di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Storage

Prevention for Applications

Prevention for Endpoints

Data Security: Powered by Deep Instinct

Deep Learning: Prevention-First Cybersecurity

Products

>99% Threat Accuracy

Prevent Ransomware

Prevent Zero-Day Attacks

Why Deep Instinct

Extend & Enhance EDR/XDR

+ Microsoft Defender

+ Tanium

Legacy AV

Enhance Existing Cyber Tools

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Events & Webinars

Resources

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick links

EXPLORE THE PREDICTIVE PREVENTION PLATFORM

End-to-end predictive prevention platform built on a deep learning framework that protects storage, applications, and endpoints.

Prevent >99% of zero-day exploits, ransomware, and unknown threats in your NAS and cloud storage repositories.

Proactively prevent malicious files from entering your storage environment through application uploads by customers, employees, and third parties.

Prevent known and unknown malware, zero-day exploits, ransomware, and script-based attacks before they execute on the endpoint – faster than a blink of an eye.

Leverage advanced predictive prevention technology to protect data across your entire environment.

Data Security: Powered By Deep Instinct

Deep Instinct is the only deep learning framework in the world built from the ground up for cybersecurity.

Unparalleled Prevention

Leverage deep learning to deliver highly accurate threat detection and reduce false positives in a rapidly evolving threat landscape.

Stop threats using real-time classification and prevention techniques to ensure robust and efficient cybersecurity.

Proactively stop zero-day threats in <20ms with unparalleled accuracy and minimal false positives.

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ MICROSOFT DEFENDER

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ TANIUM

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

LEGACY AV

Threat Research

Voice Of SecOps

Leadership Team

Board of Directors

Partners

Login

content_block

Recent Blog Posts

Recent Blog Posts

posts_listing

Blog Listing Page

In a previous article, we detailed the numerous ways to dump LSASS memory for credentials extraction, in this article we show a new way to dump LSASS 

LSASS.png

In a previous article, we detailed the numerous ways to <a href="https://www.deepinstinct.com/2021/01/24/lsass-memory-dumps-are-stealthier-than-ever-before/" target="_blank" rel="noopener">dump LSASS memory for credentials extraction</a>, in this article we show a new way to dump LSASS without dropping any new tool on the endpoint.MITRE Technique: <a href="https://attack.mitre.org/techniques/T1003/001" target="_blank" rel="noopener">T1003.001</a><h2>Technical Overview</h2>There is a very neat way to cause WerFault.exe (Windows Error Reporting process that handles process crashes) to create a memory dump of lsass.exe, in a directory of your choice. The major advantage of this technique is that it does not cause lsass.exe to crash, and since WerFault.exe is used to create file dumps all the time (not just lsass.exe), this method provides the added advantage of going undetected. &nbsp;WerFault.exe is a process known for dumping every crashing process, from an attacker standpoint this is appealing as their illicit credential extraction will appear benign because from a defender’s viewpoint it’s within the realm of normal activity.This method relies on a mechanism introduced in Windows 7 called Silent Process Exit, which provides the ability to trigger specific actions for a monitored process in one of two scenarios; either the process terminates itself by calling ExitProcess(), or another process terminates it via the TerminateProcess() API.There are multiple actions that can be configured to occur upon a silent process exit:<ul><li>Launch a monitor process</li><li>Display a pop-up</li><li>Create a dump file</li></ul>Option #1 can be used as a <a href="https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/" target="_self">persistence mechanism</a>. For the purpose of this study, we describe how to use option #3 for dumping lsass.To set-up a process for silent exit monitoring, a few registry settings must be set:<ol><li style="list-style-type: none;"><ol><li>The GlobalFlag for the process’ Image File Execution Options must be set to include the flag</li></ol></li></ol>FLG_MONITOR_SILENT_PROCESS_EXIT (0x200)2. SilentProcessExit must be set by either:a. Global settings, under the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExitb. Application-specific settings, under the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ProcessNameThe SilentProcessExit settings are set by registry values, for that purpose the interesting ones are the following:ReportingMode (REG_DWORD) – Bitwise OR of the following flags:<ul><li>LAUNCH_MONITORPROCESS (0x1) – Launch a monitor process</li><li>LOCAL_DUMP (0x2) – Create a dump file for the process that caused the termination and the process that was terminated</li><li>NOTIFICATION (0x4) – Display pop-up notification</li></ul>LocalDumpFolder&nbsp;(REG_SZ) – The directory where the dump files will be created. Default location is %TEMP%\Silent Process Exit.DumpType – Specifies the type of dump file (Micro, Mini, Heap or Custom) according to the MINIDUMP_TYPE enum. Full minidump is a value of MiniDumpWithFullMemory (0x2).So, what would happen if the SilentProcessExit registry settings are set so that LSASS.exe will dump itself, and then either lsass.exe is killed or the computer is shut down?To answer this, we use taskkill to terminate lsass. This brings up this message because Windows really doesn’t like to have lsass.exe shut down:<img class="alignnone wp-image-10632 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9d077b90b18a1fa4/611a79bacc91a61675b04d67/2.1-Windows-pop-up.png" width="602" height="156" style="width: 602px; height: 156px;"/>A warning like this is problematic for an endpoint user to see during an attempt to gather credentials, but it does provide a new directory under C:\temp, which contains the full memory dump of lsass.<img class="alignnone wp-image-10636 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1f9c6c4b66f26553/611a79b82ba0021687d2f437/2.2-Ctemp.png" width="602" height="100" style="width: 602px; height: 100px;"/>Nice!A dump of taskkill.exe is also obtained which normally isn’t accessible if the computer had been shut down, instead of terminating lsass.exe. This happened because the Silent Process Exit mechanism also causes the process that initiated the termination to be dumped as well.The question we now need to ask ourselves is – how is the process dumped? Thanks to <a href="https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/" target="_blank" rel="noopener">Hexacorn's blog</a>, we know that when a process terminates it calls the RtlReportSilentProcessExit() API from ntdll.dll, which will communicate to the Windows Error Reporting service (WerSvc under WerSvcGroup) that the process is performing a silent exit. The WER service will then launch WerFault.exe which will do the dumping of the exiting process. The interesting thing to notice is that calling this API does not cause the process to exit. This prompted us to run this process on lsass.exe, to get the file dump, but without terminating lsass.Here is the function definition of RtlReportSilentProcessExit():<pre>&lt;span style="color: #119fc2;"&gt;NTSTATUS&lt;/span&gt;&lt;span style="color: #9d73c7;"&gt;(NTAPI&lt;/span&gt;* &lt;span style="color: #00ccff;"&gt;&lt;span style="color: #119fc2;"&gt;RtlReportSilentProcessExit&lt;/span&gt;&lt;span style="color: #000000;"&gt;)&lt;/span&gt;&lt;/span&gt; ( &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;span style="color: #9d73c7;"&gt;_In_&nbsp;&lt;/span&gt;&lt;span style="color: #119fc2;"&gt;HANDLE&lt;/span&gt; &nbsp;&nbsp;&nbsp; ProcessHandle, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;span style="color: #9d73c7;"&gt;_In_&lt;/span&gt;&lt;span style="color: #119fc2;"&gt;NTSTATUS&lt;/span&gt; &nbsp; ExitStatus &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; );</pre>But what if we supply a ProcessHandle of LSASS.exe from OUTSIDE of LSASS?Calling RtlReportSilentProcessExit this way would require a handle to lsass.exe with PROCESS_VM_READ permissions and also need the SeDebugPrivilege privilege, otherwise, the dump file will be created but without any content. In addition, an x64 process is required to open a handle to an x64 lsass process.Using a program we have wrote that does just that, we can see here the dump file created:<img class="alignnone wp-image-10640 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt86403ffe090519e8/611a79b883a5a41684db9ed5/2.3-users-windows.png" width="602" height="204" style="width: 602px; height: 204px;"/>That’s great!Now, we can delete the unnecessary dump of our own process and send the lsass dump to our attacker server to have the credentials extracted.But can we go even further and force lsass.exe to create a dump of itself? Using CreateRemoteThread on lsass.exe, we were able to cause it to run RtlReportSilentProcessExit:<img class="alignnone wp-image-10628 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0acecc8c4bcafef0/611a79ba9e3e001656bde9b0/2.4-Write-itself.png" width="602" height="152" style="width: 602px; height: 152px;"/>Voila, Lsass.exe’s own dump file!From an EDR standpoint, it will appear as though lsass.exe requested a dump of itself from WER. Since WER is the mechanism in Windows which is responsible for creating dump files anyway, it is likely to be whitelisted as a process that creates a dump file of lsass.exe in order to reduce false-positives.The code to perform both of these methods can be found in our <a href="https://github.com/deepinstinct/LsassSilentProcessExit" target="_blank" rel="noopener">GitHub repository</a>.<h3>Suggested Solutions</h3>In the following section, we detail the measures that can be taken to detect dumping of the lsass.exe process.Monitoring RegistrySet a rule of registry value creation of GlobalFlag:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exeGlobalFlag&nbsp;&nbsp;&nbsp; REG_DWORD&nbsp;&nbsp;&nbsp; 0x200Note that GlobalFlag is a bitwise OR possibly numerous flags.The following registry key should also be monitored for creation and for changes:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exeMonitor FilesSet a rule for file creation for anything with the following pattern of file name:&nbsp;“lsass*.dmp”RunAsPPLWindows enables the ability to launch the lsass.exe process as a Process Protected Light (PPL), which prevents any non-PPL process from using OpenProcess() to access lsass.exe. This neutralizes all methods described in this article (besides the full memory dump methods). The following registry value is required to be set:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RunAsPPL&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; REG_DWORD 0x1&nbsp;The downside of this method is that setting lsass.exe prevents any third-party DLLs from loading into it, including known and benign authentication packages. If your organization utilizes some smart-card solution, for example, this is not an option.Due to the obscurity of this attack vector available AV and EDR solutions are not going to have these detection and mitigation configurations in place, rather they will need to be manually configured. In soon-to-be-delivered upcoming versions, Deep Instinct’s customers can expect to have <a href="https://www.deepinstinct.com/automatic-threat-analysis/" target="_blank" rel="noopener">automatic protection</a> from this technique within the credential dumping heuristic.<h2>Summary</h2>The numerous ways of dumping LSASS memory give attackers a range of options to stay undetected by antivirus products and EDRs. This new method that we have introduced to get a process dump of LSASS to disk, hasn’t been utilized before while the use of WER has the added benefit of making the illicit memory extraction appear benign. &nbsp;This creates a ripe opportunity for hackers, with the possibility of many security environments having the file dump process whitelisted.

