di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Free Scan

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DSX USE CASES

Scan and secure your S3 buckets and prevent threats to your data with this natively integrated and certified solution.

Amazon S3

Secure files and empower your hybrid-cloud with natively integrated preemptive data security.

Amazon FSx for NetApp

Protect your NetApp ONTAP storage with a purpose-built solution designed to prevent zero-day threats targeting NAS.

NetApp

Stop attackers from breaching your Dell EMC NAS with our purpose-built, natively integrated solution.

Dell EMC

Integrate scanning with your middleware layer to secure your applications with greater stability and customization.

Middleware

Ensure the files moving through your environment remain malware-free, without introducing bottlenecks or slowdowns.

Secure File Transfer

DEPLOYMENT TYPES

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE EDR

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Faster and more effective – Deep Instinct safeguards your data and protects your NAS storage better than Symantec.

REPLACE SYMANTEC

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

LockBit-2.0-Ransomware-Blog.jpg

Threat actors are constantly improving their attack mechanisms to gain an advantage over cybersecurity defenses. Sometimes this involves new malware; other times this means making iterative adjustments to previously successful malware to exploit new vulnerabilities or use new attack techniques to evade and breach underprepared network environments.We have seen ransomware evolve in this way previously, perhaps most famously with <a href="https://www.csoonline.com/article/3233210/petya-ransomware-and-notpetya-malware-what-you-need-to-know-now.html">Petya and NotPetya</a>. Ransomware is one of the <a href="/blog/2021-mid-year-cyber-threat-landscape-report/" target="_self">top threats</a> to businesses, with <a href="/blog/the-ransomware-conundrum-a-look-into-darkside/" target="_self">DarkSide</a>, <a href="https://www.youtube.com/watch?v=qQLdVXb4hOU">WastedLocker</a>, and many others leaving their mark on the international business landscape.In this post we provide analysis on an emerging ransomware variant called <a href="https://threatpost.com/lockfile-ransomware-avoid-detection/169042/">LockFile</a> which evolved from <a href="https://threatpost.com/lockbit-ransomware-proliferates-globally/168746/">Lockbit 2.0</a> and has breached security defenses using new attack techniques.LockFile’s Unique EncryptionMost ransomware operates in a similar way. It generates an encryption key and uses it to encrypt the entire binary of the file, corrupting all data.Lockfile works differently. Rather than encrypting the entire file, it intermittently encrypts 16 bytes at a time. For textual data, this means that part of the file will remain readable. For files where the structure is important (such as a pdf), it will corrupt the file and make it unusable.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt845eb4db159ad367" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt845eb4db159ad367/618eee2aced1ff3eeffa0c51/LockBit-2.0-Ransomware-Blog-image-1.jpg" /></figure>Additionally, LockFile ransomware does not encrypt certain file extensions (for example .exe and .dll), a common behavior amongst a variety of ransomware. The purpose of this encryption technique is to allow the operating system to still function for the victim, albeit only by using corrupted data, ensuring the infected organization pays the ransom.One aspect of LockFile that makes it different from other ransomware is that it does not attack image files (jpeg, bmp, giff, jpg). This is a curious approach. Does LockFile do this to preserve a victim's animal pictures, or is this simply coincidental?<figure style = "float: none;width: 588px;max-width:588px;"><img asset_uid="blt414c71ff1432181c" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt414c71ff1432181c/618eee2ad7b58b4270b662fd/LockBit-2.0-Ransomware-Blog-image-2.jpg" /></figure>What is the Strategy Behind Encrypting Only Part of the File?To understand the thinking behind encrypting only part of the file rather than the entire thing, think of a file like an enormous puzzle. When you encrypt the file, you scramble the puzzle image to the point where you can’t recognize the original. At that point no one could be tricked into thinking that this is a legitimate puzzle.But what if a large portion of the puzzle remained untouched? Without careful examination, you might not notice. As such, it may well be that only part of these files are encrypted by design to obfuscate the threat. When a full file is encrypted, it is quite easy to determine that the file has been tampered with. However, using intermittent encryption may be a new tactic to avoid detection.