Hello and welcome to
another application of the minor
attack framework discussion
today we're looking at elevated
execution with prompt.
So let's go ahead and jump in to our
objectives.
So today's objectives are
as follows.
We're going to describe elevated
execution with prompt.
So the name has a lot to say about
what we're going to be doing here.
How has elevated execution with
prompt been used?
We're going to look at some
mitigation techniques and then we're
going to talk detection techniques
as well.
So elevated
execution with prompt.
So threat actors use
authorization, execute
with privilege, appears
to escalate privileges by
prompting the user for credentials.
So that is a mouthful.
The API has no validation
to determine if the request has come
from a reputable source.
And so a key thing here
is that anybody
can pretty much put something in
here and it will attempt to get
the user to provide credentials, to
provide additional privileges.
And so this can be abused.
And that threat actors will install
malicious software and other
persistance mechanisms by taking
advantage of this API.
So very interesting.
Right. So we have something built
in, probably developed
for good causes
that someone has found and they're
able to manipulate through
this this particular loophole.
So that's very interesting.
So let's talk about an instance
where this is used.
And so there's actually a
Mac OS malware variant
called Schleyer.
And essentially this
malware attempts to get the user
to install malicious updates
claiming to be for
flash player.
And so essentially the malware
does some of the following things.
It will collect system information
such as Matt Mac version
and IO platform UUID.
It will generate a special session
jewed using the You
ID Gen Command.
It creates a custom.
You are using the information from
these given steps and then
it will attempt to download a
zip file payload.
Using Kerl creates a directory
and unzips, makes the binary,
executes the payload, performs the
kill all. And so all this happens in
pretty rapid succession.
But essentially this is mimicking
or looking much like
the elevated execution with
prompt as far as how this
x you go out,
you do something that you think is
is legit, like downloading an update
or something of that nature.
You're convinced that it's
necessary.
You're prompted to enter credentials
to maybe give a pseudo
or some type of
domain administrator, local
administrator privilege.
You do so and then they've got
you. So you really have to make
sure that you're paying attention.
And a big part of this is
going to be user education
and understanding how these things
work.
But there are also some techniques
we can use for mitigation
as well.
So with respect to mitigation
activities, in the case of
the Mac, we can prevent applications
from running that haven't been
downloaded through the Apple store.
And so not to say
that trust is one hundred percent
here, but it's a little bit harder
from a quality control standpoint
to just throw something on there
and it be infected, but it happens.
And so that's not foolproof, but
it's definitely
reducing some risk and do
not allow unsigned applications to
be run on the system at all.
Again, not
foolproof, but there's a little
extra work than a trained actor
would have to put in in order to
circumvent some of these controls
and do these things.
And then from a detection
standpoint, we
can consider monitoring for the user
Leyb Xixi
slash security underscore.
And then this is off trampoline
execution's, which could indicate
that the
authorization execute with
privileges is being executed.
So a lot of
jumbled words there, but that is
exactly what you could
do to help to provide
some type of detection in this
particular case.
Now, true or false,
Max, are not susceptible
to malware or viruses.
All right. Well, we're not going to
take too long on this one.
This is definitely false because we
just went over a particular
malware variant that is
Mac oriented.
Now, I know that it seems like we
jumped through some hoops pretty
quickly here, but essentially
some other things to consider when
we talk about this
particular type of elevated
execution with prompt is
remember that if our
users don't have privileges
to install apps and do think.
Of that nature, it can also work
is a mitigating factor in our
favor and then use our education,
while not mentioned in every
instance with respect to
detection and maybe even mitigation
is important with respect
to them being able to know when
something may be bogus or
to know when they are potentially
being manipulated by
a threat actor.
So those are always going to be
things that we want to bring up from
time to time and implement
where we can.
So in summary of today's discussion,
we described elevated execution
with prompt.
We described how elevated execution
with prompt has been used in the Mac
OS version of this
discussion as well.
Describe some interrogation
techniques and describe some
detection techniques as
well. So with that in mind,
I want to thank you for your time
today, and I look forward
to seeing you again soon.