- Mar 29, 2018
- 7,111
Here's a nice article poached from Wilders, which might interest especially those wishing to improve their understanding of malware types, behaviors, etc.:
When you get tricked by a phishing mail and open a document attachment that has a malicious macro or a link to a malicious site, or you download an infected application, there's a file that antivirus software can scan as it's saved to or opened from disk, and there's a trail of file activity that you can look back at if you're trying to review the damage done. To get around those protections, attackers are starting to use 'fileless' malware where the attacks run directly in memory or use system tools that are already installed to run malicious code without saving files that antivirus software can scan.
More about cybersecurity
SEE: Special report: Cyberwar and the future of cybersecurity (free PDF) (TechRepublic)
Fileless techniques can be extremely advanced, and they are harder for traditional antivirus software to detect. But not every advanced malware attack is fileless and throwing the term around doesn't help organisations defend against it, Tanmay Ganacharya told TechRepublic. Ganacharya runs the Microsoft Defender threat research team, which analyses new threats and builds models to detect them. "Fileless is such an overused term, and it has gone from the truly fileless threats, to now people wanting to call almost everything that is even slightly advanced fileless and making it slightly buzzwordy," he says.
To demystify the term, the threat research team started categorising fileless attacks based on how they get onto a PC and where they're hosted. There are more than a dozen combinations of those 'entry points' and malware hosts being used for fileless attacks — some of which are very sophisticated and are rarely used for targeted attacks, and some of which have been commoditised and are showing up more often for common attacks like trying to run a coin miner on your system. But they fall into three broad groups.
Image: Microsoft
"Type one is truly fileless, where the attack is delivered on the network or from a device, the payload is handled in memory and almost nothing touches the disk at all," says Ganacharya. EternalBlue and BadUSB are truly fileless attacks — and they're rare. "These are truly the most advanced attacks out there, but most of the attacks that get called fileless don't belong in this group. This kind of attack and exploitation has been getting harder and harder, so it's difficult for these to become commoditised."
Type two is a little more common, Ganacharya says. Type two attacks do use files, but not directly, so they still count as fileless. "Think of scripts being used to launch attacks, whether it's JavaScript or PowerShell. We see a few that target the MBR and try to render machines completely useful so they won't boot. But they mostly use the registry and WMI and various other mechanisms like PowerShell to leverage some of the tools that are already present on the system to sequence setup activities."
That's called 'living off the land', and it's hard to detect with standard antivirus tools because those legitimate tools don't trigger warnings and the files malware does save are obfuscated and full of junk data that's easy to change to create a new attack. You can't clean it up by deleting files either, because you can't just delete key parts of Windows like the Registry and the WMI repository.
The most common fileless attacks actually do use files, but they don't run the attacks from those files directly. "Type three clearly start with a file whether it's a document file with a macro in it, or a Java file, or Flash file, and sometimes even EXE files that drop certain files, but then persistence is fileless," Ganacharya says. "So once the payload is dropped, the payload achieves persistence by either staying just in memory or staying in the registry and running from there."
Many of those Type three attacks come from email, but the file attachments won't show up as obviously malicious if an antivirus scans the files. "You don't generally attach an EXE file, you attach a document with a macro and that links to another file and then that file goes and downloads the payload," Ganacharya explains. VBA code doesn't have a binary that antivirus software can scan, but it can load PowerShell scripts that download and run attacks.
How to detect fileless attacks
...
Continue reading here: What is fileless malware and how do you protect against it?
When you get tricked by a phishing mail and open a document attachment that has a malicious macro or a link to a malicious site, or you download an infected application, there's a file that antivirus software can scan as it's saved to or opened from disk, and there's a trail of file activity that you can look back at if you're trying to review the damage done. To get around those protections, attackers are starting to use 'fileless' malware where the attacks run directly in memory or use system tools that are already installed to run malicious code without saving files that antivirus software can scan.
More about cybersecurity
- Famous con man Frank Abagnale: Crime is 4,000 times easier today
- How to become a cybersecurity pro: A cheat sheet
- Dark Web: A cheat sheet for business professionals
- Why deepfakes are a real threat to elections and society
SEE: Special report: Cyberwar and the future of cybersecurity (free PDF) (TechRepublic)
Fileless techniques can be extremely advanced, and they are harder for traditional antivirus software to detect. But not every advanced malware attack is fileless and throwing the term around doesn't help organisations defend against it, Tanmay Ganacharya told TechRepublic. Ganacharya runs the Microsoft Defender threat research team, which analyses new threats and builds models to detect them. "Fileless is such an overused term, and it has gone from the truly fileless threats, to now people wanting to call almost everything that is even slightly advanced fileless and making it slightly buzzwordy," he says.
To demystify the term, the threat research team started categorising fileless attacks based on how they get onto a PC and where they're hosted. There are more than a dozen combinations of those 'entry points' and malware hosts being used for fileless attacks — some of which are very sophisticated and are rarely used for targeted attacks, and some of which have been commoditised and are showing up more often for common attacks like trying to run a coin miner on your system. But they fall into three broad groups.
Image: Microsoft
"Type one is truly fileless, where the attack is delivered on the network or from a device, the payload is handled in memory and almost nothing touches the disk at all," says Ganacharya. EternalBlue and BadUSB are truly fileless attacks — and they're rare. "These are truly the most advanced attacks out there, but most of the attacks that get called fileless don't belong in this group. This kind of attack and exploitation has been getting harder and harder, so it's difficult for these to become commoditised."
Type two is a little more common, Ganacharya says. Type two attacks do use files, but not directly, so they still count as fileless. "Think of scripts being used to launch attacks, whether it's JavaScript or PowerShell. We see a few that target the MBR and try to render machines completely useful so they won't boot. But they mostly use the registry and WMI and various other mechanisms like PowerShell to leverage some of the tools that are already present on the system to sequence setup activities."
That's called 'living off the land', and it's hard to detect with standard antivirus tools because those legitimate tools don't trigger warnings and the files malware does save are obfuscated and full of junk data that's easy to change to create a new attack. You can't clean it up by deleting files either, because you can't just delete key parts of Windows like the Registry and the WMI repository.
The most common fileless attacks actually do use files, but they don't run the attacks from those files directly. "Type three clearly start with a file whether it's a document file with a macro in it, or a Java file, or Flash file, and sometimes even EXE files that drop certain files, but then persistence is fileless," Ganacharya says. "So once the payload is dropped, the payload achieves persistence by either staying just in memory or staying in the registry and running from there."
Many of those Type three attacks come from email, but the file attachments won't show up as obviously malicious if an antivirus scans the files. "You don't generally attach an EXE file, you attach a document with a macro and that links to another file and then that file goes and downloads the payload," Ganacharya explains. VBA code doesn't have a binary that antivirus software can scan, but it can load PowerShell scripts that download and run attacks.
How to detect fileless attacks
...
Continue reading here: What is fileless malware and how do you protect against it?
