Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1127832" data-attributes="member: 32260">The attackers enhanced the attack vector known for several years:phishing ---&gt; ZIP archive ----&gt; LNK -----&gt;&nbsp; RunDLL32&nbsp; -----&gt; DLL loader&nbsp; (decrypted payload) ----&gt; Process Hollowing -----&gt; abusing legal cloud services for C2State-sponsored phishing is often successful, so antivirus software attempts to detect the attack when the DLL loader is executed. When RunDLL32 LOLBin is used, some AVs can efficiently block the attack via Advanced Threat Protection features (like Microsoft Defender ASR rules) or LOLBin restrictions (like Comodo Script Analysis). Such loaders have a low level of suspicious IOCs on the pre-execution stage, so the attack can be detected by Machine Learning only after some time. This time can be longer if the attackers use a runtime FUD malware (unique crypter). It is probable that this was the case in this smart attack.Top AVs can detect Process Hollowing methods (especially Enterprise versions). But I am not sure how effective they are against evolving attack methods.</blockquote>

[QUOTE="Andy Ful, post: 1127832, member: 32260"] The attackers enhanced the attack vector known for several years: phishing ---> ZIP archive ----> LNK -----> RunDLL32 -----> DLL loader (decrypted payload) ----> Process Hollowing -----> abusing legal cloud services for C2 State-sponsored phishing is often successful, so antivirus software attempts to detect the attack when the DLL loader is executed. When RunDLL32 LOLBin is used, some AVs can efficiently block the attack via Advanced Threat Protection features (like Microsoft Defender ASR rules) or LOLBin restrictions (like Comodo Script Analysis). Such loaders have a low level of suspicious IOCs on the pre-execution stage, so the attack can be detected by Machine Learning only after some time. This time can be longer if the attackers use a runtime FUD malware (unique crypter). It is probable that this was the case in this smart attack. Top AVs can detect Process Hollowing methods (especially Enterprise versions). But I am not sure how effective they are against evolving attack methods. [/QUOTE]

Verification