Adobe — CraftedSignal Threat Feed

Persistence via Windows Installer (Msiexec)

hello@craftedsignal.io — Thu, 05 Sep 2024 14:17:05 +0000

The Windows Installer (msiexec.exe) is a legitimate system tool used for installing, updating, and removing software on Windows systems. Adversaries can abuse msiexec.exe to establish persistence mechanisms by creating malicious scheduled tasks or modifying registry run keys. This allows them to execute arbitrary code during system startup or user logon. This technique is attractive to attackers due to msiexec.exe being a trusted Windows binary, potentially evading detection by security solutions that focus on flagging unknown or suspicious processes. The use of msiexec.exe for persistence can be difficult to detect without specific monitoring rules, as it is a common and legitimate system process. This activity can be observed across various Windows versions and is frequently integrated into automated attack frameworks and scripts.

Attack Chain

An attacker gains initial access to a compromised system, potentially through phishing, exploitation of a vulnerability, or stolen credentials.
The attacker leverages msiexec.exe to create a new scheduled task using the schtasks.exe command, setting it to execute a malicious script or binary.
Alternatively, the attacker uses msiexec.exe in conjunction with reg.exe or PowerShell to modify registry keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Run or HKCU\Software\Microsoft\Windows\CurrentVersion\Run, adding a pointer to their malicious executable.
The created scheduled task or registry entry points to a malicious payload, such as a reverse shell or a downloader.
The system is restarted, or the user logs on, triggering the execution of the newly created scheduled task or the malicious binary through the modified registry run key.
The malicious payload executes, establishing a persistent foothold for the attacker on the compromised system.
The attacker can now perform further actions, such as data exfiltration, lateral movement, or deployment of ransomware.

Impact

Successful exploitation allows the adversary to maintain persistent access to the compromised system. This can lead to data theft, system compromise, deployment of ransomware, or use of the system as a staging point for further attacks within the network. A single compromised system can be used to pivot and compromise additional systems, leading to a widespread security breach. The impact can include financial losses, reputational damage, and disruption of business operations.

Recommendation

Monitor process creation events for msiexec.exe spawning schtasks.exe or reg.exe to create scheduled tasks or modify registry run keys (reference: rules in this brief).
Implement and tune the Sigma rules provided in this brief to detect suspicious msiexec.exe activity related to persistence mechanisms.
Review and audit existing scheduled tasks and registry run keys for any suspicious entries or anomalies.
Enable file integrity monitoring (FIM) on critical system directories, including the Windows Task Scheduler directory and registry run key locations (reference: event.category == “file” and file.path … and event.category == “registry” and registry.path … in the rule query).
Implement application control policies to restrict the execution of unauthorized or unknown executables (reference: rule query).

Suspicious Process Access via Direct System Call

hello@craftedsignal.io — Wed, 03 Jan 2024 15:00:00 +0000

This detection identifies suspicious process access events on Windows systems where a process attempts to access another process’s memory via direct system calls, bypassing standard Windows API calls. Endpoint security solutions often hook userland Windows APIs to detect malicious code execution. Attackers can evade these hooks by directly invoking syscalls, which are lower-level instructions that interact directly with the operating system kernel. The rule specifically looks for process access events (Sysmon Event ID 10) where the call trace does not originate from known Windows system DLLs like ntdll.dll, indicating a potential attempt to bypass security measures. The rule excludes certain legitimate applications, such as Malwarebytes Anti-Exploit, Cisco AMP, Microsoft EdgeWebView, and Adobe Acrobat DC, to reduce false positives. This technique is often employed by advanced malware and red teams to evade detection.

Attack Chain

A malicious process is executed on the system, either through user interaction or exploitation of a vulnerability.
The process attempts to gain access to another process’s memory space (Target Process).
Instead of using standard Windows API calls, the malicious process directly invokes system calls (syscalls) to access the target process’s memory.
The CallTrace in the Sysmon event does not originate from expected system DLLs like ntdll.dll, sysfer.dll, wow64cpu.dll, wow64win.dll, or win32u.dll, indicating a direct syscall.
The process might attempt to read sensitive information such as credentials, inject malicious code, or manipulate the target process’s behavior.
The malicious process performs actions within the context of the target process, such as executing injected code or accessing sensitive data.
The attacker leverages the compromised process to achieve their objectives, such as data exfiltration, lateral movement, or privilege escalation.
The attacker cleans up any traces of their activity and attempts to maintain persistence on the compromised system.

Impact

Successful exploitation can lead to the compromise of sensitive data, the injection of malicious code into legitimate processes, and the complete takeover of the affected system. This can result in data breaches, financial loss, and reputational damage. The impact is especially significant if the target process holds sensitive credentials, browser secrets, or has security-product context.

