Hello and welcome to
another application of the moderate
attack framework discussion
today we're going to be looking at
our case study in the execution
phase.
So I want to introduce you to
a quick sentence here.
Living off the land.
Now, when you think about living off
the land, you probably think about
living off the grid.
You are self-sufficient.
You've got a source of water that
you use. You've got a way that you
get rid of waste.
You've got a way that you get food,
you stay warm, separate from
the grid, and you communicate
in a in a manner that is maybe
through letter or something off of
that nature. Maybe you don't
communicate at all.
So how does that look
with respect to
a cyber attack or a threat actor
in the way that they act, in the way
that they move to an environment?
So let's start with the
semantic twenty nineteen Internet
security threat report.
So this report is from February
of twenty nineteen.
And so it is going to be
the source of our particular
statistics today.
So at the time of this report,
power shell attacks have increased
by a thousand percent
based on those that were blocked in
twenty eighteen on the endpoint.
So again, this is what Symantec was
blocking.
The amount of that
as far as the blocks go, went up
by a thousand percent since twenty
eighteen to twenty nineteen.
So that's a big number.
And then at the time of this report,
Microsoft Office files accounted for
almost half. Forty eight percent of
all malicious email attachments.
Previously in twenty seventeen,
this had only been five percent.
So the statistic there was
that the number of
Microsoft files.
That were malicious had gone up
exponentially as well,
groups such as Mealybug and Nachas
were identified as preferring to
use macros in office files
as their preferred method to
propagate payloads.
And then, last but not least, it was
noted that on average, one hundred
and fifteen thousand malicious show
scripts were blocked each month,
only accounting for less than one
percent of power shell
use.
So when we
talk about this concept
of living off the land, these
particular
methods are native
to Microsoft Power.
Shell is native to Microsoft.
Microsoft Office is a native
application that you can install and
use macros is built
into office
documents and things of that nature.
So what we're seeing is
this concept which I've seen
in articles and it's come up in the
last few years, but it's nothing new
is the concept that an attacker uses
preinstalled intrusted system tools
to carry out their work.
And some of the reasons that this is
happening is, is that there are many
tools within windows that can be
used to carry out cyber attacks.
The tools are there for legitimate
administrative purpose.
But savvy threat actors
are finding that they can use these
tools to their advantage.
And then growth of these little
living off the land activities
is in part from a reduction in
the availability of zero day
vulnerabilities.
Plus, it takes a lot of work to find
them. I heard them referred
to as silver bullets, and so it's
something that these groups will put
a lot of time and effort and energy
into, but they're hesitant to use
them because once they do,
the information is out there,
especially with crowd strike and
these other groups that
could potentially pick up on that
activity and then work with
vendors to patch that particular
zero day attack.
And so we've talked about tools like
power, shell scripts, VBS script.
There's WMI just
to name a few that are native
to the Windows environment.
And a big part of why these
types of attacks are becoming more
and more prevalent is because
threat actors can use these
tools and it
doesn't get flagged right
away, especially if you're not
looking for anomalous activity.
It's just a standard tool running a
process or a script or whatever the
case may be.
The other thing we're seeing is
bogged down in programs and things
of that nature, if you think about
it, are pushing
a lot of the easy and low hanging
fruit and the
readily accessible systems
out of the picture.
And so, again, we come back to this
need to do research on zero day
vulnerabilities and things of that
nature that is causing
it to be that much harder and
resource intensive for threat actors
to do what they do.
So, again, the idea
of using native tools using
tried and true methods like fishing
and things of that nature to get
payloads or macros
and things of that nature to be run
in an environment that can then
piggyback off of legitimate services
or processes is
something that we're starting to see
more and more of.
So now comes
the component of this that I want
you to engage in.
So how is this concept
being addressed in your
organization? When you think of
living off the land,
consider your current controls
within your organization.
Do you feel confident that they
could catch anomalous activity?
Right. And aside from the tools
mentioned, what other ways
could you see an attacker living
off the land?
And so don't just be
motivated to do these two parts,
but actually think through, OK, if
someone were to use power, shell,
would we catch if someone were to
use WMI, if someone were to use
some item and control panel, if
someone were to use a
bad script or some type
of command prompt, or if they were
to, let's say,
use a service that's native to
Windows to give them access to the
system, how would we know
what they were doing?
How would we be able to block that?
How would we be able to defend
against that? And so take the
concepts that we've been looking at
in the minor attack framework, some
of those mitigating factors, as
well as some of the detection
techniques and apply
those to your organization.
And on a scale of one
to 10, 10 being most confident,
one being not confident at all,
how would you feel
that your organization's
capabilities would be able to
address an attacker that is living
off the grid, not using known
malware variants, not using
any type of malicious tools, things
of that nature?
Where do you think you fit in today
as far as that's concerned?
So good luck on this.
Please take your time, look through
it, go back and review the framework
in the execution phase as well as
the initial access phase
and just consider those controls
and things of that nature
when you're going through this
particular study.
And don't hesitate to look at these
two. Antec, 20 19 report, as well
as a reference and to get some
additional information.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.