Living off the land: the delivery & installation phases

This is the third installment of the Living Off the Land blog series. This section will focus on the Delivery and Installation phases of the Cyber Kill Chain.

The delivery phase of an attack is focused on how an adversary distributes a weaponized payload. This can include the initial delivery phase (spam email/malicious downloads) or the lateral movement inside the network. Once the delivery stage has been successfully completed, the adversary will install and execute the payload.

The use of Living Off the Land tools limits the adversary’s need for additional software, reducing the likelihood of detection. In the case of delivery and installation, having valid credentials with the appropriate permissions allows the adversary the ability to transfer and execute files throughout the network using legitimate software. Examples of misused tools include remote desktop applications, third party service provider programs and administrative tools. The two most popular Living Off the Land tools are PsExec and Windows Management Instrumentation (WMI).

There are steps that enterprises can take to minimize the chances of delivery and installation success:

• Disable or limit remote WMI and file sharing
• Implement a policy of least privilege
• Segregate networks and implement Access Control Lists (ACL)

Background

There are a variety of Living Off the Land tools that have been used by adversaries to complete the delivery and installation phases. These tools can be installed by users or system administrators for business purposes. Recent high profile cases of remote desktop applications being exploited, such as Team Viewers’ connection to the CCleaner breach ¹, have increased security focus on this issue.

The tools used by MSSPs have proven very useful to attackers in the past. Although the tools are not native to all systems, they are still considered to be Living Off the Land tools, as they may require access to maintain, update, monitor or administer client networks. The case study included in this post outlines an incident where a third party provider’s trusted software was misused for malicious purposes.

System Center Configuration Manager (SCCM) has received increased attention from security researchers due to its capability to deliver and install remote applications across the network ². eSentire has not actively observed the exploitation of SCCM at this time; however, companies should be aware of the potential for abuse.

The two main Living Off the Land tools discussed in this blog are PsExec, for delivery and installation, and Windows Management Instrumentation (WMI), for installation. In the delivery and installation examples, it is assumed that the adversary has been able to identify the tools and successfully exploit them.

Case Study

In early 2018, eSentire observed a third-party service provider’s (MSSP) Virtual System Administrator (VSA) tool being exploited to deliver and install cryptocurrency miners. It leveraged a vulnerability in the third-party provider’s application to deliver Monero mining software to customer computers. Monero is a type of cryptocurrency. Similar to other cryptocurrencies, Monero is ‘mined’ by performing complex and resource intensive equations on CPUs. As the VSA application was used in multiple customers’ environments, the adversary was able to distribute and install the malicious application across a wide range of endpoints. This method allowed the adversary to circumvent perimeter level security and harvest Monero for financial gain.

For additional information and technical details on this particular incident see the provided links ^{3 4}.

Additional Information on Delivery & Installation

The most popular Living Off the Land tools for delivery and installation that eSentire has observed are PsExec and WMI. These tools have been employed by adversaries after obtaining compromised credentials through the use of phishing campaigns or password dumping tools (Mimicatz). The NotPetya ransomware outbreak, for example, included both PsExec and WMI to incorporate worm type behaviour to infect additional endpoints on the network.

It should be noted that for adversaries to use PsExec and WMI, they require appropriate permissions to execute commands on the remote system.

PsExec

PsExec is a tool that is incorporated into Microsoft Sysinternal Utility Suite. It allows systems administrators to transfer and execute files remotely. It is not natively installed but it is a popular tool used by system administrators. The screen capture below provides an example of PsExec copying over the file payload.bat to the remote host DESKTOP-TEST1 and execute the file.

Figure 1: Deliver and execute the payload.bat file

Windows Management Instrumentation (WMI)

WMI is an infrastructure tool used for data management and task automation.Adversaries utilize WMI to execute commands remotely and install applications on systems. In figure 2, WMI is used to remotely execute the program ncat.exe on DESKTOP-C9V9E7G. Ncat.exe (netcat) is a Swiss army type tool that can be used for a variety of malicious and non-malicious purposes, such as file transfers or establishing backdoors.

When the ncat.exe command is executed in this example it creates a reverse shell backdoor. This allows the adversary to interact with the operating system on DESKTOP-C9V9E7G (Figure 3).

Figure 2: Ncat.exe is copied to DESKTOP-C9V9E7G and then executed using WMI.

Figure 3: A backdoor is established after executing the WMI command

Mitigation Strategies

To minimize the impact of delivery and installation tools, consider the follow options:

• Secure remote WMI connections ⁵
• Disable or limit remote WMI and file sharing
• Block remote execution through PsExec
• Implement a policy of least privilege
• Segregate networks and implement Access Control Lists (ACL)
• Harden network devices and secure access to infrastructure devices
• Enforce strong password policies
• Utilize host-based firewalls

Conclusion

As illustrated in the case study and other recent examples, failing to take steps to limit the malicious use of Living Off the Land tools may result in additional systems being compromised. Network segregation and implementing ACLs ensures that only systems or groups deemed authorized can access resources. A policy of least privilege can be implemented in order to prevent lateral movement of an adversary inside a network. Although a variety of external tools exist for performing delivery and installation, Living Off the Land activity is less likely to be detected. A variety of recent examples prove the popularity of these tools amongst adversaries, and the importance of prevention and detection directly relating to widely used tools.

Sources

[1] https://thehackernews.com/2018/04/ccleaner-malware-attack.html

[2] https://enigma0x3.net/2015/10/27/targeted-workstation-compromise-with-sccm/

[3] https://www.esentire.com/news-and-events/security-advisories/kaseya-virtual-system-administrator/

[4] https://www.esentire.com/news-and-events/security-advisories/kaseya-update-cryptocurrency-mining-campaign/

[5] https://msdn.microsoft.com/en-us/library/aa393266(v=vs.85).aspx