Upgrade to PRO for Only $50/Year—Limited-Time Offer! 🔥

Hunting For The Most Unusual Attack Techniques ...

Heirhabarov
September 11, 2024
190

Hunting For The Most Unusual Attack Techniques Relevant For The GCC Region

Heirhabarov

September 11, 2024
Tweet

Transcript

  1. Hunting For The Most Interesting Attack Techniques Relevant For The

    GCC Region Teymur Kheirkhabarov Head of Cyber Threat Monitoring, Response and Research BI.ZONE
  2. About me § Head of Cyber Threat Monitoring, Response and

    Research, BI.ZONE § Responsible for the SecOPS product portfolio at BI.ZONE: SOC, MDR, DFIR, EDR, XDR, SOAR, SIEM, TI § Ex-Head of SOC R&D / SOC Analyst at Kaspersky MDR § Threat Hunting, Detection Engineering § Speaker at ZeroNights, PHDays, OFFZONE § Author of cybersecurity trainings: SOC and Cyber Threat Hunting; Windows Security at Harbour.Space University (Barcelona, Spain) § SANS GIAC GXPN, GCFA, GDSA Teymur Kheirkhabarov @Heirhabarov @HeirhabarovT 2
  3. What are we going to speak about? The most interesting

    and unusual techniques observed in attacks in the GCC region. Credential Access § Modify Authentication Process: Password Filter DLL (T1556.002) § Modify Authentication Process: Network Provider DLL (T1556.008) Persistence § Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001) in an unusual way—changing the default Startup folder location Based on our Threat Zone GCC 2024 research 3
  4. Modify Authentication Process: Password Fil ter DLL (T1556.002) § Golden

    Werewolf abused the password filters in order to obtain credential material § The threat actor dropped "psgfilter.dll" into "C:\Windows\System32" § Performed registry modification to register the Password Filter: HKLM\SYSTEM\ControlSet001\ Control\Lsa Notification Packages = scecli, psgfilter Active since: 2014 Aliases: OilRig, APT34,Crambus, Hazel Sandstorm, Helix, Kitten, Yellow Maero, Cobalt Gypsy Target countries: Bahrain, China, Egypt, Jordan, Kuwait, Lebanon, Oman, Quatar, Saudi Arabia, UAE Target industries: financial, government, energy, telecom Golden Werewolf 4
  5. How are password fil ters used to obtain credentials? User

    sends password change request LSASS calls password filter to validate new password LSASS sends user`s cleartext password to filter DLL DLL writes cleartext password to controlled file 5
  6. Password Fil ter DLL configuration 1. Modifying the registry for

    Password Filter registration 3. Loading a Password Filter DLL by an LSASS process 2. Dropping a Password Filter DLL to System32 6
  7. Modify Authentication Process: Password Fil ter DLL (T1556.002). Artifacts for

    detection and hunting § Modification of the registry value HKLM\SYSTEM\ CurrentControlSet\Control\Lsa\Notification Packages § Using Windows Audit (SACL for the registry key needs to be configured in advance), Sysmon or EDR events 7
  8. Modify Authentication Process: Password Fil ter DLL (T1556.002). Windows Registry

    Audit configuration 2. Add an audit entry to the SACL of the registry key of interest to monitor Set Value access operations 1. Enable Audit Registry in the Advanced Audit Policy 8
  9. Modify Authentication Process: Password Fil ter DLL (T1556.002). Hunting for

    Password Fil ter DLL registration in the registry 9 Search for a modification of the registry value HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages: event_type:RegistryValueSetAND reg_key_path:"*\\control\\lsa\\notification packages"
  10. Modify Authentication Process: Password Fil ter DLL (T1556.002). Artifacts for

    detection and hunting 10 § Employing standard Windows tools (reg, PowerShell) for modification of the registry value HKLM\SYSTEM\ CurrentControlSet\Control\Lsa\Notification Packages § Using Windows Audit, Sysmon or EDR events
  11. Modify Authentication Process: Password Fil ter DLL (T1556.002). Hunting for