LSASS Memory Dumps are Stealthier than Ever Before - Part 2

There is a contentious relationship between budgets and cybersecurity.

General consensus has it that bigger budgets equate to better security, but 

cost-of-a-data-breach.png

There is a contentious relationship between budgets and cybersecurity.
General consensus has it that bigger budgets equate to better security, but undoubtedly the security analysts at Desjardins Group would beg to differ. The Canadian lender revealed that it had spent $70 million CAD on its security operations prior to an attack that ended up exposing the personal data of 2.9 million of its members.
A <a href="https://www.csoonline.com/article/3434601/what-is-the-cost-of-a-data-breach.html#:~:text=The%20average%20cost%20of%20a,over%20the%20last%20five%20years." target="_blank" rel="noopener">report conducted by the Ponemon Institute</a> confirmed the upward path in the cost of a data breach, that in 2020 was at $3.86 million. While the impact of suffering from a cyber-attack remains high for all companies, irrespective of how big they are, where they are or what they do, the report did confirm that companies can exert some control in managing the cost of a data breach.
Interestingly, the study found that while there has been a 10% rise in cybersecurity costs over the last five years, 2019 saw a decrease in costs by 1.5%. The researchers attributed this decrease to companies who had taken effective precautions and processes, which contributed to coming out of 2020 relatively unscathed, and yet still in budget.
&nbsp;
<h3>The Costs of a Data Breach that can be Controlled</h3>
Depending on the configuration of a SOC, there are numerous aspects where the costs can be kept under control with the right combination of technological capabilities and processes.
<ul>
<li>Time Managing Endpoint Protection</li>
</ul>
This cost is born out of inordinate management overhead due to the use of multiple endpoint products, burdensome maintenance work, constant updates, and patching required. SOC teams should seek out <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener">cybersecurity solutions</a> that have wide platform play and provide protection across different devices, OS, and environments. They should require only the occasional update (ideally, just once or twice a year). This relieves SecOps employees of many of these manual and mundane processes.
&nbsp;
<ul>
<li>Time Investigating Endpoint Threats</li>
</ul>
This includes costs associated with the manual investigation of alerts and addressing false positives. Activities redressing alerts that are ultimately found to be benign, conducting triages and threat hunting activities contribute to a significant consumption in security analysts’ time. To address this security analysts should be using solutions that provide a high degree of detection accuracy (best-in-breed is a 99% and a 0.1% false-positive rate). Also, when considering a new vendor solution, it’s worthwhile to check what manual processes are automated and the degree to which <a href="https://www.deepinstinct.com/automatic-threat-analysis/" target="_blank" rel="noopener">threat analysis</a> is provided in bite size actionable slices.
&nbsp;
<ul>
<li>Time Remediating Endpoint Attacks</li>
</ul>
This cost includes all the activities undertaken by security engineers in remediating endpoint attacks, such as restoring from back-ups, re-imaging machines, and so on. The coronavirus pandemic upscaled the risk profile of endpoint attacks, not only due to the increase in attempted attacks but also due to added difficulties of remediating attacks on a remote workforce. As the perimeter no longer really exists anymore, SecOps need to refocus their attention on where events are occurring, and that is on the endpoint.
&nbsp;
<ul>
<li>Minimizing the financial loss due to user downtime</li>
</ul>
Endpoint attacks not only create remediation work for an organization’s IT security analysts, but they also impact the productivity of affected employees with the result of causing an organization even further financial loss. With employees working remotely, COVID-19 even further amplified the detrimental impact of an attack. Over the course of the pandemic, average user downtime per endpoint attack went up to 12 hours, as now the affected employee would have to cease work until they were able to obtain a replacement computer and set it up for usage. One of the ways SecOps can minimize the impact of these consequences of being breached is by retiring legacy solutions. Whether it be a legacy EDR or anti-malware software, these solutions simply cannot keep up with the modern threat landscape.
&nbsp;
<ul>
<li>Minimizing Likelihood of a Material Breach</li>
</ul>
Weaknesses in vendor products combined with a remotely located workforce that make it difficult to define the norm in user behavior, create loopholes for attackers to gain a foothold within an organization, especially through endpoint devices. By establishing a security operation that is not constantly flooded with alerts and overwhelmed by investigation activities help to close this window of opportunity. Eliminating alert fatigue allows security operations to pounce on the fewer threats that may manage to still get through.
Beyond these costs, there are also harder to quantify sources of financial loss to business operations. The non-direct impact of a security breach can include brand reputation damage, customer attrition, regulatory fines, customer reacquisition costs, and compensation payouts.
&nbsp;
<h3>Avoiding a Budgetary Journey to Bust</h3>
Despite the multiple moving parts that contribute to the cost-efficiency of a cybersecurity operation, with the right combination of technology, automation and optimal processes, the cost of securing an organization can be brought down. A <a href="https://info.deepinstinct.com/en/mof/deep-instinct-tei-study" target="_blank" rel="noopener">Forrester Total Economic Impact Study</a> found that customers of Deep Instinct were able to reduce their costs by 446%. The study which compiled the responses of customers into a representative organization of 7,000 endpoints managed by a SecOps team of 15 employees, calculated that they were able to reduce security operation costs by $3.5 million.
A break-down of the cost savings for each of the elements listed above can be found here:
<img class="alignnone wp-image-10307 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltec2a9521525815ed/611a79d8005cd416221b4b23/cost-of-a-breach-pie-chart.jpg" alt="" width="716" height="416" />
Figures are indicated in terms of thousands of dollars. The biggest cost saving was $1,300 million in time saved in threat investigation work, retiring legacy solutions was another big cost-saver at $860.7K.
Through the investment in <a href="https://www.deepinstinct.com/" target="_blank" rel="noopener">Deep Instinct</a>, the interviewed customers reported both quantitative and qualitative benefits against the backdrop of enhanced endpoint security. The early prevention through deep-learning predictive algorithms meant that the representative organization was able to prevent more attacks from occurring pre-emptively, they were able to get better visibility and control over the far fewer attacks that still managed to slip through, and SecOps employees were able to reallocate their time towards higher-value tasks and projects. The implementation of Deep Instinct reduced the number of false positives by 99% and significantly alleviated the workload placed on SecOps.
To learn more about how these customers were able to optimize their cybersecurity environment and put their budgetary figures in the green, we recommend <a href="https://info.deepinstinct.com/en/mof/deep-instinct-tei-study" target="_blank" rel="noopener">checking out the full Deep Instinct TEI Study</a>.