<figure style = "float: none;width: 533px;max-width:auto;"><img asset_uid="bltf6d2c98e665d31fd" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf6d2c98e665d31fd/618eee2be11662388c9a0aeb/LockBit-2.0-Ransomware-Blog-image-3.jpg" /></figure>Old Dog, New TricksSo, who is behind this new ransomware?Some speculate that the Conti ransomware gang is responsible based on the email address in the ransom note (contact@contipauper.com).<figure style = "float: none;width: 466px;max-width:466px;"><img asset_uid="blt8048befd0b5fc0fa" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8048befd0b5fc0fa/618eee2bfd434d43ee06f3c9/LockBit-2.0-Ransomware-Blog-image-4.jpg" /></figure>But a close examination of the note reveals a striking similarity to the note used in LockBit 2.0.<figure style = "float: none;width: 561px;max-width:auto;"><img asset_uid="blt59e670c4e0d9ac61" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt59e670c4e0d9ac61/618eee2b6e3250402c099b58/LockBit-2.0-Ransomware-Blog-image-5.jpg" /></figure>Although the ransom note is nearly identical (the font, colors, and formatting are the same) LockBit 2.0 uses 32bit files while all the LockFile samples we found were 64bit. The 64bit payload Lockfile narrows the target range of potential victims since 64bit won’t work on machines with older operating systems or 32bit operating systems.This is interesting because threat actors typically prefer to keep a wider scope, not limiting their targets to specific OS architectures. Perhaps Lockfile’s developers had performance aspects in mind during the development process which led them to this decision?LockBit 2.0 and LockFile: What are the Differences?There are three more noticeable ‘features’ which differentiate LockBit 2.0 and LockFile:<ol><li>LockBit 2.0 did not use the unique intermittent encryption we saw in LockFile.</li><li>LockBit 2.0 used wmic.exe only for deleting shadow copies, while in LockFile we saw their extensive use to terminate any process related to virtualization or databases the machine is connected to.</li><li>LockBit 2.0 encrypted victim’s images, whereas LockFile did not do image encryption.</li></ol><figure style = "float: none;width: 531px;max-width:auto;"><img asset_uid="blte6266ca498adf048" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte6266ca498adf048/618eee2b8714cc4276242823/LockBit-2.0-Ransomware-Blog-image-6.jpg" /></figure>Mitigating the ThreatAccording to sources familiar with the threat infection chain, the latest version of the ransomware is using two very new attack vectors:<ul><li><a href="https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-scanned-for-proxyshell-vulnerability-patch-now/">ProxyShell</a> – Microsoft Exchange servers remote code execution vulnerability</li><li><a href="https://www.bleepingcomputer.com/news/microsoft/new-petitpotam-attack-allows-take-over-of-windows-domains/">PetitPotam NTLM relay attack</a> – new technique used to perform an NTLM relay attack</li></ul>To mitigate the ProxyShell vulnerabilities, one must simply patch the exchange servers. (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31207">CVE-2021-31207</a>, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473">2021-33473</a>, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523">2021-34523</a>, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31206">2021-31206</a>)Mitigating the PetitPotam requires more than just downloading a patch – it necessitates following a <a href="https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429">guide Microsoft released</a>, which first informs a user about whether they are affected and includes details on how to configure one’s domain controllers to mitigate this attack vector.How Deep Instinct Stopped LockFileThreat actors will continue to find flaws and create sophisticated ways to attack your environment. The onus is on all of us to stay one step ahead.When it comes to preventing LockFile ransomware, Deep Instinct is the answer. We detect it pre-execution without any updates or modifications to our product and stop it in its tracks.If you’d like to learn more about our ransomware prevention capabilities – including our industry best $3M no-ransomware guarantee – we'd be delighted to <a href="/request-demo/" target="_self">give you a demo</a>.<figure style = "float: none;width: 428px;max-width:auto;"><img asset_uid="blt3ca24fdc7930d801" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3ca24fdc7930d801/618eee2a6cb00137592adb87/LockBit-2.0-Ransomware-Blog-image-7.jpg" /></figure>IOCs:Lockfile’s SHA256 Referred to in this Blog Post:<table><tbody><tr><td>SHA256</td><td>File Type</td></tr><tr><td>2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a</td><td>64-bit executable</td></tr><tr><td>cafe54e85c539671c94abdeb4b8adbef3bde8655006003088760d04a86b5f915</td><td>64-bit executable</td></tr><tr><td>bf315c9c064b887ee3276e1342d43637d8c0e067260946db45942f39b970d7ce</td><td>64-bit executable</td></tr><tr><td> a926fe9fc32e645bdde9656470c7cd005b21590cda222f72daf854de9ffc4fe0</td><td>64-bit executable</td></tr></tbody></table>

