di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

What is a Zero-Day Vulnerability?
A zero-day vulnerability is a software flaw that can be potentially abused in different ways, and is unknown to the

zeroday.jpg

<h3>What is a Zero-Day Vulnerability?</h3>A zero-day vulnerability is a software flaw that can be potentially abused in different ways, and is unknown to the targeted software vendor. The term ‘Zero-day Attack’ refers to a vulnerability that is both exploited in the wild and unknown to the target software vendor, and therefore the targeted vendor has “zero days” to fix it.A zero-day vulnerability is considered the ultimate infection method since it is less likely to trigger an operating system security warning and less dependent on the user’s lack of awareness. Other attack vectors such as phishing email require user interaction, be it to download an email or click on a link. In contrast, a zero-day exploit would potentially abuse the operating system or a software flaw to infect a target machine.Private zero-day vulnerabilities are only known to their discoverer and whoever it’s been shared with. These are mostly owned by elite cyber-espionage groups, usually state-sponsored. Though these are a major security risk, they are not very widespread since their owners would like to keep them from being discovered.<a href="https://www.deepinstinct.com/2020/01/15/cve-2020-0601-what-you-need-to-know/" target="_blank" rel="noopener noreferrer">When a zero-day vulnerability is discovered</a> publicly - either through a leak, a security researchers’ publication, or a disclosure – it is no longer private. However, a newly exposed zero-day vulnerability can still hold a threat, and in many cases represents more of a risk than a private one. Once it is exposed, even if it was already patched by the vendor, a race against the clock starts between attackers creating exploits for the vulnerability while the targeted vendor’s users that need to apply the fix. This window of time leaves an opening for attackers to abuse while the vulnerability is still available. This situation is known as a One-day or an N-day attack.&nbsp;<h3>The Race Against the Clock</h3>One of the most famous cases of an active zero-day vulnerability exploited in the wild is the case of EternalBlue. The Shadow Brokers, a threat group known for leaking hacking tools and exploits of the United States National Security Agency (NSA) had leaked in April 2017 an exploit for a vulnerability in the Microsoft Server Message Block protocol (CVE-2017-0144). The vulnerability is exploited by sending crafted packets to a vulnerable machine, which will result in the attacker executing arbitrary code remotely in the compromised system.The consequences of these leaks were the massive ransomware campaigns of May to August 2017, which included malware such as <a href="https://www.deepinstinct.com/2017/05/14/wannacry-no-need-to-cry-if-youre-deeply-protected/" target="_blank" rel="noopener noreferrer">WannaCry</a>, Petya, NotPetya, and more. Even though the vulnerability that was abused by the leaked EternalBlue exploit was patched one month prior to the leak, it was still a major part of some of the most proliferating malware campaigns of all time, due to the massive number of machines worldwide that remained unpatched.A more recent example occurred in August 2020, when Microsoft had released a patch for a severe Netlogon Remote Protocol (MS-NRPC) vulnerability, discovered and published by the Dutch security company Secura.The vulnerability, known as Zerologon (CVE-2020-1472), allows an unauthenticated attacker to access the domain admin account. Due to a flaw in the authentication protocol, sending crafted authentication requests to will lead to the attacker gaining complete control over an environment.Two months after the patch release and one month after Secura’s researchers published the technical details of the vulnerability, the Ryuk ransomware operation began <a href="https://threatpost.com/ryuk-ransomware-gang-zerologon-lightning-attack/160286/" target="_blank" rel="noopener noreferrer">exploiting Zerologon in a massive campaign</a>, targeting unpatched systems en-mass.&nbsp;<h3>How to Defend Against Zero-day Attacks</h3>Defending against zero-day and N-Day attacks requires an alert and agile approach that includes:<ul><li><a href="https://www.deepinstinct.com/deep-instinct-multi-layer-protection/" target="_blank" rel="noopener noreferrer">A multi-layered cybersecurity</a> policy. Defending against zero-day exploits requires controlling every aspect of your network through up-to-date tools, such as firewalls and <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener noreferrer">next-gen antivirus software</a>,&nbsp;<a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener noreferrer">endpoint protection</a>, authentication and identity management, SIEMs, and most importantly software patching. When developing your multi-layered approach keep your focus on prevention. Aside from the fact that it’s so much cheaper to prevent attacks rather than reacting to them, it keeps your systems cleaner and gives your SIEM tools a fighting chance against the latest exploits that do get through.</li><li>Good cyber hygiene. Training employees for cybersecurity awareness at all ranks in the organization is a must. Every employee should know what to look out for in email communication and were to address suspicious links and attachments. This, along with a planned on-time software patching policy, could prevent attackers’ initial foothold and foil an infection.</li></ul>Zero-day attacks, though uncommon, can potentially have destructive consequences to an organization. N-day attacks exploiting known vulnerabilities are much more common and while they can cause severe damage, are nevertheless much easier to defend against. By keeping up to date with recent updates and cybersecurity news, and consistently patching vulnerable systems, companies can amplify their <a href="https://www.deepinstinct.com/zero-day-attacks" target="_self">protection from zero-day attacks.</a>&nbsp;

