Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
What did we find?
- A successful credential-based brute force attack against an exposed remote management service in an attempt to incorporate the host into a cryptomining botnet.
- Attempts to deploy a persistent Monero coinminer using a PowerShell script were blocked.
- Analysis of the PowerShell script revealed the following behaviors:
- Disabling of Microsoft Defender and other common antivirus products.
- Terminating the processes of other bots if present on the system.
- Downloading a configuration file for XMR coinminer.
- Establishing persistence with Windows Management Instrumentation (WMI).
- Downloading and executing a self-extracting archive containing the coinminer and malware for a persistent foothold on the system.
Figure 1 PowerShell Executing Instructions Retrieved from a Remote Server
Figure 2 PowerShell Script Disabling Microsoft Defender
Figure 3 PowerShell Disabling Common AV Platforms
Figure 4 Contents of the Self-Extracting Archive file "m.dat" Executed by the PowerShell script
- At time of writing, the botnet contains 50 compromised hosts and has made 10 XMR (approximately $200 USD).
- The activity bears some similarities to the MyKings botnet but isn’t confidently attributed at this time.
How did we find it?
- BlueSteel, our machine- learning powered PowerShell classifier, identified PowerShell commands executed by a compromised Administrator account.
- The activity was traced to a successful brute force against a remote management port.
What did we do?
- eSentire’s MDR for Endpoint blocked the self-extracting archive containing the coinminer payload.
Figure 5 Blocking the Coinminer Payload
- Our team of 24/7 SOC Cyber Analysts isolated the host to prevent lateral spread and escalated the event to our Incident Handling team to scope the intrusion.
- We coordinated with the customer to eradicate the threat and provided an after-action report with recommendations.
What can you learn from this TRU positive?
- Systems exposed to untrusted networks are at increased risk of attack.
- Preventive and detective security controls should be proportional to this risk to limit and identify unauthorized access.
- The scale of automated attacks across the Internet means an exposed system is likely to be identified and attacked by automated scanners in a timely manner.
Recommendations from our Threat Response Unit (TRU) Team:
- Audit public facing assets regularly to identify known vulnerabilities or misconfigurations.
- Restrict access to remote access services using VPN or Access Control Lists (ACLs).
- Employ network, log and endpoint monitoring to identify and scope unauthorized activity.
- Leverage a machine learning powered MDR solution that helps your team detect, contain, and respond to Powershell attacks 24/7/365.
Ask Yourself…
- Can you audit your network perimeter at scale to identify weak configurations and other vulnerabilities?
- Can you distinguish between legitimate and malicious use of remote administration tools?
If you’re not currently engaged with a Managed Detection and Response provider, we highly recommend you partner with us for security services in order to disrupt threats before they impact your business.
Want to learn more? Connect with an eSentire Security Specialist.
