Friday, October 4, 2024
HomeInfosec- ResourcesHackers Increasing the use of "Command Line Evasion and Obfuscation" to...

Hackers Increasing the use of “Command Line Evasion and Obfuscation” to Spread Advance Level Threats

Published on

Advance level threats are increasing day by day and attackers using more Sophisticated Techniques to bypass the Detection. Evasion and obfuscation technique give more pain to Researchers in 2017 Compare to previous years.

Command line evasion and obfuscation are the most used technique among many numbers of advance level attacks which are increased its use by attackers with their phishing and Malware attacks.

Malicious hackers use Fileless malware to achieve stealth, privilege escalation, to gather sensitive information and achieve persistence in the system, so the malware infection can continue to carry on its effect for a longer period of time.

- Advertisement - EHA

More over sometime VB Script code aslo has highly obfuscated and it developed to evade the sandbox Detection and its make Difficult to understand

It used to create with Advanced level obfuscation to bypass both static and dynamic analysis method and attacker always on step ahead from  signature-based detection methods.

Also Read  Creating and Analyzing a Malicious PDF File with PDF-Parser Tool

Environment Variable Attack by Advance Level Threats

An earlier time of 2017 ,FIN8 malware received command using standard input to evade detection based on process command line arguments by using environment variables paired with Power Shell.

Powers hell command that ends with Dash “-“ ,that will Execute the command by using standard input (Stdin) and the only dash will appear in powershell.exe’s command line arguments.

FIN8 environment variable commands extracted (Source: FireEye)

According to FireEye , In the February 2017 phishing document “COMPLAINT Homer Glynn.doc” (MD5: cc89ddac1afe69069eb18bac58c6a9e4tt), the file contains a macro that sets the PowerShell command in one environment variable(_MICROSOFT_UPDATE_CATALOG) and then the string “powershell -” in another environment variable (MICROSOFT_UPDATE_SERVICE).

Evasion and obfuscation detection’s based parent-child process relationships. FIN8 crafted this macro to use WMI to spawn the “cmd.exe” execution.

Therefore, WinWord.exe never creates a child process, but the process tree looks like: wmiprvse.exe > cmd.exe > powershell.exe. 

Also Read  Most important considerations with Malware Analysis Cheats And Tools list

Application whitelisting Bypass

To stay away from many Detection techniques and Defenders, Attackers using extra layers of obfuscation by new application whitelisting bypass techniques.

According to FireEye , The regsvr32.exe  application whitelisting bypass exploit done by few Groups

  1. APT19 in their 2017 campaign against law firms
  2. The cyber espionage group APT32 heavily obfuscates their backdoors and scripts
  3. Mandiant consultants observed APT32 implement additional command argument obfuscation in April 2017
Regsvr32 is a command-line utility to register and unregister OLE controls, such as DLLs and ActiveX controls in the Windows Registry. Regsvr32.exe is installed in the %systemroot%\System32 folder in Windows XP and later versions of Windows.

APT32 used cmd.exe obfuscation techniques to attempt to break signature-based detection of this argument ,Instead of using the argument /i:https for the regsvr32.exe bypass.

FireEye Identified New obfuscation Technique in both JavaScript and cmd.exe levels and perform the initial infection, it hiding shortcut files (LNK files) in their DOCX and RTF phishing documents. Read more here for complete Analyse.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Prince Ransomware Hits UK and US via Royal Mail Phishing Scam

A new ransomware campaign targeting individuals and organizations in the UK and the US...

Microsoft, DOJ Dismantle Domains Used by Russian FSB-Linked Hacking Group

Microsoft and the U.S. Department of Justice (DOJ) have successfully dismantled a network of...

Cloud Penetration Testing Checklist – 2024

Cloud Penetration Testing is a method of actively checking and examining the Cloud system...

Linux Malware perfctl Attacking Millions of Linux Servers

Researchers have uncovered a sophisticated Linux malware, dubbed "perfctl," actively targeting millions of Linux...

Free Webinar

Decoding Compliance | What CISOs Need to Know

Non-compliance can result in substantial financial penalties, with average fines reaching up to $4.5 million for GDPR breaches alone.

Join us for an insightful panel discussion with Chandan Pani, CISO - LTIMindtree and Ashish Tandon, Founder & CEO – Indusface, as we explore the multifaceted role of compliance in securing modern enterprises.

Discussion points

The Role of Compliance
The Alphabet Soup of Compliance
Compliance
SaaS and Compliance
Indusface's Approach to Compliance

More like this

DCRAt Attacking Users Via HTML Smuggling To Steal Login Credentials

In a new campaign that is aimed at users who speak Russian, the modular...

Creating An AI Honeypot To Engage With Attackers Sophisticatedly

Honeypots, decoy systems, detect and analyze malicious activity by coming in various forms and...

Crimson Palace Returns With New Hacking Tolls And Tactics

Cluster Bravo, despite its brief initial activity, subsequently targeted 11 organizations in the same...