    Password Fil ter DLL registration in the registry 11 Search for the usage of reg.exe or PowerShell.exe for modifying the registry value HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages: cmdline:(*powershell* OR *reg*) AND cmdline:(*add* OR "*set-itemproperty*" OR "* sp *" OR "*new-itemproperty*") AND cmdline:("*\\control\\lsa*" AND "*notification packages*")
  12. Modify Authentication Process: Password Fil ter DLL (T1556.002). Artifacts for

    detection and hunting § Loading an unusual DLL by an LSASS process § Using Sysmon or EDR events Exports related to the Password Filter DLL 12
  13. Modify Authentication Process: Password Fil ter DLL (T1556.002). Hunting for

    unusual DLLs loaded by an LSASS process 13 Search for DLLs loaded by an LSASS process from the “Windows\System32” directory and not signed by Microsoft: event_type:imageLoad AND proc_file_path:"*\\Windows\\system32\\lsass.exe” AND file_path:"*\\windows\\system32\\" AND -file_sig:("Microsoft Windows" OR "EasyAntiCheat Oy" OR "Security Code Ltd." OR "Fortinet, Inc.") AND -file_path:"*\\docker\\windowsfilter\\*"
  14. Modify Authentication Process: Password Fil ter DLL (T1556.002). Hunting for

    rare DLLs loaded by an LSASS process 14 Search for rare DLLs loaded by an LSASS process from the “Windows\System32” directory and not signed by Microsoft: Number of hosts where the library from file_path was loaded by an LSASS process. Pay attention where the number of hosts is very small
  15. Modify Authentication Process: Password Fil ter DLL (T1556.002). Artifacts for

    detection and hunting § Windows Event ID 4614 § Contains the name of the loaded Password Filter DLL § Generated each time when a Password Filter DLL is loaded by an LSASS process § Needs Advanced Audit Policy configuration 15
  16. Modify Authentication Process: Password Fil ter DLL (T1556.002). Hunting for

    unusual Password Fil ter DLLs based on EID 4614 16 Searching for the loading of unusual password filters based on Windows EID 4614: event_log_name:Security AND event_id:4614 AND -file_path:(rassfm OR scecli OR kdcpw)
  17. Modify Authentication Process: Network Provider DLL (T1556.008) § Iron Werewolf

    abused the network providers in order to obtain credential material § The threat actor dropped "ntos.dll" into "C:\Windows\System32" § Executed a PowerShell script for registry modification to register a network provider, named "ntos": HKLM\SYSTEM\CurrentControlSet\Control\ NetworkProvider\Order = ntos HKLM\SYSTEM\CurrentControlSet\Services\ ntos\NetworkProvider\Class = 2 HKLM\SYSTEM\CurrentControlSet\Services\ ntos\NetworkProvider\Name = ntos HKLM\SYSTEM\CurrentControlSet\Services\ntos\Network Provider\ProviderPath = %SystemRoot%\System32\ntos.dll Active since: 2013 Aliases: Emissary Panda, APT27, Budworm, Lucky Mouse, Iron Tiger, Bronze Union, TG-3390, Earth Smilodon Target countries: Middle East, Canada, India, Japan, South Korea, Mongolia, Russia, Turkey, Thailand, UK, USA Target industries: government, telecom, IT, manufacturing, defense, Iron Werewolf 17
  18. How are Network Providers used to obtain credentials? User gives

    password Winlogon RPC channel to mpnotify Winlogon sends user`s password to mpnotify DLL writes cleartext password to controlled file mpnotify sends password to malicious DLL 18
  19. Network Provider DLL configuration 1. Modifying the registry to register

    a new Network Provider: HKLM\SYSTEM\CurrentControlSet\ Control\NetworkProvider\Order 2. Modifying the registry to configure Network Provider parameters: HKLM\SYSTEM\CurrentControlSet\Services\ <ProviderName>\NetworkProvider\Class, Name, ProviderPath 3. Drop the provider DLL into the directory specified as data of the ProviderPath registry value 4. Network Provider DLL is loaded by an mpnotify process during each user logon 19
  20. Modify Authentication Process: Network Provider DLL (T1556.008). Artifacts for detection

    and hunting 20 § Modification of the registry values HKLM\SYSTEM\CurrentControlSet\Control\ NetworkProvider\Order HKLM\SYSTEM\CurrentControlSet\Services\<ProviderName>\ NetworkProvider\Class, Name, ProviderPath § Using Windows Audit (SACL for the registry key needs to be configured in advance), Sysmon or EDR events
  21. Modify Authentication Process: Network Provider DLL (T1556.008). Windows Registry Audit

    configuration 2. Add an audit entry to the SACL of the registry key of interest to monitor Set Value access operations 1. Enable Audit Registry in the Advanced Audit Policy 21
  22. Modify Authentication Process: Network Provider DLL (T1556.008). Hunting for Network

