Thanks to all of our ATT&CKcon participants. All sessions are here, and individual presentations will be posted soon.

Security Software Discovery

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules, anti-virus, and virtualization. These checks may be built into early-stage remote access tools.

Windows

Example commands that can be used to obtain security software information are netsh, reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for.

Mac

It's becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.

ID: T1063

Tactic: Discovery

Platform:  macOS, Windows

Permissions Required:  User, Administrator, SYSTEM

Data Sources:  File monitoring, Process monitoring, Process command-line parameters

Version: 1.0

Examples

NameDescription
CHOPSTICK

CHOPSTICK checks for anti-virus, forensics, and virtualization software.[1]

Comnie

Comnie attempts to detect several anti-virus products.[2]

CozyCar

The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit. Newer versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit.[3]

Crimson

Crimson contains a command to collect information about anti-virus software on the victim.[4]

DustySky

DustySky checks for the existence of anti-virus.[5]

Dyre

The Dyre crimeware toolkit has refined its detection of sandbox analysis environments by inspecting the process list and Registry.[6]

Felismus

Felismus checks for processes associated with anti-virus vendors.[7]

FIN8

FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.[8]

FinFisher

FinFisher probes the system to check for sandbox/virtualized environments and other antimalware processes.[9][10]

Flame

Flame identifies security software such as antivirus through the Security module.[11][12]

Gold Dragon

Gold Dragon checks for anti-malware products and processes.[13]

JPIN

JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.[14]

jRAT

jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.[15]

Kasidet

Kasidet has the ability to identify any anti-virus installed on the infected system.[16]

More_eggs

More_eggs can obtain information on installed anti-malware programs.[17]

Mosquito

Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.[18]

Naikon

Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings.[19]

netsh

netsh can be used to discover system firewall settings.[20][21]

OopsIE

OopsIE performs several anti-VM and sandbox checks on the victim's machine.[22]

Patchwork

Patchwork scanned the "Program Files" directories for a directory with the string "Total Security" (the installation path of the "360 Total Security" antivirus tool).[23]

POWERSTATS

POWERSTATS has detected security tools.[24]

POWRUNER

POWRUNER may collect information the victim's anti-virus software.[25]

Prikormka

A module in Prikormka collects information from the victim about installed anti-virus software.[26]

Remsec

Remsec has a plugin to detect active drivers of some security products.[27]

RogueRobin

RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite.[28]

ROKRAT

ROKRAT checks for sandboxing libraries and debugging tools.[29]

RTM

RTM can obtain information about security software on the victim.[30]

StreamEx

StreamEx has the ability to scan for security tools such as firewalls and antivirus tools.[31]

T9000

T9000 performs checks for various antivirus and security products during installation.[32]

Tasklist

Tasklist can be used to enumerate security software currently running on a system by process name of known products.[33]

VERMIN

VERMIN uses WMI to check for anti-virus software installed on the system.[34]

Wingbird

Wingbird checks for the presence of Bitdefender security software.[35]

yty

yty checks for ant-sandboxing software such as virtual PC, sandboxie, and VMware.[36]

Mitigation

Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about local security software, and audit and/or block them by using whitelisting [37] tools, like AppLocker, [38] [39] or Software Restriction Policies [40] where appropriate. [41]

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained.

Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

References

  1. FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
  2. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  3. F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015.
  4. Huss, D.. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.
  5. ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.
  6. Symantec Security Response. (2015, June 23). Dyre: Emerging threat on financial fraud landscape. Retrieved August 23, 2018.
  7. Somerville, L. and Toro, A. (2017, March 30). Playing Cat & Mouse: Introducing the Felismus Malware. Retrieved November 16, 2017.
  8. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  9. FinFisher. (n.d.). Retrieved December 20, 2017.
  10. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  11. Gostev, A. (2012, May 28). The Flame: Questions and Answers. Retrieved March 1, 2017.
  12. Gostev, A. (2012, May 30). Flame: Bunny, Frog, Munch and BeetleJuice…. Retrieved March 1, 2017.
  13. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  14. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  15. Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.
  16. Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.
  17. Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.
  18. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
  19. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved December 17, 2015.
  20. Microsoft. (n.d.). Using Netsh. Retrieved February 13, 2017.
  21. Microsoft. (2009, June 3). Netsh Commands for Windows Firewall. Retrieved April 20, 2016.
  1. Falcone, R., et al. (2018, September 04). OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September 24, 2018.
  2. Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved August 3, 2016.
  3. Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.
  4. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  5. Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.
  6. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.
  7. Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.
  8. Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
  9. Faou, M. and Boutin, J.. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  10. Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.
  11. Grunzweig, J. and Miller-Osborn, J.. (2016, February 4). T9000: Advanced Modular Backdoor Uses Complex Anti-Analysis Techniques. Retrieved April 15, 2016.
  12. Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015.
  13. Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.
  14. Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.
  15. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.
  16. Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
  17. Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
  18. NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
  19. Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.
  20. Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.