How Companies are Successfully Bringing Down the Cost of a Data Breach

Domain, local usernames, and passwords that are stored in the memory space of a process are named LSASS (Local Security Authority Subsystem Service). 

Rarely analyzed on its own, but rather as part of a wider attack chain, this article provides an in-depth analysis of LSASS dumps as an attack vector. By aggregating multiple sources of information, it focuses on the numerous ways known today to retrieve a dump file of LSASS. In Part 2, we introduce a new method of LSASS dumps that was found to be particularly stealthy that was discovered in Deep Instinct’s threat research labs.<h2>What Are LSASS Memory Dump Files and How Do Attackers Use Them?</h2>Domain, local usernames, and passwords that are stored in the memory space of a process are named LSASS (Local Security Authority Subsystem Service). If given the requisite permissions on the endpoint, users can be given access to LSASS and its data can be extracted for lateral movement and privilege escalation.It is increasingly common to see LSASS memory dump files being sent over the network to attackers in order to extract credentials in a stealthier manner. The alternative is running Mimikatz on the endpoint which might cause it to be blocked or detected by the local antivirus software.In fact, LSASS dumps were observed in the highly pervasive <a href="https://www.deepinstinct.com/2019/07/12/trickbooster-trickbots-email-based-infection-module/" target="_blank" rel="noopener">Trickbot</a> campaign that necessitated the applied effort of the US Cyber Command to break the bot’s connections to the larger network. While at the same time, Microsoft along with other partners, had to resort to securing court orders to take control and bring down Trickbot’s command and control servers.Arguably, the most notorious tool in the Windows landscape for red teams and threat actors is Mimikatz, the tool used to extract usernames and passwords from LSASS. Benjamin Delpy, its creator, has thoroughly researched the authentication process in Windows, and released an open-source tool with the capability of extracting Windows credentials that are stored in the LSASS process. He does this either by reading the memory structures inside LSASS memory space or by reading a full memory dump file of LSASS.Read more about <a href="https://attack.mitre.org/techniques/T1003/001" target="_self">MITRE's LSASS Memory Dumping</a>. <h2>Known Methods for Dumping LSASS</h2>1. Microsoft-Signed ToolsOut of all the options available, using Microsoft-signed binaries is an extremely convenient way to stealthily get a memory dump of LSASS, especially when they are already present on the workstation. Using these methods can deter blue teams because something like ProcDump is problematic to add to a blacklist. All these tools end-up calling the API mentioned in the “Custom Dump Tool” section.2. Task ManagerThe built-in task manager has a dumping mechanism for processes:<figure style = "float: none;width: 213px;max-width:auto;"><img class="alignnone wp-image-10258 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt597da55c9ad60b0d/611a79e949650215ea9eb537/Dialog-box-to-dump-file.png" alt="Dumping LSASS in Task Manager" /></figure>A dialog will be displayed and the dump file will be located in the TEMP folder as &lt;process name&gt;.DMP:<figure style = "float: none;width: 220px;max-width:auto;"><img class="alignnone wp-image-10262 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb499d2e2ffe25cbe/611a79e7844c89162405ee58/file-location-of-dump.png" alt="LSASS dumping file located in TEMP folder" /></figure>3. Process ExplorerThe Sysinternals tool ProcExp.exe tool can also be used for process dumping:<figure style = "float: none;width: 382px;max-width:auto;"><img class="alignnone wp-image-10250 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltef4fdefe66de155d/611a79ea2ba0021687d2f449/Sysinternal-tool.png" alt="LSASS dumping with Sysinternals and ProcExp.exe tools" /></figure>The dump file location and name (excluding extension, which must be .dmp) can be set with the “Save As” dialog.4. ProcDumpThe Sysinternals tool ProcDump.exe is probably the tool that is used the most by malware to dump the LSASS process to disk, due to its command-line capabilities and since it’s not used exclusively for dumping the LSASS process. While the “.dmp” extension is necessary, the rest of the dump file name can be controlled in the arguments:<figure style = "float: none;width: 602px;max-width:auto;"><img class="alignnone wp-image-10278 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltad928c22509cd691/611a79e5239eb216a30d1b42/ProcDump.png" alt="ProcDump tool for LSASS dumping" /></figure>5. ProcDump With Clone Flag<figure style = "float: none;width: 602px;max-width:auto;"><img class="alignnone wp-image-10274 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf53b3ffc881f835c/611a79e6bb11b815dcedc6eb/ProcDump-with-clone-flag.png" alt="LSASS dumping: Use ProcDump to clone lsass.exe and dump the clone to a disk" /></figure>Using the “-r” switch causes ProcDump to create a clone of lsass.exe and to dump the clone to disk.6. SQLDumperSQLDumper.exe is included with both Microsoft SQL and Office and has the <a href="https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/" target="_blank" rel="noopener">ability to produce a full dump file</a>.<figure style = "float: none;width: 602px;max-width:auto;"><img class="alignnone wp-image-10286 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfd88bad22850968e/611a79e075cc581671070676/SQL-Dumper.png" alt="LSASS dumping with SQLDumper" /></figure>The first parameter is the PID of the process to dump. The dump file will be located in the current directory (“C:\users\windows” in my case), and the dump file name will have a pattern of SQLDmprxxxx.mdmp.7. Comsvcs.dllThe “comsvcs.dll” can be found in every Windows system and has an export that can be used to <a href="https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz" target="_self">dump processes by their PID</a>. This is also a very popular choice among malware authors. The command line should be written in the following way:rundll32.exe comsvcs.dll MiniDump &lt;lsass PID&gt; &lt;out path&gt; full<figure style = "float: none;width: 602px;max-width:auto;"><img class="alignnone wp-image-10254 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbc3182c4fe5de2bc/611a79e9180e12166a5b4b7c/comsvcs.png" alt="Use Comsvcs.dll to dump LSASS files." /></figure>Note, that the process needs to have a debug privilege, and for that reason, PowerShell was used for this command.8. PowerSploit Out-MiniDumpOne of the modules of PowerSploit, <a href="https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1" target="_self">Out-MiniDump</a>, which is a Powershell-based penetration toolkit, has the option to create a process’ full memory dump:<figure style = "float: none;width: 452px;max-width:auto;"><img class="alignnone wp-image-10270 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd441c07f69d130ea/611a79e65fe4021650f8a7dd/PowerSploit.png" alt="Dumping LSASS with PowerSploit Out-MiniDump" /></figure><h2>Other Signed Tools</h2>Process Hacker is another great tool for producing memory dumps:<figure style = "float: none;width: 249px;max-width:auto;"><img class="alignnone wp-image-10282 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5e1a2d1697772a50/611a79e5207bb815f5885765/Process-Hacker.png" alt="How to create an LSASS dump file with Process Hacker" /></figure>A “Save File” dialog will be opened in which you can specify any filename you want, including the extension.<a href="https://info.deepinstinct.com/8-reasons-why-edr-is-not-enough" class="inline-block tracking-widder font-bold uppercase text-cta button_btn--square__qkto_ button_btn--yellow__9MFxXinline-block tracking-widder font-bold uppercase text-cta button_btn--square__qkto_ button_btn--yellow__9MFxX" style="text-decoration-line: none;text-decoration-thickness: initial;text-decoration-style: initial;text-decoration-color: initial;" target="_self">8 Reasons Why EDR Is Not Enough</a><h3>Full LSASS Memory Dump Options</h3>Dumping the entire RAM to disk is another way to get credentials out of LSASS. Although this tends to be less preferred because producing a full dump will take some time and take up a lot of space on disk, which is usually not desirable for attackers.1. Live memory dumpOut of all the options for full memory dumping listed here, this method is probably the most practical for an attacker. There are some signed kernel drivers that can go through the entire memory and dump it to disk. WinPmem for example is signed by Google and allows for the creation of a full memory dump. <a href="https://labs.f-secure.com/blog/rethinking-credential-theft/" target="_blank" rel="noopener">Physmem2profit</a> utilizes WinPmem with a C2 server to allow reading LSASS memory through the WinPmem driver, without dropping the full memory to disk.2. Hibernation fileThe hiberfil.sys can be copied with a tool like<a href="https://github.com/jschicht/RawCopy" target="_blank" rel="noopener"> RawCopy</a> to extract credentials with explanations available on how to <a href="https://diverto.github.io/2019/11/05/Extracting-Passwords-from-hiberfil-and-memdumps" target="_blank" rel="noopener">get the credentials out of the hibernation file</a>.3. VMEM/VMSN fileA full memory dump can be extracted from the memory file created when either taking a snapshot of a virtual machine or by suspending one. See an explanation of <a href="https://diverto.github.io/2019/11/05/Extracting-Passwords-from-hiberfil-and-memdumps" target="_blank" rel="noopener">how to extract LSASS credentials</a> from hibernation and VMEM files.<h2>Custom Dump Tool: How to Do a Manual LSASS Dump</h2>While the options above provide a good opportunity to get a dump file of LSASS, these tools can often be detected by their command line or output dump file. For example, ProcDump requires the “-ma” options, and Task Manager drops a file name “lsass.DMP” to the hard disk. These artifacts are incriminating, and a simple threat hunt can catch these activities. This makes it preferable to write a program that manually dumps the LSASS process (one tool that does this is <a href="https://github.com/outflanknl/Dumpert" target="_blank" rel="noopener">DumpErt</a>). Below, are two example methods of achieving this:1. MiniDumpWriteDump methodInside dbghelp.dll there’s a function called MiniDumpWriteDump, which is <a href="https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump" target="_self">&nbsp;</a>:<figure style = "float: none;width: 372px;max-width:auto;"><img class="alignnone wp-image-10266 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0594c87a4359df44/611a79e83ad228160f2ddeb7/MiniDumpWriteDump.png" alt="how to do an lsass dump with MiniDumpWriteDump" /></figure>Internally, MiniDumpWriteDump uses the undocumented NtReadVirtualMemory API to read the process memory of its target.2. MiniDumpWriteDump + PssCaptureSnapshotSince opening a privileged handle to LSASS and passing it to MiniDumpWriteDump can be incriminating, a more stealthy method is to create a process snapshot of LSASS using the <a href="https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass" target="_blank" rel="noopener">PssCaptureSnapshot API</a>, which is also documented by MSDN. In fact, this method of process dumping is documented on its own page in <a href="https://docs.microsoft.com/en-us/previous-versions/windows/desktop/proc_snap/export-a-process-snapshot-to-a-file" target="_blank" rel="noopener">MSDN</a>.Every tool listed in all the previous categories of LSASS memory dumping uses one of these two methods (excluding the full memory dumping methods).<h2>Summary</h2>In this article, we have laid out all known methods of dumping the lsass.exe process for credential extraction. Since different EDRs have different ways of detecting a memory dump of lsass.exe, for IT security practitioners it serves to be aware of all the different methods to make sure all possible attempts are caught. Upon identifying one of the credential-stealing methods described here, the methods to mitigate this attack vector are detailed in the MITRE ATT&CK framework. However, with the release of Deep Instinct’s credential dumping heuristic in version 2.5 of our <a href="/product-overview/" target="_blank" rel="noopener">cybersecurity product</a>, all of our customers are protected from this type of malicious activity.Make sure to check out Part II of this series, where we introduce a <a href="/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2" target="_blank" rel="noopener">new lsass.exe dumping method</a> that has never been analyzed before.<a href="https://info.deepinstinct.com/8-reasons-why-edr-is-not-enough" class="inline-block tracking-widder font-bold uppercase text-cta button_btn--square__qkto_ button_btn--yellow__9MFxXinline-block tracking-widder font-bold uppercase text-cta button_btn--square__qkto_ button_btn--yellow__9MFxX" style="text-decoration-line: none;text-decoration-thickness: initial;text-decoration-style: initial;text-decoration-color: initial;" target="_self">8 Reasons Why EDR Is Not Enough</a><h2>Further Reading:</h2><ul><li><a href="/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2" target="_self">https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2</a></li><li><a href="/blog/2022-cyber-threat-landscape-report" target="_self">https://www.deepinstinct.com/blog/2022-cyber-threat-landscape-report</a></li><li><a href="/blog/what-s-new-in-deep-instinct-3-0" target="_self">https://www.deepinstinct.com/blog/what-s-new-in-deep-instinct-3-0</a></li></ul>