    Provider DLL registration in the registry 22 Search for a modification of the registry keys related to Network Providers: event_type:RegistryValueSet AND reg_key_path:("*\\Control\\NetworkProvider\\Order" OR "\\NetworkProvider\\Class" OR "\\NetworkProvider\\Name" OR "\\NetworkProvider\\ProviderPath") AND -proc_file_path:("*\\oracle\\virtualbox guest additions\\vboxdrvinst.exe" OR "*\\windows\\syswow64\\msiexec.exe" OR "*\\windows\\system32\\msiexec.exe" "*\\windows\\system32\\poqexec.exe" OR "*\\vboxwindowsadditions-amd64.exe" OR "*\\checkpoint\\endpoint connect\\tracsrvwrapper.exe" OR ("*\\citrix\\*" AND "*\\cwainstaller.exe"))
  23. Modify Authentication Process: Network Provider DLL (T1556.008). Artifacts for detection

    and hunting Loading an unusual DLL by mpnotify and LSASS processes Exports related to the Network Provider DLL 23
  24. Modify Authentication Process: Network Provider DLL (T1556.008). Hunting for unusual

    DLLs loaded by an mpnotify process 24 Search for unusual DLLs (rare, not signed, located in unusual directories, etc.) loaded by an mpnotify process: event_type:"ImageLoad" AND proc_file_path:"\\mpnotify.exe" AND -file_sig:("Check Point Software Technologies Ltd." OR "Infowatch Laboratory LLC" OR "Microsoft Windows Hardware Compatibility Publisher" OR "Dell Inc" OR "Microsoft Windows" OR "Citrix Systems, Inc." OR "Musarubra US LLC" OR "Sentinel Labs, Inc." OR "AO Kaspersky Lab" OR "Solar Security LLC" OR "NVIDIA CORPORATION" OR "Huawei Device Co., Ltd." OR "Kaspersky Lab JSC" OR "Trend Micro, Inc." OR "Wave Systems Corp." OR "Validata LLC")
  25. Modify Authentication Process: Network Provider DLL (T1556.008). Hunting for rare

    DLLs loaded by an mpnotify process 25 Search for rare DLLs loaded by an mpnotify process Number of hosts where the library from file_path was loaded by an mpnotify process. Pay attention where the number of hosts is very small
  26. OS Credential Dumping (T1003) § In addition to the unusual

    techniques (Password Filter DLL, Network Provider DLL), the attackers employed other more popular techniques to obtain user credentials, especially OS Credential Dumping § Threat actors used such sub-techniques as LSASS Memory (T1003.001), Security Account Manager (T1003.002), DCSync (T1003.003), NTDS (T1003.004) § See the presentation to learn how to detect different credential dumping techniques 26
  27. BOOT OR LOGON AUTOSTART EXECUTION: REGISTRY RUN KEYS / STARTUP

    FOLDER (T1547.001) § Dancing Werewolf achieves persistence on an infected system by replacing the standard location of the Startup folder § The threat actor created a directory called "WindowsHost " in "C:\ProgramData" to store the VBScript file "gJhkEJvwBCHe.vbs" § The threat actor replaced the standard location of the Startup folder with the directory "C:\ProgramData\WindowsHost" by modifying "User Shell" and "Shell" registry keys, using PowerShell: Active since: Mid-2022 Aliases: Earth Bogle Target countries: Middle East, North Africa Target industries: various Dancing Werewolf 27
  28. Configuration of Startup folder location 28 § Default users' Startup

    folder is located at: C:\Users\<Username>\AppData\Roaming\Microsoft\Windows\ Start Menu\Programs\Startup § Default system Startup folder is located at: C:\ProgramData\Microsoft\Windows\Start Menu\ Programs\Startup § The location of the Startup folder can be changed via the registry
  29. Changing defaul t Startup folder location (T1547.001). Artifacts for detection

    and hunting 29 § Modification of the registry values: HKU\<USER_SID>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup HKU\<USER_SID>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup § Using Windows Audit, Sysmon or EDR events
  30. Changing defaul t Startup folder location (T1547.001). Hunting for registry

