APT Malware LOLBins & GTFOBins Attack users by Evading the Security Sysem

guest · Feb 4, 2019

APT Malware LOLBins & GTFOBins Attack users by Evading the Security Sysem
February 2, 2019
https://gbhackers.com/apt-malware-lolbins-gtfobins-attack-users-by-evading-the-security-sysem/

In every system, there are Trusted Binaries, Scripts and Library files are available for the purpose of system communications. But cybercriminals use this genuine utility in such a way where the defense systems fail to stop this behavior.
These binaries, scripts, and libraries cannot be blocked since they are valid and might leads to system crash if they are deleted.

Motive of abusing LOLBins make it possible for attackers to bypass defensive countermeasures such as application whitelisting, security monitoring, and antivirus software with a reduced chance of being detected.

Attackers POV: Certutil is a great little binary that can download remote files, create certificates, or encode files
Conclusion
We are seeing many APT threat actors are using LOLBins for their activity.
So the threat hunting teams and the SOC teams should understand the LOLBins and GTFOBins.
Click to expand...

itman · Feb 4, 2019

As far as PowerShell execution via SyncAppPublishinServer.vbs, I am sure most by now are monitoring/blocking script execution. The question is if WD for example monitors signed script execution via Win 10 AMSI? As far as third party AV's, I don't believe script signing plans any part in the scanning of the script via AMSI.

What the article didn't mention was that SyncAppPublishinServer.exe can likewise be employed to execute PowerShell commands. You can read about that here: https://safe-cyberdefense.com/malware-can-use-powershell-without-powershell-exe/ . Article also covers GitHub PowerShell facsimile that executes Powershell commands via .Net usage. So OSArmor users, check out if this is covered.

-EDIT- Also, one should always check out these articles for accuracy. As far as SyncAppPublishinServer goes, neither the script or executable are present in the System32 directory on my Win 10 x(64) Home build. I did find them in the Servicing directory, C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~17763.253.1.4\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.17763.194_none_4103f04b4dfa5f5a\f. Trying to run them from there resulted in a Win 10 blue popup stating they won't run on the Win 10 version I have. Appears App-V has to be first install and the PublishingServer configured via Win PowerShell: http://virtualvibes.co.uk/installin...-and-configuring-it-with-a-publishing-server/

Floyd 57 · Feb 4, 2019

It's funny that even the dlls that are listed here https://lolbas-project.github.io are only listed because of them being usable with rundll32, which is, guess what, an executable, and we know what happens when an executable goes against a properly configured anti-exe, that is, not automatically allowing stuff

guest · Feb 4, 2019

Floyd 57 said: ↑

It's funny that even the dlls that are listed here https://lolbas-project.github.io are only listed because of them being usable with rundll32, which is, guess what, an executable, and we know what happens when an executable goes against a properly configured anti-exe, that is, not automatically allowing stuff
Click to expand...

and we didn't went to fileless malware, reflective dlls and co.

shmu26 · Feb 5, 2019

itman said: ↑

Also, one should always check out these articles for accuracy. As far as SyncAppPublishinServer goes, neither the script or executable are present in the System32 directory on my Win 10 x(64) Home build.
Click to expand...

I checked for the executable on Pro and Enterprise, Win10 x64 1809 , and I didn't find it in System32 directory.

guest · Feb 5, 2019

itman said: ↑

-EDIT- Also, one should always check out these articles for accuracy. As far as SyncAppPublishinServer goes, neither the script or executable are present in the System32 directory on my Win 10 x(64) Home build.
Click to expand...

shmu26 said: ↑

I checked for the executable on Pro and Enterprise, Win10 x64 1809 , and I didn't find it in System32 directory.
Click to expand...

of course you won't find it, it is a PoSh cmdlet...

The Sync-AppvPublishingServer cmdlet initiates the Microsoft Application Virtualization (App-V) publishing refresh operation in the context of the current user. The publishing refresh connects to all added servers on the client and expose new App-V packages and their respective extension points to the user.
Click to expand...

https://docs.microsoft.com/en-us/po...lient/sync-appvpublishingserver?view=win10-ps

itman · Feb 5, 2019

guest said: ↑

of course you won't find it, it is a PoSh cmdlet...

https://docs.microsoft.com/en-us/po...lient/sync-appvpublishingserver?view=win10-ps
Click to expand...

Prior to this, you would first have to:

Description

The Add-AppvPublishingServer cmdlet adds a new publishing server for the computer that runs the Microsoft Application Virtualization (App-V) client to connect to. After the server has been added, the computer that runs the App-V client can use the server to obtain publishing refresh data, stream packages, and perform other operations.
Click to expand...

Again, App-V must be installed.

-EDIT- World Wide Web Publishing service is not installed by default on any Win client OS version. It should never be installed unless a need to interface with a local web server is required.

guest · Nov 13, 2019

Hunting for LoLBins
November 13, 2019
https://blog.talosintelligence.com/2019/11/hunting-for-lolbins.html

Attackers' trends tend to come and go. But one popular technique we're seeing at this time is the use of living-off-the-land binaries — or "LoLBins". LoLBins are used by different actors combined with fileless malware and legitimate cloud services to improve chances of staying undetected within an organisation, usually during post-exploitation attack phases.