LSASS Memory Dumps are Stealthier than Ever Before

Emotet, the infamous malware botnet, went silent at the end of October and came back on December 21, 2020. The botnet continues to serve as a platform

emotet-new-wave.jpg

Emotet, the infamous malware botnet, went silent at the end of October and came back on December 21, 2020. The botnet continues to serve as a platform that installs other malware in the infected systems. Currently, it's being observed delivering Trickbot. <a href="https://securityaffairs.co/wordpress/112817/malware/emotet-campaign-hit-lithuania.html" target="_blank" rel="noopener">Lithuania's National Public Health Center</a> was <a href="https://nvsc.lrv.lt/lt/naujienos/siunciant-dideli-kieki-virusu-uzkrestu-elektroniniu-laisku-antra-karta-si-rudeni-bandoma-pakenkti-valstybes-institucijoms" target="_blank" rel="noopener">hit by Emotet</a>. The malware infected their internal networks and began downloading additional files, sending fake emails, and engaged in other types of malicious activity. This caused the institution to temporarily disable their email systems until the malware was removed.We have been following the botnet operation. In the previous publications, we described the <a href="https://www.deepinstinct.com/2020/08/12/why-emotets-latest-wave-is-harder-to-catch-than-ever-before/" target="_blank" rel="noopener">techniques used by Emotet</a> to avoid detection by security products, and how to overcome them and <a href="https://www.deepinstinct.com/2020/10/12/why-emotets-latest-wave-is-harder-to-catch-than-ever-before-part-2/" target="_blank" rel="noopener">unpack the malware</a>.In this blog post, the new loader of Emotet will be examined and compared to the previous one. We’ll describe the changes to the unpacking order, new unique properties of the files, and novel obfuscation methods. We’ll also talk about which evasion techniques and indicative features of the malware stayed the same.<h3>Differences</h3><ol><li>Execution flow – The malware is packed and there are several steps performed before the final payload is executed.</li></ol><img class="alignnone wp-image-10145 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt011ba48de43d59ad/611a79fabf98451666a132d0/4-Infection-Stages.jpg" width="800" height="726" data-image="3wyiqfj512hb" style="width: 800px; height: 726px;"/>From the samples we recently gathered, the number of steps executed was cut down:<img class="alignnone wp-image-10128 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb9344e17cf74b901/611a7a060779a81633f9ebf3/reduced-stages.jpg" width="690" height="553" data-image="6nh75fc819nk" style="width: 690px; height: 553px;"/>The reason for that is unclear, but our hypothesis is that the longer unpacking process was ineffective at reducing detection rates. <a href="/glossary/emotet-malware" target="_self">Emotet</a> uses a technique called reflective loading to load all of its stages. If a certain security product can detect reflective loading, using it multiple times won’t help to evade it. Another explanation can be that they are trying to evade heuristics that were created specifically for Emotet. The previous execution flow was very long and unique. If their malware is prevented by detecting this specific flow, changing it might help.2. The Loader – The loader went through a few changes, the first of which is switching from an executable file to a DLL. This DLL has unique exports: “RunDLL” and “Control_RunDLL”. This makes it possible to detect Emotet infections with EDR. If the process rundll32.exe was started with a parameter that matches the export, the system would be infected. Samples can also be detected with the following YARA rule:import "pe"private rule emotet_exports { condition: pe.exports("RunDLL") or pe.exports("Control_RunDLL") }private rule is_dll { condition: pe.characteristics & pe.DLL }rule emotet { condition: is_dll and emotet_exports }We noticed another important change from the samples we manually examined. It looks like some of them do not contain benign code. This technique was used by the malware to reduce the detection rate and bypass security products but has since disappeared.3. Additional obfuscation – A new code obfuscation technique was observed in payloads extracted from the loaders. They set the value in local variables using many bit-wise operations instead of a single, simple operation. This form of obfuscation makes it is harder to understand the code without executing it and makes the debugging process more tedious.<img class="alignnone size-full wp-image-10132" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf09d39e5e2e1c812/611a7a06e29cee162e563780/image1.png" width="240" height="623" data-image="xrv3fydxty8m" style="width: 240px; height: 623px;"/><h3>Similarities</h3>1. Decryption algorithm – The payload is stored as an encrypted resource inside the loader. While performing the research on the previous wave of Emotet, we developed a tool that is able the decrypt and extract the payload statically, without executing the malware. This tool is still viable for recent samples, and this shows the developers did not change the algorithm.2. Code obfuscation – In addition to the obfuscation described above, there is an obfuscation technique that also existed in the previous version of the payload. The code contains a complicated switch case and unnecessary jump instructions making it harder to understand the natural order of the code.<img data-image="ouci405yiyeg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltdb5b5c294332df09/6180b46407a3a40cd7f0e0c9/image2-1000x803.png" data-sys-asset-uid="bltdb5b5c294332df09" alt="image2-1000x803.png"/>3. Hidden data – The payload conceals its functionality by not listing any WinAPI import or meaningful string. This subverts the static analysis and forces the researcher to debug the malware to discover this data. The strings are stored in an encrypted form, and the APIs are resolved using a hash of their name. The decryption algorithm of the strings and the <a href="https://www.deepinstinct.com/2020/10/12/why-emotets-latest-wave-is-harder-to-catch-than-ever-before-part-2/" target="_blank" rel="noopener">hashing algorithm of the APIs</a> stayed the same.<h3>Practice Makes Perfect</h3>By assessing the stages of 2020's new trojan&nbsp; of Emotet, the changes and new techniques used by the malware were identified along with the parts and features that have stayed the same.Emotet is known as very evasive malware. These modifications indicate a desire to decrease their detection rate as much as possible. The techniques that were found useful for bypassing security products were kept, while the methods that were improved or removed are reflective of an agile methodology of improving on what isn’t sufficiently effective.Keeping track of modifications in malware such as Emotet is vital because of their wide infection base. New evasion or injection techniques might help the malware to bypass security products and infect many systems.

