We talked about persistence and the file has to exist somewhere.
Generally,
that's the registry or maybe there's a temp directory or
a temp file that's created temporarily as things are
moving through and into memory.
But I think when I was reading through kind of the
stuff we were going to talk about,
another question I have is what if they're not worried about persistence?
Is there any artifact at all left over?
If an attacker decides that they're not worried about persistence,
and I have seen attacks like this before from some pretty
advanced attackers where they get on the system,
they load their malware into memory, and then they don't set up persistence,
there could be very little to nothing left behind.
I mean, you may get a couple log messages indicating that something happened.
But beyond that, if the attacker is good enough,
and like you said, they don't care about persistence,
because persistence is going to leave some artifact behind,
it could be very difficult to detect them.
Or if you do detect them,
it could be very difficult to almost impossible to
recover anything related to what they did.
Let's take the situation of an attacker gets on a system,
they compromise it,
they use fileless malware techniques so their tools
are loaded directly into memory, they've been injected directly into memory,
and they don't set up persistence so there's no artifacts in there.
They do what they want to do,
and then they cause the system to reboot so you don't have that memory
that you can grab anymore that has that tool in place.
After the reboot, you're struck.
As a defender, there is really not much you can do.
You can kind of hope that maybe something got written to the
page file that you can maybe pull out, maybe--- If you get there in time.
---if you get there in time,
maybe you will get lucky and there was some network traffic if you
were recording network traffic that you can use.
But beyond that, you're kind of stuck.
And I've seen attacks like this before, and I've seen this happen.
And from the defender side,
there is not much you can do at that point except
for try to infer what they did.
Yeah.
So you definitely have to be watching for this if
this is something you want to catch,
and it also kind of speaks to it's not just malware.
This isn't just kind of broad.
I want to spread out some malware for ransomware and to get
somebody to pay me some Bitcoin or something.
We're also talking about individual targeted attacks where you
can load not just the exploit in the memory,
but you can load tools that can be actively used.
You bring up a good point as well.
This isn't, these techniques are becoming more and more common,
so you are seeing them with commodity malware.
You are seeing them start to happen with the attacker whose
goal is to install Bitcoin miners on a system.
So those would definitely leave things behind.
You install a coin miner on there, it's going to spike the CPU,
you're going to leave files behind, and all that.
But the root cause of how it happened, which is,
as an investigator, that's one of the things that I want to try to find,
that may not be there.
And so those techniques are being used just by those advanced attackers,
at the APT A very targeted.
---a very targeted,
as well as the commodity hackers who are just trying to make money essentially.
Yeah right.