PowerPoint — CraftedSignal Threat Feed

XSL Script Execution via COM Interface in Microsoft Office

hello@craftedsignal.io — Fri, 26 Jan 2024 18:22:00 +0000

Attackers are increasingly leveraging the Microsoft.XMLDOM COM interface in Microsoft Office applications to execute malicious scripts. This technique involves embedding malicious JScript or VBScript within XSL transformations, which are then processed by Office applications like Word, Excel, PowerPoint, and Publisher. The exploitation begins when a user opens a specially crafted document. This campaign abuses legitimate functionalities for malicious purposes. This technique can be used for initial access, defense evasion, and execution of arbitrary code. The observed behavior includes the loading of msxml3.dll and the spawning of child processes.

Attack Chain

A user receives a phishing email containing a malicious Office document.
The user opens the document in Microsoft Word (winword.exe), Excel (excel.exe), PowerPoint (powerpnt.exe), or Publisher (mspub.exe).
The Office application loads msxml3.dll to process XML content within the document.
The document contains an embedded XSL script with malicious JScript or VBScript code.
The XSL transformation is initiated, executing the embedded script via the COM interface.
The script spawns a new process (cmd.exe, powershell.exe, or mshta.exe) to execute arbitrary commands.
The spawned process downloads and executes a payload from a remote server.
The payload establishes persistence, escalates privileges, and performs malicious activities such as data exfiltration or lateral movement.

Impact

Successful exploitation can lead to arbitrary code execution, potentially compromising sensitive data and allowing attackers to gain initial access to the targeted system. This can result in data breaches, financial losses, and reputational damage. The scope of impact includes any Windows systems running vulnerable versions of Microsoft Office. If successful, the attacker can achieve persistence, perform lateral movement and compromise other systems on the network.

Recommendation

Deploy the Sigma rule “XSL Script Execution via COM” to your SIEM to detect the execution of hosted XSL scripts using the Microsoft.XMLDOM COM interface.
Monitor for the loading of msxml3.dll by Microsoft Office applications and subsequent process creations to identify potential exploitation attempts.
Implement application whitelisting to restrict the execution of unauthorized scripts and executables, particularly those not located in standard directories.
Block the execution of unusual or unsigned child processes spawned by Microsoft Office applications to prevent malicious script execution.
Educate users about the risks of opening suspicious attachments or clicking on links in phishing emails (T1566).

Suspicious Image Load (taskschd.dll) from MS Office

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection rule identifies a suspicious image load (taskschd.dll) originating from Microsoft Office applications (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, MSPUB.EXE, MSACCESS.EXE). The behavior suggests potential adversarial activity involving the creation of scheduled tasks through the Windows Component Object Model (COM). Attackers may exploit this technique to establish persistence, circumventing traditional monitoring focused on the schtasks.exe utility. The use of COM for scheduled task management allows for stealthier operation and evasion of standard security controls, making it a valuable persistence mechanism for malicious actors. The rule is designed for data generated by Elastic Defend, Sysmon, and other endpoint detection platforms.

Attack Chain

User opens a malicious Microsoft Office document (e.g., Word, Excel).
The document executes embedded macro code or exploits a vulnerability.
The macro or exploit leverages the Component Object Model (COM).
The Office application (e.g., WINWORD.EXE) loads the taskschd.dll library, providing access to the Task Scheduler service.
The COM interface is used to programmatically create a new scheduled task.
The scheduled task is configured to execute a malicious payload at a later time or on a recurring basis.
The malicious payload could be a script, executable, or command-line instruction.
Upon execution, the payload achieves the attacker’s objective, such as establishing persistence, downloading additional malware, or compromising the system.

Impact

A successful attack leveraging this technique can allow adversaries to maintain persistent access to a compromised system. This can lead to long-term data exfiltration, lateral movement within the network, and deployment of ransomware. The low severity score assigned to the original rule may underestimate the potential impact, as persistence is a critical component of many advanced attacks. Affected systems may require extensive remediation to remove all traces of the malicious activity.

Recommendation

Deploy the Sigma rule “Office Application Loading Task Scheduler DLL” to your SIEM and tune for your environment to detect this specific activity.
Enable Sysmon Event ID 7 (Image Loaded) logging on Windows endpoints to provide visibility into DLL loading events, which is a prerequisite for the Sigma rule.
Investigate any alerts generated by the Sigma rule, focusing on the specific scheduled tasks that are created and the payloads they execute.
Monitor for scheduled task creation events (Event ID 4698) and deletion events (Event ID 4699) in the Windows Event Logs, as referenced in the rule’s investigation guide.

Suspicious Command Prompt Network Connection

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This detection identifies suspicious network connections initiated by the command prompt (cmd.exe) on Windows systems. The rule focuses on cmd.exe processes executed with specific arguments, such as those indicating script execution (e.g., *.bat, *.cmd), access to remote resources (e.g., URLs), or those spawned by Microsoft Office applications (Excel, Word, etc.). Attackers frequently abuse cmd.exe to download malicious payloads, execute commands, or establish command and control channels. This detection aims to identify such potentially malicious activity by correlating process creation events with subsequent network connections. The rule excludes common private and reserved IP address ranges to reduce false positives. The targeted systems are Windows endpoints where adversaries attempt to leverage cmd.exe for malicious purposes.

Attack Chain

A user opens a malicious document (e.g., Word, Excel) or executes a seemingly benign application.
The document or application contains a macro or script that initiates a cmd.exe process.
The cmd.exe process is launched with arguments indicating script execution (/c, /k) and referencing a remote resource (e.g., a URL) or a local batch file.
The cmd.exe process attempts to download a payload from a remote server using protocols like HTTP, HTTPS, or FTP.
The downloaded payload is saved to disk, often with a disguised filename.
The cmd.exe process executes the downloaded payload, initiating further malicious actions.
The malicious payload establishes a command and control (C2) channel with a remote server.
The attacker uses the C2 channel to send commands to the compromised system, potentially leading to data exfiltration or other malicious activities.

Impact

Successful exploitation can lead to the compromise of Windows endpoints, potentially enabling attackers to download and execute malicious payloads, establish command and control channels, and perform further malicious activities such as data theft, lateral movement, or ransomware deployment. While this detection has a low severity, it serves as an early warning sign of potential compromise and should be investigated promptly.

Recommendation

Enable process creation logging with command line arguments to capture the full context of cmd.exe executions.
Monitor network connections from cmd.exe processes, focusing on connections to external IP addresses, using a network monitoring solution.
Deploy the Sigma rules provided in this brief to your SIEM to detect suspicious cmd.exe network connections.
Investigate any alerts generated by the Sigma rules, focusing on cmd.exe processes spawned by Office applications or those executing scripts from remote URLs.