Emotet Malware 2020

With the advancement of technology and artificial intelligence in the 21st century, AI applications are being introduced in a myriad of sectors. Parti

shutterstock_394552096-1.jpg

With the advancement of technology and artificial intelligence in the 21st century, AI applications are being introduced in a myriad of sectors. Particularly in the Covid era, digital transformation has been rapid in many sectors that are not yet equipped to deal with advanced and increasing cyber threats, putting valuable digital assets at risk of malicious AI attacks.To cope with these increased threats, an efficient Advanced Threat Protection (ATP) security system is required that can filter malicious breaches and prevent user data from falling into the wrong hands. ATP security is an <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener">advanced malware protection</a> system designed to protect sensitive data from complex and malicious <a href="https://www.deepinstinct.com/2019/05/19/how-ai-can-be-used-for-malicious-purposes/" target="_blank" rel="noopener">AI malware attacks</a>.Among ATP security solutions are <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener">artificial intelligence antivirus products</a> that are purposed to protect organizations to achieve ongoing security of digital assets and valuable data. Different vendors have introduced highly innovative <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener">endpoint security platforms</a> to help users improve organizational and corporate digital security. ATP Security provides the best adaptive system for organizations to deal with various cyber-attacks and malware, providing detection and prevention before a cyber attack strikes. By taking a preventative approach, files are analyzed before they get the chance to execute, keeping the risk profile of an organization as low as possible, while easing the endpoint management of the threats that still manage to get through.&nbsp;<h3>How Does ATP Security Work?</h3>Despite their focus on preventing cyber threats, ATP security solutions should address the entire cybersecurity protection lifecycle, from prevention, detection and response, and finally remediation. It has three main goals.<ol><li>Early detection: It scans for access vulnerabilities to critical data before the risks are noticed</li></ol><ol><li>Swift defense: Automatically scans all files to defend against AI-based malware attacks.</li><li>Response:&nbsp; Proactive response&nbsp;to mitigate risks and respond to offensive events.</li></ol>To achieve these goals an ATP security solution will need several components and functions. Such as;Real-time visibility:Provides real-time visibility into events occurring behind your network programs. Without real-time visibility, it will be too late to detect attacks before the damage is already done.Deep Learning capabilities:&nbsp;Ideally, the ATP operation should involve an automated deep learning algorithm that can detect and prevent not just known malware, but more importantly new, never-seen-before malware variants.Data awareness:The system must be aware of data sensitivity, value, and other factors, to determine risk severity and respond accordingly.Further study may be required when a risk is found. The ATP's security services typically handle risk analysis and enable the business to carry on as usual with minimal downtime. File analysis, minimizing threat surfaces, and detection and response functions are all carried on behind the scenes.&nbsp;<h3>Key Features of an ATP Operation:</h3>ATP products have various features that make them stand out from traditional detection or antivirus products. Some of their key features are:Automatic File Analysis:The most important feature is to combat and deal with imminent threats swiftly. ATP products monitor data traffic and <a href="https://www.deepinstinct.com/zero-day-attacks" target="_self">prevent zero-day attacks</a> with strong artificial intelligence deep learning models. They analyze data in real-time to automatically mitigate threats that are indicated to be above a set risk threshold.Attack Surface Reduction:ATP products eliminate risk by minimizing the attack surface area of the organizational work environment with hardware-based and file isolation, exploit and network protection, and application control (particularly for smartphones), etc. This is particularly important given the expansion of attack surfaces due to the rapid and widescale move to work from home.Protection and Detection:ATP security prevents ongoing attacks and mitigates threats before system breaches occur. However, even after an attack has been able to execute, it provides some level of protection by continuously monitoring behaviors with a dynamic analysis engine to protect against advanced, and highly threats that managed to get through the prevention-focused solutions. This includes advanced threat hunting, intrusion detection, and providing analysis tools that enable the security analyst to pivot and quickly narrow down suspicious activity.&nbsp;ATP security is a comprehensive <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener">endpoint protection</a> system that mitigates the threat of cyberattacks and protects sensitive business or organizational data from breaches. Artificial intelligence antivirus, with its focus on prevention, is one of the most vital applications used in an ATP security operation. The cost of cleaning up a security breach, rather than mitigating it proactively, is enormous. Without a robust preventative defense, an attack can bring business to a halt, cause brand damage, and contribute to customer attrition. In the present era, as digital adoption increases and more sensitive is hosted on the cloud, ATP is undoubtedly a leading asset of any security operation and a necessity for organizations.

What is ATP Security?

The SunBurst trojan was first reported on December 8th, 2020, and has been making headlines ever since. The Sunburst malware is significant both for i