LockBit 2.0 Ransomware Becomes LockFile Ransomware with a Never-Before-Seen Encryption Method

print-nightmare

[7/11 Update] Although Microsoft have released the <a href="https://support.microsoft.com/en-us/topic/kb5005010-restricting-installation-of-new-printer-drivers-after-applying-the-july-6-2021-updates-31b91c02-05bc-4ada-a7ea-183b129578a7">KB5005010 security update</a> that should resolve the PrintNightmare issue. Researchers have managed to completely <a href="https://twitter.com/gentilkiwi/status/1412771368534528001">bypass the security update</a> and achieve both LPE and RCE on a fully patched system. In order to bypass this patch, the ‘Point and Print’ Windows policy must be enabled.Last week was a busy one in cyber circles, with the <a href="/blog/deconstructing-the-revil-ransomware-attack-on-kaseya-vsa/" target="_self">Kaseya VSA ransomware outbreak</a> and PrintNightmare both highlighting significant network threats for organizations.PrintNightmare refers to a vulnerability in the Windows Print Spooler – an exploit that many may remember as the <a href="https://www.zdnet.com/article/stuxnet-attackers-used-4-windows-zero-day-exploits/">attack method</a> used to destroy Iranian nuclear centrifuges more than a decade ago. This new vulnerability is actually two-pronged: the first is local privilege escalation, allowing a third party to establish admin or system-level rights to a computer from only low-level privilege, and the second allowing for <a href="https://techxplore.com/tags/remote+code+execution/">remote code execution</a> access.PrintNightmare begins (CVE-2021-1675) In early June, Microsoft <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675">addressed a vulnerability</a> in the Windows print Spooler service. It first appeared with a medium CVSS score of 6.8 and was listed as a LPE (local privilege escalation) vulnerability.Double trouble: from LPE to LPE + RCE A week after the vulnerability was surfaced by Microsoft, the researcher who discovered the flaw <a href="https://twitter.com/_f0rgetting_/status/1405119285802897410">published a video</a> where he is allegedly demonstrating that CVE-2021-1675 is not just an LPE vulnerability but also a RCE vulnerability.<figure style = "float: none;display: flow-root;margin:0;width: 518px;max-width:518px;"><img asset_uid="blt1552a84337486b11" inline="true" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1552a84337486b11/61b3813af6b339160b825db2/yunhai-zhang-tweet.png" /></figure>CVE-2021-1675&gt; CVE-2021-34527About two weeks later, on June 21, the CVSS score of CVE-2021-1675 was <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675">updated</a> from a medium 6.8 to a critical 7.8, and the definition was updated from an LPE to RCE. In addition, a new CVE identifier was issued – <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527">CVE-2021-34527</a>, also known as PrintNightmare.