Know Your Adversary

Hello everyone! What do you know about macOS stealers? Looks like one can buy it on underground resources. And yes, we're seeing it in-the-wild more and more often! But we are interested in detection opportunities, of course! Let's look at a report published by Unit42. There's an overview of three stealers: Atomic Stealer, Poseidon Stealer and Cthulhu Stealer. If we look through the report, we can see a very distinct feature: all of them abuse AppleScript to obtain the victims' password! So, what to look for? Look for osascript executions with  display dialog and password in the command line! That's it! That easy! See you tomorrow!

Hello everyone! Let's talk about Hex Staging technique. I saw it in Unit42 report on  CL-STA-0048 .  So, a threat actor incrementally writes hex-encoded data into a temporary file piece by piece, and evades defenses this way. For example: cmd.exe /c >> "path_to_temp_file" set /p="hex_encoded_data" To decode the hex data back into ASCII, the adversary leveraged certutil, for example: cmd.exe /c certUtil -decodehex "path_to_temp_file" "path_to_decoded_file" As you can see, detecting it is quite easy: Look for cmd.exe executions with " set /p= " in arguments Look for certutil.exe executions with " -decodehex " Make sure you've checked the report - there're lots of interesting techniques inside! See you tomorrow!