Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1042839" data-attributes="member: 32260">SWH vs. Horabot[URL unfurl=&quot;false&quot;]https://blog.talosintelligence.com/new-horabot-targets-americas/[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/new-horabot-campaign-targets-the-americas.123594/[/URL]I like the examples posted by @[USER=26718]silversurfer[/USER]. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />They usually present a complex infection chain that can evade the protection of AVs.&nbsp; The Horabot campaign was started in November 2020 and has been ongoing through the year 2023. So, one can say that it was successful.[ATTACH=full]275849[/ATTACH]In purpose to evade AV protection, the attackers adopted the initial fileless attack vector. But, SWH settings are adjusted to prevent such attacks. In this concrete example, the attack will fail just after unpacking the initial script (CMD). But, in many cases, SWH is not required. Many attacks can be prevented by simple hardening, for example:<ul>
<li data-xf-list-type="ul">blocking batch scripts (BAT, CMD),</li>
<li data-xf-list-type="ul">blocking the outbound connections of popular LOLBins (powershell.exe, wscript.exe, cscript.exe, mshta.exe ...) or simply blocking the execution of popular LOLBins.</li>
</ul></blockquote>

[QUOTE="Andy Ful, post: 1042839, member: 32260"] [B][SIZE=5]SWH vs. Horabot[/SIZE][/B] [URL unfurl="false"]https://blog.talosintelligence.com/new-horabot-targets-americas/[/URL] [URL unfurl="false"]https://malwaretips.com/threads/new-horabot-campaign-targets-the-americas.123594/[/URL] I like the examples posted by @[USER=26718]silversurfer[/USER]. :) They usually present a complex infection chain that can evade the protection of AVs. The Horabot campaign was started in November 2020 and has been ongoing through the year 2023. So, one can say that it was successful. [ATTACH type="full" alt="1685719062627.png"]275849[/ATTACH] In purpose to evade AV protection, the attackers adopted the initial fileless attack vector. But, SWH settings are adjusted to prevent such attacks. In this concrete example, the attack will fail just after unpacking the initial script (CMD). But, in many cases, SWH is not required. Many attacks can be prevented by simple hardening, for example: [LIST] [*]blocking batch scripts (BAT, CMD), [*]blocking the outbound connections of popular LOLBins (powershell.exe, wscript.exe, cscript.exe, mshta.exe ...) or simply blocking the execution of popular LOLBins. [/LIST] [/QUOTE]

Verification