<img asset_uid="blt7db8442bf7ef17b3" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7db8442bf7ef17b3/61b38474369dd16feec893e0/revisions.png" width="689" height="auto" max-width="689" style="width: 689px; height: auto;"/>Now things get interesting. Microsoft issued two different CVEs on the same service in less than a month. According to Microsoft, these two CVEs are similar but distinct as they address different vulnerabilities in the RpcAddPrinterDriverEx function. The attack vector is also different.In mid-June another <a href="https://twitter.com/edwardzpeng">researcher</a> from Sangfor security team <a href="https://twitter.com/BlackHatEvents/status/1405154449165856777">retweeted</a> a tweet from BlackHat’s official Twitter account announcing a research talk that would be given at BlackHat Las Vegas this year entitled, ‘Diving in to Spooler: Discovering LPE and RCE Vulnerabilities in Windows Printer.’Will they present what we already know as PrintNightmare? Or perhaps the presentation will show that the spooler service is more vulnerable than first thought, bringing the potential for more vulnerabilities to come? The presentation is scheduled for August 8th, so this question will remain until then.<img asset_uid="blt13de13a6a49a7e30" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt13de13a6a49a7e30/61b385026e8734160a206aa4/black-hat-tweet.png" width="549" height="auto" max-width="549" style="width: 549px; height: auto;"/>On June 29th another tweet and video was posted by the QiAnXin security team on Twitter showing a full RCE demo of CVE-2021-34527, but without any technical details. A researcher from Sangfor security team then published (some claim by accident) a public exploit POC to his GitHub account. After realizing their error – an unpatched exploit which is enabled by default on every Windows OS and a jackpot for hackers – they quickly removed this repository.<img asset_uid="bltfdc8ed957cda47d0" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfdc8ed957cda47d0/61b384f5f6b339160b825dba/deleted-poc-nightmare-tweet.png" width="441" height="auto" max-width="441" style="width: 441px; height: auto;"/> Figure 4 – the researcher who published the POC of PrintNightmare saying he deleted it[/caption]But the damage had been done; by the time they removed the POC the code had been forked many times.Here are a few working examples:<ul><li><a href="https://github.com/afwu/PrintNightmare">https://github.com/afwu/PrintNightmare</a></li><li><a href="https://github.com/cube0x0/CVE-2021-1675">https://github.com/cube0x0/CVE-2021-1675</a></li><li><a href="https://github.com/calebstewart/CVE-2021-1675">https://github.com/calebstewart/CVE-2021-1675</a></li></ul>Unfortunately, security updates for Windows Server 2016, Windows 10, version 1607, and Windows Server 2012 will be delayed for a short period, but they are expected soon.What is the flaw and how can exploit be prevented?The root cause of this vulnerability is at a function called <a href="https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/b96cc497-59e5-4510-ab04-5484993b259b">RpcAddPrinterDriverEx</a>, a simple function that is designed to allow users the ability to have remote printing.To understand why this threat is so serious, let’s unpack two basic facts about print drivers:<ol><li>Print drivers have full execution abilities as a system on the machine by design.</li><li>There is a flaw on the remote authentication function which allows any authenticated user to add a print driver, remotely. (the notorious PrintNightmare) Again, this is important because even users who have gained low-level access can attain admin or system-level access with this exploit.