Teaming up with VMware Carbon Black to Hunt Evasive Malware

Beyond the first-order health effects of the COVID-19 and the second-order impact on the social and economic environment, the global pandemic has forced upon companies and other organizations a degree of technical and operational change—in terms of the combined might of scope and suddenness—that is without equal.

Workforce shifts to home workstations and the rapid migration to (or accelerated introduction of) more cloud services in support of that shift have altered threat surfaces. In parallel, this shift has disrupted processes and changed the working environments for many.

We recently teamed up with our partner VMware Carbon Black to investigate the impact that these changes have had on how threat actors operate. You can find the full results of this investigation in Threat Intelligence Spotlight: Hunting Evasive Malware, but in this post we’ll focus on one clear observation.

Perimeter dissolution leads to an emphasis on exploiting user behavior and leveraging trusted tools.

Threat actors, showing their usual agility, have shifted efforts to target remote workers and take advantage of current events. Because today’s networks have more sophisticated automated defenses than ever before, attackers are turning to:

• Exploiting user behavior: Tricking users into opening and executing a malicious file, going to a malicious site or handing over information. Threat actors are using lures that create urgency to increase the rate of successful exploitation and have introduced messaging to target remote workers and take advantage of current events. (In addition to the familiar financial lures, attackers are now using COVID-19 and Black Lives Matter-themed lures)
• Leveraging trusted operating system tools (living-off-the-land binaries, aka LOLBins): Abusing the capabilities of binaries and processes to achieve malicious goals (e.g., perform domain reconnaissance, establish persistence, escalate privileges, etc.)

When used in combination, as is frequently the case, these techniques are effective at bypassing automated defenses to gain initial access. In fact, the majority of successful bypass incidents eSentire observes result from these tactics. In the first half of 2020, eSentire observed Zloader, Valak, SocGholish and More_eggs successfully employing user exploitation and LOLBin abuse to gain initial access (the report examines a few examples in some detail).

Hunting is a necessity.

Customizable behavioral rules, macro controls and macro signing provide some defenses. However, the challenge in developing automated defenses against user execution and LOLBins is that these activities in isolation do not indicate intent. It is only when considering the larger context of the action or execution that the malicious intention becomes clear.

That is why threat hunting is so important. Through continuous and collaborative research, threat hunters can distinguish between legitimate and malicious use of tools and processes, which is a necessary precursor to defining automated methods that reliably detect endpoint threats.