Zero Day Vulnerability: What it is, and How it works

As originally published in HelpNet Security.

Attackers always seek out new ways to evade detection. As most endpoint security products handle file-

script-attacks.jpg

As originally published in <a href="https://www.helpnetsecurity.com/2020/07/31/what-are-script-based-attacks/" target="_blank" rel="noopener noreferrer">HelpNet Security</a>.Attackers always seek out new ways to evade detection. As most endpoint security products handle file-based attacks relatively well, scripts are an excellent way for attackers to avoid making changes to a disk, thus bypassing the threat detection capabilities of most products. In today's threat landscape, scripts provide initial access, enable evasion, and facilitate lateral movements post-infection. Attackers will use scripts directly on the machine or embed them in Office documents and PDFs sent to the victims as email attachments. The following blog post provides a short snapshot of what the script threat landscape looks like, and reviews common attacks and methods.Script-based cyber attacks gained popularity in 2017 as their availability grew by over 400%. Nation-state and cybercrime groups adopted the use of scripts and <a href="/glossary/fileless-malware-definition" target="_self">fileless malware</a> in this same timeframe. Today, script-based attacks account for 40% of all cyberattacks, according to the <a href="https://engage.morphisec.com/2020-endpoint-security-risk-study" target="_self">2020 endpoint security report</a> from Ponemon Institute.&nbsp;In 2019 and 2018, Deep Instinct identified increased use of fileless attack methods. Particularly suspicious was a spike in the abuse of legitimate applications and native tools such as PowerShell for lateral movement and infection. This trend applies to the nation-state and non-state actors alike.A script can be anything from a sequence of simple system commands, advanced scripting languages used for system configurations, complex task automation, and other general purposes. Common scripting languages are VBScript, JavaScript, and PowerShell. Unlike applications that run after compiled into machine code, computers interpret scripts. To put in <a href="https://www.perl.com/pub/2007/12/06/soto-11.html/" target="_self">the words of Larry Wall</a>, creator Perl scripting language, "a script is what you give the actors, but a program is what you give the audience."&nbsp;<h3>How Attackers Use Scripts</h3>Like other types of malware, payload delivery, and lateral movement follow a successful script initiated infection. The payload performs actions desired by the attacker, such as information collection, file encryption, or backdoor communication. At the same time, lateral movement infects additional computers within the network.The use of scripts poses many advantages to the attacker: scripts are easy to write and execute, trivial to obfuscate, and extremely polymorphic. Moreover, attackers can use many types of script files to carry out an attack - the most popular being PowerShell, JavaScript, HTA, VBA, VBS, and batch scripts. Finally, since fileless attacks occur in memory, traditional static file detection is rendered useless. Furthermore, scripts complicate post-event analysis since many artifacts related to the attack only exist in the computer's memory and may be overwritten or removed through a reboot, for example. In-memory detection and artifact collection is possible through the use of heuristics and behavioral analysis, which can detect malicious in-memory activities.Script-based attacks run on virtually all Windows systems, increasing the potential attack surface and the chance of infection. One major drawback of script-based attacks is that, unless deployed via an exploit, for the script to run, user interaction is required. For example, in most cases, the script is contained either as a script file within an email requiring user action or as a VBA macro in a document that requires the user to enable macros.Many types of malware, including ransomware, backdoors, and