DarkGate malware variant was first observed in the wild in 2018 (seemingly in production since 2017), evolving into a more dangerous and widespread version of itself in recent years - more notably after the takedown of the Qbot infrastructure, there has been a surge in cases involving the variant. DarkGate is a malicious toolkit that operates under the Malware-as-a-Service model (meaning it is sold or rented to threat actors), and understood to have the functionality of both a loader and a RAT (Remote Access Trojan).
GO TO COLLECTION
DOWNLOAD THE REPORT
Get your FREE Community Account today on the HUNTER Platform and get access to behavioral threat hunting content for your SIEM, EDR, NDR, and XDR platforms!
GET YOUR FREE HUNTER COMMUNITY ACCOUNT!
This Hunt Package focuses on identifying attempts by attackers to coax Microsoft applications, LOLB or similar applications to utilize WebDav to communicate over HTTP to attacker controlled infrastructure. In recent reports, attackers have exclusively utilized direct to IP communication for their WebDAV addresses. As such, the provided query syntax looks for the composition of an IP structured like a UNC path within the execution of rundll32 to create a WebDAV session. This activity has been observed in several vulnerabilities, such as CVE-2023-22397, CVE-2023-36025 and CVE-2024-21412. Web Distributed Authoring and Versioning (WebDav) is an extension of the HTTP protocol that allows users to collaboratively edit and manage files on remote web servers. In typical use, WebDav provides a convenient means for file sharing and collaboration. WebDav can be abused by adversaries to execute arbitrary code and perform other malicious activities, such as specially crafted links in websites and phishing emails, and Internet Shortcuts.
This will identify the potentially malicious use of WMI (Windows Management Interface) utilized for local enumeration and discovery of a host.
PowerShell and Windows Shell can be utilized to download files and execute them via VBA code to obfuscate their actions and potentially bypass security controls. The hypothesis for this Hunt Package identifies when cmd.exe or powershell.exe are utilized to perform a web request and subsequently execute through the "Shell.Application" function in VBA. This technique was employed by the targeted attacks reported by TrueSec against Microsoft Teams users, to deploy the DarkGate malware.
This Hunt Package is designed to identify suspicious PowerShell execution arguments in order to search for potentially malicious activities that may deviate from standard practices within a specific environment. This can help the analyst discover abnormal or harmful events that are leveraging PowerShell for various purposes, such as launching attacks or maintaining persistence.
This package identifies the use of PowerShell to pull down a payload and execute it. This is similar to activity observed in association with SysJoker's Dropper for Windows where the Powershell commands are broken up as individual execution calls.
The intent of the provided query logic is to look for the execution of cscript.exe or wscript.exe processes, with a parent of cmd.exe. Attackers often abuse these LOLBs to launch scripts and other malicious commands in an attempt to hide with legitimate activity or bypass defenses.
This use case is meant to identify suspicious parent processes for cmd.exe and regedit.exe.
This Hunt Package focuses on identifying attempts by attackers to coax Microsoft applications, LOLB or similar applications to utilize WebDav to communicate over HTTP to attacker controlled infrastructure. In March 2023, Microsoft issued a patch for the vulnerability tracked as CVE-2023-23397, which was a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends an appointment with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. In addition to SMB, it was found ports and services could be forced, such as WebDav over SSL:443 or HTTP:80. Web Distributed Authoring and Versioning (WebDav) is an extension of the HTTP protocol that allows users to collaboratively edit and manage files on remote web servers. In typical use, WebDav provides a convenient means for file sharing and collaboration. WebDav can be abused by adversaries to execute arbitrary code and perform other malicious activities. In this particular case, attackers may send malicious calendar invites or appointments, which trigger the "reminder notification" sound for the proposed meeting or event. As a result, Outlook will initiate a connection to the configured address found in the "PidLidReminderFileParameter" appointment MAPI field.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。