked, or you can monitor for suspicious connections to them: event_type: "dnsreq" AND dns_rname: "easyupload.io" Attackers are increasingly relying on legitimate tools and services, so understanding exactly which ones they may use can become...