Hello and welcome to another
application of the minor attack
framework discussion today,
we're going to briefly look at
compile after delivery
within the defense evasion
phase of the framework.
So with that, let's go ahead and
jump right into our objectives.
So the objectives of today's
discussion are as follows.
We're going to describe what compile
after delivery means.
We're going to look at some
mitigation techniques and
we're going to look at some
detection techniques.
So with that, let's go ahead and
jump right in.
Compile after delivery is
essentially when the threat actor
delivers code to the victim
system in an uncontrolled
manner. So typically,
when we are using
mange to catch known
variants of code
or of a payload or whatever
it is that the threat actors using,
it's generally in a compiled manner.
Now, delivering the code in an
uncontrolled manner is done in
an attempt to subvert technical
controls by compiling
the payload before execution.
And so the hope here.
Is that instead of sending the
code in a compiled manner, ready to
go, it will put itself
together, button itself up and
essentially do that right before
it goes to execute.
And the hope here again is that it
will subvert
controls or systems and provide
a means for the right actor to get
the payload to run.
So what are some things that we
should look for in these cases?
Well, payloads may be encrypted,
so there are some systems that may
be able to pick up encrypted
payloads or may be able to.
You know, seek those out and give
you feedback on them before they
become an issue,
they may be encoded within other
files. And so I've seen where
we take like an executable that's
from a known source, and we try
to put the payload within that known
source and kind of trick
the system into believing it's
something it's not.
Delivery can be done via phishing
attachments and things of that
nature. So if you've got end users
that aren't well trained or if
you've got end users that are
historically good
at opening these types of things,
then that's one way that
these can be delivered.
Payloads could be in a format
that is not native to the operating
system that's in Houston.
So you may have a Windows system
that's got some Linux looking files
on it. And in those cases,
the systems may not always pick
those up because they're not native
to the operating system.
So that may be one confusing for
users and it may also be
an attempt to trick
defenses and things of that nature
from not functioning properly.
So mitigation techniques with
respect to this were listed as
somewhat limited because of the
complexity and way in which these
attacks happen.
But we can always say that in user
awareness, training is a great
mitigation technique here, because
at the end of the day, end users
are typically the ones who
are interacting with the payloads
or who are going out to different
sites, maybe to download things that
they think are legitimate.
Whatever the case may be,
building awareness where the control
sets to actually outright stop these
types of attacks is limited
is always a good step in the right
direction because, again,
end users are likely going to be the
ones that interact with this
content. No disrespect to my end
users out there. We love you.
You help us to keep doing what we
love doing.
But if we help to educate end users
in this case, it could
greatly limit the potential for
one of these types of attacks
to be successful or these types
of defensive techniques to be
successful.
So detection techniques, we do have
a few extras here
that could be of benefit.
So monitoring systems for a normal
activities like command line
arguments for compilers like CSC
and, you know, things that
are going to take code and put
it into an executable machine
readable format, definitely
want to look for those.
If there are any other compilers out
there that may be pertinent to
your environment, your systems, it
would be good to have techniques in
place to monitor for these types of
things and their execution,
especially if you're a
manufacturer who doesn't do
any type of programing.
If no one in your environment should
be compiling code or doing
things of that nature.
And then these things here should
definitely be taken into account
and monitored and blocked.
Even if you can look for non-native
binary formats and cross platform
compilers.
Again, if the
threat actor is using a nonstandard
payload or a nonstandard
format that your system wouldn't
understand right out the gate.
It doesn't mean that it's benign.
It could be done for a purpose or a
reason.
So monitoring for those things can
also be beneficial for the
organization as well.
So let's go ahead and do a quick
check on learning.
True or false,
the methods used for compile
after delivery are easy to detect
and prevent.
All right, well, if you need some
additional time, please pass the
video. So in the.
This is not easy to detect
and prevent. When we got to the
mitigation components, we said
really the end user awareness
training is kind of the only
mitigation technique that was
described by minor matter.
Really use some language that was.
I'm in favor of mitigation very
heavily, but there are other
controls we can implement
in tandem with some
of the other phases and vectors
that will help to reduce the risk of
Kampala after delivery being easily
executed by threat actors.
So this
is not easy to detect and
prevent.
So this is a false statement.
So let's go ahead and jump in to our
summary.
So very short summary.
Today we described what compile
after delivery is essentially this
is the payload gets to
us in a manner that is not readable
and not executable.
It is compiled using some
components that an actor would have
in their overall package for this
payload and then it would be
compiled before execution.
We describe some mitigation
techniques, primarily being in user
awareness training.
And then we described some detection
techniques, like looking for
compilers that are being ran
through command line in environments
especially where coding or
programing is not the standard
day to day operation.
And we also look at.
Any binaries that
would not be native to the system
being a potential red flag
as well.
So with that in mind, I want to
thank you for your time today,
and I look forward to seeing you
again soon.