    modification 30 Search for a modification of the registry values: HKU\<USER_SID>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup HKU\<USER_SID>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup event_type:RegistryValueSet AND reg_key_path:("*\\Shell Folders\\Startup" OR "*\\User Shell Folders\\Startup") AND -proc_file_path:"*\\windows\\system32\\runonce.exe" AND -proc_cmdline:(*regsvr32* AND *shell32*) AND -reg_value_data:"*\\Start Menu\\Programs\\Startup”
  31. Changing defaul t Startup folder location (T1547.001). Artifacts for detection

    and hunting 31 § Usage of standard Windows tools (reg, PowerShell) for modifying the registry values HKU\<USER_SID>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup HKU\<USER_SID>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup § Using Windows Audit, Sysmon or EDR events
  32. Changing defaul t Startup folder location (T15547.001). Hunting for registry

    modification 32 Search for the usage of reg.exe or PowerShell.exe for registry modification to replace the standard location of the Startup folder: cmdline:(*powershell* OR *reg*) AND cmdline:(*add* OR "*set-itemproperty*" OR "* sp *" OR "*new-itemproperty*") AND cmdline:( ("*\\User Shell Folders*" AND "*Startup*") OR ("*\\Shell Folders*" AND "*Startup*") )
  33. Access Token Manipulation (T1134) § Iron Werewolf used JuicyPotatoNG and

    SharpEfsPotato to escalate privileges § JuicyPotatoNG, a local privilege escalation tool using SeImpersonate or SeAssignPrimaryToken privileges to escalate from a Windows service account to NT AUTHORITY\SYSTEM § SharpEfsPotato, a local privilege escalation tool using EfsRpc, with SeImpersonate or SeAssignPrimaryToken privileges, built from SweetPotato § By employing these tools, the threat actor attempted to create administrative accounts and to run various tools that require elevated privileges Active since: 2013 Aliases: Emissary Panda, APT27, Budworm, Lucky Mouse, Iron Tiger, Bronze Union, TG-3390, Earth Smilodon Target countries: Middle East, Canada, India, Japan, South Korea, Mongolia, Russia, Turkey, Thailand, UK, USA Target industries: government, telecom, IT, manufacturing, defense, Iron Werewolf 33
  34. Using potato tools for privilege escalation (T1134) 34 § Potato

    tools (RottenPotato, JuicyPotato, JuicyPotatoNG, RottenPotatoNG, SharpEfsPotato, Sweet Potato, etc.) are used to escalate privileges from Windows Service Accounts to NT AUTHORITY/SYSTEM § By default, LOCAL SERVICE and NETWORK SERVICE accounts have an impersonation privilege § Any user with an impersonation privilege can escalate to SYSTEM! SeImpersonatePrivilege SeAssignPrimaryPrivilege
  35. Using potato tools for privilege escalation (T1134). Service account system

    35 1. Checking current privileges (NETWORK SERVICE) 2. Downloading JucyPotato tool 3. Downloading binary to run with elevated privileges 4. Launching JucyPotato tool 5. Using obtained SYSTEM token to start downloaded binary via CreateProcessWithTokenW API 6. Pwned! J
  36. Using potato tools for privilege escalation (T1134). Artifacts for detection

    and hunting 36 § Network/local service account starts a process with the SYSTEM right § Using Windows Audit, Sysmon or EDR events
  37. Using potato tools for privilege escalation (T1134). Hunting for parent-child

    privileges mismatch 37 Search for the spawning of SYSTEM processes by processes, started with a Network or Local service account: event_type:ProcessCreate AND proc_p_usr_sid:("S-1-5-20" OR "S-1-5-19") AND proc_usr_sid:"S-1-5-18" AND -proc_file_path:("*\\windows\\system32\\runtimebroker.exe") AND -cmdline:(*rundll32* AND *DavSetCookie*) AND -proc_p_file_path:"\\System32\\wbem\\WmiPrvSE.exe"
  38. Privilege Escalation in Windows Threat actors used a lot of

    other techniques for privilege escalation. See the presentation to learn how threat actors can escalate privileges in Windows and how this can be detected 38
  39. Command and Scripting Interpreter: PowerShell (T1059.001) PowerShell is the most

    common command and scripting interpreter abused by threat actors in the GCC countries This allows adversaries to solve the majority of tasks at any stage of the attack lifecycle See the presentation to learn how threat actors abuse PowerShell and how this can be detected 39