eSentire MDR for Endpoint Prevents Purple Fox Exploit Targeting Windows Machine

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

• Purple Fox EK exploited a victim’s browser to execute malicious code.
• The victim’s browser (Internet Explorer) was missing critical security updates and was successfully exploited while browsing the Internet.
• While the IE exploit succeeded, eSentire MDR for Endpoint prevented the exploit from executing malicious PowerShell code.
• If the code execution had been successful, the resulting actions taken on the machine include:
  • Disabling Microsoft Defender real-time monitoring via PowerShell
  • Creating an exclusion rule for Defender for a specific registry patch via PowerShell
  • Executing a remote MSI installer package from https://8ef[.]one/.
  • Modifying the system to prevent compromise by rival threat actors:
    • Modifying the Windows Firewall to block incoming connections to common ports:
      
    • Applying mitigations for CVE-2020-0674 (Scripting Engine Memory Corruption Vulnerability):
      
  • Changing power settings on the machine to maximize performance (likely for cryptomining activity)
  • Installation of additional payloads
    

Figure 1 Commands executed as a result of successful exploitation

Figure 2 Decoded PowerShell command. Retrieves additional obfuscated PowerShell code.

Figure 3 Decoded instructions for disabling defenses and executing MSI payload

How did we find it?

• Our Machine Learning PowerShell classifier detected an obfuscated PowerShell code executing because of a successful Internet Explorer exploit. eSentire MDR for Endpoint prevented the resulting PowerShell code from executing.
• Our 24/7 SOC was alerted and investigated.

What did we do?

• Alerted the customer and isolated the host as the investigation took place.
• Confirmed the exploit attempt was blocked successfully and the customer’s workstation was not compromised.
• Provided remediation recommendations and support.

What can you learn from this TRU positive?

• Opportunistic drive-by exploit attacks still exist. Applications that run untrusted code (e.g., browsers) must be protected with the latest security patches from vendors.
• Endpoint detection and response products can help compensate for patching blind spots by detecting and stopping exploitation attempts.

Recommendations from our Threat Response Unit (TRU) Team:

• Audit your environment for unpatched systems and applications and apply security patches in a timely manner, particularly for applications exposed to untrusted code.
• Organizations still using outdated browsers like Internet Explorer should consider transitioning to more secure, modern browsers.
• Use a modern endpoint detection and response product to protect systems and limit compromise.

Ask Yourself…

• Do you have the visibility into your network to ensure systems are patched and protected against known attacks?
• Drive-by exploit attacks are rare, but impactful. Do you have the tools in place to detect and prevent these exploits?

If you’re not currently engaged with a Managed Detection and Response provider, we highly recommend you partner with us for security services in order to disrupt threats before they impact your business.

Want to learn more? Connect with an eSentire Security Specialist.