This chapter is from the book
This chapter is from the book
This chapter is from the book
3.5 Priming
Prior to gaining leverage, the adversary will typically “prime” the environment to maximize the potential damage and impact. For example, before detonating ransomware, the adversary may modify key network configuration settings and disable antivirus software. These steps are intended to remove roadblocks and improve the chances of a successful detonation during the next stage of the attack.
Adversaries commonly modify and/or disable the following network components:
Antivirus/security software
Processes and applications
Logging/monitoring systems
Filesystem permissions and configuration
In the remainder of this section, we discuss each of these in turn.
3.5.1 Antivirus and Security Software
Security and antivirus software present hurdles for adversaries and can issue alerts during any phase in the compromise. Signature-based antivirus software may detect and delete the malicious files used by the adversary, or heuristic security software may detect the actions associated with file encryption and stop the process before it completes. As a result, neutralizing security software is often a top priority for the adversary. Typically, this will take the form of one or more of the following actions:
Disabling security software: If the adversary is not worried about making too much noise on the network, a common tactic is to simply disable the active security software currently in use by the victim by killing the active process. This can prevent the software itself from alerting, but it can also set off alerts within the victim’s network notifying IT security personnel that something is wrong.
Modifying configuration: In some cases, an adversary may gain access to the centralized console used to manage a security application. If the software allows for global changes, the adversary may modify the configuration so as to neutralize the software across the entire domain. For example, often the adversary will put the security software into a “monitor-only” mode, allowing the adversary to freely distribute malware without interference.
Allowlisting signatures: An adversary with sufficient access may simply allowlist signatures associated with their specific malware in the victim’s security software. Like service alteration, this type of change requires access to a central administration platform but will rarely generate an alert from the software itself. While not the most common method of evasion, signature exceptions can often be nearly invisible to the victim.
Opportunities for Detection
The following indicators suggest that security software on your network may be under attack:
Alerts for nonresponsive antivirus software on endpoints
State-change alerts from security software
3.5.2 Running Processes and Applications
Many software applications are designed to prevent other services from modifying open files or databases while they are in use, thereby minimizing the risk of corruption. This is especially common in software that maintains a database, such as a SQL server application or a financial application like QuickBooks. One unexpected silver lining is that these applications may inherently block ransomware from encrypting important databases and files if they are actively in use.
Opportunities for Detection
How can you recognize that an adversary may be actively compromising services and applications on your network? Look for the following indicators:
System health indicators, which you can use to flag modifications of this type
Signature identification of tools such as ProcessHacker
3.5.3 Logging and Monitoring Software
Event logging and monitoring software can enable victims to:
Detect anomalous activity quickly and thwart the adversary
Trace the adversary’s activities through the network and close any security gaps
Quickly eradicate the adversary from the network
Gain information that could be leveraged in a negotiation
As a result, adversaries often take steps to undermine event logging and monitoring capabilities. Without accurate logging, activities including access times, filesystem exploration, indicators of exfiltration, and other valuable information may no longer be available. Many small and midsized organizations rely on local log files on the affected host, and do not have a central SIEM, which makes the adversary’s job easier.
Often, adversaries will undermine event logging and monitoring using the following tactics:
Log deletion: The adversary may delete key elements of the available log data to completely obscure local system activities. These sources of data commonly include Windows Event Log data, Link files, Jump lists, Windows Explorer history, web browser history, and more.
Stop services: If a log collection service like Winlogbeat or Rsyslog is in use to centralize log collection, the adversary may simply kill the export service on the local system, effectively stopping the collection of data.
Time-stomping: The adversary may alter timestamps on log data to make investigating the attack and correlating logs between multiple systems difficult, if not impossible. This may also be done to obscure the identification of files or programs used in the attack.
Opportunities for Detection
The following evidence suggests that logging and monitoring solutions have been tampered with:
Event log data indicating that logs have been cleared (i.e., Event ID 1102 on a Windows host)
Use of a specialized utility such as the Sysinternals SDelete tool to make deleted log recovery impossible
Alerts for data stoppage from monitored hosts
3.5.4 Accounts and Permissions
To ensure an effective rollout of ransomware encryption software, the adversary typically adds at least one account and carefully modifies access permissions to ensure that the ransomware spreads as quickly and effectively as possible. Here are some specific, commonly used tactics:
Create new administrative user accounts: By the time the adversary is in the “priming” phase, they usually already have domain administrator access. However, the adversary will typically create a different account to use for the ransomware deployment. This will make it more difficult for the victim to trace the attack back to the actual accounts that the adversary used prior to detonation.
Add the account to the “remote users” groups: This gives the newly created user access to all endpoints that have remote access enabled.
Gain unauthorized network share access: This enables the ransomware to encrypt shared drives and connected devices (including, much of the time, backups).
Perform unauthorized software installations: The adversary uses common administrative tools (such as PsExec) to automate deployment of the ransomware.
Opportunities for Detection
Set up logging and automated alerts for the following indicators:
New or unknown administrative user accounts
Increases in remote connection activity or unusual accounts accessing remote services
Unauthorized access to network shares
Installation of unauthorized software