Parallels International GmbH — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/parallels-international-gmbh/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 24 Jan 2024 12:00:00 +0000First Time Seen Remote Monitoring and Management Tool Executionhttps://feed.craftedsignal.io/briefs/2024-01-first-time-seen-rmm/Wed, 24 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-first-time-seen-rmm/Detects the execution of previously unseen remote monitoring and management (RMM) tools or remote access software on compromised Windows endpoints, often leveraged for command-and-control, persistence, and execution of malicious commands.Attackers commonly abuse legitimate remote monitoring and management (RMM) tools and remote access software for command and control (C2), persistence, and execution of native commands on compromised endpoints. These tools provide attackers with the ability to maintain access, execute commands, and move laterally within a network. This detection identifies when a process associated with commonly abused RMM/remote access tools is observed for the first time on a host. The rule is designed to trigger when a new process name or code signature associated with RMM software, or a child process of such software, is seen within a configured history window. This helps defenders quickly identify potentially malicious use of legitimate tools.

Attack Chain

  1. Initial Access: The attacker gains initial access to a target system through various methods, such as exploiting vulnerabilities or using compromised credentials.
  2. Tool Deployment: The attacker deploys a remote monitoring and management (RMM) tool or remote access software on the compromised endpoint. This may involve downloading and installing the tool, or exploiting existing installations.
  3. Persistence: The RMM tool is configured to run persistently on the system, ensuring that the attacker maintains access even after a reboot or other disruption. This may involve creating a service or adding a registry key to ensure the tool starts automatically.
  4. Command and Control: The attacker uses the RMM tool to establish a command and control (C2) channel with the compromised system. This allows them to remotely execute commands, transfer files, and monitor activity on the system.
  5. Lateral Movement: Using the RMM tool, the attacker moves laterally within the network, compromising additional systems and escalating their access. This may involve using the tool to access shared resources or execute commands on other systems.
  6. Data Exfiltration or Ransomware Deployment: The attacker uses their access to exfiltrate sensitive data from the compromised network or deploy ransomware to encrypt files and demand a ransom payment.
  7. Cleanup: The attacker may attempt to remove traces of their activity, such as logs or files associated with the RMM tool, to avoid detection.

Impact

Compromise via RMM tools can lead to significant data breaches, financial losses, and reputational damage. The use of legitimate tools makes detection more difficult. Successful attacks can result in ransomware deployment, data theft, and prolonged unauthorized access to sensitive systems. Organizations in all sectors are potentially at risk.

Recommendation

  • Deploy the process creation rule to detect the execution of RMM tools on endpoints based on process.name and process.code_signature.subject_name criteria in the query.
  • Enable Sysmon process creation logging (Event ID 1) to ensure the collection of necessary event data for the detection rule.
  • Investigate any alerts generated by the detection rule to determine whether the execution of the RMM tool is authorized and legitimate. Refer to the references for a list of commonly abused RMM tools and associated indicators.
]]>mediumadvisoryremote-accessrmmcommand-and-controlpersistenceLSASS Loading Suspicious DLLhttps://feed.craftedsignal.io/briefs/2024-01-lsass-suspicious-dll/Wed, 03 Jan 2024 10:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-lsass-suspicious-dll/Detection of LSASS loading an unsigned or untrusted DLL, which can indicate credential access attempts by malicious actors targeting sensitive information stored in the LSASS process.The Local Security Authority Subsystem Service (LSASS) is a critical Windows component that manages security policies and user authentication. Attackers often target LSASS to dump credentials, using techniques like injecting malicious DLLs. This detection focuses on identifying instances where LSASS loads a DLL that is either unsigned or not signed by a trusted vendor. The rule excludes known legitimate signatures and file hashes to reduce false positives. This activity is a strong indicator of credential access attempts, potentially leading to further compromise of the system and network. The signatures identified in the rule contain well-known software vendors like Microsoft, McAfee and Citrix.

Attack Chain

  1. An attacker gains initial access to the system through various means (e.g., phishing, exploiting a vulnerability).
  2. The attacker elevates privileges to gain sufficient access to interact with the LSASS process.
  3. The attacker drops a malicious DLL onto the system, often disguised as a legitimate file.
  4. The attacker injects the malicious DLL into the LSASS process using techniques like Reflective DLL Injection.
  5. LSASS loads the injected DLL, granting the attacker access to sensitive credentials stored in memory.
  6. The malicious DLL dumps credentials, such as plaintext passwords or NTLM hashes.
  7. The attacker uses the stolen credentials for lateral movement to other systems on the network.
  8. The attacker achieves their final objective, such as data exfiltration or deploying ransomware.

Impact

Successful exploitation leads to credential compromise, allowing attackers to move laterally within the network, access sensitive data, and potentially achieve complete domain dominance. This can result in data breaches, financial losses, and reputational damage. The impact depends on the level of access associated with the compromised credentials.

Recommendation

  • Deploy the LSASS Loading Untrusted DLL Sigma rule to your SIEM to detect suspicious DLLs loaded by LSASS.
  • Investigate any alerts generated by the Sigma rule and review the loaded DLL’s code signature and hash.
  • Block the identified SHA256 hashes listed in the IOC table to prevent the execution of known malicious DLLs.
  • Implement application whitelisting to restrict which DLLs can be loaded into LSASS.
  • Enable Sysmon process creation and image load logging to provide the necessary data for detection.
]]>mediumadvisorycredential-accesslsassdll-injectionwindows