https://feed.craftedsignal.io/products/microsoft-powershell/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 01 Nov 2024 12:00:00 +0000https://feed.craftedsignal.io/briefs/2024-11-abused-web-services/Fri, 01 Nov 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-11-abused-web-services/Suspicious processes on Windows hosts are making DNS queries to known, abused web services such as text-paste sites, file sharing platforms, and tunneling services, potentially indicating malware downloading or command and control activity.This threat brief highlights the use of legitimate web services for malicious purposes. Attackers often leverage these services to host malware, exfiltrate data, or establish command and control (C2) channels. This activity focuses on detecting suspicious processes making DNS queries to domains associated with services like pastebin.com, mediafire.com, and ngrok.io. These services are abused due to their widespread use and the trust often placed in them, making it easier for attackers to blend in with normal network traffic. The increased use of such services in malicious campaigns necessitates proactive detection and monitoring. The scope of targeting includes any Windows endpoint within an organization's network. This activity is commonly seen across various malware families.

Attack Chain

1. A user clicks a malicious link or opens a compromised document (not directly observed in source).
2. The compromised document executes a malicious script, such as PowerShell, via cmd.exe.
3. The script initiates a DNS query to a known, abused web service, like pastebin.com, using Windows DNS client.
4. The attacker retrieves a payload or configuration from the web service via HTTP or HTTPS.
5. The script downloads and executes the payload in memory or on disk.
6. The payload establishes persistence and begins beaconing to a command-and-control server, potentially using ngrok.io for tunneling.
7. The attacker uses the C2 channel to send commands and exfiltrate sensitive data or deploy additional malware.
8. The attacker achieves their final objective, such as data theft, ransomware deployment, or system compromise.

Impact

Successful exploitation can lead to various detrimental outcomes. Malware infections can disrupt business operations, resulting in financial losses and reputational damage. Data exfiltration can compromise sensitive information, leading to legal and regulatory penalties. Ransomware deployment can encrypt critical files, holding the organization hostage. The wide range of services abused makes detection challenging but crucial. The impact can range from a single compromised host to a full-scale network breach.

Recommendation

• Enable Sysmon Event ID 22 (DNS Query) logging to capture DNS query events (reference: description, search query).
• Deploy the Sigma rules provided in this brief to your SIEM and tune them based on your environment's baseline (reference: rules).
• Review and update firewall rules to restrict access to known abused web services if they are not required for business operations (reference: iocs).
• Investigate any alerts generated by these rules to identify and remediate potentially compromised hosts (reference: rules).

]]>highadvisoryabused-web-servicescommand-and-controlwindowshttps://feed.craftedsignal.io/briefs/2024-01-09-powershell-obfuscation/Tue, 09 Jan 2024 14:30:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-09-powershell-obfuscation/This rule detects potential PowerShell obfuscated scripts by identifying script blocks with high entropy and non-uniform character distributions, which attackers use to evade signature-based detections.Attackers often obfuscate PowerShell scripts using encoding, encryption, or compression to evade signature-based detections and hinder manual analysis. This technique allows malicious actors to hide their code's true intent, making it difficult for security analysts to identify and understand the script's behavior. This detection identifies PowerShell script blocks with high entropy and non-uniform character distributions, characteristics that are common in obfuscated scripts. The rule focuses on statistical anomalies in PowerShell script blocks. It checks for large script blocks (over 1000 characters) with high entropy (>= 5.5 bits) and significant surprisal standard deviation (> 0.7). Note that legitimate scripts can trigger this alert when they embed packed data (e.g., compressed resources).

Attack Chain

1. An attacker gains initial access to a Windows system (e.g., via phishing or exploiting a vulnerability).
2. The attacker uploads or creates a PowerShell script on the target system.
3. The PowerShell script is obfuscated using techniques such as Base64 encoding, gzip compression, or encryption algorithms.
4. The obfuscated script is executed via powershell.exe.
5. The script decodes, decrypts, or decompresses the malicious payload in memory.
6. The payload is executed, performing actions such as establishing persistence, downloading additional malware, or exfiltrating data.
7. The attacker leverages the established foothold for lateral movement within the network.
8. The final objective is achieved (e.g., data theft, ransomware deployment).

Impact

Successful obfuscation allows attackers to bypass traditional signature-based security controls. This can lead to undetected malware infections, data breaches, and system compromise. The impact includes potential data theft, system disruption, and financial loss. While the number of victims and specific sectors targeted are unknown, the widespread use of PowerShell makes this a broadly applicable threat.

Recommendation

• Enable PowerShell Script Block Logging to generate the necessary events (4104) for this detection. Reference: https://ela.st/powershell-logging-setup
• Deploy the Sigma rule "Detect Obfuscated PowerShell Script via High Entropy" to your SIEM and tune the threshold values (powershell.file.script_block_length, powershell.file.script_block_entropy_bits, powershell.file.script_block_surprisal_stdev) to match your environment.
• Investigate any alerts triggered by the Sigma rule, focusing on execution context, script content, and initiating source as detailed in the rule's description.
• Review file.path (if present) to determine the script's origin and legitimacy.
• Implement endpoint detection and response (EDR) solutions to monitor for post-execution activity, such as suspicious network connections and file modifications.
• Block execution of PowerShell scripts from unusual file directories (user-writable or temporary locations).

]]>mediumadvisorypowershellobfuscationdefense_evasionwindows