Hello and welcome to
another application of the minor
attack framework discussion
today we're going to discuss
process.
So what are the objectives of
today's discussion?
Well, they're pretty straightforward.
We're going to describe for you what
process Halloween is.
We'll have a little example based
on a recent tool that's been
used.
We're going to look at some mitigation
techniques and some
detection techniques as well.
So with that, let's go ahead and
jump right in.
So process Halloween as
laid out in INM happens
when a process is created in
a suspended state, then its memory
is unmapped and replaced with
malicious code.
So this can be masked under
legitimate processes and
can evade defenses quite effectively
if you don't have the appropriate
detection mechanisms or
capabilities in place to find these
types of things.
So an example of this is
the assim injector
that's described as a Trojan,
really, and it is used to install
back doors and it will install
several. It's associated with the
threat group Oilrig
and it essentially is
obfuscated with smart assembly
botnet obfuscatory.
So Downbelow, here's
a little snippet we took from Palo
Alto Networks unit forty two.
And the part to pay attention to
here is where it works
to create these resources,
essentially that will hide the
activities and create
the shells and things of that nature
with this particular Trojan.
Now, something to keep in mind
about these types of techniques and
tools.
Typically they require access to a
network or access to a system.
So unless you've got a system
that's Internet facing and it's
vulnerable to some other type of
exploit, this typically
isn't the first thing that a threat
actor does on the system.
But once they get to a point where
they can enact these types of
attacks or mechanisms,
they become a lot harder to detect
and find on these systems.
Now, let's talk about some
mitigation techniques for a moment,
of course,
on the site.
Looking at Meitner and kind of their
recommendations, they just indicate
that these are very hard techniques
to mitigate, especially
once we have
other mechanisms that have been used
to give a threat actor to this
point.
Now, some things that we can
commonly do that make it harder for
a threat actor to take advantage of
these types of techniques is to
implement this privilege on user
accounts. And so, again, it's
a recurring theme that we're going
to hear over and over again.
But if you could do anything to
mitigate risk and help to reduce the
capabilities of threat actors, it
would be implementing least
privilege and awareness training.
And so the reason
that awareness training is so
important is when I learn
to drive or do something like
that, at least here in
in Georgia where I'm at, they
require me to do so much training.
They require me to be aware of the
signs in the way that things
happen on on the roads and what I'm
supposed to do when what I'm not
supposed to do.
And so those
things are now innately a part of
my experience.
And when I go to drive a vehicle,
I'm aware of what those things mean
innately. I know what to avoid.
I know what to be careful of.
If we don't take those same steps
with our end users and training them
what the risks are out there on the
Internet, what people are trying to
do to take advantage of them and
what their you know, it becomes a
bit of ignorance that we've got
among ourselves.
And so if we can at least make end
users aware,
then the likelihood that the threat
actor gets in through something like
social engineering or, you
know, things of that nature are less
likely the more that we
train our staff and our folks
and our businesses.
Now, detection mechanisms
that we could implement here,
we could look to monitor API calls
that unmap process memory and
those that can modify memory within
another process.
And so any time
we see these types of activities
that are associated with process
Halling, we should have some
mechanisms in place to alert
either staff members or a third
party to then look
into that instance and determine
whether or not a malicious threat
actor is in play.
Now, let's do a quick check
on learning.
True or false
process. Hallowing is easily
detected and prevented.
All right, well, if you need some
additional time, please pause the
video and take a moment to think it
through.
So process following the keyword
here, easily detected and prevented
as we discuss process following is
somewhat of an advanced technique
actors can use to avoid detection.
And it is not always easily
detected or prevented if a threat
actor has already gotten on the
system. And so in this instance,
this is a false statement
process. Halloween is not easily
detected and it can be difficult
to prevent if other
mitigating factors were not
implemented.
So let's go ahead and move over to
the summary for today's discussion.
We looked at and described process
Halloween at a high level and we
introduced you to a particular tool
that has been used for process
Halloween. We discussed mitigating
techniques, really focusing on at
least privilege and end user
awareness training as factors for
that.
And then we talked about detection
techniques where we look for APIs
or calls on systems that are
doing things that would be
associated with process Halloween
or these types of techniques.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.