IcedID — CraftedSignal Threat Feed

Windows Defender MpEngine Disabled via Registry Modification

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

Attackers, particularly those associated with IcedID campaigns, may attempt to disable Windows Defender to evade detection. This involves modifying the MpEnablePus registry value within the Windows Defender MpEngine settings, specifically setting it to 0x00000000. This action effectively disables key features of Windows Defender, creating a window of opportunity for malware to execute undetected. The observed registry modification is a strong indicator of malicious intent, allowing attackers to gain a foothold and further compromise the system. The DFIR Report has documented instances of this technique being used in conjunction with IcedID leading to XingLocker ransomware deployment.

Attack Chain

Initial access is gained through an unknown method (e.g., phishing, exploit).
The attacker obtains elevated privileges on the compromised system.
The attacker modifies the registry value MpEnablePus to 0x00000000 under the path HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine.
This registry change disables key Windows Defender features, weakening the endpoint’s defenses.
The attacker deploys malware, such as IcedID, which can now operate with reduced interference from the disabled security product.
The malware establishes persistence through various mechanisms (e.g., scheduled tasks, registry run keys).
The attacker performs reconnaissance to identify valuable data and systems within the network.
The attacker moves laterally to other systems, potentially deploying ransomware such as XingLocker.

Impact

Successful disabling of Windows Defender can lead to widespread malware infection and data compromise. Organizations may experience data breaches, financial losses, and reputational damage. The IcedID malware has been linked to XingLocker ransomware deployment, demonstrating the potential for significant impact following a successful attack. Disabling Windows Defender increases the dwell time of attackers and the likelihood of successful lateral movement and data exfiltration.

Recommendation

Enable Sysmon EventID 13 to capture registry modifications on endpoints.
Deploy the Sigma rule “Detect Defender MpEngine Disabled via Registry Modification” to identify suspicious registry changes related to Windows Defender.
Investigate any alerts generated by the Sigma rule, prioritizing systems where other suspicious activities have been observed.
Ensure Sysmon TA version 2.0 or higher is installed for accurate registry monitoring.
Review and harden Windows Defender configuration policies to prevent unauthorized modifications of critical settings.

Suspicious WMIC Application Uninstallation

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection focuses on the abuse of Windows Management Instrumentation Command-line (WMIC) to uninstall applications in a non-interactive manner. This technique is often employed by threat actors, including IcedID, to disable or remove security software, such as antivirus solutions, in order to evade detection and establish a stronger foothold within a compromised environment. This activity is often seen post-compromise, after initial access has been established, and is used to further the attacker’s objectives. The use of the /nointeractive flag is a key indicator of this malicious activity. This behavior is significant because it allows attackers to disable security defenses, facilitating further compromise and persistence within the environment.

Attack Chain

Initial access is gained through a phishing campaign or other exploit.
The attacker executes a malicious payload on the victim machine.
The payload establishes persistence and elevates privileges.
WMIC is invoked via wmic.exe with parameters to enumerate installed products.
The attacker uses the product argument with a where name clause to identify target applications.
WMIC is then used with the call uninstall command to remove the target application.
The /nointeractive flag is used to suppress prompts and execute the uninstall silently.
Security software is disabled, allowing for further malicious activity.

Impact

Successful execution of this attack results in the removal of security software, such as antivirus or endpoint detection and response (EDR) agents, which significantly reduces the victim’s ability to detect and respond to the compromise. As seen in the IcedID campaign, this can lead to rapid escalation, such as ransomware deployment within 24 hours. This can affect any Windows environment where WMIC is accessible, potentially impacting organizations of any size.

Recommendation

Deploy the Sigma rule Suspicious WMIC Product Uninstall via CommandLine to detect non-interactive uninstallation attempts.
Investigate any process that spawns wmic.exe with arguments containing product, where name, call uninstall, and /nointeractive, as highlighted in the rule description.
Ensure endpoint detection and response (EDR) agents are configured to log process command-line arguments, which is required for the detection to function correctly.
Review and harden endpoint security policies to restrict the use of WMIC where possible.
Monitor parent processes of wmic.exe to identify potential malicious origins.
Whitelist legitimate uses of wmic.exe for application uninstallation, based on parent process and command line, to reduce false positives.

Scheduled Task Disablement via Schtasks.exe

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

Attackers, including malware such as IcedID, frequently disable scheduled tasks as a means of evading detection and maintaining persistence. This technique involves using the schtasks.exe utility with the /change and /disable parameters. By disabling scheduled tasks, adversaries can disrupt security applications, prevent routine system maintenance, and prolong their access to compromised systems. This activity allows attackers to operate undetected, disable critical security defenses, and further compromise the targeted host. The initial report surfaced on October 18, 2021, highlighting the use of this technique in conjunction with the IcedID malware leading to XingLocker ransomware deployment.

Attack Chain

Initial compromise of the host via an unspecified method (e.g., phishing, exploit).
The attacker gains initial access and executes code on the target system.
The attacker identifies scheduled tasks to disable, often targeting security applications or system maintenance tasks.
The attacker executes schtasks.exe with the /change parameter to modify the task configuration.
The attacker uses the /disable parameter with schtasks.exe to deactivate the targeted scheduled task. For example: schtasks /change /tn "Security Scan" /disable.
The disabled task no longer runs, allowing the attacker to bypass its functionality.
The attacker maintains persistence and evades detection by preventing security scans and updates.
The attacker proceeds with further malicious activities, such as data theft or ransomware deployment.

Impact

Successful disabling of scheduled tasks can lead to the compromise of critical security defenses. The IcedID malware, for example, has been observed using this technique as a precursor to XingLocker ransomware deployment. This can affect any organization relying on scheduled tasks for security and system maintenance, leading to potential data breaches, system instability, and financial losses. The number of victims can vary depending on the scope of the initial compromise and the effectiveness of the attacker’s lateral movement.

Recommendation

Deploy the Sigma rule Detect Schtasks Disable to your SIEM and tune for your environment to detect schtasks.exe being used to disable tasks.
Enable Sysmon process-creation logging (Event ID 1) and Windows Event Log Security (4688) to activate the Sigma rule.
Investigate any alerts generated by the Sigma rule, prioritizing systems known to host critical applications or data.
Review scheduled task configurations for unexpected changes or disabled tasks.
Implement endpoint detection and response (EDR) solutions that provide visibility into process execution and command-line arguments.
Ensure that all systems have up-to-date security patches and antivirus definitions to prevent initial compromise.