What We Do
How we do it
Resources
TRU INTELLIGENCE CENTER
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
SECURITY ADVISORIES
Mar 15, 2023
CVE-2023-23397 - Microsoft Outlook Elevation of Privilege Zero-Day Vulnerability
THE THREAT On March 14th, as part of Microsoft’s monthly Patch Tuesday release, the company disclosed a critical, actively exploited vulnerability impacting Microsoft Office and Outlook. The…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Mar 20, 2023
Exertis and eSentire Partner to Deliver 24/7 Multi-Signal MDR, Digital Forensics & IR Services and Exposure Management to Organisations Across the UK, Ireland, and Europe
Basingstoke, UK– 20 March, 2023. Leading technology distributor, Exertis, announced today that it has bolstered its cybersecurity services, adding eSentire, the Authority in Managed Detection and Response (MDR), to its Enterprise portfolio of offerings. eSentire’s award-winning, 24/7 multi-signal MDR, Digital Forensics & Incident Response (IR), and Exposure Management services will be available…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — May 03, 2018

Living off the land: the delivery & installation phases

5 minutes read
Speak With A Security Expert Now

This is the third installment of the Living Off the Land blog series. This section will focus on the Delivery and Installation phases of the Cyber Kill Chain.

The delivery phase of an attack is focused on how an adversary distributes a weaponized payload. This can include the initial delivery phase (spam email/malicious downloads) or the lateral movement inside the network. Once the delivery stage has been successfully completed, the adversary will install and execute the payload.

The use of Living Off the Land tools limits the adversary’s need for additional software, reducing the likelihood of detection. In the case of delivery and installation, having valid credentials with the appropriate permissions allows the adversary the ability to transfer and execute files throughout the network using legitimate software. Examples of misused tools include remote desktop applications, third party service provider programs and administrative tools. The two most popular Living Off the Land tools are PsExec and Windows Management Instrumentation (WMI).

There are steps that enterprises can take to minimize the chances of delivery and installation success:

Background

There are a variety of Living Off the Land tools that have been used by adversaries to complete the delivery and installation phases. These tools can be installed by users or system administrators for business purposes. Recent high profile cases of remote desktop applications being exploited, such as Team Viewers’ connection to the CCleaner breach 1, have increased security focus on this issue.

The tools used by MSSPs have proven very useful to attackers in the past. Although the tools are not native to all systems, they are still considered to be Living Off the Land tools, as they may require access to maintain, update, monitor or administer client networks. The case study included in this post outlines an incident where a third party provider’s trusted software was misused for malicious purposes.

System Center Configuration Manager (SCCM) has received increased attention from security researchers due to its capability to deliver and install remote applications across the network 2. eSentire has not actively observed the exploitation of SCCM at this time; however, companies should be aware of the potential for abuse.

The two main Living Off the Land tools discussed in this blog are PsExec, for delivery and installation, and Windows Management Instrumentation (WMI), for installation. In the delivery and installation examples, it is assumed that the adversary has been able to identify the tools and successfully exploit them.

Case Study

In early 2018, eSentire observed a third-party service provider’s (MSSP) Virtual System Administrator (VSA) tool being exploited to deliver and install cryptocurrency miners. It leveraged a vulnerability in the third-party provider’s application to deliver Monero mining software to customer computers. Monero is a type of cryptocurrency. Similar to other cryptocurrencies, Monero is ‘mined’ by performing complex and resource intensive equations on CPUs. As the VSA application was used in multiple customers’ environments, the adversary was able to distribute and install the malicious application across a wide range of endpoints. This method allowed the adversary to circumvent perimeter level security and harvest Monero for financial gain.

For additional information and technical details on this particular incident see the provided links 3 4.

Additional Information on Delivery & Installation

The most popular Living Off the Land tools for delivery and installation that eSentire has observed are PsExec and WMI. These tools have been employed by adversaries after obtaining compromised credentials through the use of phishing campaigns or password dumping tools (Mimicatz). The NotPetya ransomware outbreak, for example, included both PsExec and WMI to incorporate worm type behaviour to infect additional endpoints on the network.

It should be noted that for adversaries to use PsExec and WMI, they require appropriate permissions to execute commands on the remote system.

PsExec

PsExec is a tool that is incorporated into Microsoft Sysinternal Utility Suite. It allows systems administrators to transfer and execute files remotely. It is not natively installed but it is a popular tool used by system administrators. The screen capture below provides an example of PsExec copying over the file payload.bat to the remote host DESKTOP-TEST1 and execute the file.


Figure 1: Deliver and execute the payload.bat file

Windows Management Instrumentation (WMI)

WMI is an infrastructure tool used for data management and task automation.Adversaries utilize WMI to execute commands remotely and install applications on systems. In figure 2, WMI is used to remotely execute the program ncat.exe on DESKTOP-C9V9E7G. Ncat.exe (netcat) is a Swiss army type tool that can be used for a variety of malicious and non-malicious purposes, such as file transfers or establishing backdoors.

When the ncat.exe command is executed in this example it creates a reverse shell backdoor. This allows the adversary to interact with the operating system on DESKTOP-C9V9E7G (Figure 3).

Figure 2: Ncat.exe is copied to DESKTOP-C9V9E7G and then executed using WMI.

Figure 3: A backdoor is established after executing the WMI command

Figure 3: A backdoor is established after executing the WMI command

Mitigation Strategies

To minimize the impact of delivery and installation tools, consider the follow options:

Conclusion

As illustrated in the case study and other recent examples, failing to take steps to limit the malicious use of Living Off the Land tools may result in additional systems being compromised. Network segregation and implementing ACLs ensures that only systems or groups deemed authorized can access resources. A policy of least privilege can be implemented in order to prevent lateral movement of an adversary inside a network. Although a variety of external tools exist for performing delivery and installation, Living Off the Land activity is less likely to be detected. A variety of recent examples prove the popularity of these tools amongst adversaries, and the importance of prevention and detection directly relating to widely used tools.


Sources

[1] https://thehackernews.com/2018/04/ccleaner-malware-attack.html

[2] https://enigma0x3.net/2015/10/27/targeted-workstation-compromise-with-sccm/

[3] https://www.esentire.com/news-and-events/security-advisories/kaseya-virtual-system-administrator/

[4] https://www.esentire.com/news-and-events/security-advisories/kaseya-update-cryptocurrency-mining-campaign/

[5] https://msdn.microsoft.com/en-us/library/aa393266(v=vs.85).aspx

View Most Recent Blogs
Red Team
Red Team Penetration Testing Team