sunburst-malware.png

The <a href="https://www.deepinstinct.com/2020/12/16/sunburst-trojan-what-you-need-to-know/">SunBurst trojan</a> was first reported on December 8th, 2020, and has been making headlines ever since. The Sunburst malware is significant both for its strategic and highly developed malicious logic and for its many targeted high-profile victims.
Reminiscent of the Duqu 2.0 nation-state attack in 2015, which successfully infiltrated Kaspersky, the sophistication of the Sunburst attack is indicative of a nation-state group that is sufficiently well-resourced to conduct the in-depth research and development that it would have necessitated. This is evident in the identification of Orion as a prime target to host a backdoor and the many other multiple evasion techniques that successfully avoided its detection for months in 2020.
Orion, the SolarWinds product that was compromised, was used by about 33,000 public and private sector customers, many of which were Fortune 500 companies and federal government agencies. This entailed the compromised data of many millions of their respective customers causing the event to be of wide public interest.
This post will provide a more elaborate description of the attack flow, as well as additional details about new developments in the battle against SunBurst.
<h3>The Attack Flow</h3>
The attackers had silently compromised the SolarWinds’ software development framework/infrastructure used for building Orion’s software updates allowing the adversaries to patch the update packages, specifically its component “SolarWinds.Orion.Core.BusinessLayer.dll”.
Like other updates, the infected Orion Windows Installer patches were available to users for download on SolarWind’s official website.
Once an infected patch installer was executed, the patch’s intended legitimate functionality took place, but the attacker’s code did as well. When the infected DLL was called, the malicious code inserted into it by the threat actors made sure that the SunBurst backdoor would be executed each time the legitimate task was run.
In the short term, the backdoor stayed dormant for 12 to 14 days. Each time the recurring task executed it, it checked if the specified period had passed, and if not- it didn’t execute the malicious part.
Once the time threshold passed, the backdoor-related code ran a series of tests, including comparing the list of running processes against encoded blacklists of security analysis and antivirus related process names, driver paths, and services. If one of the blacklisted processes was running, there would be an attempt to disable it and restart the SunBurst backdoor malware.
If the system passed all the pre-execution tests, the malware would gather information about its execution environment and the domain it resided in and send this information to its command and control (C&amp;C) server. The data was sent to a URL, which was unique per user, as it contained the encoded name of the infected machine’s domain. The URL was a subdomain of avsvmcloud[.]com. SunBurst also checked the IP returned for the requested domain, and if it was in a certain range, the malware terminated itself and made sure that no further executions would take place.
Using the C&amp;C servers, attackers could reply to the end-user malware with commands to execute on the victim machine. If they found a certain domain to be particularly interesting, they would order the backdoor to connect to a different C&amp;C server, from which additional commands could be executed and more malware samples could be downloaded.
<h3>Evasion Mechanisms</h3>
The attackers had put a lot of thought into how to evade detection and since it took months to discover their activities, their efforts clearly paid off. Besides staying dormant for 12 to 14 days and refraining from performing malicious activities while certain security processes were running, the malware set hostnames on its C&amp;C infrastructure to match legitimate hostnames from the victim's environment. This enabled the malware to more effectively blend in the environment and avoid suspicion that could have alerted security analysts if they used different hostnames. Moreover, SunBusrt’s network activity was made to look like it came from the Orion Improvement Program (OIP) protocol and the malware stored reconnaissance information within legitimate plugin configuration files, so it could blend in with legitimate SolarWinds activity. The attackers also used IP addresses from the same country as the victim, using Virtual Private Servers, as out-of-country IPs could arouse suspicion.
<h3>Microsoft vs. SunBurst</h3>
Since the attack was first reported, Microsoft has taken substantial measures against the malware and has played an important part in the effort to neutralize it. First, the company removed the digital certificate used to sign the compromised DLL, meaning Windows systems no longer immediately trust this DLL, which is intended to cause some of its executions to fail. Next, Windows Defender was set to detect the malware and alert its presence in a compromised machine.
On December 15th, Microsoft and partners took legal action against the attackers and sinkholed the domain "avsvmcloud[.]com", which was used as the malware's C&amp;C server. The domain now redirects to an IP controlled by Microsoft, which, alongside its partners, monitors the IP for incoming connections, and then informs compromised organizations about the breach.
As mentioned earlier, the end-user backdoor checks the returned IP for the C&amp;C domain and if it is in a certain range, a “kill switch” is activated- the malware terminates itself and any plans for further execution of it are canceled. Knowing that Microsoft set the IP returned for the C&amp;C domain to one that will turn this “kill switch” on. However, FireEye warned that in cases it investigated, attackers had established additional persistent mechanisms, which were left unaffected by this action. Their investigation showed the attackers still have a way to connect to victim machines without this backdoor.
If that wasn’t enough, on December 16th, Microsoft changed Windows Defender’s approach towards SunBurst from "Alert" to "Quarantine".
<h3>A New Malware</h3>
The attack’s complexity, significance, and publicity caused many to try to analyze it. In the past few days, it was reported that a new backdoor, dubbed “Supernova”, was discovered while analyzing samples of the compromised Orion software. Similar to “SunBurst”, “Supernova” is a backdoor made to be used as a persistence mechanism. The newly discovered malware is file-less – it is compiled and executed in memory, which makes it hard to detect by security products. At this point, not many details are known about “Supernova”, but it is believed to be a part of an attack unrelated to “SunBurst”, since unlike the DLL used to deliver the latter, the DLL used to deliver the former is not signed with a legitimate SolarWinds certificate.
<h3>More Victims</h3>
Recently, more organizations confirmed that they were compromised by “SunBurst”. On December 17th, the FBI, DHS-CISA, and the Office of the Director of National Intelligence (ODNI) confirmed in a joint statement, that the backdoor had affected US federal government networks. On December 21st, VMWare confirmed that its network was also compromised by the attack, but claimed that the attackers did not use their access to the network for any additional malicious purposes. Microsoft also confirmed that it found variants of the backdoor in its network, however, the company claimed that there is no evidence that attackers had accessed any customer data or compromised any of its products.
As was mentioned earlier, SunBurst backdoors connected to unique URLs, in which the domain names that they had infiltrated into were encoded. By decoding a list of subdomains generated by the malware, researchers were able to find names of well-known organizations, some of which have yet to disclose if the supply chain attack affected them. These names include Cisco, Intel, and Mediatek.
<a href="https://www.deepinstinct.com/" target="_blank" rel="noopener noreferrer">Deep Instinct</a> is on the alert for any new developments and does everything in its power to ensure our customers are protected from any malicious file that may try to compromise their systems. We are focused on expanding and monitoring all relevant IoCs and making sure Deep Instinct’s advanced <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener noreferrer">endpoint protection solution</a> protects against them.

Why the Sunburst Malware Was So Unique and What We've Learnt From it

On December 8th, the security company FireEye disclosed that it had been breached by an advanced, supposedly nation state-backed, attack group, and as

Solar-burst.png

On December 8th, the security company <a href="https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html" target="_blank" rel="noopener noreferrer">FireEye disclosed</a> that it had been breached by an advanced, supposedly nation state-backed, attack group, and as a result- tools developed and used by the company’s red teams were stolen.
It was later disclosed that the attackers were able to infiltrate FireEye’s network by infecting updates of a popular IT infrastructure management software named Orion, with their malware. Orion is a SolarWinds product, used by many organizations, including many Fortune 500 companies and the US Treasury Department, which was affected by the campaign.
The malware is believed to had been distributed in Spring 2020, compromised Orion versions 2019.4 HF 5 to 2020.2.1, and most likely resided in breached networks for months without being detected.
The trojanized updates delivered a backdoor, dubbed “<a href="https://www.deepinstinct.com/2020/12/28/why-the-sunburst-malware-was-so-unique-and-what-weve-learnt-from-it/" target="_blank" rel="noopener noreferrer">SunBurst</a>” by FireEye and “Solorigate” by Microsoft, that allowed the attackers to steal data, which is assumed to be the attack’s primary goal. To avoid detection, the attackers had limited the malware’s capabilities, tracked security software installed, and put a lot of effort into making SunBurst’s network activity look normal. The breadth, sophistication, and scope of the attack indeed indicate it was perpetrated by an advanced threat actor with ample, state-level resources and motivation.
Although the attackers had likely planned for their actions to be hard to attribute to any specific attack group, many in the cybersecurity and intelligence communities believe that the attack group APT 29, aka “Cozy Bear”, was behind these attacks. The Russian Embassy in the USA denied this accusation.
The story of “SunBurst” trojan is still unfolding, and more chapters will probably be added to it in the upcoming weeks. It’s likely that more organizations, that were compromised by the malware, will realize it and publicly disclose this information, as well as the effect it has on their clients or others. The large interest in the attack and its scale will probably result in the release of more technical details and behavioral evidence, as many in the cybersecurity field investigate the attack and analyze the malware samples.
<h3>Putting Out the Fire</h3>
As mentioned earlier, the attackers stole tools developed by FireEye’s red team, to test their customers’ security. These tools can be used dually for malicious purposes as well, so knowing that they are in the wrong hands, FireEye released rules and IoCs, that can help security vendors detect and prevent the use of the stolen tools in the networks they are entrusted with.
Moreover, SolarWinds released an update and urged its customers to install it, so it could replace the compromised versions. We call on our customers and partners to update SolarWinds software where applicable.
As one of the leading <a href="https://www.deepinstinct.com/about-us/">cybersecurity companies</a> today, Deep Instinct is always on the alert for new attacks of this kind and does everything in its power to ensure our customers are protected from any threat they might face. We are focused on expanding and monitoring all relevant IoCs and making sure <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener noreferrer">Deep Instinct’s cybersecurity product</a> line protects against them.

SunBurst Trojan -What You Need to Know

As originally published in VMblog

How is the cybersecurity landscape shaping up for 2021? With the wholesale structural shift to WFH, we provide so

