Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Visibility and response across your entire Microsoft security ecosystem.
XDR with Machine Learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert threat hunting, original research, and proactive threat intelligence.
TRU is foundational to our MDR service. No add-ons or additional costs required.
Stop ransomware attacks before they disrupt your business.
Detect and respond to zero-day exploits.
Protect against third-party and supply chain risk.
Adopt a risk-based approach to cybersecurity.
Protect your most sensitive data.
Meet cybersecurity regulatory compliance mandates.
Eliminate misconfigurations and policy violations.
Prevent business disruption by outsourcing MDR.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and mediating threats to prevent lateral spread.
Enhance investigation and threat detection across multi-cloud or hybrid environments.
Remediate critical misconfigurations, security vulnerabilities and policy violations across cloud and containerized environments.
Detect malicious insider and identity-based behavior leveraging machine learning models.
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company's mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
We believe a multi-signal approach is paramount to protecting your complete attack surface. See why eSentire MDR means multi-signal telemetry and complete response.
See how our 24/7 SOC Cyber Analysts and Elite Threat Hunters stop even the most advanced cyberattacks before they disrupt your business.
Choose the right mix of Managed Detection and Response, Exposure Management, and Incident Response services to strengthen your cyber resilience.
Try our interactive tools including the MITRE ATT&CK Tool, the SOC Pricing Calculator, the Cybersecurity Maturity Assessment, and our MDR ROI Calculator.
Read the latest security advisories, blogs, reports, industry publications and webinars published by eSentire's Threat Response Unit (TRU).
See why 2000+ organizations count on eSentire to build resilience and prevent business disruption.
TRU Positives: Weekly investigation summaries and recommendations from eSentire's Threat Response Unit (TRU)
BY eSentire Threat Response Unit (TRU)
June 21, 2023 | 6 MINS READ
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
In June 2023, we identified and effectively responded to security incidents involving multiple hosts associated with Python-based post-exploitation. We named the campaign Nitrogen after the PDB path and the strings found in the malicious msi.dll employed during the initial infection.
The threat actor(s) established initial access via a drive-by download, wherein the victim downloaded an ISO image from a compromised WordPress website.
Below is a description of the observed initial infection chain.
The process begins with the manual execution of the install file by the end user from within an ISO image. Subsequently, the installer proceeds to load the msi.dll file and decrypts the accompanying data file. A more comprehensive analysis of this campaign will follow this blog.
The malicious installer drops an embedded Python distribution as well as the malicious DLL that is used for sideloading (T1574.002) under the “C:\Users\Public\Music\python” path.
The scheduled task,“OneDrive Security Task-S-1-5-21-5678566754-9123742832-2638705499-2003”, is created as a persistence mechanism to run the pythonw.exe binary. The task is set to trigger at system startup and expires on 12/1/2029 at midnight.
The threat actor(s) have been observed employing the DLL sideloading technique to execute a malicious payload and establish a persistent connection with C2 servers. The screenshot below reveals the utilization of python310.dll as the DLL for sideloading.
We found the code responsible for establishing a connection to a remote host, retrieving compressed and encoded data, and executing it locally.
We were able to extract the C2 from the malicious DLLs:
The threat actor(s) were able to run Bloodhound-py and LaZagne on patient zero via one of the malicious Python files (work2.py). During the investigation, our in-house Incident Response team retrieved a copy of the work2.py script for further analysis.
The Python script contained the Pyramid module; Pyramid is a Python-based HTTP/HTTPS C2 server equipped with the ability to distribute encrypted payloads. Additionally, Pyramid incorporates numerous modules to facilitate the loading of offensive tools such as LaZagne, Bloodhound-py, secretsdumps, and more.
The snippet of the Pyramid module below makes an encrypted HTTP request to a server, providing authorization credentials and executing the received response payload as code.
Another file that the attacker(s) utilized to drop a Cobalt Strike DLL was work7.py, which contained Python code with a marshal module to execute a payload that has been marshaled or serialized.
Upon disassembling the bytecode, we were able to retrieve the Cobalt Strike DLL that the attacker(s) ran on one of the hosts. You can find the Cobalt Strike beacon configuration at the end of this article.