financial, make use of scripts. For instance, a script that downloads a PE file can either save it to disk or run it from memory, depending on its level of sophistication. The script can also perform additional malicious actions, such as collecting information about the victim, from the computer name to saved passwords.Studying a sample set of attacks, Deep Instinct Threat Intelligence concluded 75% of fileless campaigns use scripts (mostly one or more of PowerShell, HTA, JavaScript, VBA) during at least one of the attack stages.For example, the <a href="https://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability" target="_self">Helminth Trojan</a>, used by the Iran-based Oilrig group, uses scripts for its malicious logic. In the attack, a Microsoft Word document file exploiting CVE-2017-0199 delivers an HTA script executed by the Windows process, which runs the HTML executable mshta.exe. Once executed, the script initiates the attack, delivering the Helminth Trojan as PowerShell and VBS files.<h3>Powershell: A Powerful Tool for the Sysadmin and Attacker Alike</h3>PowerShell is a framework used for configuration management and task automation, with a command-line shell and scripting language. PowerShell provides access to Microsoft Windows Management Instrumentation (WMI) and Component Object Model (COM), which makes it a useful and versatile tool for system administrators automating IT management processes, but also for attackers seeking a hold of the system.<img class="alignnone wp-image-7152 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/07/malicious-file-loader-1000x321.png" width="1000" height="321" style="width: 1000px; height: 321px;"/>A malicious file loader using PowerShellAttackers use PowerShell in their attacks to load malware directly in memory without writing to disk, thus bypassing many endpoint security products. Attackers also use PowerShell to automate data exfiltration and infection processes using frameworks such as Metasploit or PowerSploit.As with other types of attacks, in a script-based attack, the initial hold of the victim generally occurs through a successful phishing attack, which contains a dropper - such as a PDF, RTF, Office file, or archive. In most cases, the dropper will then run a script, either a VBA macro or another type of script, such as PowerShell, JavaScript, or HTA. In some cases, the scripts act as downloaders, either downloading a PE file to disk before removing it, injecting a PE file into another process, or downloading another script to carry out the next stage of the attack. In rare cases, the script contains the entire malicious logic. In other cases, the attacker exploits the vulnerabilities in the document reader, for example, Adobe Acrobat, to drop the next phase of the attack. The use of droppers is widespread not only in script-based malware but also in file-based malware attacks, including well-known ransomware and financial malware campaigns.A well-known attack using this method was <a href="https://blog.fortinet.com/2017/11/27/cobalt-malware-strikes-using-cve-2017-11882-rtf-vulnerability" target="_self">Cobalt malware</a>, which used a document dropper exploiting CVE-2017-11882. When the user opened the document, the exploit contained in the document downloaded a JavaScript, which in turn executed several PowerShell scripts – the last of which included Cobalt DLLs in the script code. These completed in PowerShell's memory without being dumped to disk. Through the use of this exploit, attackers executed a fileless attack, in which the only action performed by the user was opening the document dropper.<img class="alignnone wp-image-7151 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/07/cobalt-malware-diagram-1000x274.png" width="1000" height="274" style="width: 1000px; height: 274px;"/>In many cases, PowerShell allows the attacker to gain an initial foothold on a victim, since using PowerShell enables attackers to obtain permissions and privileges, perform the lateral movement in the system, as well as interact with other Windows applications such as Microsoft Exchange.