</li></ol>Combining these two facts we now have an unpatched vulnerability where any authenticated user can gain full remote code execution abilities with system privileges.The first question many will ask is a good one: Will Microsoft patches protect me?While Microsoft’s patch doesn’t solve the issue completely, a combination of the patch and the right mitigations will provide strong protection.The cyber security community joined forces and formed a scenario flow chart (below) to demonstrate when the exploit will work and when it will fail.<img asset_uid="blt6c844bae92f0611e" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6c844bae92f0611e/61b3867d7c125a69ccdb8449/making-sense-of-print-nightmare.jpeg" width="570" height="auto" max-width="570" style="width: 570px; height: auto;"/>Further mitigations beyond the patchAs you may have noticed in the flow graph, in a case where the print spooler is inaccessible, the entire exploit is irrelevant. Therefore, another way to defend your organization against this exploit is to disable the spooler services on machines where this feature is not required.Disabling this service can be done via <a href="https://docs.microsoft.com/en-us/troubleshoot/windows-server/printing/use-group-policy-to-control-ad-printer">Group Policy</a> on Windows 10 or through PowerShell using two simple commands.Stopping the service: Stop-Service -Name Spooler -ForceDisabling it from startup: Set-Service -Name Spooler -StartupType Disabled<img asset_uid="blt0e9354c99af2e9bd" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0e9354c99af2e9bd/61b386f2d461606efe8e6e6e/ineffective-print-spooler-patch.jpeg" height="auto"/>How can Deep Instinct help you?The nature of this attack allows bad actors to potentially gain reverse shell to perform <a href="/blog/what-are-script-based-attacks-and-what-can-be-done-to-prevent-them" target="_self">scripting-based attacks</a> or use them as droppers for additional payloads.Deep Instinct has several solutions to handle these attacks. Deep Instinct Script Control policy can block these kinds of attacks. In addition, Deep Instinct prevents malicious scripts in pre-execution through the deep learning that lies at the core of our neural network technology. Not only do we prevent threats of this nature, we <a href="https://www.deepinstinct.com/zero-day-attacks" target="_self">prevent zero-day</a> malware and ransomware – and back our no-ransomware promise with a $3M guarantee.You can learn more about our prevention-first approach in our new eBook,&nbsp;<a href="https://info.deepinstinct.com/tof/ransomware-prevention?_ga=2.99070299.453200457.1622600658-1453025447.1612830865">Ransomware: Why Prevention is better than the Cure</a>. Or you can speak with a sales rep by requesting a <a href="/request-demo/" target="_self">demo</a> to see our tech in action.References:<a href="https://www.bleepingcomputer.com/news/microsoft/microsofts-incomplete-printnightmare-patch-fails-to-fix-vulnerability/">https://www.bleepingcomputer.com/news/microsoft/microsofts-incomplete-printnightmare-patch-fails-to-fix-vulnerability/</a><a href="https://twitter.com/gentilkiwi/status/1412771368534528001">https://twitter.com/gentilkiwi/status/1412771368534528001</a><a href="https://www.wired.com/story/microsoft-keeps-failing-patch-windows-printnightmare-bug/">https://www.wired.com/story/microsoft-keeps-failing-patch-windows-printnightmare-bug/</a><a href="https://www.welivesecurity.com/2021/07/08/microsoft-rushes-out-patch-fix-printnightmare-zero-day-bug/">https://www.welivesecurity.com/2021/07/08/microsoft-rushes-out-patch-fix-printnightmare-zero-day-bug/</a>