It is important to note that within a span of 2 hours, the threat actor(s) engaged in lateral movement, deploying several malicious Python files onto compromised hosts.
Our Threat Response Unit (TRU) conducted further research and identified other samples involved in the Nitrogen campaign, including the malicious DLLs used for sideloading. We were also able to extract additional C2s for the campaign that you can find in the Indicators of Compromise section.
eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.
If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.
Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.
Indicator |
Note |
ISO image |
e825667790caf1024ea2a6f907387f860ea431bca6d799f0e69d031483c42568 |
ISO image |
5f3488fc958b98867ef661c6697b5c2cd920199f7209086591a5e87e691891f4 |
ISO image |
9c57a2a27b6fcea5bcf1eda791ccdaa0eb3fdbf93781b37283d956332f4d2ceb |
ISO image |
2eb2ef7a562145a0faf3c82f439221908adfcc784022a64e5bb17a432f4a8a91 |
ISO image |
9ae74c4247a7e8acdebfd87781c9ebb594e68a26b64ac84dbb1fbaebf4fc8058 |
python310.dll |
71ef00dd6c5e0446bab2ee2d030547a1841e5fdf5063902c206b6f4bf9ca9a11 |
python310.dll |
ff32997b85098d2bb0f1adccc5dc4e608a869dd54fc8539482788855d53d43b7 |
python310.dll |
e74c4cf311f2b3365605b6648d96baf5674990c3f181f01f462e1ba665bf1f7f |
python310.dll |
8dfac6521ef877efede0a82bf46d94f590127e2607b78d08321953796fddbba9 |
python310.dll |
8859a09fdc94d7048289d2481ede4c98dc342c0a0629cbcef2b91af32d52acb5 |
python310.dll |
fa911a3639ae77f8f890fb76ba1ab78c2ab17ab80bdfec381ab6a9ba8fef32fe |
python310.dll |
bacbe893b668a63490d2ad045a69b66c96dcacb500803c68a9de6cca944affef |
python310.dll |
3ce4ed3c7bd97b84045bdcfc84d3772b4c3a29392a9a2eee9cc17d8a5e5403ce |
python310.dll |
535aefaba2eb8d7898b176b0dcdd23fcef984994e609db222c33ece2d1c081b3 |
C2 |
141.98.6[.]95:4418 |
C2 |
104.234.147[.]74 |
C2 |
141.98.6[.]95:8880 |
C2 |
141.98.6[.]96:4419 |
C2 |
141.98.6[.]96:8880 |
C2 |
45.61.128[.]133:888 |
C2 |
85.217.144[.]233:8443 |
C2 |
166.0.94[.]216:8880 |
C2 |
45.61.128[.]133:1042 |
{ "BeaconType": [ "HTTPS" ], "Port": 8443, "SleepTime": 10000, "MaxGetSize": 2801745, "Jitter": 37, "C2Server": "85.217.144[.]234,/jquery-3.3.1.min.js", "HttpPostUri": "/jquery-3.3.2.min.js", "Malleable_C2_Instructions": [ "Remove 1522 bytes from the end", "Remove 84 bytes from the beginning", "Remove 3931 bytes from the beginning", "Base64 URL-safe decode", "XOR mask w/ random key" ], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\dllhost.exe", "Spawnto_x64": "%windir%\\sysnative\\dllhost.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 587247372, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 17500, "ProcInject_PrependAppend_x86": [ "kJA=", "Empty" ], "ProcInject_PrependAppend_x64": [ "kJA=", "Empty" ], "ProcInject_Execute": [ "ntdll:RtlUserThreadStart", "CreateThread", "NtQueueApcThread-s", "CreateRemoteThread", "RtlCreateUserThread" ], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "True", "HostHeader": "" }
Our industry-renowned Threat Response Unit (TRU) is an elite team of threat hunters and researchers, that supports our 24/7 Security Operations Centers (SOCs), builds detection models across our Atlas XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. TRU has been recognized for its threat hunting, original research and content development capabilities. TRU is strategically organized into cross-functional groups to protect you against advanced and emerging threats, allowing your organization to gain leading threat intelligence and incredible cybersecurity acumen.