In this post, we will take a look at the use of LOLBins through the lense of Cisco's product telemetry.
You'll also find an overview of a few recent campaigns we've seen using LoLBins, along with recommendations for how to detect malicious LoLBins' activities.
Although they may have been used only by more advanced actors, today they are also used by actors employing common malicious code such as ransomware or cryptominers.
Detecting and preventing LoLBins abuse
The protection against abuse of LoLBins combined with fileless code is difficult for security controls that do not monitor process behavior. The abuse can be detected based on the parent-child relationship of the launched processes as well as anomalies in network activity of processes that are not usually associated with network communication. [...]
Click to expand...

Conclusion
Our research shows that many types of actors are employing various techniques to use LoLBins in their activities, from commodity malware to more targeted attacks. However, the overall proportion of malicious usage is very low (below 0.2 percent), which is not enough to block all invocations of LoLBins.

However, blue team members must keep LoLBins in mind while conducting regular hunting activities. If used successfully, an attacker can use these to make their attacks more difficult to trace or make their malware linger for longer on the victim machine.
Click to expand...

guest · Feb 18, 2020

Building a bypass with MSBuild
Living-off-the-land binaries (LoLBins) continue to pose a risk to security defenders
February 18, 2020
https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html

In one of our previous posts, we discussed the usage of default operating system functionality and other legitimate executables to execute the so-called "living-off-the-land" approach to the post-compromise phase of an attack. We called those binaries LoLBins. Since then, Cisco Talos has analyzed telemetry we received from Cisco products and attempted to measure the usage of LoLBins in real-world attacks.

Specifically, we are going to focus on MSBuild as a platform for post-exploitation activities. For that, we are collecting information from open and closed data repositories as well as the behavior of samples submitted for analysis to the Cisco Threat Grid platform.
WHAT'S NEW?
We collected malicious MSBuild project configuration files and documented their structure, observed infection vectors and final payloads. We also discuss potential actors behind the discovered threats. [...]
Click to expand...

Conclusion
MSBuild is an essential tool for software engineers building .NET software projects. However, the ability to include code in MSBuild project files allows malicious actors to abuse it and potentially provide a way to bypass some of the Windows security mechanisms.

Finally, our research shows that MSBuild is generally not used by commodity malware. Most of the observed cases had a variant of a post-exploitation agent as a final payload. The usage of widely available post-exploitation agents in penetration testing is somewhat questionable as the defenders can be lulled into a false sense of security.
Click to expand...

itman · Feb 18, 2020

mood said: ↑

Building a bypass with MSBuild
Click to expand...

Another startup execution to monitor with the HIPS:

In a production environment, where there are no software developers, every execution of MSBuild.exe should be investigated to make sure the usage is legitimate.
Click to expand...

guest · Dec 28, 2021

Threat Actors Abuse MSBuild for Cobalt Strike Beacon Execution
December 28, 2021

Designed for the creation of applications on Windows, MSBuild uses a project file element called ‘Tasks’ to designate components that are executed during project building, and threat actors are abusing these Tasks to run malicious code disguised as MSBuild.

Over the past week, Morphus Labs security researcher and SANS Internet Storm Center (ISC) handler Renato Marinho says, two different malicious campaigns were observed abusing MSBuild for code execution.
Click to expand...

The malicious MSBuild project was designed to compile and execute specific C# code that in turn decodes and executes Cobalt Strike.

The researcher also notes that, to stay protected from such attacks, organizations should set the Windows Defender Application Control (WDAC) policy to block the Microsoft-signed applications that can allow for the execution of other code. MSBuild composes a list of such applications.
Click to expand...

SANS Internet Storm Center (ISC): Attackers are abusing MSBuild to evade defenses and implant Cobalt Strike beacons

Microsoft Build Engine is the platform for building applications on Windows, mainly used in environments where Visual Studio is not installed. Also known as MSBuild, the engine provides an XML schema for a project file that controls how the build platform processes and builds software [1]. The project file element named ‘Tasks’ designates independent executable components to run during the project building. Tasks are meant to perform build operations but are being abused by attackers to run malicious code under the MSBuild disguise. The technique is mapped on Mitre ATT&CK as “Trusted Developer Utilities Proxy Execution” - T1127.001.

This is the second malicious campaign I got using MSBuild in less than a week. Usually, it starts with an RDP access using a valid account, spreads over the network via remote Windows Services (SCM), and pushes Cobalt Strike beacon to corporate hosts abusing the MSBuild task feature as described in today’s diary.
Click to expand...

Log in or Sign up

APT Malware LOLBins & GTFOBins Attack users by Evading the Security Sysem

guest Guest

itman Registered Member

Floyd 57 Registered Member

guest Guest

shmu26 Registered Member

guest Guest

itman Registered Member

guest Guest

guest Guest

itman Registered Member

guest Guest

Log in or Sign up

APT Malware LOLBins & GTFOBins Attack users by Evading the Security Sysem

guest Guest

itman Registered Member

Floyd 57 Registered Member

guest Guest

shmu26 Registered Member

guest Guest

itman Registered Member

guest Guest

guest Guest

itman Registered Member

guest Guest

Useful Searches