Threat briefs

Snake malware modifies the .wav\OpenWithProgIds registry path to facilitate the decryption of configuration blobs used by WerFault.exe to load malicious kernel drivers.

Snake Malware utilizes the creation of a specifically named file, 'comadmin.dat', within the system32\Com directory to facilitate the installation and loading of a malicious kernel driver for persistence and privilege escalation.

The Snake malware utilizes the Windows Registration directory to store operational .crmlog files, enabling persistence and configuration management for its malicious activities.

Adversaries frequently terminate security and system services using built-in utilities to facilitate ransomware deployment, evade defensive monitoring, and disrupt organizational operations.

RemCom is an open-source tool functionally similar to PsExec, frequently abused by threat actors to perform lateral movement and remote command execution within Windows environments.

Detection of unauthorized Windows service configuration via modification of registry ImagePath values, a common technique for persistence, privilege escalation, and lateral movement by various threat actors.

Attackers leverage legitimate Windows binaries like reg.exe and regedit.exe to export sensitive SAM, SECURITY, and SYSTEM hives for offline credential theft and lateral movement.

Adversaries, including those deploying Lumma Stealer via fake CAPTCHA campaigns, utilize the Windows RunMRU registry key to execute malicious commands while masking activity as legitimate user behavior.

Adversaries utilize the sc.exe utility to create services on remote Windows endpoints to establish persistence, escalate privileges, or facilitate lateral movement.

Adversaries modify SafeBoot registry keys to ensure malicious drivers or services execute during Safe Mode, enabling persistence and bypassing standard startup security.

This brief outlines the detection of unauthorized root CA certificate installation in the Windows Registry, a technique used to facilitate man-in-the-middle attacks and bypass encrypted communication security.

Threat actors, including Volt Typhoon, modify Windows registry keys to configure PortProxy via netsh, enabling persistent network traffic redirection and potential command-and-control.

The Volt Typhoon group utilizes the Windows netsh utility to establish covert network proxies, enabling persistence and traffic redirection through the portproxy interface.

This brief documents the use of the PowerView PowerShell cmdlet Get-DomainSPNTicket to conduct Kerberoasting, a technique that extracts Kerberos service tickets for offline password cracking.

Adversaries leverage the Export-PfxCertificate PowerShell cmdlet to exfiltrate sensitive certificates from the Windows Certificate Store, enabling credential theft and impersonation.

Adversaries may leverage the PowerShell cmdlet 'Export-Certificate' to exfiltrate cryptographic material from the Windows Certificate Store, enabling impersonation and decryption of sensitive data.

This analytic identifies potential credential dumping by detecting unauthorized processes requesting suspicious access masks to the Local Security Authority Subsystem Service (LSASS).

Malware utilizes parent process spoofing by spawning an instance of explorer.exe with the /root command-line argument to evade security monitoring and obscure process lineage.

Attackers may modify Outlook registry keys related to WebView and Today features to redirect web-based components to malicious URLs, facilitating phishing and credential theft.

Attackers are abusing the legitimate Windows utility odbcconf.exe to execute arbitrary code or load malicious DLLs by utilizing response files to bypass security controls.

Attackers are abusing the legitimate Windows utility odbcconf.exe to load arbitrary DLLs via the regsvr action, enabling defense evasion and unauthorized code execution.

Attackers frequently abuse the legitimate, signed Windows utility Odbcconf.exe to execute arbitrary code or load malicious DLLs, facilitating defense evasion and persistence.

Threat actors leverage the legitimate NirSoft AdvancedRun utility to perform remote code execution, privilege escalation, and persistence on Windows systems.

Attackers modify the 'ChannelAccess' registry value to restrict event log visibility and evade detection, a technique observed in ransomware campaigns like LockBit.

Attackers are modifying the 'CustomSD' registry value in Windows EventLog channels to restrict access to logs and blind security monitoring capabilities.

Attackers utilize the Windows 'net' utility to discover and enumerate network shares as a precursor to lateral movement, privilege escalation, or data exfiltration.

This brief outlines the detection of 'net start' usage, a technique frequently leveraged by threat actors for system discovery and situational awareness during the reconnaissance phase of an intrusion.

Adversaries abuse the msiexec.exe /z parameter to unregister DLLs, facilitating defense evasion and disruption of security controls.

This brief details the abuse of the Windows utility msiexec.exe by attackers to download and execute remote files via HTTP or HTTPS URLs, often leading to unauthorized code execution, system compromise, or further malware deployment.

Adversaries abuse the msiexec.exe /y command-line switch to trigger the DLLRegisterServer function, facilitating malicious DLL loading for defense evasion and persistence.