Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 834322" data-attributes="member: 32260">H_C and fileless malware - an example.Here is the infection chain of the Astaroth variant attack:[ATTACH=full]224550[/ATTACH]The malware link on stage 1 can be blocked by WD Network protection, but not if it is never seen malware. So the ZIP archive would be probably downloaded and the user will run the shortcut (LNK file) from this archive. But generally, shortcuts in H_C default-deny settings are blocked in UserSpace and this will stop the attack.Let&#039;s suppose that we have another variant without intermediate LNK file. So, the user will run the BAT file instead. This also will be blocked, because BAT scripts are blocked in UserSpace. We can imagine that another attack variant could somehow get to stage 2 (or 3) and WMIC was run. This will be stopped either when H_C&#039;s enhanced profile is applied or &lt;Recommended H_C&gt; outbound block rules in FirewallHardening are applied.WMIC command will be also blocked if ConfigureDefender MAX Protection Level is applied.On stage 4, the attack can be blocked when H_C&#039;s enhanced profile was applied which blocks running Bitsadmin.exe . It should be remembered that downloading by Bitsadmin.exe cannot be blocked via outbound firewall rules.On the later stage, H_C could break the infection chain via custom settings by blocking Regsvr32.exe or Certutil.exe.Anyway, blocking sponsors (Wmic.exe, Bitsadmin.exe, Certutil.exe, Regsvr32.exe) is usually not necessary because in most cases the infection chain can be broken by blocking shortcuts or scripts.[URL unfurl=&quot;true&quot;]https://www.techrepublic.com/article/what-is-fileless-malware-and-how-do-you-protect-against-it/[/URL]</blockquote>

[QUOTE="Andy Ful, post: 834322, member: 32260"] [B]H_C and fileless malware - an example.[/B] Here is the infection chain of the Astaroth variant attack: [ATTACH type="full" alt="fileless-astaroth.jpg"]224550[/ATTACH] The malware link on [B]stage 1[/B] can be blocked by WD Network protection, but not if it is never seen malware. So the ZIP archive would be probably downloaded and the user will run the shortcut (LNK file) from this archive. But generally, shortcuts in H_C default-deny settings are blocked in UserSpace and this will stop the attack. Let's suppose that we have another variant without intermediate LNK file. So, the user will run the BAT file instead. This also will be blocked, because BAT scripts are blocked in UserSpace. We can imagine that another attack variant could somehow get to[B] stage 2 (or 3)[/B] and WMIC was run. This will be stopped either when H_C's enhanced profile is applied or <Recommended H_C> outbound block rules in FirewallHardening are applied. WMIC command will be also blocked if ConfigureDefender MAX Protection Level is applied. On [B]stage 4[/B], the attack can be blocked when H_C's enhanced profile was applied which blocks running Bitsadmin.exe . It should be remembered that downloading by Bitsadmin.exe cannot be blocked via outbound firewall rules. On the [B]later stage[/B], H_C could break the infection chain via custom settings by blocking Regsvr32.exe or Certutil.exe. Anyway, blocking sponsors (Wmic.exe, Bitsadmin.exe, Certutil.exe, Regsvr32.exe) is usually not necessary because in most cases the infection chain can be broken by blocking shortcuts or scripts. [URL unfurl="true"]https://www.techrepublic.com/article/what-is-fileless-malware-and-how-do-you-protect-against-it/[/URL] [/QUOTE]

Verification