Attackers become more effective.

In the last few years we see a growing proliferation of targeted attacks (APTs) by cyber criminals, that results in ransomware and data breaches which result in great financial and reputational damage. Cyber criminals are employing new tools and sophisticated methodes to execute their attacks which make most detection tools not effective and make it hard for the security teams to detect their activities.

On the other side, in their attemt to protect a complex and ever expanding environment, security teams are integrating dozens of security tools which is time consuming, creates security gaps and generates a lot of data and an overwhelming flood of security alerts every day.

The result is a lot of noise, alert fatigue, prolonged response times, and heightened risk caused by the difficlty to find attack data hiding in the noise.

Can it become even tougher?

According to CyTwist research team cyber criminals continue to evolve and are taking it to the next level by adding another level of difficulty for the defenders and leveraging legitimate actions to mask their activities and bypass the security tools. By blending in the environment attackers can move undetected, avoid triggering the security tools and execute their attack.

If we look at the latest results, the number and impact of cyber attacks continue to grow and it looks like for now attackers are maintaining the upper hand as in 2023 Ransomware payments exceed $1 Billion, Hitting Record High. (Source: Chainalysis cybercrime report)

“Attackers are constantly evolving in order to stay ahead of the defenders, they have access to the latest security tools and defense methods and are using them to improve their attack tactics and develop new malware types and evasion techniques.” Said Eran Orzel, CyTwist CEO.

Current protection might not be enough.

In numerous security vendors’ documentation, there is an emphasis on their ability to scan a computer’s files and memory thoroughly. These vendors often claim that, regardless of the manipulations an attacker might attempt on the operating system, their scans will always detect such intrusions. However, as this article will demonstrate, there are significant gaps in this promise and the reality of cybersecurity is far more complex.

Endpoint security protection tool leverage several common security scans to protect computers from attackers’ activities and malware:

1. File System Scanning

Scanning is triggered when a file is created or modified, or when there is a read/access request. The scan searches for the entire file’s signature, or if not found, for a partial file signature.

2. Process Scanning

Security tools use hooks, and when the CreateProcess() function is called, the tools scan the file loaded into the function. However, it is important to note that the scan is performed on the hard disk, not in memory as the memory structure changes with each build of the operating system. This makes it very difficult to identify process signatures when they are in memory.

3. Memory Scanning

Memory scanning looks for anomalies in the memory structure, primarily aiming to identify processes injected into other processes to perform privilege escalation or defense evasion.

4. Hooking Specific Functions and Processes

Since security tools know that existing security mechanisms can be bypassed, they have created an additional layer of protection. This layer identifies and blocks attempts to call specific processes in memory, such as lsass, Svchost, etc.

5. Allow & Deny Lists

All security tools are based on allow and deny lists. There are actions that are prohibited, but on the other hand, there are actions that are allowed, even if they exhibit malicious behavior.

Bypassing enterprise security protection

To test this hypothesis, CyTwist research team ran an attack texting those five-defense mechanism and tested it on leading Endpoint security products.

The team used the Legit – Action masking tactics and avoid detection and execute the attack. 

1. Use code Execution without running an EXE file

All creation and injection actions were carried out using Macro commands via an Office file, so that the defensive tools would not detect the execution of a new process. We proceeded with the understanding that if we run code through a legitimate tool, it will be blocked only if we do something that is on the Deny list.

2. Obfuscate the file you want to execute.

We used a malicious and well-known mimikatz file.
To prevent security tools from detecting the malicious content, we will encrypt the file by creating a mirror image of the bits and save the result in a new file.
Typically, the challenge for attackers is to maintain the executable capabilities of the file despite the padding actions they perform. However, since we are going to execute the file in memory, we do not need to preserve its executable capabilities.

3. Execute Without a file.

After we have a file that is not identified by the defense tool, we will need to run the file without passing through the hard disk by performing injections into another process.

As explained at the beginning of the article, defense tools (defense mechanism number 3) scan memory and look for a process running within another process. We do not need to disguise our execution (and since no tool searches for file signatures in memory), as long as we work legitimately and openly without manipulation.
In order not to be detected, we will not inject into a file already running in the system, but we will use the CreateProcess() function to load the parent file into it.

During execution, we will run the file in a suspended state (we are allowed to edit the memory of a process in suspend mode once we have created it), until we finish editing it and inject malicious content into it. Only after completing the injection and memory editing, we will use the ResumeThread() function so that it starts operating legitimately.

4. Avoid Deny lists.

In order to avid traps (Deny lists – defense mechanism number 5), we looked for a file that is in the allow list. And what could be better than the EDR itself.  in that case we injected the malicious code into valid EDR process.

By using the Legit-Action techniques above we made sure we use the following bypass mechanisms:

1. We have no malicious file on the hard disk.
2. We did not create a process from a malicious file found on the hard disk.
3. The memory appears completely normal without any anomalies.
4. We did not access a process that we were not supposed to have access to as we used processes that are in the whitelist.

In this example CyTwist research team was able to execute a malicious file while successfully bypassing all five defense mechanisms described above. Sophisticated attackers are increasingly adopting such techniques leveraging security tools partial implamantation and blind spots.

Conclusion and Next Steps

Security teams are often understaffed and underfunded in their battle against cyber criminals. In most cases, they rely on security tools that detect yesterday’s attacks, leaving them fighting an uphill battle to prevent the next cyber attack. The use of Legit-Action masking by cyber attackers widens the gap between attackers and defenders and requires security leaders to update their security strategies moving forward.

“Leveraging Legit-Actions by attackers hampers the security tools’ ability to detect targeted attacks and malware. To maintain a high security posture, we must adapt and employ new techniques that will enable us to identify attacker activities disguised as Legit-Actions,” said Moshe Forman, Head of CyTwist’s research team. “As long as defensive tools continue to rely on file signatures and behavior signatures, attackers will always have the upper hand.”

Organizations must take proactive steps to fortify their defenses against advanced threats and targeted attacks, those actions should include:

1. Invest in Advanced Detection Technologies: Move beyond traditional security tools and adopt advanced detection platforms like CyTwist, which utilize counterintelligence tactics and attacker behavioral methodologies to identify sophisticated attacks.
2. Enhance cyberintelligence Capabilities: Leverage such expertise to gain insights into attacker tactics and anticipate new attack vectors. This can help in developing more effective defense strategies.
3. Integrate and Streamline Security Tools: Reduce the complexity and fragmentation of security tools. Use comprehensive solutions that integrate seamlessly with existing infrastructure to minimize noise and improve response times.
4. Conduct Proactive Threat Hunting: Regularly engage in threat hunting activities to identify and neutralize potential threats before they can cause harm. This proactive approach can uncover hidden vulnerabilities and mitigate risks early.
5. Continuous Learning and Adaptation: Stay updated with the latest intelligence on cyber threats and ensure that your security measures are continuously evolving. Adapt your security strategies to keep pace with emerging threats and attacker techniques.

By taking these steps, organizations can bridge the gap between attackers and defenders, enhancing their ability to detect and respond to advanced threats. CyTwist offers the expertise and technology needed to empower security teams and ensure a robust security posture in the face of evolving cyber threats