This article will explore Windows Smart App Control and SmartScreen as a case study for researching bypasses to reputation-based systems, then demonstrate detections to cover those weaknesses.

Introduction

Key Takeaways:

SmartScreen/SAC Background

Signed Malware

Reputation Hijacking

Reputation Seeding

Reputation Tampering

LNK Stomping

Detections

Conclusion

New Initial Access and Evasion Techniques

Dismantling Smart App Control

Elastic researchers uncovered a new technique, GrimResource, which allows full code execution via specially crafted MSC files. It underscores a trend of well-resourced attackers favoring innovative initial access methods to evade defenses.

Overview

Key takeaways

Analysis

Suspicious Execution via Microsoft Common Console

.NET COM object created in non-standard Windows Script Interpreter

Script Execution via MMC Console File 

Windows Script Execution via MMC Console File

Observables

Adversaries adapting to Microsoft's new security landscape

GrimResource - Microsoft Management Console for initial access and evasion

Elastic Security Labs reveals details of a new campaign leveraging defense evasion capabilities to infect victims with malicious MSIX executables.

Update

Preamble

Malware Analysis

Stage 0

Stage 1

Stage 2

Stage 3

Final Payload

Configuration extractor

Detection Guidance

Observations

References

GHOSTPULSE haunts victims using defense evasion bag o' tricks

We aim to out-innovate adversaries and maintain protections against the cutting edge of attacker tradecraft. With Elastic Security 8.8, we added new kernel call stack based detections which provide us with improved efficacy against in-memory threats.

Intro

Deep Visibility

New Rules

C2 Coverage

Resources

Upping the Ante: Detecting In-Memory Threats with Kernel Call Stacks

Elastic Security Labs is releasing a triage analysis to assist 3CX customers in the initial detection of SUDDENICON, a potential supply-chain compromise affecting 3CX VOIP softphone users.

Prevention

Hunting queries

KQL queries

EQL queries

YARA

Defensive recommendations

Potentially malicious domains

Elastic alert telemetry has observed protection events related to the supply chain attacks targeting the 3CXDesktopApp update process.

Elastic users protected from SUDDENICON’s supply chain attack

Elastic Security discovered PHOREAL malware, which is targeting Southeast Asia financial organizations, particularly those in the Vietnamese financial sector.

What is the threat?

What is the impact?

What is Elastic doing about it?

Investigation Details

Adversary Assessment Justification

YARA Rules

Defensive Recommendations

Artifacts

PHOREAL Malware Targets the Southeast Asian Financial Sector

This post includes a primer on kernel mode attacks, along with Elastic’s recommendations for securing users from kernel attacks leveraging vulnerable drivers.

Background

Attack flow

Blocklisting

Allowlisting

Behavior control

First seen

Using vulnerable drivers to gain kernel mode execution.

Stopping Vulnerable Driver Attacks

Elastic Security verifies new destructive malware targeting Ukraine: Operation Bleeding Bear

Key Takeaways

Stage 1: WhisperGate MBR payload

Malware analysis breakdown (Stages 1-4)

Stage 2/3: Discord downloader and injector

Final stage: File corruptor

MBR protection with Elastic Security

Observing WhisperGate in Elastic Security

Alert breakdown and defensive recommendations

Endpoint Security Integration Alerts

Stage 1 - MBR Wiper

Stage 2 - Downloader

Stage 3 + Stage 4 - Injector/File Corruptor

Prebuilt Detection Engine Alerts

MITRE ATT&CK

Summary

Indicators

Operation Bleeding Bear

Elastic Security has identified active intrusions leveraging the newly identified BLISTER malware loader utilizing valid code-signing certificates to evade detection. We are providing detection guidance for security teams to protect themselves.

Key takeaways:

Details

Certificate abuse

BLISTER malware loader

Elastic Endpoint Alerts

Elastic Security uncovers BLISTER malware campaign

As a follow up to my DerbyCon presentation, this post will investigate an emerging trend of adversaries using .NET-based in-memory techniques to evade detection

The .NET Allure

.NET Attacker Techniques

Detecting .NET Attacks

On-demand detection

Eventing-based detection

Hunting For In-Memory .NET Attacks

Threat Hunters are charged with the difficult task of sifting through vast sources of diverse data to pinpoint adversarial activity at any stage in the attack.

Attacker Techniques

SHELLCODE INJECTION

REFLECTIVE DLL INJECTION

![Reflective Loader](/assets/images/hunting-memory/endgame-reflective-loader.jpg)

作者

Joe Desimone

文章

拆解智能应用控制

GrimResource - 用于初始访问和逃避的 Microsoft 管理控制台

GHOSTPULSE 利用防御逃避手段来困扰受害者

提高赌注：使用内核调用堆栈检测内存威胁

Elastic 用户免受 SUDDENICON 供应链攻击的侵害

PHOREAL 恶意软件以东南亚金融业为目标

阻止易受攻击的驱动程序攻击

流血熊行动

Elastic Security 揭露 BLISTER 恶意软件活动

搜索内存中的 .NET 攻击

搜索内存