Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company's mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
What did we find?
A successful credential-based brute force attack against an exposed remote management service in an attempt to incorporate the host into a cryptomining botnet.
Attempts to deploy a persistent Monero coinminer using a PowerShell script were blocked.
Analysis of the PowerShell script revealed the following behaviors:
Disabling of Microsoft Defender and other common antivirus products.
Terminating the processes of other bots if present on the system.
Downloading a configuration file for XMR coinminer.
Establishing persistence with Windows Management Instrumentation (WMI).
Downloading and executing a self-extracting archive containing the coinminer and malware for a persistent foothold on the system.
Figure 1 PowerShell Executing Instructions Retrieved from a Remote Server
Figure 2 PowerShell Script Disabling Microsoft Defender
Figure 3 PowerShell Disabling Common AV Platforms
Figure 4 Contents of the Self-Extracting Archive file "m.dat" Executed by the PowerShell script
At time of writing, the botnet contains 50 compromised hosts and has made 10 XMR (approximately $200 USD).
The activity bears some similarities to the MyKings botnet but isn’t confidently attributed at this time.
How did we find it?
BlueSteel, our machine- learning powered PowerShell classifier, identified PowerShell commands executed by a compromised Administrator account.
The activity was traced to a successful brute force against a remote management port.
What did we do?
eSentire’s MDR for Endpoint blocked the self-extracting archive containing the coinminer payload.
Figure 5 Blocking the Coinminer Payload
Our team of 24/7 SOC Cyber Analysts isolated the host to prevent lateral spread and escalated the event to our Incident Handling team to scope the intrusion.
We coordinated with the customer to eradicate the threat and provided an after-action report with recommendations.
What can you learn from this TRU positive?
Systems exposed to untrusted networks are at increased risk of attack.
Preventive and detective security controls should be proportional to this risk to limit and identify unauthorized access.
The scale of automated attacks across the Internet means an exposed system is likely to be identified and attacked by automated scanners in a timely manner.
Recommendations from our Threat Response Unit (TRU) Team:
Audit public facing assets regularly to identify known vulnerabilities or misconfigurations.
Restrict access to remote access services using VPN or Access Control Lists (ACLs).
Employ network, log and endpoint monitoring to identify and scope unauthorized activity.
Leverage a machine learning powered MDR solution that helps your team detect, contain, and respond to Powershell attacks 24/7/365.
Ask Yourself…
Can you audit your network perimeter at scale to identify weak configurations and other vulnerabilities?
Can you distinguish between legitimate and malicious use of remote administration tools?
If you’re not currently engaged with a Managed Detection and Response provider, we highly recommend you partner with us for security services in order to disrupt threats before they impact your business.
Want to learn more? Connect with an eSentire Security Specialist.
eSentire Threat Response Unit (TRU)
Our industry-renowned Threat Response Unit (TRU) is an elite team of threat hunters and researchers, that supports our 24/7 Security Operations Centers (SOCs), builds detection models across our Atlas XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. TRU has been recognized for its threat hunting, original research and content development capabilities. TRU is strategically organized into cross-functional groups to protect you against advanced and emerging threats, allowing your organization to gain leading threat intelligence and incredible cybersecurity acumen.
Cookies allow us to deliver the best possible experience for you on our website - by continuing to use our website or by closing this box, you are consenting to our use of cookies. Visit our Privacy Policy to learn more.
