OpenEDR - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/openedr/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 24 Jan 2024 12:00:00 +0000Suspicious File Creation via OpenEDR ITSMServicehttps://feed.craftedsignal.io/briefs/2024-01-openedr-file-creation/Wed, 24 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-openedr-file-creation/OpenEDR's ITSMService process, used for remote management, is being abused to create suspicious files on compromised systems, potentially leading to unauthorized file uploads, data staging, or malicious file deployment.OpenEDR's ITSMService.exe is a legitimate component responsible for remote management operations within an environment. However, adversaries can abuse the ITSMService process to create executable or script files on the system through the process explorer or file management features. While these functions are legitimate for IT administrators, the creation of executable or script files in unusual locations or with suspicious names may indicate unauthorized file uploads, data staging for lateral movement, or the deployment of malicious payloads. This activity has been observed in experimental settings, highlighting the potential for abuse in real-world scenarios by threat actors aiming to leverage the built-in capabilities of OpenEDR for malicious purposes.

Attack Chain

  1. Initial Access: An attacker gains initial access to the target system through external means (e.g., phishing, exploit).
  2. OpenEDR Access: The attacker gains control or access to an existing OpenEDR installation or is able to install/configure a rogue instance.
  3. ITSMService Exploitation: The attacker leverages the OpenEDR console to interact with the ITSMService.exe process.
  4. File Upload: The attacker uses the ITSMService to upload a malicious file (e.g., .exe, .dll, .ps1) to a location on the target system.
  5. Persistence (Optional): The attacker creates a scheduled task or modifies a registry key using ITSMService to maintain persistent access.
  6. Execution: The attacker leverages ITSMService to execute the uploaded malicious file.
  7. Lateral Movement: The executed payload initiates lateral movement, potentially using credentials obtained through OpenEDR or other tools.
  8. Objective: The attacker achieves their final objective, such as data exfiltration, ransomware deployment, or establishing a persistent backdoor.

Impact

Successful exploitation allows attackers to bypass traditional security controls by abusing a trusted application (OpenEDR). It enables the deployment of malware, exfiltration of sensitive data, or the establishment of persistent access to compromised systems. While specific victim numbers are unknown, the permissive nature of OpenEDR's trial, as noted in research, suggests a broad potential attack surface. The impact could extend across various sectors utilizing OpenEDR for endpoint management.

Recommendation

  • Deploy the Sigma rule "Potentially Suspicious File Creation by OpenEDR's ITSMService" to your SIEM to detect the creation of suspicious file types by the ITSMService process, and tune it for your environment.
  • Monitor file creation events for files with extensions like .exe, .dll, .ps1, .bat, etc. created by 'ITSMService.exe' (logsource: file_event/windows).
  • Implement strict access controls and auditing for OpenEDR consoles to prevent unauthorized use of ITSMService.exe.
  • Review and audit OpenEDR configurations to identify and remediate overly permissive settings.
]]>mediumadvisoryopenedritsmservicefile-creationlateral-movementOpenEDR ssh-shellhost.exe Spawning Command Shell or PowerShell with PTYhttps://feed.craftedsignal.io/briefs/2024-01-openedr-cmd-spawn/Wed, 24 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-openedr-cmd-spawn/OpenEDR's ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY capabilities may indicate remote command execution and potential abuse of OpenEDR's remote management features by threat actors for lateral movement or command-and-control.OpenEDR, a security solution, includes remote management features that can be abused by threat actors. This activity involves the ssh-shellhost.exe process, spawned by ITSMService.exe, creating command shells like cmd.exe or PowerShell instances with PTY (pseudo-terminal) capabilities. The abuse of these features can allow attackers to execute arbitrary commands on a compromised system, move laterally within the network, or establish command and control channels. While legitimate administrators may use these features for remote management, their abuse represents a significant security risk. This is particularly concerning in environments where OpenEDR is deployed, as it provides a potential avenue for attackers to gain unauthorized access and control.

Attack Chain

  1. The attacker gains initial access to a system with OpenEDR installed. This could be achieved through various means, such as exploiting vulnerabilities or using stolen credentials.
  2. The attacker leverages OpenEDR's remote management capabilities.
  3. The ITSMService.exe process, associated with OpenEDR, spawns the ssh-shellhost.exe process.
  4. The ssh-shellhost.exe process executes a command shell, such as cmd.exe, powershell.exe, pwsh.exe or bash, with PTY (pseudo-terminal) support, indicated by the --pty argument in the command line.
  5. The attacker uses the spawned shell to execute commands on the compromised system. These commands could be used for reconnaissance, lateral movement, or other malicious activities.
  6. The attacker may use the established shell to install additional tools or malware on the system.
  7. The attacker moves laterally to other systems on the network, repeating the process.
  8. The final objective includes data exfiltration, ransomware deployment, or other malicious activities.

Impact

Successful exploitation allows attackers to execute arbitrary commands on compromised systems, potentially leading to data theft, system disruption, or ransomware deployment. The number of affected systems depends on the attacker's ability to move laterally within the network. Targeted sectors include any organization utilizing OpenEDR for endpoint protection. If successful, the attack can result in significant financial losses, reputational damage, and operational disruptions.

Recommendation

  • Deploy the Sigma rule "OpenEDR Spawning Command Shell" to your SIEM to detect suspicious ssh-shellhost.exe process creation events in your environment (rules).
  • Investigate any alerts generated by the Sigma rule to determine if the activity is legitimate or malicious.
  • Implement strict access controls and monitoring for OpenEDR's remote management features to prevent unauthorized use.
  • Review the reference article to gain a better understanding of the attack vector and potential mitigation strategies (references).
]]>mediumadvisoryopenedrremote-access-toollateral-movement