Hello and welcome to another
application of the minor attack
framework discussion today
we're going to be looking at
persistance mechanism known as
new service.
So with that, let's go ahead and
jump into our objectives.
So the objectives of today's
discussion are to describe what new
service is with respect to the
framework.
How has new service been used?
Some mitigation techniques and
some detection techniques.
So new service is when
a threat actor
or actors take advantage of
systems by installing a new service
that can be configured to execute
it, start up using utilities to
interact with the service or by
modifying the registry.
So threat actors will typically name
services after legit software
to attempt to circumvent controls
or bypass detection methods.
Services are commonly used to
perform privilege escalation
to get an administrator account to
system level again,
sometimes as services
run at a system level and you
can go in and do a quick control
delete. And so while we're sitting
here, I can actually go ahead and
demonstrate that.
So I had control alt delete
click outside of that.
And then if we go into task
manager and we
actually look at some of
the services here.
A threat actor could potentially
attempt to run as
any given service in these areas,
and so it's got groups and things of
that nature and like a local
service.
And if we go into the
details and look here,
we'll actually see that a number of
services are running as system
and things of that nature.
And so if a threat actor is
able to take a
particular service and run
as that service, like inject itself
into that and take
over that particular idea or
something of that nature, they could
potentially have system level
privilege.
And so this particular
type of attack could be very
beneficial for a threat actor if
they're able to get system
level access.
So let's talk about the Trojan
RockYou Mannu.
So Ricky Mannu is a Trojan
that steals information from
the compromised system.
And so just to give you an idea of
how this works, it creates
the following files.
So in the help
C in doing that
and then it does I r and
D l l and
so then it, after
creating these two areas here,
will create the following service
I armaan, which is the name
of the service, it will have an
image path as follows here
and then the description, it will
actually have a written out
description. And so it indicates
here that infrared port monitor
is present for all computers
with infrared ports.
It initiates file transfers between
your computer and another device
like a PDA or mobile phone.
So very interesting.
So if we're not savvy, if
we're not really paying attention,
if we don't know what we're looking
for, this could potentially
sneak under the radar as far as
having that installed and just never
knowing the difference.
So let's go ahead and look at some
mitigation techniques for this as
well. So limit user account
privileges to those necessary
and do not allow accounts to have
administrative access again
for daily tasks, utilize
malware detection and prevention
tools to slow down or stop known
variants of these types of attacks.
Again, there may be
components of these packages that
could be undetected
if even if the animals were
able to get it, maybe providing a
false sense of security.
And again, we keep coming back to
not allowing administrative access
for daily tasks.
I know that that's becoming
redundant, but it is a mitigating
technique for several of these areas
within persistance.
Now, let's talk about some detection
techniques at a high level.
We can monitor service creation
and changes in the registry.
And so we shouldn't be making daily
changes to our registry.
So any time changes occur,
we would want to alert on that and
evaluate it to see if it was a
legitimate activity.
Analysis should be done on multiple
events to determine if a threat
actor is potentially in the network.
And so what this means is you don't
want to do a one for one.
One thing happens, we review it.
One thing happens, we look at it.
We want to take a group of events,
cluster those together and see if
those activities correlate
with things that are a threat.
Actor would be doing a network scan
in MAP scans,
attempts to load software as
attempts to do privilege,
escalation. All of that maybe
ties back to known
bad IP addresses that something
tried to reach out to
again.
So you can't take
a single event and tie it back
to a threat actor.
In most cases, you'll have
to take multiple events, put them
all together and kind of create a
chain of attacks that this
threat actor was moving through.
And so look for changes in systems
that do not correlate with patching
or other system management
practices. So if there was no
patching going on that day, if
we weren't supposed to be making
changes, if there was nothing on the
calendar for us to be doing, why
did it happen? And if something is
different or if something's out of
place, then it makes sense to
evaluate it and see if
you can tie it back to either
legitimate function or business
function or if it
is indeed a threat actor.
Now, let's do a quick check
on learning.
Implementing a new service does
not allow threat actors to get
system level access.
All right. Well, if you need
additional time to evaluate the
statement, please do so.
So the key thing here is,
is that implementing a new service
does not allow the threat actor
to gain system level access.
When we just did a quick look at
the command prompt or the
task manager, and we found that
there were a number of services
running at system level.
So this is
a false statement.
A threat actor could be
allowed
OK, to get system level access
by implementing a new service
depending on what they do.
So at that, let's go ahead and jump
over to. Our summary, so
we described what news service is,
and essentially this is where throw
an actor either injects themselves
into a current service or creates a
new service on a system.
We review how the news service has
been used or how it could be used by
evaluating a particular Trojan and
some things that it does to the
system.
We reviewed some mitigation
techniques and we looked at some
detection techniques as well.
Again, we will continue to
iterate any time.
It is pertinent that administrative
access in limited quantities
is good.
Lisse privilege is good.
A high number of these attack
vectors are mitigated by things
that we can do with little to
no cost to our organizations.
So with that in mind, I want to
thank you for your time today and
I look forward to seeing you again
soon.