Stopping PrintNightmare

powershell-blog.jpeg

<a href="https://docs.microsoft.com/en-us/powershell/" target="_self">PowerShell</a><a href="#ref1" target="_self">[1]</a> is a command-line shell interface that leverages the .NET framework. Its main purpose is to assist in task automation, however, unlike other shells like Bash, fish, and Zsh, PowerShell is not only a shell, but also an interpreted language with the ability to run scripts.PowerShell has several compelling qualities which make it a natural choice for automation development:<ul><li>It is pre-installed on every Windows operating system from Window 7 onwards</li><li><a href="https://github.com/PowerShell/PowerShell" target="_self">It has been open source since 2016</a></li><li>It is supported over Linux and MacOS, as well as Windows</li><li>It offers direct access to Win32 API</li></ul>For as popular and powerful as these attributes make PowerShell for the developer community, these qualities also make it an ideal tool for post-exploitation, thus making it popular to threat actors in recent years.<div></div>Common Attack Vectors<a href="/blog/what-are-script-based-attacks-and-what-can-be-done-to-prevent-them" target="_self">Script-based cyber-attacks</a> have been gaining popularity since 2017 due to their ability to perform <a href="/blog/be-fearless-when-it-comes-to-file-less-malware-attacks" target="_self">file-less attacks</a>. These attacks usually involve only a small number of files during the infection chain; and in some scenarios no files may be involved in the infection chain at all.Threat actors have begun using file-less attacks in greater frequency because they are more difficult to detect. Since most infection happens in the victims’ memory space rather than the file system, file-less attacks have a higher success rate at evading detection by anti-malware products, many of whom base their detection on filesystem scanning.PowerShell is one of the best malware dropper options — with <a href="https://www.virustotal.com/gui/file/4c1233537b472308dabdc1ca217c1dae62fe6e6ba60feaead0100b43cbe0bae1/detection" target="_self">a simple script</a> an attacker can easily download and execute payloads from the Internet. We have seen <a href="/blog/ursnif-ups-its-game-with-sophisticated-vba-and-powershell-combination-dropper" target="_self">recent attacks involving PowerShell</a> as a component for communicating with the C2 servers and downloading the payload to initiate the infection chain.The Tools of the TradeWith the rise in popularity of PowerShell amongst red teams and pen testers—and after many successful attacks involving it—researchers and developers have started creating PowerShell post-exploitation frameworks. Using these frameworks, even individuals without in-depth knowledge of cybersecurity and OS internals can create legitimate threats.Below is a short overview of the most popular frameworks:<ul><li><a href="https://www.powershellempire.com/" target="_self">PowerShell Empire</a><a href="#ref2" target="_self">[2]</a> post-exploitation, open-source framework helps to achieve:<ul><li>Lateral movement (e.g. Pass-the-hash / Invoking PsExec)</li><li>Credential dumping using <a href="https://github.com/gentilkiwi/mimikatz/wiki" target="_self">Mimikatz</a></li><li>Persistence</li><li>User information collection (e.g. clipboard data and keylogging)</li><li>Privilege Escalation through UAC Bypass</li></ul></li></ul>Although the project is no longer supported, the Empire framework offers several modules and features which make it a favorite amongst red teams.<img asset_uid="blt64fa22d419ebd59f" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt64fa22d419ebd59f/61b38eec28bb636fef293808/blog-powershell-security-image.png" width="581" height="auto" max-width="581" style="width: 581px; height: auto;"/> Figure 1 – PowerShell Empire framework (taken from <a href="https://www.powershellempire.com" target="_self">https://www.powershellempire.com</a>	<a href="https://github.com/samratashok/nishang" target="_self">Nishang</a> is another well-known post-exploitation, open-source framework that offers a set of attacking abilities such as:<ul><li>Creating backdoors on victims’ machines</li><li>Escalating privileges in multiple ways</li><li>Network scanning and brute force for lateral movement</li><li>File-less attacks – executing malicious payload in memory</li></ul><ul><li><a href="https://github.com/PowerShellMafia/PowerSploit" target="_self">PowerSploit</a><a href="#ref5" target="_self">[5]</a><a href="#ref6" target="_self">[6]</a> is also a popular open-source, offensive