Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Visibility and response across your entire Microsoft security ecosystem.
XDR with Machine Learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert threat hunting, original research, and proactive threat intelligence.
TRU is foundational to our MDR service. No add-ons or additional costs required.
Stop ransomware attacks before they disrupt your business.
Detect and respond to zero-day exploits.
Protect against third-party and supply chain risk.
Adopt a risk-based approach to cybersecurity.
Protect your most sensitive data.
Meet cybersecurity regulatory compliance mandates.
Eliminate misconfigurations and policy violations.
Prevent business disruption by outsourcing MDR.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and mediating threats to prevent lateral spread.
Enhance investigation and threat detection across multi-cloud or hybrid environments.
Remediate critical misconfigurations, security vulnerabilities and policy violations across cloud and containerized environments.
Detect malicious insider and identity-based behavior leveraging machine learning models.
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company's mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
We believe a multi-signal approach is paramount to protecting your complete attack surface. See why eSentire MDR means multi-signal telemetry and complete response.
See how our 24/7 SOC Cyber Analysts and Elite Threat Hunters stop even the most advanced cyberattacks before they disrupt your business.
Choose the right mix of Managed Detection and Response, Exposure Management, and Incident Response services to strengthen your cyber resilience.
Try our interactive tools including the MITRE ATT&CK Tool, the SOC Pricing Calculator, the Cybersecurity Maturity Assessment, and our MDR ROI Calculator.
Read the latest security advisories, blogs, reports, industry publications and webinars published by eSentire's Threat Response Unit (TRU).
See why 2000+ organizations count on eSentire to build resilience and prevent business disruption.
This is the third installment of the Living Off the Land blog series. This section will focus on the Delivery and Installation phases of the Cyber Kill Chain.
The delivery phase of an attack is focused on how an adversary distributes a weaponized payload. This can include the initial delivery phase (spam email/malicious downloads) or the lateral movement inside the network. Once the delivery stage has been successfully completed, the adversary will install and execute the payload.
The use of Living Off the Land tools limits the adversary’s need for additional software, reducing the likelihood of detection. In the case of delivery and installation, having valid credentials with the appropriate permissions allows the adversary the ability to transfer and execute files throughout the network using legitimate software. Examples of misused tools include remote desktop applications, third party service provider programs and administrative tools. The two most popular Living Off the Land tools are PsExec and Windows Management Instrumentation (WMI).
There are steps that enterprises can take to minimize the chances of delivery and installation success:
There are a variety of Living Off the Land tools that have been used by adversaries to complete the delivery and installation phases. These tools can be installed by users or system administrators for business purposes. Recent high profile cases of remote desktop applications being exploited, such as Team Viewers’ connection to the CCleaner breach 1, have increased security focus on this issue.
The tools used by MSSPs have proven very useful to attackers in the past. Although the tools are not native to all systems, they are still considered to be Living Off the Land tools, as they may require access to maintain, update, monitor or administer client networks. The case study included in this post outlines an incident where a third party provider’s trusted software was misused for malicious purposes.
System Center Configuration Manager (SCCM) has received increased attention from security researchers due to its capability to deliver and install remote applications across the network 2. eSentire has not actively observed the exploitation of SCCM at this time; however, companies should be aware of the potential for abuse.
The two main Living Off the Land tools discussed in this blog are PsExec, for delivery and installation, and Windows Management Instrumentation (WMI), for installation. In the delivery and installation examples, it is assumed that the adversary has been able to identify the tools and successfully exploit them.
In early 2018, eSentire observed a third-party service provider’s (MSSP) Virtual System Administrator (VSA) tool being exploited to deliver and install cryptocurrency miners. It leveraged a vulnerability in the third-party provider’s application to deliver Monero mining software to customer computers. Monero is a type of cryptocurrency. Similar to other cryptocurrencies, Monero is ‘mined’ by performing complex and resource intensive equations on CPUs. As the VSA application was used in multiple customers’ environments, the adversary was able to distribute and install the malicious application across a wide range of endpoints. This method allowed the adversary to circumvent perimeter level security and harvest Monero for financial gain.
For additional information and technical details on this particular incident see the provided links 3 4.
The most popular Living Off the Land tools for delivery and installation that eSentire has observed are PsExec and WMI. These tools have been employed by adversaries after obtaining compromised credentials through the use of phishing campaigns or password dumping tools (Mimicatz). The NotPetya ransomware outbreak, for example, included both PsExec and WMI to incorporate worm type behaviour to infect additional endpoints on the network.
It should be noted that for adversaries to use PsExec and WMI, they require appropriate permissions to execute commands on the remote system.
PsExec is a tool that is incorporated into Microsoft Sysinternal Utility Suite. It allows systems administrators to transfer and execute files remotely. It is not natively installed but it is a popular tool used by system administrators. The screen capture below provides an example of PsExec copying over the file payload.bat to the remote host DESKTOP-TEST1 and execute the file.
Figure 1: Deliver and execute the payload.bat file
WMI is an infrastructure tool used for data management and task automation.Adversaries utilize WMI to execute commands remotely and install applications on systems. In figure 2, WMI is used to remotely execute the program ncat.exe on DESKTOP-C9V9E7G. Ncat.exe (netcat) is a Swiss army type tool that can be used for a variety of malicious and non-malicious purposes, such as file transfers or establishing backdoors.
When the ncat.exe command is executed in this example it creates a reverse shell backdoor. This allows the adversary to interact with the operating system on DESKTOP-C9V9E7G (Figure 3).
Figure 2: Ncat.exe is copied to DESKTOP-C9V9E7G and then executed using WMI.
Figure 3: A backdoor is established after executing the WMI command
To minimize the impact of delivery and installation tools, consider the follow options:
As illustrated in the case study and other recent examples, failing to take steps to limit the malicious use of Living Off the Land tools may result in additional systems being compromised. Network segregation and implementing ACLs ensures that only systems or groups deemed authorized can access resources. A policy of least privilege can be implemented in order to prevent lateral movement of an adversary inside a network. Although a variety of external tools exist for performing delivery and installation, Living Off the Land activity is less likely to be detected. A variety of recent examples prove the popularity of these tools amongst adversaries, and the importance of prevention and detection directly relating to widely used tools.
Sources
[1] https://thehackernews.com/2018/04/ccleaner-malware-attack.html
[2] https://enigma0x3.net/2015/10/27/targeted-workstation-compromise-with-sccm/
[3] https://www.esentire.com/news-and-events/security-advisories/kaseya-virtual-system-administrator/
[5] https://msdn.microsoft.com/en-us/library/aa393266(v=vs.85).aspx