blog3-copy-12.jpg

As originally published in <a href="https://vmblog.com/archive/2021/01/25/deep-instinct-2021-predictions-connected-world-means-many-challenges-for-cybersecurity.aspx#.YA7-T-gzZPZ" target="_blank" rel="noopener">VMblog</a>
How is the cybersecurity landscape shaping up for 2021? With the wholesale structural shift to WFH, we provide some cybersecurity predictions into how this rupture will continue to pan out in 2021. Cyber leaders will need to keep their proverbial ‘finger on the pulse’ to keep pace with the new risks, priorities, and considerations that are emerging in this rapidly evolving arena.
<h3>Covid19 After Effects</h3>
While all the <a href="https://www.deepinstinct.com/2020/03/26/attackers-abuse-the-covid-19-pandemic-to-spread-malware/" target="_blank" rel="noopener noreferrer">Covid19 themed Mal-spam</a> that we’ve seen will eventually die down, the new arrangement of Working From Home (WFH) is going to become the industry norm. The concern is that in the time that it takes companies to upscale their security to meet the changing location and form of the office network, we will see hackers taking advantage of this window of exposure. Previously, an organization’s network and all its data were sitting securely behind fortifications of the organizational security network. All of a sudden, the transition of moving to a wide and varied mess of different work environments makes it far more complex for defenders to keep protecting the enterprise at the same level. Naturally, the organization’s attack surface is amplified. While in the past only one attempt was all a hacker could get of successfully breaking in using a new variant of malware, now they have multiple attempts, all with equally good chances. And for an attack to cause damage, it only needs to succeed once.
An example of this was the <a href="https://www.zdnet.com/article/cognizant-expects-to-lose-between-50m-and-70m-following-ransomware-attack/" target="_blank" rel="noopener noreferrer">Cognizant incident</a> that hit the company early on in the work from home transition. The IT Service provider was attacked by ransomware that managed to bring business to a halt for a period of time and is alleged to have cost the company between $50 and $70 million.
<h3>The Proliferation of Botnets and Access as a Service</h3>
Botnets have become one of the biggest cyber threats today and by that nature a major cause for concern to those charged with cybersecurity. What makes botnets so dangerous is the size of their network, where the more infected online devices that a botnet has under its command, the wider its pool of malware delivery, and therefore the bigger its impact. And considering, a hacker’s ultimate goal is financial gain, malware infiltration, or just disruption, the bigger the pool, the better. In 2021, we expect to see more malware creators sell access to their botnets, and thereby access into their network of millions of infected connected devices. In an exchange that researchers at Deep Instinct have coined ‘Access-as-a-Service”.
The implication of this is bad. These botnets have market value in the dark web for their ability to break down the attack chain into several components, so that a smaller scale hacker can just focus their efforts on fewer components of the attack chain, and thereby become more skilled in just those limited components. For example, the botnet will provide the initial access, while the hacker will focus their effort on becoming better at information theft or the ransomware logic.
<h3>Organized Cybersecurity Co-operation Between Government and Private Enterprise</h3>
Combatting the growing complexity of attacks has necessitated the collaboration between private companies and government security departments. This was particularly observed in the lead up to the US elections this past November where the U.S. Cyber Command branch of the Department of Defense collaborated with multiple security companies in an effort to <a href="https://www.bleepingcomputer.com/news/security/trickbot-botnet-targeted-in-takedown-operations-little-impact-seen/" target="_blank" rel="noopener noreferrer">take down Trickbot</a>. The malicious botnet which is known to be one of the most active and dangerous, had many of its infected computers liberated, as the combined effort worked to put the brakes on the attempt to interfere with electoral systems.
Furthermore, Microsoft was able to clear a legal pathway to sabotage the botnet on the basis that the writers of Trickbot malware are infringing their terms of service. Instead of writing their own code from scratch, they’re abusing Microsoft code, an activity that almost every malware writer is bound to do.
We expect to see this collaboration continue and escalate as more nation-states engage in cyber warfare and support both the development and defense efforts of APTs, zero-day exploits, and machine learning-based adversarial attacks.
<h3>Continued Adoption of Adversarial Machine Learning Malware</h3>
As knowledge on adversarial machine learning continues to grow, that knowledge is disseminating among both sides of the cyber battleground. 2020 saw the increased adoption of machine learning academic knowledge being used in adversarial attacks in private industry research. As this knowledge gradually makes the transition from academia to the wild, we expect to see malware campaigns attempting to evade products based on machine learning models, either by fooling the model, learning how to subvert it, or by forcing it to shut down. Since machine learning-based products are becoming the market-dominant solution, it makes sense that they represent the next target for well-resourced hackers. We expect that those perpetrating the attacks will be only a select few of very sophisticated and highly capable threat actor groups who most likely will be acting as part of a nation state-sponsored campaign. The bar of entry to AI based attacks is still very high, and we, therefore, don’t expect it to become “run-of-the-mill” malware next year.
<h3>Ransomware to Target Mission-Critical Organizations</h3>
2020 saw <a href="https://www.deepinstinct.com/2020/04/20/the-evolution-of-ransomware-and-its-culmination-to-the-nameshame-game/" target="_blank" rel="noopener noreferrer">ransomware attacks</a> increasingly amplify their leverage to coerce ransom pay-outs by not only stealing a victim’s sensitive data but also threatening to expose it. It appears that the lesson learned for hackers is that the test of a good ransomware attack is its method of extortion. The greater the stakes the better likelihood of a payday. For this reason, in 2021 we expect to see a move towards targeting mission-critical organizations, i.e. those organizations that have the minimal risk tolerance to having their digital systems shut down or their data stollen and exposed.
Hospitals and educational institutions are a good example of this, with both sectors having already suffered from a wave of ransomware infections, both schools and hospitals are under enormous pressure to keep their doors open. In the crossroads between ransomware and data privacy regulations, private companies are also more susceptible to being breached, with the added risk of being hit with large fines if found to have exposed data.
<h3>Rising Cybersecurity Company Valuations</h3>
During the recent worldwide economic downturn, cybersecurity was one of the few industries to record growth. In 2021 we expect to see cybersecurity stock prices and company valuations continue this upward trajectory, with multiples expected to reach new heights. This development appears to reflect a changing market perception of cybersecurity products no longer seen as a discretionary item, but rather as a staple.
For more insights download Deep Instinct’s “2020 Cyber Threat Landscape Report” which includes an analysis of the latest malware trends and developments, insights on the past year’s cyber threat landscape, and predictions for this year, all based on empirical research findings. A full copy of the 31-page “<a href="https://info.deepinstinct.com/en/tof/cyber-threat-report" rel="noopener noreferrer">2020 Cyber Threat Landscape Report</a>” is available. In addition, anyone interested can join a live webinar “<a href="https://info.deepinstinct.com/en/tof/the-pandemic-and-its-manipulation-by-the-cyber-underworld" rel="noopener noreferrer">The Pandemic and its Manipulation by the Cyber Underworld</a>” scheduled on Tuesday, February 23 at 1 pm Eastern. Featuring the Deep Instinct security intelligence researchers who contributed to the study, participants will also have an opportunity to ask questions on the report findings.

Cybersecurity Predictions for 2021

We have heard this story before, so I will skip the backstory about how ransomware is a giant nightmare that shows absolutely no sign of slowing down,