framework that offers a variety of PowerShell modules and scripts. PowerSploit offers several benefits including:<ul><li>Audio capture using the Get-Microphone Audio module</li><li>Keylogging using the Get-Keystrokes module</li><li>Creating scheduled tasks for persistence using the New-User Persistence Option module</li><li>It also includes a set of code-injection techniques</li></ul></li></ul>These frameworks offer a large collection of offensive capabilities that can potentially cause severe damage to organizations that are not aware of the risks.There are many other open-source frameworks and paid products as well, including the notorious <a href="https://www.cobaltstrike.com/" target="_self">Cobalt Strike</a><a href="#ref7" target="_self">[7]</a> paid penetration testing toolkit publicly leaked a few months ago which employs PowerShell in its Beacon component.<div></div>AMSI – How Does it Help?Many of today’s attacks utilize PowerShell scripts that are obfuscated and difficult to detect. Starting from Windows 10, Microsoft has created an interface through which any anti-malware product can integrate. This interface is called AMSI – <a href="https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal" target="_self">Antimalware Scan Interface</a>.<a href="#ref8" target="_self">[8]</a><img asset_uid="bltdc7934286a2621bc" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltdc7934286a2621bc/61b38eecfc1766686e8bccc9/blog-powershell-security-image-2.jpeg" width="505" height="auto" max-width="505" style="width: 505px; height: auto;"/>PowerShell scripts will often arrive encrypted, obfuscated, or will simply try to download the payload from a third-party website.For simplicity, let’s say we want to prevent the execution of ‘Evil PS’ string. Heuristics and signature-based anti-malware would simply add a rule to block the desired string or regex and the following execution will be prevented:<ol><li>powershell.exe Write-Host 'Evil PS'</li></ol>But what if we try breaking up the strings?<ol><li>powershell.exe Write-Host(("{1}{0}" -f 'v','E')+'i'+("{2}{1}{0}" -f 'S','P','l '))</li></ol>Would all cyber security products still work? And what if we put more complexity into the equation and add simple base64 encoding?<ol><li>powershell.exe Write-Host([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(("{1}{0}" -f 'pbC','RXZ')+'BQ'+("{2}{1}{0}" -f '=','w=','U'))))</li></ol>And if that’s not enough we could still hide our payload in pastebin.com like I did in the following example (trust me, it’s there[<a href="#ref9" target="_self">9]</a>):<ol><li>powershell.exe Write-Host([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(("{1}{0}" -f 'zZUJhc2ljUGFyc2','KHdnZXQgLVV')+'luZyBod'+("{2}{1}{0}" -f 'IpLkNvbnRlbnQ=','9yYXcvTlZVa0tZOW','HRwczovL3Bhc3RlYmluLmNvbS'))))</li></ol><img asset_uid="blt5986e47dbf4627e1" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5986e47dbf4627e1/61b38eecaeff971f3fd50c00/blog-powershell-security-image-3.png" width="501" height="auto" max-width="501" style="width: 501px; height: auto;"/> Figure 3 – PowerShell simple obfuscations[/caption]Do Simple Obsfuscations Really Work?In a PoV we conducted, we took one of the PowerSploit modules which uses <a href="https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-Mimikatz.ps1" target="_self">Mimikatz for credentials harvesting</a> and removed a single character at the end of line just to make it unknown on VirusTotal. We then uploaded it to test the results. <a href="https://www.virustotal.com/gui/file/333b27ab27c4ebb9da570f7a4085639600485778e32ed0b3a0d91f21cb063f5e/detection" target="_self">32 different engines in VirusTotal</a> managed to detect it immediately.<img asset_uid="bltc2aa36705ebcc2e8" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc2aa36705ebcc2e8/61b38eecd461606efe8e6e74/blog-powershell-security-image-4.png" width="545" height="auto" max-width="545" style="width: 545px; height: auto;"/> Figure 4 – Invoke-Mimikatz module on plain textWhen trying to run the plaintext script, the Deep Instinct agent immediately detected it.<img asset_uid="blt92ecd524b6de6e71" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt92ecd524b6de6e71/61b38eec7c125a69ccdb844f/blog-powershell-security-image-5.png" width="591" height="auto" max-width="591" style="width: 591px; height: auto;"/>After simply base64 encoding the entire script and uploading it again, we managed to reduce the detection of a few more engines and dropped <a href="https://www.virustotal.com/gui/file/0f2160e3bf03eacfb4a58e81e2cfde68a2fa8dae060246821b1bf302c1659358/detection" target="_self">down to 11</a> detections.