Hello and welcome to another
application of the minor attack
framework discussion today
we are looking at execution through
API as an attack vector in
the execution phase.
So let's go ahead and jump right
into our objectives.
So today we're going to look
at what is execution
through API.
We're going to look at some tools
that are used in this particular
method.
We're going to look at some
mitigation techniques and some
detection techniques as well.
So with that, let's go ahead and
jump right in
now, execution through API.
So these attacks involve the use of
tools that may directly use
the Windows application programing
interface to execute binaries.
And so we've
probably heard of or I'm sure you've
heard of using APIs
to communicate between systems as
well as between Web applications
and things of that nature or doing
API calls with
you URLs and things of that nature.
This is focusing on the Windows
application programing
interface with respect to the
execution of binaries.
And so some examples of API calls
that can be used to execute binaries
are as given.
Now, this list isn't all inclusive,
but create process
and w create processes,
user create processes,
user w load library
and load modules.
So these can be beneficial in
executing scripts and things of that
nature.
When APIs are
a part of attacking.
And generally it's again,
when we're looking at the attack
vectors and we're talking about the
attack vectors,
a user may
execute a phishing attachment
or superefficient attachment that
results in command line calls
that result in API actions
or something of that nature.
So these can be compounded
and each of these vectors is
not a one for one.
You may have lateral movement as
well as movement up
and down through a particular phase
as well.
Now, when we look at tools
used, this is
some tools that are used by a
particular threat group.
So Boost Right Loader
is essentially a loader created
to be launched via
the abuse of the
search order of applications.
And so the application loads,
several libraries and finally loads
D Right now, this
causes the import of a malicious DLL
that is then used to load an
instance of the Carbonetti
backdoor.
Another tool that we have here is
already F sniffer
module, which is loaded by
a boost. Right.
It will hook within 30 to
API functions and can be used
to hijack elements of NCR
Inshala Aloha
Command Center.
There's also a back door component
that enables it to inject commands
into an active already have client
session now some
other components of this tool
and also allows for the
uploading and downloading of files
on systems. And so if there are
particular files that the
threat actor would be after, they
could potentially load some of those
files as well.
Now, when we talk about mitigation
techniques, really within
respect to these apps and things
of that nature, identify and block
malicious payloads of software
through execution prevention
methods. And so this can be
things such as antivirus,
can be things such as
intrusion prevention systems
and things of that nature that will
look essentially for suspicious
activity and then will attempt to
block that activity based on what is
known malicious now
detection methods
with respect to APIs, because
they're so as far as within Windows,
because they're used so
much in the
way software works and the way the
systems work, it wouldn't make
sense to log activity
of every API or
every call on
the Windows system.
It would overwhelm your logs and it
would make it very tedious to
inspect this information.
And so what you would want to do is
utilize intrusion prevention and
detection systems to do correlation
essentially around events
that could be potentially malicious
in nature involving Windows API.
So instead of looking at single
events, you would really want
to take multiple events at a time
that look suspicious or seem to be
a signature of a particular type of
attack.
And then you would investigate
that information and see if it
is in fact malicious.
Now, let's do a quick check on
learning. True
or false execution
through a API is concerning
the use of the Windows
application programing interface.
All right, well, if you need some
additional time, please go
ahead and pause the video and take a
moment.
Now, this statement is
true. So with respect to
API execution,
in this case, daughter talks
about the Windows application
programing interface.
And so we're
not talking Web APIs and things
of that nature. Right now, it's
strictly focusing in on a Windows
application programing interface.
And so in this case, the statement
given is true.
So let's go ahead and jump
over to the summary for today's
discussion.
So we reviewed execution
through API as presented
in the attack framework.
We reviewed some tools that we
can use or that would be used for
manipulating these APIs or
how we've seen instances of these
APIs being taken advantage of.
We reviewed some mitigation
techniques, which was really
through things like ARENAVIRUS,
through execution prevention and
other white listing tools that you
can put in place to try and block
malicious loads and things of that
nature and then
reviewed some detection techniques.
Again, not looking at all
aspects of API activity
within Windows because it
would be so much information,
it would be very tedious and hard
for you to single
out one event as being malicious.
So you'd want to focus again on
correlation of events to attempt
to detect activity with respect to
Windows APIs and malicious
activity.
So with that in mind, I want to
thank you for your time today,
and I look forward to seeing you
again soon.