Ryuk.jpg

We have heard this story before, so I will skip the backstory about how ransomware is a giant nightmare that shows absolutely no sign of slowing down, at all. There is plenty of coverage out there pertaining to Ryuk, but lesser known is that there are different variants of Ryuk and in fact different generations of Ryuk which could potentially be hitting your environment.
Generation 1 of Ryuk was, to be polite, less than intelligent. A derivation of Hermes, which at its time had its own level of success, Ryuk was a new variant with an added new mechanism to drop the ransom payload. For this to succeed, the hacker groups were highly reliant on using tools they had access to, such as Trickbot, which is still considered a very notorious and highly successful trojan.
A gen1 encryption of Ryuk was rarely found without also finding Trickbot in the environment, which meant that if you could shut down Trickbot you would have a very successful chance of not getting hit with Ryuk. Why is this the case? Trickbot is how the group gained an initial foothold to launch their reconnaissance of the network. If the trojan is blocked at the gates, then there is no ground to attack.
<h3>A More Manual Version</h3>
What makes gen1 of Ryuk different from other ransomware variants is the human element. Once Trickbot is on the machine, someone needs to do the reconnaissance work to gain further access into the machine which would cause the most “impact” to the environment and thus force the hand to “guarantee” a payment.
Common targets would be critical machines such as fileservers, domain controllers, or hosting machines. Why was gen1 so successful, even with the increased ability to share information pertaining to malware/ransomware and countless sites where you can see live submissions from ample sources? Plain and simple, the ripest targets tend to be the ones which administrators “exclude” from strict AV policies to minimize the impact on end-users (read: performance delays, application crashes, etc.) or in some instances have the product outright disabled.
<h3>Next-Gen Ryuk</h3>
Now we have the next generation of Ryuk, where its creators have gone back to school, gained advanced knowledge on how to penetrate an environment and iterated. A pattern that admins everywhere do not want to hear about. While some things have changed (I will go over those shortly), other things have stayed the same. Basic entry to the environment still relies primarily on targeted spear-phishing and a “document” which most likely has a VBA macro included, and will execute the dropper/loader the second you enable macros (or, open the document in the case you have content enabled by default). There is also still a possibility that Trickbot can be part of the equation (after all, if it’s not broken, don’t fix it)
Common fare, many campaigns use this method. MAZE (now defunct), Ragnar, <a href="https://www.deepinstinct.com/2020/08/12/why-emotets-latest-wave-is-harder-to-catch-than-ever-before/" target="_blank" rel="noopener noreferrer">Emotet Malware</a>, and more use this methodology as their first phase of gaining a foothold. Part of their advanced education has taught them about some new tools which can be leveraged, such as CobaltStrike Beacon, something commonly used during red-team penetration testing exercises because of the flexibility it gives to the one controlling the beacon (C2). Wizard Spider has started to rely substantially less on customized tools and instituted a new phase of living off the land, making their ability to laterally move once inside an environment exponentially easier.
Once they have a foothold and the C2 server in place, it’s the same fare as other ransom attacks; leveraging command and Powershell for lateral movements and credential dumping. Unfortunately, there are not many products which are capable of monitoring Powershell scripting, substantially less can analyze Powershell scripts on a contextual level to allow legit scripts through and malicious scripts to be shut down.
This entails two options; either to outright block Powershell or to allow Powershell. Neither are great options if you want the utmost of security and balance for your users (specifically admins) to properly manage the environment or complete tasks. This harkens back to admins doing anything they can to not impact their user base, even if that means lowering the security posture of the environment.
An example of what can happen when you take that lowered security stance anywhere in the enterprise are the <a href="https://www.wired.com/story/ransomware-hospitals-ryuk-trickbot/" target="_blank" rel="noopener noreferrer">dozens of hospitals</a> that have been hit with generation 1 of Ryuk at the height of the Coronavirus pandemic. A terrible situation which no healthcare provider should ever be caught in the middle of.
This is where prevention becomes essential. It’s not an option anymore and no one can afford to deprioritize prevention as secondary to detecting and trying to remediate. In the case of ransomware, organizations can’t afford any risk at all, in September of 2020 a patient died due to a ransomware attack at a hospital which prevented them from accepting new in-patients.
A colleague of mine made a video about Ryuk which shows prevention in action. In the video, the static engine brain version 109 is used to prevent Ryuk. This is important to note as the 109 brain was trained and released in November 2018 – two years prior to infection!
https://youtu.be/TOpIJa5Pf90
&nbsp;
The above video helps to outline why a prevention-focused solution is absolutely necessary. The <a href="https://www.deepinstinct.com/endpoint-protection/">endpoint security solution</a> provides intelligent Powershell script analysis that supports admins with the flexibility to do their work but simultaneously applies a rigorous prevention method against malicious actions. Deep Instinct really is the complete package.
&nbsp;

Ryuk Ransomware: The Deviance is in the Variance

Almost 40% of organizations surveyed in a recent Verizon report said they had experienced a mobile-related security compromise. Of those, 66% said the

android-security.jpg

Almost 40% of organizations surveyed in a recent Verizon report said they had experienced a mobile-related security compromise. Of those, 66% said the impact was major. Major security breaches cost organizations time, money, and public trust. Android security is critical, particularly in Bring-Your-Own-Device (BYOD) environments. You have more control over corporate devices, but all devices used for business purposes need to be secured from hackers. Learn more about Android threats and how to improve <a href="https://www.deepinstinct.com/mobile-security/" target="_blank" rel="noopener noreferrer">mobile security</a>.
<h3>Android Threat Landscape</h3>
Hackers take advantage of multiple points of vulnerability, including:
<ul>
<li>Apps — Apps offer hackers a wealth of opportunities. These include threats, where malware is embedded in a malicious app, and vulnerabilities, which are flaws in otherwise benign apps that hackers manipulate. Both threats and vulnerabilities could be used to access company data. Ransomware is another possibility, where the phone is locked until a ransom is paid. Phones are also being used for crypto-jacking, where a device is used to mine cryptocurrency, which drains the device and causes other performance issues.</li>
</ul>
&nbsp;
<ul>
<li>Data leakage — Users may inadvertently download either malicious apps or benign apps with security vulnerabilities. Either of these could leak confidential company information. They may also unintentionally make mistakes, like transferring company files to the wrong place or copying and pasting proprietary information into the wrong field, which hackers could take advantage of.</li>
</ul>
&nbsp;
<ul>
<li>Unsecured Wi-Fi - People tend to save on cellular data usage when wireless hot spots are available. The same features that make Wi-Fi hotspots easy to use for consumers make them a fertile breeding ground for hackers. The fact that authentication is not required to establish a network connection creates an amazing opportunity for the hacker to gain access to the network and consequently also to insecure devices on the same network.</li>
</ul>
&nbsp;
<ul>
<li>Phishing - According to the CSO, mobile users are more vulnerable to phishing attacks because they follow email frequently and open and read emails as soon as they are received. In addition, the messages received in mobile email applications hide some of the information about the source of the message more than on a PC, which can lead to confusion and opening of messages from unverified sources.</li>
</ul>
&nbsp;
<ul>
<li>Social engineering — Even if you’ve educated your end-users on cybersecurity, they may still be vulnerable when checking email on their phone. It’s harder to see the “to” and “from” email addresses and other details when checking email on a phone, meaning end-users may respond or click links without scrutinizing them.</li>
</ul>
&nbsp;
<ul>
<li>Physical device breaches — Phones are easy to lose or leave unattended. If that’s combined with the surprising number of users who don’t practice good password hygiene, you have a recipe for easy access to your organization’s data.</li>
</ul>
<h3>Android Security: Essential Steps to Take</h3>
Combat these threats, and more, by developing clear policies. Train your end-users on these policies and how to implement them. Follow up with your end-users regularly to ensure your organization’s policies are being followed. Policies to consider include:
<ul>
<li>Phone locking — While it might seem simple, many find taking the extra step of unlocking their phone annoying, so they don’t do it. A PIN of more than four digits is the best way to secure a phone. It protects both company information and personal information of the employee.</li>
<li>Install security updates — Remind end-users not to put off an Android security update. These are critical, but they’re released by phone manufacturers, so not all employees will have Android security updates at the same time.</li>
<li>Only using reliable apps from the Google Play Store — The Google Play Store takes measures to verify apps and scan apps for security. End-users should stick with these verified apps.</li>
<li>Confirming Google Play Protect is working — Google Play Protect is Android’s security system. End-users can confirm it’s working by visiting Security in their phone settings and tapping “Google Play Protect,” than ensuring all the toggles are activated.</li>
<li>Enabling Find My Device — For end-users to know whether their phone is misplaced or lost, have them enable Find My Device. It can be turned on in the security settings, and there’s also an official Find My Device app.</li>
<li>Add emergency contact info — End-users can add an emergency contact to their phone in case it’s lost. They can find it in system settings, and can also add a lock screen message directing people on how to access your emergency information.</li>
<li>Use Chrome’s safe browsing mode — The Chrome browser on an Android is the most secure option for web browsing. It has a safe browsing mode, and users can confirm it’s on by looking in their Chrome settings.</li>
<li>Using VPNs — You may want to recommend a specific VPN for your end-users to use, as there are many options. You should also address when and how to use it, like when they’re using free Wi-Fi at a coffee shop.</li>
</ul>
Another way to secure <a href="https://www.deepinstinct.com/2020/08/02/mobile-security-and-why-i-hate-byod-policies/" target="_blank" rel="noopener noreferrer">BYOD devices</a> is by using an Android work profile. This sets up a second profile that runs alongside a user’s personal profile. Their personal information stays private, while your corporate information stays secure. You can also implement policies like screen locks, encryption, and not allowing employees to copy and paste from work to personal apps and VPNs. All employees need to do is download this type of Android security app and sign in with their corporate credentials.
All of these steps can be enhanced by deploying Deep Instinct’s advanced <a href="https://www.deepinstinct.com/mobile-security/" target="_blank" rel="noopener noreferrer">mobile security solution</a>. It’s the best security app for Android, offering multiple layers of protection driven by deep learning, the most advanced AI technology.
&nbsp;

Announcing Deep Instinct Prevention for Storage for cloud storage and NAS environments

Blog

Recent Blog Posts

LSASS Memory Dumps are Stealthier than Ever Before - Part 2

How Companies are Successfully Bringing Down the Cost of a Data Breach

LSASS Memory Dumps are Stealthier than Ever Before

Emotet Malware 2020

What is ATP Security?

Why the Sunburst Malware Was So Unique and What We've Learnt From it

SunBurst Trojan -What You Need to Know

Cybersecurity Predictions for 2021

Ryuk Ransomware: The Deviance is in the Variance

How to Secure an Android Phone from Hackers

Products

Why Deep Instinct

Enhance Existing Cyber Tools

Company

Resources

Quick links