Dcom — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/dcom/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 04 Jan 2024 12:00:00 +0000DCOM Lateral Movement via ShellWindows/ShellBrowserWindowhttps://feed.craftedsignal.io/briefs/2024-01-dcom-lateral-movement/Thu, 04 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-dcom-lateral-movement/This analytic identifies the use of Distributed Component Object Model (DCOM) to execute commands on a remote host, specifically when launched via ShellBrowserWindow or ShellWindows Application COM objects, indicating potential lateral movement by an attacker.This detection identifies the abuse of Distributed Component Object Model (DCOM) for lateral movement within a Windows environment. DCOM allows software components to communicate across a network, and attackers may leverage it to execute commands remotely. This rule specifically focuses on the use of ShellBrowserWindow or ShellWindows Application COM objects as the launching point for these remote commands. The technique enables stealthy lateral movement, as it leverages legitimate Windows functionality. This activity is detected by identifying incoming TCP connections on high ports associated with explorer.exe spawning child processes, which are indicative of DCOM abuse. The rule is designed to detect this behavior and alert security teams to potential unauthorized lateral movement attempts.

Attack Chain

  1. An attacker gains initial access to a compromised host within the network.
  2. The attacker uses DCOM to initiate a connection to a target host.
  3. The DCOM connection is established to the target host via high TCP ports (above 49151).
  4. The explorer.exe process on the target host receives the DCOM connection.
  5. The attacker uses ShellBrowserWindow or ShellWindows COM objects to execute commands.
  6. explorer.exe spawns a child process to execute the attacker-supplied command.
  7. The spawned process performs malicious actions, such as reconnaissance or further lateral movement.

Impact

Successful exploitation allows attackers to execute arbitrary commands on the target system, leading to potential data exfiltration, system compromise, and further lateral movement within the network. This can result in significant damage, including data breaches, financial losses, and reputational harm. The DCOM protocol is commonly used in many Windows environments, so this technique could be broadly applicable across many victim organizations.

Recommendation

  • Deploy the Sigma rule “DCOM Lateral Movement with Explorer.exe” to your SIEM and tune for your environment to detect suspicious process creations spawned by explorer.exe.
  • Enable Sysmon Event ID 3 (Network Connection) and Event ID 1 (Process Creation) logging to ensure the required data is available for the Sigma rule to function correctly.
  • Review network activity for incoming TCP connections to high ports (49151+) associated with explorer.exe, as highlighted in the “Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows” detection.
  • Investigate any unusual or unexpected child processes spawned by explorer.exe, as detected by the Sigma rule.
]]>mediumadvisorylateral-movementdcomwindowsSuspicious Explorer Child Process via DCOMhttps://feed.craftedsignal.io/briefs/2024-01-suspicious-explorer-child-process/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-suspicious-explorer-child-process/Adversaries abuse the trusted status of explorer.exe to launch malicious scripts or executables, often using DCOM to start processes like PowerShell or cmd.exe, achieving initial access, defense evasion, and execution.Attackers frequently exploit Windows Explorer (explorer.exe) to execute malicious code due to its inherent trust within the operating system. This involves spawning child processes such as PowerShell, cmd.exe, or other scripting engines via Component Object Model (COM) and Distributed Component Object Model (DCOM). This technique enables attackers to bypass security controls, blending malicious activity with legitimate system processes. The detection rule identifies such anomalies by monitoring child processes of Explorer with specific characteristics, excluding known benign activities, to flag potential threats. This activity is frequently associated with initial access and execution of follow-on malware.

Attack Chain

  1. The attack begins with an initial access vector such as spearphishing (T1566).
  2. A user clicks a malicious link or opens an attachment, leading to code execution.
  3. The initial payload exploits explorer.exe through DCOM using the -Embedding argument.
  4. Explorer.exe spawns a child process such as powershell.exe, cmd.exe, or mshta.exe (T1059, T1218).
  5. The spawned process executes malicious commands or scripts.
  6. These commands might download or execute additional payloads.
  7. The attacker achieves code execution, potentially gaining persistence on the system.
  8. The ultimate objective is often lateral movement, data exfiltration, or deploying ransomware.

Impact

Successful exploitation allows attackers to execute arbitrary code within a trusted process context, bypassing application whitelisting and other security controls. This can lead to initial access, privilege escalation, and persistence within the compromised system. The compromise can remain undetected for extended periods due to the trusted nature of the parent process (explorer.exe), enabling attackers to perform reconnaissance, deploy malware, exfiltrate data, or disrupt services.

Recommendation

  • Enable process creation logging with command line details to detect suspicious explorer.exe child processes.
  • Deploy the Sigma rule “Suspicious Explorer Child Process - PowerShell” to identify instances of PowerShell spawned by explorer.exe with suspicious arguments.
  • Deploy the Sigma rule “Suspicious Explorer Child Process - Scripting Engines” to detect other scripting engines launched by explorer.exe.
  • Monitor process execution events for processes like powershell.exe, cmd.exe, cscript.exe, wscript.exe, mshta.exe, regsvr32.exe, and rundll32.exe with a parent process of explorer.exe and the argument “-Embedding” via process creation logs.
  • Implement application control policies to restrict execution of unsigned or untrusted scripts and executables.
]]>mediumadvisoryinitial-accessdefense-evasionexecutionexplorer.exedcom