Hello and welcome to
another application of the minor
attack framework discussion,
so today we're going to be looking
at user execution.
So the objectives of
today's discussion are to
look at what user execution
is, some common methods
as far as using user execution
as a vector, common
file types that have been seen in
user execution.
As far as the types of attachments
that have been seen, mitigation
techniques and then some detection
techniques as well that we're going
to go through.
So with that, let's go ahead and
jump over to our first slide
here. User executions.
So the reliance on an
end user to
perform a specific action
in order to gain execution,
essentially we do initial access
where we get on a system,
but we need a user to open
something, do something.
Perminder So that could be
several things, but really we're
looking at direct code execution
where a user is opening
a malicious executable.
So this could be something in the
form of an email attachment or
something of that nature.
That's my attempt to do email
and then code execution through
links is also a way that
this happens. And so this could be
again, we looked at that your bank
exploit or something of that nature
where a user doesn't so
much get an attachment, they get
some kind of link in the body of an
email.
They interact with it.
That takes them to a site.
Maybe there's more action that has
to take place or and at that point,
attempts to do a download
of some kind.
So that's what we're looking at when
we talk about user execution.
And so some ways that
it's mentioned that user execution
happens, one of
which can be drive by compromise.
And so this is where a threat
actor gains access by having a user
visit a website that
has infected ads or
maybe some other function of the
website has been compromised.
And so when the user interacts with
that, it then
downloads something or does
something to their system.
Spearfishing attachments is
something that we've mentioned as
well. So this is where malware is
attached to an email directly.
Again, the user has to interact
with that content and that content
also has to get past
any number of controls that we have
in place that should hopefully strip
that content or prevent
the user from executing that
content.
And then we've got spearfishing
links. And so in this case, the user
must interact with a link sent via
email that then downloads
the malware. So now something
to remember here is that with
a drive by compromise or
a compromise that has to do with a
site, the user
could just be surfing the Web,
as they normally would during the
day, maybe on lunch or something
like that. So this is
interaction as far as Dropbox
compromise goes, but it's not as
direct as spearfishing
attachments and spearfishing links,
because in these two cases,
the user has been sent something
that they interact with, with drive
by compromise.
The user could just be surfing the
web, not really thinking about
anything.
And they go to a site that,
you know, delivers some type of
malware or something of that nature
at that point.
Now, when we look at attachments
and file types with
respect to what threat actors are
using, there's a few
common ones.
Now, this list isn't all inclusive,
but these if you were going
to get an email attachment or
something of that nature, of the
ones you'll likely see.
And so word documents,
PDF, Excel files,
rich text files, executables.
We've got control panel items that
we had talked about earlier.
We've talked about executables as
well.
But really, you know, text files,
you can't deliver like that text.
You can't deliver a virus with that.
It just doesn't execute in the same
way that these other ones do.
So any time
you get any form
of file
via email, that wasn't
something you discussed with
somebody or anything of that nature,
you need to kind of stop and think,
hey, did I ask for this?
Was it requested?
Do I know this person?
And even if you do know them,
we're finding more and more that
higher UPS, managers, executives,
business partners, whatever the case
may be, are falling victim
to spoofing like
their account is either spoofed
or it's outright compromised.
And then a third party, a threat
actor, will engage you in an attempt
to get you to do things on behalf
of that person. So always ask,
always call and just look into
things a little bit further before
taking action, especially when these
files are involved.
Now, let's talk about some
mitigation techniques here.
So execution prevention
of executables, so stopping
those from even running
use of antivirus to stop known bad
files from running.
So antivirus. Is kind of the age
old, you know, hopefully it'll
catch everything and anything that
runs, especially if it's a common
attack type or common
pattern. But
if you're dealing with a zero day
attack or something that hasn't been
seen before.
Chances are your antivirus may
not stop it. So you would run
the risk of having the issues there,
network intrusion prevention
to block moonbat activity.
So essentially how this differs
from intrusion detection is with
intrusion prevention.
It will see the activity
that is associated with malicious
behavior or a threat actor
with detection.
It will simply notify somebody
or alert on the activity.
But the activity continues.
As is with prevention.
It will attempt to block the
connection out, block the process,
whatever the case may be.
And so network intrusion prevention
definitely could help with
mitigation, but it can also block
legitimate activity as well.
So you always want to consider that,
restrict Web content and prevent
users from visiting known bad
sites. And so that can help
would drive by compromise
and things of that nature.
It could also assist
if they can click a link
that takes them to a known bad site
that's attempting to do something
that could be blocked any
time Web restrictions
or restrictions in the office take
place, especially when
the office was previously
liberal. As far as their permissions
and allowing people to do things,
this could be seen as as
oppressive. But really
the mission here is to reduce risk
for the business.
And as long as that's clearly
explained, I don't think there would
be anyone that would have issues
with restrictions on content
and things of that nature.
And then, of course, end user a.
Well, awareness training is huge.
I don't think there's a single
person that would view this content
that has not heard of any user
awareness training as far as
training and users doing security
awareness training, maybe doing
phishing campaigns to see
who your risky users
are, who interact with content and
things of that nature. Because if
they do it during a test,
chances are they may have interacted
with content in the past as well.
That was potentially malicious.
So with that, let's go ahead and
look at some detection techniques as
well.
So in this list, we've got
monitoring for the execution
of command line arguments.
Again, this carries between
multiple discussions like
PowerPoint, the PowerPoint
discussion sorry, the power shell
discussion. This is a PowerPoint,
the power shell discussion, as well
as
the scripting discussion, things of
that nature.
So in those cases,
that's user execution, user
interaction. So it's going to carry
true that we want to
prevent the users from using the
the command line from using the
terminal, from using power
shell things of that nature, because
if they don't need it again in their
day to day activities, then it
can help us in the event that they
get some type of infection that
attempts to take advantage of that
and then monitor hits on antivirus
and have a security team member
review activity
pre and post alert.
And the reason I say pre alert
and post alert is there may have
been things on that system that
happened leading up to
that antivirus hit
that were the threat actor doing
certain things to get to that point
and then post that activity
to see one if it was not successful,
which if the antivirus alerted on
it, it blocked something.
But there may be remnants or pieces
of that that it didn't get.
And so you'd want to look at that
scenario kind of holistically.
They're kind of walking into it
thinking that maybe something was
going on before or after the fact.
And so definitely take that into
consideration with your detection
activities there.
Now, let's do a quick check
on learning.
A DOT text file is a common
means for threat actors to execute a
virus or malware
commonly used in a phishing attack.
All right, well, if you need any
additional time to think this
through, please pause the video.
So true or false,
a text
file is a common means
for threat actors to execute a virus
or malware using a phishing attack.
Well, if you were listening to what
we said earlier, this is a false
statement. Currently, text files are
not able to execute
viruses, malware, things of that
nature. And so they are not commonly
seen as a component for
threat actors to attack.
Now, that's where an actor could
send a text file with a link in it
that you could then copy and paste
into a Web browser that would then
download something.
So that's not to say that
it could not be malicious,
but it is currently not a common
means of attack as far as this
is concerned.
So in summary of today's
discussion, we did a review
of user execution and what it is.
We talked about some common methods
for user execution, common
file types, mitigation
techniques, as well as detection
techniques. So with that in
mind, I want to thank you for your
time today, and I look forward
to seeing you again soon.