Opera — CraftedSignal Threat Feed

Suspicious Child Processes from Communication Applications

hello@craftedsignal.io — Wed, 31 Jan 2024 12:00:00 +0000

This detection rule focuses on identifying suspicious child processes of communication applications such as Slack, Cisco Webex, Microsoft Teams, Discord, WhatsApp, Zoom, and Thunderbird on Windows operating systems. Attackers may attempt to masquerade as legitimate processes or exploit vulnerabilities in these applications to execute malicious code. The rule monitors for the creation of child processes by these communication apps and checks if those child processes are unexpected, untrusted, or lack a valid code signature. This detection is crucial because successful exploitation can lead to unauthorized access, data exfiltration, or further compromise of the system. The rule has been actively maintained since August 2023, with updates as recent as May 2026, indicating its relevance and ongoing refinement to address emerging threats.

Attack Chain

User launches a communication application (e.g., Slack, Teams, Webex).
The communication application executes a vulnerable or compromised component.
The compromised component spawns a child process (e.g., powershell.exe, cmd.exe).
The child process executes a malicious command or script.
The script attempts to download additional payloads from an external source.
The payload executes, establishing persistence through registry modification or scheduled tasks.
The attacker gains remote access to the system.
Data exfiltration or lateral movement within the network occurs.

Impact

A successful attack can lead to the compromise of sensitive data, installation of malware, and potential lateral movement within the organization’s network. By exploiting communication applications, attackers can gain access to internal communications, confidential documents, and user credentials. The number of affected users and the extent of the damage depend on the compromised application and the attacker’s objectives. If successful, this attack may lead to significant financial loss, reputational damage, and disruption of business operations.

Recommendation

Deploy the Sigma rule Suspicious Communication App Child Process to your SIEM to detect anomalous child processes spawned by communication applications and tune for your environment.
Enable process creation logging with command line arguments in Windows to ensure that the Sigma rule has the necessary data to function correctly (logsource: process_creation, product: windows).
Investigate any alerts generated by the rule and review the command line arguments of the spawned processes to identify potential malicious activity.
Implement application whitelisting to restrict the execution of unauthorized applications and reduce the attack surface.
Ensure that all communication applications are updated to the latest versions to patch known vulnerabilities and reduce the risk of exploitation.
Examine the network activity of the affected system to identify any suspicious outbound connections that may indicate data exfiltration or communication with a command and control server, referencing the setup guide.

Detection of Command and Control Activity via Commonly Abused Web Services

hello@craftedsignal.io — Thu, 04 Jan 2024 12:00:00 +0000

Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in. This detection focuses on identifying connections from Windows hosts to a predefined list of commonly abused web services from processes running outside of typical program installation directories, indicating a potential C2 channel leveraging legitimate services. The rule aims to detect this behavior by monitoring network connections and DNS requests originating from unusual locations.

Attack Chain

Initial access is achieved via an unknown method (e.g., phishing, exploit).
Malware is installed on the victim’s system, likely outside typical program directories.
The malware establishes a DNS connection to a commonly abused web service (e.g., pastebin.com, raw.githubusercontent.com) to obscure C2 traffic.
The malware sends encrypted or encoded commands to the web service.
The web service acts as an intermediary, relaying the commands to the attacker’s C2 server.
The C2 server responds with instructions, which are then relayed back to the compromised host through the same web service.
The malware executes the received commands, potentially leading to data exfiltration, lateral movement, or other malicious activities.
The attacker maintains persistent access and control over the compromised system using the web service as a hidden C2 channel.

Impact

Successful exploitation can lead to data theft, system compromise, and further propagation within the network. Since commonly used web services are utilized, the malicious activity can blend in with legitimate network traffic, making it difficult to detect. The impact can range from minor data breaches to complete network compromise, depending on the attacker’s objectives and the level of access gained.

Recommendation

Deploy the Sigma rule Detect Commonly Abused Web Services via DNS to your SIEM to identify suspicious DNS queries to known C2 web services originating from anomalous processes.
Enable DNS query logging on Windows endpoints to provide the data source required for the Sigma rule.
Review network connection logs for processes outside standard installation directories communicating with domains listed in the query section of the Sigma rule to identify potential C2 activity.
Implement network segmentation to limit the potential impact of compromised hosts.

Detection of Command and Control Activity via Common Web Services

hello@craftedsignal.io — Wed, 03 Jan 2024 15:00:00 +0000

This detection rule, sourced from Elastic, identifies potential command and control (C2) activity by detecting connections to commonly abused web services. Adversaries often leverage popular web services like pastebin, GitHub, Dropbox, and Discord to mask malicious communications within legitimate network traffic. This technique makes it challenging for defenders to distinguish between normal user activity and malicious C2 traffic. The rule focuses on Windows systems and monitors DNS queries to identify processes communicating with a predefined list of services known to be abused by attackers. The rule was last updated on 2026-05-04 and is designed to work with data from Elastic Defend and SentinelOne Cloud Funnel. The goal is to identify anomalous network connections originating from unusual processes.

Attack Chain

A user on a Windows host unknowingly executes a malicious file (e.g., via phishing or drive-by download).
The malicious file executes a process outside of typical program directories (e.g., C:\Windows\Temp).
This process initiates a DNS query to a domain associated with a commonly abused web service (e.g., pastebin.com, githubusercontent.com).
The DNS query resolves to an IP address, and a network connection is established to the web service.
The malicious process uploads or downloads data from the web service, potentially containing commands for the compromised host or exfiltrated data.
The web service acts as an intermediary, relaying commands from the attacker to the compromised host or exfiltrated data from the compromised host to the attacker.
The attacker uses the C2 channel to perform further actions on the compromised host, such as lateral movement or data theft.

Impact

A successful attack using common web services for C2 can lead to data exfiltration, system compromise, and further propagation within the network. The low severity suggests a focus on detecting early-stage C2 activity, which if left unchecked, could escalate into a significant incident. The usage of popular web services makes detection difficult, requiring careful analysis and tuning to avoid false positives.

Recommendation

Deploy the Sigma rule “Connection to Commonly Abused Web Services” to your SIEM and tune it for your environment to minimize false positives.
Enable Sysmon DNS query logging to accurately capture DNS requests for improved detection capabilities, activating the “DNS Query to Commonly Abused Web Services” rule.
Investigate any alerts generated by this rule, focusing on the process execution chain and network connections to determine the legitimacy of the activity, referencing the investigation steps described in the rule documentation.
Review and update the list of excluded processes in the Sigma rule to reflect your organization’s approved software and reduce false positives.