&nbsp;<h3>Javascript: An Unwanted Guest on your PDF Reader</h3>JavaScript is a standard scripting language used in web pages, web applications, and browsers. JavaScript can manipulate and modify PDF files with implemented objects, web page links, and more. Even though not designed to have direct access to the file system, most PDF-based attacks use a PDF reader software or an in-browser reader to run JavaScript code on the victims' machine. Either exploiting an unpatched vulnerability or using a by-design feature, PDF reader companies and malware developers are on a cat-and-dog chase that has been going on for years.'<h3>Additional script-based threats</h3>HTML application (HTA) is a Microsoft Windows file meant to run on Internet Explorer, which combines HTML code with internet explorer supported scripts such as VBScript or JScript. HTA files execute through Microsoft HTA engine (mshta.exe) that has the local user's privileges instead of Internet Explorer's restricted privileges, with access to the filesystem and registry.Malicious HTA files allow scripts to run the machine with local user privileges to download and run executables or additional scripts. Though considered an old attack vector, many script-based attacks continue to use HTA files. These files can be sent as attachments, downloaded by another script, or redirects from malicious websites.VBScript (Microsoft Visual Basic Scripting Edition) is a Microsoft scripting language based on VBA (Visual Basic for Applications). Instead of a full application development that VBA offers, VBS offers more straightforward usage, aiming at task automation for system administrators. Much like PowerShell, which is intended for similar uses, VBScript in often seen in script-based attacks. Microsoft's support of script encoding in the form of VBE files is another reason attackers find it useful.&nbsp;<h3>So, Should I allow scripts to run in my organization network?</h3>In fileless and script-based attacks, the malicious logic of the attack occurs in memory, making threat detection with traditional static file analysis insufficient. With script based-attacks on the rise, PowerShell in particular, organizations need to be ready to combat attacks in which the entire attack sequence occurs in memory.A basic first step any organization should consider is segmenting employees into several groups:<ol><li>Running scripts is part of their day-to-day job</li><li>Running scripts is not common but might happen</li><li>There is no need to run scripts</li></ol>Once segmented, security teams should ensure scripts can only execute from read-only locations and access specific machines. Additionally, security teams should restrict and monitor the use of interactive PowerShell across the organization. Additionally, practicing good IT hygiene can limit an organization's attack surface and the risk associated with script-based attacks.With these foundational rules in place, organizations should seek out security solutions with specific capabilities that balance the ability to detect script-based attacks while allowing users who need to use scripts for their job function to do so without interruption. In its latest product version , Deep Instinct introduced Contextual Script Behavioral Analysis that delivers script threat prevention capabilities that meet these requirements. Unlike other script prevention approaches that limit script access by policy only, <a href="https://www.deepinstinct.com/" target="_blank" rel="noopener noreferrer">Deep Instinct</a>'s <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener noreferrer">Contextual Script Behavioral Analysis</a> analyzes the content of the script to identify threats. With built-in capabilities to identify malicious PowerShell commands and content as well as identify when a script executes as a child process of a closed list of parent processes (such as MS Word, Outlook, etc.) Deep Instinct's hybrid approach to script-based threat prevention delivers what you need to maintain a resilient security posture.