Recommendation

Enable Sysmon process access logging (Event ID 10) with call tracing and ingest the logs into your SIEM to activate the rules above (https://ela.st/sysmon-event-10-setup).
Deploy the Sigma rules provided in this brief to your SIEM and tune them for your environment to detect direct syscall process access.
Investigate any alerts generated by these rules, focusing on the SourceImage, TargetImage, GrantedAccess, and CallTrace fields in the Sysmon event to determine the legitimacy of the process access attempt.
Prioritize investigation of alerts where the target process is lsass.exe or other security-sensitive processes.
Implement robust endpoint detection and response (EDR) solutions to detect and prevent malicious activity on endpoints.
Monitor for suspicious process creation events originating from the flagged processes.

Startup or Run Key Registry Modification

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

Attackers often modify registry run keys to achieve persistence on a system. By adding entries to these keys, they ensure that a malicious program executes automatically whenever a user logs in. This technique allows the attacker to maintain access to the compromised system even after reboots or other interruptions. The programs added to these run keys execute under the context of the user account, inheriting its permissions. This activity is often difficult to distinguish from legitimate software installations or updates, requiring careful analysis to identify malicious intent. Elastic has observed this activity and created a detection rule to identify this behavior.

Attack Chain

The attacker gains initial access to the target system.
The attacker identifies registry run key locations for persistence.
The attacker modifies a registry run key (e.g., HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) using tools such as reg.exe.
The attacker adds a malicious executable path to the registry key.
The system is restarted, or a user logs in.
The malicious executable is launched automatically as part of the logon process.
The malicious executable establishes a connection to a command-and-control server.
The attacker gains remote access to the compromised system.

Impact

Successful exploitation allows attackers to maintain persistent access to compromised systems, enabling them to perform unauthorized activities such as data theft, lateral movement, and deployment of ransomware. While each instance may not cause immediate critical damage, the cumulative effect of multiple persistent infections across an environment can lead to significant data breaches and operational disruption. The Elastic rule attempts to minimize false positives with built-in filters for common legitimate applications and processes like ctfmon.exe, but tuning is required.

Recommendation

Deploy the Sigma rule provided below to detect suspicious modifications to registry run keys and tune it to filter out legitimate application updates.
Enable registry event logging to capture modifications made to the registry, ensuring that the Sigma rule can function correctly.
Investigate any alerts generated by the Sigma rule, examining the parent process of the process modifying the registry for suspicious activity.
Block known malicious executables and domains identified during triage to prevent further infection.
Use endpoint detection and response (EDR) solutions like Elastic Defend to gain enhanced visibility into endpoint activity and detect malicious behavior associated with persistence mechanisms.

Ingress Transfer via Windows BITS

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

The Windows Background Intelligent Transfer Service (BITS) is a legitimate Windows service that allows for prioritized, asynchronous, and throttled transfer of files between a client and a server. Adversaries abuse BITS to download malicious payloads while evading typical security protections, as file transfers occur in the context of the svchost.exe process. This activity can obscure the origin of the download and bypass application whitelisting rules. This detection focuses on identifying file rename events where svchost.exe renames temporary BITS files (BIT*.tmp) to executable or archive file types, indicating a potential malicious download via BITS. This technique is commonly employed to deliver malware, exfiltrate data, or download additional tools.

Attack Chain

An attacker gains initial access to a system (e.g., through phishing or exploiting a vulnerability).
The attacker uses a script or command-line interface (e.g., PowerShell) to create a BITS job.
The BITS job is configured to download a malicious executable or archive from a remote server using the bitsadmin.exe utility.
BITS downloads the file to a temporary location on the system with a BIT*.tmp extension.
The svchost.exe process renames the temporary file to its final name and extension (e.g., .exe, .zip).
The attacker executes the downloaded file, initiating further malicious activities.
The malware establishes persistence through registry keys or scheduled tasks.
The malware communicates with a command and control (C2) server to receive instructions and exfiltrate data.

Impact

Successful exploitation enables attackers to download and execute arbitrary code on compromised systems. The use of BITS can bypass traditional security measures, leading to malware infections, data theft, and potentially full system compromise. This technique can be used in conjunction with other attack vectors to establish a persistent foothold within the network. While the rule itself triggers at low severity, the identified activity can be an early warning of more severe attack stages.

Recommendation

Deploy the “Ingress Transfer via Windows BITS” Sigma rule to your SIEM and tune for your environment.
Enable Sysmon file creation and process creation logging to enhance visibility into BITS-related activities.
Monitor network connections initiated by svchost.exe to identify potentially malicious downloads.
Investigate any instances of bitsadmin.exe being executed, especially with command-line arguments indicative of suspicious downloads.
Review Microsoft-Windows-Bits-Client/Operational Windows logs (event ID 59) for unusual BITS events.
Block known malicious domains or IP addresses associated with BITS-related attacks at the firewall or DNS resolver.

