Command-Line Interface

From enterprise
Jump to: navigation, search
Command-Line Interface
Technique
ID T1059
Tactic Execution
Platform Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP, Windows 7, Windows 8, Windows Server 2003 R2, Windows Server 2008 R2, Windows Server 2012 R2, Windows Vista, Windows 8.1, Linux, Windows 10, MacOS, OS X
Permissions Required User, Administrator, SYSTEM
Data Sources Process command-line parameters, Process monitoring
Supports Remote No

Command-line interfaces provide a way of interacting with computer systems and is a common feature across many types of operating system platforms.1 One example command-line interface on Windows systems is cmd, which can be used to perform a number of tasks including execution of other software. Command-line interfaces can be interacted with locally or remotely via a remote desktop application, reverse shell session, etc. Commands that are executed run with the current permission level of the command-line interface process unless the command includes process invocation that changes permissions context for that execution (e.g. Scheduled Task).

Adversaries may use command-line interfaces to interact with systems and execute other software during the course of an operation.

Examples

  • APT1 has used the Windows command shell to execute commands.2
  • An APT3 downloader uses the Windows command "cmd.exe" /C whoami.3 The group also uses a tool to execute commands on remote computers.4
  • Malware used by Ke3chang can run commands on the command-line interface.5
  • Lazarus Group malware uses cmd.exe to execute commands on victims.6
  • Patchwork ran a reverse shell with Meterpreter.7
  • Several tools used by Suckfly have been command-line driven.8
  • Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.9
  • Threat Group-3390 has used command-line interfaces for execution.10
  • Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.11
  • menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands.121314
  • 4H RAT has the capability to create a remote shell.15
  • ADVSTORESHELL can create a remote shell and run a given command.1617
  • Adversaries can direct BACKSPACE to execute from the command-line on infected hosts, or have BACKSPACE create a reverse shell.18
  • BADNEWS is capable of executing commands via cmd.exe.19
  • BLACKCOFFEE has the capability to create a reverse shell.20
  • CHOPSTICK is capable of performing remote command execution.2116
  • CallMe has the capability to create a reverse shell on victims.22
  • China Chopper is capable of opening a command terminal.10
  • A module in CozyCar allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe.23
  • Derusbi is capable of creating a remote Bash shell and executing commands.24
  • Emissary has the capability to create a remote shell and execute specified commands.25
  • H1N1 kills and disables services by using cmd.exe.26
  • HTTPBrowser is capable of spawning a reverse shell on a victim.27
  • Hi-Zor has the ability to create a reverse shell.28
  • KOMPROGO is capable of creating a reverse shell.29
  • Kasidet can execute commands using cmd.exe.30
  • Mis-Type uses cmd.exe to run commands for enumerating the host.31
  • Misdat is capable of providing shell functionality to the attacker to execute commands.31
  • Mivast has the capability to open a remote shell and run basic commands.32
  • MoonWind can execute commands via an interactive command shell.33
  • NETEAGLE allows adversaries to execute shell commands on the infected host.18
  • PHOREAL is capable of creating reverse shell.29
  • Pisloader uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.34
  • PlugX allows actors to spawn a reverse shell on a victim.27
  • PowerDuke runs cmd.exe /c and sends the output to its C2.35
  • Pteranodon can execute commands on the victim.36
  • RTM uses the command line and rundll32.exe to execute.37
  • RedLeaves can receive and execute commands with cmd.exe.13 It can also provide a reverse shell.38
  • SNUGRIDE is capable of executing commands and spawning a reverse shell.38
  • Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.39
  • SeaDuke is capable of executing commands.40
  • StreamEx has the ability to remotely execute commands.41
  • TEXTMATE executes cmd.exe to provide a reverse shell to attackers.4243
  • TinyZBot supports execution from the command-line.44
  • XTunnel has been used to execute remote commands.21
  • ZLib has the ability to execute shell commands.31
  • cmd is used to execute programs and other actions at the command-line interface.45
  • gh0st RAT is able to open a command shell.46
  • hcdLoader provides command-line access to the compromised system.47
  • httpclient opens cmd.exe on the victim.15

Mitigation

Audit and/or block command-line interpreters by using whitelisting48 tools, like AppLocker,4950 or Software Restriction Policies51 where appropriate.52

Detection

Command-line interface activities can be captured through proper logging of process execution with command-line arguments. This information can be useful in gaining additional insight to adversaries' actions through how they use native processes or custom tools.

References

  1. ^  Wikipedia. (2016, June 26). Command-line interface. Retrieved June 27, 2016.
  2. ^  Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  3. ^  Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.
  4. ^  Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.
  5. ^  Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  6. ^  Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016.
  7. ^  Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved August 3, 2016.
  8. ^  DiMaggio, J.. (2016, May 17). Indian organizations targeted in Suckfly attacks. Retrieved August 3, 2016.
  9. ^  Dell SecureWorks Counter Threat Unit Special Operations Team. (2015, May 28). Living off the Land. Retrieved January 26, 2016.
  10. a b  Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
  11. ^  FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.
  12. ^  PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017.
  13. a b  PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  14. ^  Twi1ight. (2015, July 11). AD-Pentest-Script - wmiexec.vbs. Retrieved June 29, 2017.
  15. a b  Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
  16. a b  ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
  17. ^  Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.
  18. a b  FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  19. ^  Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.
  20. ^  FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016.
  21. a b  Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.
  22. ^  Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
  23. ^  F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015.
  24. ^  Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.
  25. ^  Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.
  26. ^  Reynolds, J.. (2016, September 14). H1N1: Technical analysis reveals new capabilities – part 2. Retrieved September 26, 2016.
  1. a b  Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved January 25, 2016.
  2. ^  Fidelis Cybersecurity. (2015, December 16). Fidelis Threat Advisory #1020: Dissecting the Malware Involved in the INOCNATION Campaign. Retrieved March 24, 2016.
  3. a b  Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.
  4. ^  Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.
  5. a b c  Gross, J. (2016, February 23). Operation Dust Storm. Retrieved September 19, 2017.
  6. ^  Stama, D.. (2015, February 6). Backdoor.Mivast. Retrieved February 15, 2016.
  7. ^  Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  8. ^  Grunzweig, J., et al. (2016, May 24). New Wekby Attacks Use DNS Requests As Command and Control Mechanism. Retrieved August 17, 2016.
  9. ^  Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
  10. ^  Kasza, A. and Reichel, D.. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.
  11. ^  Faou, M. and Boutin, J.. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  12. a b  FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.
  13. ^  Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, July 30). Sakula Malware Family. Retrieved January 26, 2016.
  14. ^  Grunzweig, J.. (2015, July 14). Unit 42 Technical Analysis: Seaduke. Retrieved August 3, 2016.
  15. ^  Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.
  16. ^  Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017.
  17. ^  Brumaghin, E. and Grady, C.. (2017, March 2). Covert Channels and Poor Decisions: The Tale of DNSMessenger. Retrieved March 8, 2017.
  18. ^  Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.
  19. ^  Microsoft. (n.d.). Cmd. Retrieved April 18, 2016.
  20. ^  FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.
  21. ^  Carvey, H.. (2014, September 2). Where you AT?: Indicators of lateral movement using at.exe on Windows 7 systems. Retrieved January 25, 2016.
  22. ^  Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
  23. ^  Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
  24. ^  NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
  25. ^  Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.
  26. ^  Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.