What are Script-Based Attacks? And What can be Done to Prevent Them?

The Chrome Web store went live in December 2010, and by November 2011, Google was reporting millions of downloads per day, over 200 million active use

Chrome-web-store.jpg

The Chrome Web store went live in December 2010, and by November 2011, Google was reporting millions of downloads per day, over 200 million active users, and a total of 750 million extensions downloaded.
However, the stunning success opened a Pandora’s box of security threats. Most <a href="https://www.deepinstinct.com/">antivirus</a> companies viewed <a href="https://www.deepinstinct.com/2020/01/12/browser-extensions-malware-in-a-nutshell/" target="_blank" rel="noopener noreferrer">CRX malware</a> as a low severity threat because it was limited to the browser environment and could not affect local files, only steal passwords, clicks and browser-related data. They were also much less common than other file types. This article, the second in a <a href="https://www.deepinstinct.com/2020/01/12/browser-extensions-malware-in-a-nutshell/" target="_blank" rel="noopener noreferrer">four-part series</a>, covers various CRX threats that arose in the past, and the significant steps Google has taken to address them.
One of the features malware developers initially took advantage of was “silent install” for Chrome extensions (CRXs). This feature originally allowed developers to deploy extensions as part of another installation in the Windows operating system without user consent, making it an easy target for malicious threat actors. For example, the “I want this” extension, which was spread in May 2012. It was installed silently as an attack vector and injected ads into what were supposed to be ad-free Wikipedia pages.
Following “I want this” and other malware attacks, in December 2012, Google disabled “silent install” for Chrome extensions using the Windows registry, as well as all extensions installed silently. This made the Command-line installation much harder and the silent attack vector obsolete.
In June 2013, Google added new security measures to the Chrome Web Store upload process, scanning each extension before making it publicly available. This was an important step in securing extensions hosted in the Chrome Web Store, however malicious extensions were still available in third-party platforms and could still be installed natively in browsers or bundled with file downloads.  Therefore, in May 2014, Google took the most significant step it has taken to date in the threat landscape, announcing that it would prevent Windows users from natively installing extensions that were not stored in the Chrome Web Store. It also automatically disabled all extensions not installed from the Chrome Web Store, with no option to manually re-enable them until they were migrated to the Web Store. According to Google, this step alone caused a 75% decrease in customer support requests regarding unwanted Chrome extensions in the year following the implementation. In May 2015, Google implemented the same policy for other operating systems.
Throughout 2014, Chrome also discontinued its support of the Netscape Plug-in API (NPAPI), an architecture from the ’90s used for content plugins such as audio and video, that allowed unrestricted local access and called unprotected binary code from JavaScript. NPAPI had often been abused by <a href="https://www.deepinstinct.com/product-overview/">malware</a> developers. A well-known example was Theola, an NPAPI-based CRX malware, installed by the Mebroot rootkit. It had video recording functionality and its unrestricted permissions allowed it to access sensitive data and intercept all network activity. It was able to collect private information such as credit card information and passwords submitted by the victims in web forms. In 2015, the option to manually enable NPAPI was also discontinued.
Following Google’s efforts, the threat landscape was transformed from the wild west to an exclusive club.  Attackers have had to adapt and change their strategy. Instead of trying to infect as many users as possible, following Google’s gatekeeping efforts, the real challenge became bypassing Google security measures and trying to get into the Chrome Web Store.
Read this whitepaper to learn more about <a href="https://info.deepinstinct.com/tof/whitepaper-chrome-extension-malware">Chrome Extension malware</a>
<a href="https://info.deepinstinct.com/tof/whitepaper-chrome-extension-malware" target="_blank" rel="noopener noreferrer"><img class="alignnone wp-image-6421" src="https://www.deepinstinct.com/wp-content/uploads/2020/01/chrome-ext-banner-450x168.png" alt="" width="568" height="212" /></a>

From the Wild West to an Exclusive Club: Google’s Gatekeeping of the Chrome Web Store

Most of us have learned to be wary of unknown apps or emails with suspicious links. However, our digital vigilance doesn’t always extend to another cr