Suspicious Process Creation Followed by Memory Access from Unknown Region

hello@craftedsignal.io — Wed, 03 Jan 2024 10:00:00 +0000

This detection identifies potential process injection attempts, specifically process hollowing, by monitoring process creation events followed by memory access from unknown regions. The rule focuses on processes spawned by Microsoft Office applications (winword.exe, excel.exe, outlook.exe, powerpnt.exe), scripting engines (cscript.exe, wscript.exe, mshta.exe), and command-line tools (cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, wmic.exe, cmstp.exe, msxsl.exe). The logic looks for a spawned process by one of these applications/tools, followed by a process access event for an unknown memory region by the parent process, indicating a potential code injection attempt. Attackers use process injection to hide malicious activity within legitimate processes, evading detection and hindering forensic analysis. This technique is a common tactic used to establish persistence, escalate privileges, or execute malicious payloads.

Attack Chain

A user opens a malicious document or executes a script.
The Microsoft Office application (e.g., winword.exe) or scripting engine (e.g., wscript.exe) starts as a parent process.
The parent process creates a new child process (e.g., a legitimate system executable).
The attacker injects malicious code into the newly created child process’s memory, often overwriting legitimate code sections.
The parent process accesses the child process’s memory from an unknown code region, indicating the injected code. Sysmon event ID 10 captures this access.
The injected code executes within the context of the child process, performing malicious actions.
These actions can include establishing persistence, downloading additional malware, or exfiltrating data.

Impact

Successful process injection allows attackers to mask their malicious activities within legitimate processes, making detection and attribution significantly harder. This can lead to prolonged infections, data breaches, and system compromise. The impact can range from individual workstation compromise to widespread organizational damage, depending on the attacker’s objectives and the compromised system’s role. The rule mitigates risks associated with advanced persistent threats (APTs) and commodity malware using process injection for defense evasion.

Recommendation

Enable Sysmon Event ID 1 (Process Creation) and Event ID 10 (Process Access) to collect the necessary telemetry for this detection (Sysmon Event ID 1 - Process Creation, Sysmon Event ID 10 - Process Access).
Deploy the Sigma rule “Suspicious Process Creation CallTrace” to your SIEM and tune for your environment.
Investigate any alerts triggered by the Sigma rule, focusing on the process execution chain and potential malicious activities performed by the injected code.
Consider memory dumping the child process for further analysis, to examine if malicious code exists.

Adobe RdrCEF.exe Hijack for Persistence

hello@craftedsignal.io — Wed, 03 Jan 2024 10:00:00 +0000

This detection identifies a persistence technique where attackers replace Adobe Acrobat Reader’s RdrCEF.exe with a malicious executable. This allows the attacker to gain persistence, as their malicious file will be executed every time the user launches Adobe Acrobat Reader DC. The rule focuses on detecting the file creation event of a file named RdrCEF.exe in the Adobe Acrobat Reader directory. The targeted versions are those using the RdrCEF.exe file located within the AcroCEF subdirectory. The purpose of this technique is to maintain unauthorized access to a compromised system. This technique was publicly discussed on Twitter as early as 2018.

Attack Chain

Initial access is gained through an existing compromise or vulnerability.
The attacker locates the RdrCEF.exe file within the Adobe Acrobat Reader installation directory (e.g., C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\).
The legitimate RdrCEF.exe file is either deleted or renamed.
A malicious executable is created or copied and renamed to RdrCEF.exe in the same directory.
The system is used as normal, and whenever Adobe Acrobat Reader DC is launched, the malicious RdrCEF.exe is executed.
The malicious executable performs its intended actions, such as establishing a reverse shell, injecting code into other processes, or exfiltrating data.
The attacker maintains persistent access to the compromised system.

Impact

A successful attack allows the attacker to maintain persistent access to the compromised system. The attacker can then perform various malicious activities, such as stealing sensitive data, installing additional malware, or using the system as a foothold for lateral movement within the network. The compromise affects any user who launches Adobe Acrobat Reader on the infected machine.

Recommendation

Enable Sysmon file creation logging (Event ID 11) to detect the creation of RdrCEF.exe in the specified Adobe Acrobat Reader directories to enable the rule “Deprecated - Adobe Hijack Persistence” (Data Source: Sysmon).
Deploy the Sigma rule “Detect Adobe RdrCEF.exe File Creation” to your SIEM and tune for your environment.
Investigate any alerts generated by the provided Sigma rule, focusing on identifying the origin and purpose of the created RdrCEF.exe file.
Monitor for unusual process execution originating from the RdrCEF.exe file location.