https://feed.craftedsignal.io/tags/cisco-nvm/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 05 Jan 2024 15:30:00 +0000https://feed.craftedsignal.io/briefs/2024-01-suspicious-file-download/Fri, 05 Jan 2024 15:30:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-suspicious-file-download/Detection of suspicious downloads from file sharing and content delivery platforms using living-off-the-land binaries (LOLBins) to identify potential initial access, payload staging, or command and control activity.This threat brief addresses the abuse of living-off-the-land binaries (LOLBins) to download malicious payloads from file-sharing websites. Attackers leverage tools like curl.exe, certutil.exe, msiexec.exe, powershell.exe, and wmic.exe to retrieve payloads from public hosting platforms such as GitHub, Discord CDN, Transfer.sh, or Pastebin. This activity often bypasses traditional security measures, blending malicious network traffic with legitimate system processes. The detection outlined here relies on Cisco Network Visibility Module logs to provide network flow activity with process context, including command-line arguments, process path, and parent process information. Identifying this behavior is crucial for preventing initial access, detecting payload staging, and uncovering command and control activities disguised as normal operations. This approach is especially relevant given the increasing sophistication of threat actors and their ability to mask malicious behavior within trusted system processes.

Attack Chain

1. Initial Access: The attacker gains initial access through an undisclosed method (e.g., compromised account, software vulnerability).
2. LOLBin Execution: A living-off-the-land binary (e.g., powershell.exe, curl.exe) is executed on the compromised system.
3. Download Attempt: The LOLBin is used to download a file from a public file-sharing service (e.g., githubusercontent.com, pastebin.com). The command line includes the URL of the hosted payload.
4. Payload Staging: The downloaded file is saved to a temporary location on the system (e.g., C:\Windows\Temp).
5. Execution: The downloaded file is executed. This could be a script (e.g., PowerShell, VBScript) or an executable.
6. Persistence: The attacker establishes persistence by creating a scheduled task, modifying registry keys, or other methods.
7. Lateral Movement: The attacker uses compromised credentials or exploits vulnerabilities to move laterally to other systems on the network.
8. Objective Achieved: The attacker achieves their final objective, which could be data exfiltration, ransomware deployment, or other malicious activities.

Impact

Successful exploitation can lead to initial access, payload staging, command and control, and ultimately data theft, system compromise, or ransomware deployment. The scope of impact can range from individual endpoints to entire networks, depending on the attacker's objectives and lateral movement capabilities. Given that LOLBins are commonly used system tools, detecting malicious use requires careful analysis of process execution and network connections. Failure to detect this activity can result in significant financial losses, reputational damage, and operational disruption. Recent campaigns, such as those attributed to Mint Sandstorm, highlight the risk of targeting high-profile individuals at universities and research organizations.

Recommendation

• Deploy the provided Sigma rules to detect suspicious downloads from file-sharing websites using LOLBins, ingesting Cisco NVM flow data.
• Monitor network connections from LOLBins (curl.exe, certutil.exe, msiexec.exe, powershell.exe, wmic.exe) to the listed file-sharing domains in the IOC table.
• Review and tune the cisco_nvm___suspicious_download_from_file_sharing_website_filter macro to reduce false positives based on internal usage patterns.
• Enable and monitor Cisco Network Visibility Module Flow Data to capture the required network and process context.
• Ingest logs using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) as described in the "how_to_implement" section, to provide the necessary data for the Sigma rules.

]]>highadvisorylolbinfile-sharingcisco-nvmhttps://feed.craftedsignal.io/briefs/2024-01-headless-browser-download/Wed, 03 Jan 2024 18:23:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-headless-browser-download/Attackers are leveraging Chromium-based browsers in headless mode with the `--dump-dom` argument to download files from file-sharing services and direct IPs, potentially indicative of reconnaissance or malware delivery.Attackers are increasingly utilizing Chromium-based browsers such as Chrome, Edge, and Brave in headless mode to download files surreptitiously. This technique involves using the --headless and --dump-dom arguments, allowing attackers to automate browser actions without a graphical user interface. This tactic has been observed in campaigns like DUCKTAIL, where attackers used this method to download content from the internet using direct URLs or file-sharing platforms. This behavior is especially concerning because it can bypass traditional security measures that rely on user interaction. Defenders should be aware of processes spawning headless browsers and monitor for network connections to file-sharing services or unusual IP addresses.

Attack Chain

1. The attacker compromises a system through an initial access vector (e.g., spearphishing, exploit).
2. The attacker executes a Chromium-based browser (Chrome, Edge, Brave, etc.) from the command line or through a script.
3. The browser is launched with the --headless and --dump-dom arguments to run without a GUI and potentially download content.
4. The attacker uses the browser to access a URL, either a direct IP address or a file-sharing service like Mega.nz or Mediafire.com.
5. The browser downloads a file from the specified URL or domain.
6. The downloaded file may be a malicious payload, configuration file, or stolen data.
7. The attacker executes the downloaded file or uses the data for further exploitation or lateral movement.

Impact

A successful attack can lead to malware infection, data exfiltration, or further compromise of the affected system and network. The use of headless browsers makes detection more challenging, as it mimics legitimate browser activity without the visual cues of a typical user session. The number of victims and specific sectors targeted are currently unknown, but the potential for widespread impact is significant, especially if the downloaded files contain ransomware or other destructive payloads.

Recommendation

• Monitor process creation events for Chromium-based browsers (chrome.exe, msedge.exe, brave.exe) with the --headless and --dump-dom arguments using the provided Sigma rules.
• Inspect network connections from processes matching the above criteria to known file-sharing domains listed in the IOCs.
• Analyze command-line arguments of browser processes for direct IP addresses and correlate with network connection logs.
• Review the known_false_positives section in the original Splunk detection for tips on tuning the detections.

]]>mediumadvisoryheadless-browserfile-downloadcisco-nvm