Hello and welcome to another
application of the moderate tech
framework discussion today
we're going to be looking at control
panel items within the execution
phase of the minor attack framework.
So with that, let's go ahead
and jump right in.
So today's objectives are
as follows. We're going to be
looking at what our control
panel items as laid out
and minor.
We're going to discuss method for
attacking using control
panel items.
So discuss a method for
attacking. We're going to look at
some mitigation techniques as usual
and some detection techniques
as well.
So let's go ahead and jump in to our
definition here.
So control panel items
is the items used
in Windows to allow users
to view and adjust system
settings.
They're typically registered as DOT,
XY and KPL files
or control panel files and
executables.
These items can be executed
from the command line via an API
or through interaction with the
file. So if an attachment
or something of that nature were
sent and the user interacts
with it and it executes about
X File, it can be done through
there.
And then these files
have been used as execution
payloads to an arbitrary commands,
common delivery method of malicious
control panel items is
done through spearfishing
attachments or through multi
stage malware.
And so, again, we
talked about the initial access
phase and how a threat actor
would gain access to systems.
This, in combination with
spearfishing links, would get
them into a system.
And then this would be essentially,
again, part of execution,
getting a bigger payload onto
a system, getting malicious software
onto a system,
and then potentially allowing a
threat actor to further
propagate through the network or do
some initial discovery on the system
that is impacted or infected.
Now, let's look at a method
for attacking or how this could be
put to use.
And so this could be
popular as far as this
particular vector, when
environments have defenses in place,
such as application white listing
and process white listing.
So this may not get scanned
or it may be able to bypass that.
And so our particular
case here is step one
user receives a message with a
malicious attachment.
And again, this is typically
the product of some type of spear
fishing campaign, or
maybe they've clicked on a link
that's taken them to a site that's
downloaded some payload.
The attachment contains an embedded
KPL file,
which then upon its
execution, the file connects to the
Internet and downloads
the bigger payload or whatever it is
that the threat actor is trying to
get onto the system.
So this particular
method in itself
is not the final
piece of software or the final piece
for getting the threat factor into
a system and establishing
persistence. But it is one of the
stepping stones in doing
so.
So you may be asking yourself, what
are some ways that we can stop this
or look for this on
our systems?
Well, mitigation
techniques pretty much fall
into line with some of the other
things that we've looked at.
So execution prevention can still
be obtained through means such as
antivirus. And so in the
example we previously showed,
if a user downloads
a known malicious payload being that
the signature matches that
would have been seen through these
threat groups and
the antivirus vendors update their
systems or their signature bases,
it would block the particular
payload or Conexion attempt.
If the payload calls out to a known
malicious IP or system,
then the connection can be blocked.
So, again, if we're using some sort
of intrusion prevention system,
if we've got
a set up on the firewall that looks
for Blacklist and IPS
or IPS or systems or
URLs that may be suspicious or
that may be malicious and
it can block them, then even if the
payload were changed,
if it reached it reaches out to
a known bad IP or system,
then it can be blocked at that point
as well.
And then control panel items
within something like group policy
or some other software white listing
application can be restricted
or protected the spaces within
them as far as where they write
and those directories can be
protected. So taking
the steps to lock those down and
prevent those from being executed by
standard users could also be
a way that we can implement some
type of mitigation for
these control panel items or this
particular vector within
the execution phase.
Now, let's talk about detection
techniques, so
items related to or associated
with CPO files can be monitored
and analyzed with monitoring tools.
Some examples are a control run.
Rundell control Rundle's
user.
There are some other examples as
well. But if there are particular
particular commands or particular
instances of these that you would
want to monitor and check for,
you would definitely want to see
what threat actors are commonly
used, what's associated with some of
the common malicious
tools.
And then you could monitor these
particular areas as well.
Now, another area that's a little
more manual in process would be
an inventory of control panel
items that can be conducted
to find unregistered or potentially
malicious files.
And so in doing this, we
ran a get
dash control panel item,
all one word there,
and it produces a list
with name, conical, name, category
and description.
So a way that we could approach this
is that we could do an initial
review of these
particular items
and validate that they are, in fact
known good on the system.
And then to help automate the
process later, we could potentially
implement some form of
output of this list.
That's compared to
the new list.
So we get the original approved
list. So we'd have essentially
list one and then we
would run something like a script or
something that would produce a list
to the two,
should be equal and
shouldn't have no changes.
And if that's the case, then we're
good to go.
But if you run an output of
list one and
against list two or you
have list one and then you run
and get list two, and there is
something in list, too, that makes
it more than what
list one was like.
There has been changes or something
like that. Then you can focus on
reviewing that particular system.
So there is some flexibility here
and maybe some capability for those
that have a knack for writing
scripts or writing some type of
comparative script
that could then look at the outputs
of this and you could use that to
your advantage.
So with that in mind,
let's go ahead and do a quick check
on learning.
True or false, the
KPL or XY
file extensions are used for
manipulating or using control
panel items.
All right, so if you need some
additional time, please pause the
video so the DOT, KPL
or DOT extensions
are used for manipulating
or using control panel items
in this instance.
That is a true statement.
So those were the two that we
reviewed in the initial
component of this discussion.
And those are currently the primary
means through which threat actors
will attempt to manipulate
those settings in those areas.
So with that, let's go ahead and
look at our summary.
So we reviewed control
panel items, essentially that
this is a vector where threat actors
are using XY
and dot file
extensions to manipulate
configurations within the control
panel to insert
functions or features that may not
be legitimate
rereviewed methods for attacking,
using control panel items.
And so we looked at those three
steps again, remember
that fishing or some type
of interaction is typically
the first step in these.
And even then, if you interact
with this item, it could
be that your antivirus would
pick it up and block it, or even
if it were able to run
and try to make a connection, going
out to a command and control
server or some type of system to get
a payload, it could be blocked
as well if it's blacklisted or
known. Bad actor.
We also reviewed some mitigation
techniques looking at maybe blocking
the areas where
these control panel items can be
written to and preventing
end users from being able to
interact with those areas could
assist. And then we looked at some
detection techniques, again,
focusing on
preventative measures such as
antivirus and something of that
nature that would stop the initial
payloads and connections out.
And then if all else fails,
having some type of manual review
initially where we can pull
the information in the control panel
enemies list, do
a review to look for unregistered or
unknown entities on that list,
validate that the list is good, and
then have some measure in place to
look for changes against that list
in the future. Again, it's
a very broad area.
As far as control panel items,
there's a number of ways that this
can be taken advantage of.
But the gist of it is
that there are not as
far as within the minor tech
framework, a high number of
malicious attack attempts using that
KPL files.
But if that becomes more popular and
continues to grow, it would
definitely be beneficial to be ahead
of the curve on that.
So with that in mind, I want to
thank you for your time today and
I look forward to seeing you again
soon.