malware-ext-blog.jpg

Most of us have learned to be wary of unknown apps or emails with suspicious links. However, our digital vigilance doesn’t always extend to another critical threat — browser extensions.  This handy little tool sits alongside the address bar in your browser, makes it easy to save passwords, pin pictures and integrates your browser with other services you use. Yet browser extensions have, and continue to be, a threat to our <a href="https://www.deepinstinct.com/">cybersecurity</a>. This article, which gives an overview of the browser extensions and the problems they present, is the first in a series of <a href="https://www.deepinstinct.com/2020/04/21/from-the-wild-west-to-an-exclusive-club-googles-gatekeeping-of-the-chrome-web-store/" target="_blank" rel="noopener noreferrer">four articles</a> on Chrome Extension malware.
<img class="alignnone wp-image-6325 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf644d8130129e39f/611a7e325fe4021650f8a839/browser.png" alt="" width="800" height="400" />
&nbsp;
<h3>Browser Extensions in a Nutshell</h3>
Before we get into the threats, a bit of background on how browser extensions came to be such a ubiquitous part of our digital lives. Browsers started off as simple software that displayed websites. As they grew and developed into the multifunctional software we know today, they had to add the capacity to support advanced abilities and features. Rather than slow down their performance by building the capacity to support a wide range of features internally, browser extensions were introduced.
According to Google’s official statement, “Extensions are small software programs that customize the browsing experience. They enable users to tailor Chrome [browser] functionality and behavior to individual needs or preferences. An extension must fulfill a single purpose that is narrowly defined and easy to understand. A single extension can include multiple components and a range of functionality, as long as everything contributes towards a common purpose.” In other words, extensions allow users to pick and choose additional features and functionalities and add them to a basic browser without slowing the browser performance.
From a security perspective, however, browser extensions posed a challenge. Although limited to the browser environment, they are simple to install, and do not require high privileges, or have a digital certificate. In addition, the continuing shift towards web and cloud-based products means that browser extensions increasingly handle and are being exposed to sensitive data, making them a highly-attractive attack surface for threat actors. Cisco’s 2016 annual security report found that 85% of the organizations sampled in their study were affected by malicious browser extensions.
Chrome extensions (CRX) are available to users through the <a href="https://www.deepinstinct.com/2020/04/21/from-the-wild-west-to-an-exclusive-club-googles-gatekeeping-of-the-chrome-web-store/" target="_blank" rel="noopener noreferrer">Chrome Web Store</a>. Before being published in the store, they do go through a vetting process that includes static and dynamic analysis, as well as safe browsing checks on the examined file. According to Google, 10% of the extensions examined were detected as malicious in the first three years of using this evaluation process.
Google’s gatekeeping efforts, covered in further detail in the next article in the series, have limited the ability of attackers and threat actors to use Chrome extensions as malware. However, like in the Google Play Store, they are not foolproof. Malicious extensions can and do still find their way into the <a href="https://www.deepinstinct.com/2020/04/21/from-the-wild-west-to-an-exclusive-club-googles-gatekeeping-of-the-chrome-web-store/" target="_blank" rel="noopener noreferrer">Chrome Web Store</a> and from there, into the victim’s browsers. For example, in July 2019, <a href="https://www.xda-developers.com/camscanner-app-injecting-malware/" target="_blank" rel="noopener noreferrer">CamScanner had 100 million downloads</a> before it was detected and removed from the Chrome store. The app which allows users to digitize paper documents, and then auto-crop and enhance image quality, enjoyed great popularity for the niche nature of its value. However, it was identified as being used to inject malware on the phones of millions of users before Google removed the app from the Play Store.
Security solutions and the SOC teams that manage them offer limited security coverage, this is largely due to a mindset that considers browser extension malware as a low-priority threat. The threat landscape for extensions malware begs for a different approach to effectively prevent malicious CRXs from breaching the organization’s security surface. It the next blog in the series we address the growth of Chrome extension malware and its expanding threat landscape.
To learn more about <a href="https://info.deepinstinct.com/whitepaper-chrome-extension-malware" target="_blank" rel="noopener noreferrer">Chrome Extension Malware Read the Whitepaper</a>
<a href="https://info.deepinstinct.com/whitepaper-chrome-extension-malware" target="_blank" rel="noopener noreferrer"><img class="alignnone wp-image-6421" src="https://www.deepinstinct.com/wp-content/uploads/2020/01/chrome-ext-banner-450x168.png" alt="" width="501" height="187" /></a>
&nbsp;
<a href="#_ftnref1" name="_ftn1"></a>

Browser Extensions Malware in a Nutshell

As demonstrated in our previous blog on anti-sandboxing, malware developers use whatever they can to remain stealthy and avoid being analyzed. To do t

