BERJAYA

Post

Nick Carr
@ItsReallyNick
Hey #ATTACKcon, how about some hot #AdversaryMethods talk. 📁🔀📂💾 It appears renaming system binaries is considered a subset of Defense Evasion > Masquerading (#T1036) in @MITREattack. Cool. Let's clarify, update with more in-the-wild APT usage, & discuss detection concerns.
4:54 AM · Oct 25, 2018
6
Nick Carr
@ItsReallyNick
Oct 27, 2018
The best part about tweeting @MITREattack is that the technique hashtags are all tied to @Target stores. #T1036 masquerading indeed.
4
Nick Carr
@ItsReallyNick
Oct 25, 2018
So there's living off the land which makes this... redecorating? 👨🏻‍🎨 Attackers take system binaries & rename them to evade brittle detections. Most are being used to download, deobfuscate, & execute payloads - or to collect data. Simple to do – but difficult to detect resiliently
1
Nick Carr
@ItsReallyNick
Oct 25, 2018
Example 1: Recent #APT10 targeting: fireeye.com/blog/threat-re… NOTE: APT10 using renamed certutil to deobfuscate payloads. Example 2: #PLATINUM renaming rar.exe for data compression (#T1002) & encryption (#T1022): x.com/ItsReallyNick/… ...also see renamed rar.exe -hp with #Turla
Nick Carr
@ItsReallyNick
Oct 3, 2018
What they thought *might* be a boring IR based on initial leads, quickly became interesting when the attacker snapped up the endpoint tooling they just deployed. Peep that renamed rar.exe snapping up our files for nation state attackers (PLATINUM) to analyze 😅 #FireEyeSummit
1
Nick Carr
@ItsReallyNick
Oct 25, 2018
Detection time! Before continuing, please watch @matthewdunwoody & @danielhbohannon's recent talk on resilient detections: x.com/danielhbohanno… I'll wait. Ok, now - if you have access to it, use PE metadata. Moving a file retains its InternalName/OriginalFilename/ProductName.
Daniel Bohannon
@danielhbohannon
Oct 8, 2018
Here are the slides and video for mine and @matthewdunwoody's presentation at @brucon: $SignaturesAreDead = "Long Live RESILIENT Signatures" wide ascii nocase Slides: slideshare.net/DanielBohannon… Video: youtube.com/watch?v=YGJaj6…
1
Nick Carr
@ItsReallyNick
Oct 25, 2018
File hashes may be helpful but beware of padding (#T1009). Relying on signatures? Trust [trust] but verify [you've read @mattifestation's research]. Know what forensic residue specific legit tools leave - e.g., EULA acceptance registry key for Sysinternals tools, even if renamed.
1
Nick Carr
@ItsReallyNick
Oct 25, 2018
🚨 Critical mistake: don't focus on finding the actual renaming - often separate anyway - you won't see a move + #LOLbin This is noisy & doesn't scale. Instead try to write EVERY command line detection based on args, accounting for renamed files up front:
Nick Carr
@ItsReallyNick
Oct 2, 2018
Replying to @HackingDave
I am surprised they have blocking coverage for it, as that's payload-agnostic. But if you're going to look for it, we'd recommend accounting for renamed certutil.exe and any parameter order: Content: "urlcache" || "ping" && Regex: "[\-\/]\s*(urlcache|ping)" && Regex: "tps?:\/"
2
Nick Carr
@ItsReallyNick
Sep 9, 2020
Since the above thread is cited on @MITREattack's "Masquerading: Rename System Utilities" page: attack.mitre.org/techniques/T10… #T1036.003 ... makes sense to add a few more to it! Example #4: #FIN7 has loved bringing along renamed binaries since November 2018
Nick Carr
@ItsReallyNick
Nov 6, 2018
#FIN7 is still active and getting in on the renamed legitimate binary trend Why launch your JavaScript backdoor with wscript.exe when you can run it with cesar.exe? %𝚄𝚂𝙴𝚁𝙿𝚁𝙾𝙵𝙸𝙻𝙴%\𝙲𝚘𝚗𝚝𝚊𝚌𝚝𝚜\𝚌𝚎𝚜𝚊𝚛.𝚎𝚡𝚎 //𝙴:𝚓𝚜𝚌𝚛𝚒𝚙𝚝 %𝚃𝙴𝙼𝙿%\𝚜𝚎𝚝𝚝𝚒𝚗𝚐𝚜.𝚝𝚡𝚝
Javier Antunez
@javierantunez
Oct 25, 2018
Great thread. Interesting info.

Hey #ATTACKcon, how about some hot #AdversaryMethods talk. 📁🔀📂💾 It appears renaming system binaries is considered a subset of Defense Evasion > Masquerading (#T1036) in @MITREattack. Cool. Let's clarify, update with more in-the-wild APT usage, & discuss detection concerns.

4:54 AM · Oct 25, 2018