<img asset_uid="bltaa02d18dbce52c2e" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltaa02d18dbce52c2e/61b38eec005cf21f3b8ad013/blog-powershell-security-image-6.png" height="auto"/> Figure 6 – Invoke-Mimikatz module after encoding with base64In this example, the Deep Instinct agent is still able to detect the malicious payload.<img asset_uid="blt19165b21fc93a4bb" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt19165b21fc93a4bb/61b38eec26ed2c6e8f1b8d2c/blog-powershell-security-image-7.png" width="565" height="auto" max-width="565" style="width: 565px; height: auto;"/>Eventually, we took the base64 Invoke-Mimikatz module, shuffled it using a few basic concatenating methods in PowerShell, and we got <a href="https://www.virustotal.com/gui/file/1cf62e5498cbe7d3c705abfb735fb848c50a163ba54fd1bceaa6d23fa4b29a14/detection" target="_self">0 detections in VirusTotal</a>!<img asset_uid="blt7cd8aa9245c86572" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7cd8aa9245c86572/61b38eec6527b2206338d02d/blog-powershell-security-image-8.png" width="574" height="auto" max-width="574" style="width: 574px; height: auto;"/> Figure 8 – Invoke-Mimikatz module after encoding and shuffling the dataAlthough we played with the file and tried to hide its true nature, the Deep Instinct agent still detected a risk and tagged this script as a Malicious PowerShell Command Execution.<img asset_uid="blt4d0c679f33e29e07" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4d0c679f33e29e07/61b38eecb9cabc6d40adc8c9/blog-powershell-security-image-9.png" width="654" height="auto" max-width="654" style="width: 654px; height: auto;"/>The purpose of AMSI is to strip attackers of the ability to enable cybersecurity vendors to focus on the payload and not on the encryptions and obfuscations.In order to use the AMSI interface, Microsoft has released <a href="https://docs.microsoft.com/en-us/windows/win32/api/_amsi/" target="_self">documentation guides for developers and researchers.</a>Although there have been few successful attempts to <a href="https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell" target="_self">bypass AMSI detections</a>, it is still a strong interface that can assist in preventing most of the PowerShell attacks.Deep Instinct vs PowerShellDeep Instinct has <a href="https://info.deepinstinct.com/mof/demo_fileless-powershell-attack" target="_self">several solutions to handle PowerShell attacks</a>. In addition to behavioral protection mechanisms, Deep Instinct prevents malicious PowerShell scripts through the deep learning that lies at the core of our neural network technology. This allows us to detect known and unknown threats, including those that are PowerShell based.If you’d like to learn more about our industry-leading approach to stopping malware, backed by a $3M guarantee, please&nbsp;download our new eBook,&nbsp;<a href="https://info.deepinstinct.com/tof/ransomware-prevention?_ga=2.190475299.904700770.1623078264-1598413446.1621950290" target="_self">Ransomware: Why Prevention is better than the Cure</a>.References:[1]<a href="https://github.com/PowerShell" target="_self">https://github.com/PowerShell</a>[2]<a href="https://github.com/EmpireProject/Empire" target="_self">https://github.com/EmpireProject/Empire</a>[3]<a href="https://github.com/samratashok/nishang" target="_self">https://github.com/samratashok/nishang</a>[4]<a href="https://kalilinuxtutorials.com/nishang/" target="_self">https://kalilinuxtutorials.com/nishang/</a>[5]<a href="https://github.com/PowerShellMafia/PowerSploit" target="_self">https://github.com/PowerShellMafia/PowerSploit</a>[6]<a href="https://attack.mitre.org/software/S0194/" target="_self">https://attack.mitre.org/software/S0194/</a>[7]<a href="https://deepinsarchive.wpengine.com/2021/03/18/cobalt-strike-post-exploitation-attackers-toolkit/" target="_self">https://deepinsarchive.wpengine.com/2021/03/18/cobalt-strike-post-exploitation-attackers-toolkit/</a>[8]<a href="https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal" target="_self">https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal</a>[9]<a href="https://pastebin.com/raw/NVUkKY9b" target="_self">https://pastebin.com/raw/NVUkKY9b</a><h2>Further Reading:</h2><ul><li><a href="https://www.deepinstinct.com/blog/new-fileless-attacks-found-in-event-logs" target="_self">https://www.deepinstinct.com/blog/new-fileless-attacks-found-in-event-logs</a></li></ul>

DSX for Cloud - Amazon S3 provides natively integrated preemptive data security for Amazon S3.

Moshe Hayun

From Moshe Hayun.