prt-4-LOTL.jpg

As demonstrated in our <a href="https://www.deepinstinct.com/2019/11/24/malware-evasion-techniques-part-3-anti-sandboxing/" target="_blank" rel="noopener noreferrer">previous blog on anti-sandboxing</a>, malware developers use whatever they can to remain stealthy and avoid being analyzed. To do this, one method is to use built-in Microsoft Windows capabilities and trusted tools. <a href="/glossary/living-off-the-land-lotl" target="_self">Living Off The Land (LOTL)</a> techniques allow malware to blend in using existing resources in order to evade detection by AV or Sandbox analysis.The use of built-in features in the target environments to evade detection and analysis is common, and many <a href="https://www.deepinstinct.com/automatic-threat-analysis/" target="_self">malware</a> has been spotted using LOTL techniques in the wild. For example, GravityRAT and OopsIE which use WMI requests to detect <a href="https://www.deepinstinct.com/2019/10/29/malware-evasion-techniques-part-2-anti-vm-blog/" target="_blank" rel="noopener noreferrer">virtual environments</a>. Also, malware such as the <a href="https://www.deepinstinct.com/2020/10/12/why-emotets-latest-wave-is-harder-to-catch-than-ever-before-part-2/" target="_self">Emotet trojan</a>, Carbon Backdoor and Shamoon used scheduled tasks in their campaigns to persist and evade detection.In the following post, we will review and demonstrate some of the more common techniques in the field of LOTL, used to detect a virtual environment or dodge AV products.&nbsp;<h3>WMI checks</h3>Windows Management Instrumentation (WMI) is an infrastructure on Windows-based operating systems that store environment management information. WMI supplies management data to parts of the operating systems, administrative tasks scripts and other products, and can also be queried using PowerShell and SQL.Malware that relies on LOTL techniques for evasion can use WMI queries to detect virtual environments and to evade anti-malware software and analysis tools. For example, simply querying the WMI namespace root\SecurityCenter2 will present information from the Windows security center, in classes like “AntiVirusProduct”, “AntiSpywareProduct”, and “FirewallProduct” which store information regarding the security solution installed.Under the namespace root\cimv2, the classes such as “Win32_DiskDrive” “Win32_VideoController” and “Win32_BIOS” classes can contain specific strings for virtual environments, security products and monitoring tools like Wireshark.Optional WMI evasion checks using SQL queries:root\cimv2 classes: SELECT * from class and search matches for: “Virtual Machine”, “VirtualBox”, “VMware” or “Hyper-V”:“Win32_ComputerSystem”“Win32_BaseBoard”“Win32_DiskDrive”Win32_PointingDevice“Win32_VideoController”“Win32_BIOS”Additional queries: Higher chance for false-positive results due to hardware or firmware compatibility issues.Root\WMI classes:SELECT * FROM MSAcpi_ThermalZoneTemperature (Virtual environments return error)root\cimv2 classes:SELECT * from Win32_Fan (Virtual environments return 0)&nbsp;<h3>Task Scheduler</h3>Windows Task Scheduler is a built-in Windows component used to run scripts and executables at tie intervals and at specifically defined times. Malware uses it for persistence, commonly to schedule a task either at system startup or on a regular basis.Even though <a href="https://www.deepinstinct.com/automatic-threat-analysis/" target="_self">malware analysis</a> systems and sandboxes may identify the capability to schedule tasks, in many cases this delayed execution will be used to evade analysis in a sandbox environment.<h3>Sysinternals Suite</h3>Sysinternals are a set of monitoring and diagnostics tools for Windows, created for IT administrators. Malware that employs LOTL techniques relies on the Sysinternals suite’s features such as restoring passwords, recovering data, file execution on remote systems, etc. to persist and evade sandboxes and Anti-malware products.One of the most common utilities in the Sysinternals Suite is PSExec. PSExec allows running executables and commands on remote machines through SMB (Server Message Block) protocol, though it has a set of requirements such as credentials, admin privileges and having the SMB protocol allowed. PSExec, as well as modified versions of it, are commonly used by attackers to evade AV detection in the infection and lateral movement.ListDLLs is another Sysinternals utility, that lists the DLLs loaded into all processes in memory. ListDLLs can be used to evade virtual environments, compared to DLLs used by virtualization products.List of known DLLs:dbghelp.dll (VMware)sbiedll.dll (Sandboxie)vmcheck.dll (virtual PC)pstorec.dll (SunBelt Sandbox)snxhk.dll (avast sandbox)snxhk64.dl (avast sandbox)sxIn.dll (avast sandbox)&nbsp;LOTL techniques are one of the best examples of how malware developers utilize whatever they can to <a href="https://www.deepinstinct.com/2019/09/15/malware-evasion-techniques-part-1-process-injection-and-manipulation/" target="_blank" rel="noopener noreferrer">achieve persistence and evasion</a>, as one of the key issues when facing LOTL techniques is the fact that it relies on by design features of the environment. Though it’s recommended to address the basic techniques mentioned above, in your own <a href="https://www.deepinstinct.com/endpoint-protection/" target="_self">endpoints</a> and malware analysis environments, it’s important to remember that in the game of LOTL techniques, this is just the tip of the iceberg. Like a classic Whac-A-Mole game, attackers will forever be developing new and challenging techniques that <a href="https://www.deepinstinct.com/" target="_self">cyber-security</a> researchers will be anticipating and doing their best to overcome.&nbsp;

Malware Evasion Techniques Part 4: Living Off The Land

Deep Instinct Included in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP)