Hackers Increasing the use of “Command Line Evasion and Obfuscation” to Spread Advance Level Threats

Advance level threats are increasing day by day and attackers using more Sophisticated Techniques to bypass the Detection. Evasion and obfuscation technique give more pain to Researchers in 2017 Compare to previous years.

Command line evasion and obfuscation are the most used technique among many numbers of advance level attacks which are increased its use by attackers with their phishing and Malware attacks.

Malicious hackers use Fileless malware to achieve stealth, privilege escalation, to gather sensitive information and achieve persistence in the system, so the malware infection can continue to carry on its effect for a longer period of time.

More over sometime VB Script code aslo has highly obfuscated and it developed to evade the sandbox Detection and its make Difficult to understand

It used to create with Advanced level obfuscation to bypass both static and dynamic analysis method and attacker always on step ahead from  signature-based detection methods.

Also Read  Creating and Analyzing a Malicious PDF File with PDF-Parser Tool

Environment Variable Attack by Advance Level Threats

An earlier time of 2017 ,FIN8 malware received command using standard input to evade detection based on process command line arguments by using environment variables paired with Power Shell.

Powers hell command that ends with Dash “-“ ,that will Execute the command by using standard input (Stdin) and the only dash will appear in powershell.exe’s command line arguments.

FIN8 environment variable commands extracted (Source: FireEye)

According to FireEye , In the February 2017 phishing document “COMPLAINT Homer Glynn.doc” (MD5: cc89ddac1afe69069eb18bac58c6a9e4tt), the file contains a macro that sets the PowerShell command in one environment variable(_MICROSOFT_UPDATE_CATALOG) and then the string “powershell -” in another environment variable (MICROSOFT_UPDATE_SERVICE).

Evasion and obfuscation detection’s based parent-child process relationships. FIN8 crafted this macro to use WMI to spawn the “cmd.exe” execution.

Therefore, WinWord.exe never creates a child process, but the process tree looks like: wmiprvse.exe > cmd.exe > powershell.exe. 

Also Read  Most important considerations with Malware Analysis Cheats And Tools list

Application whitelisting Bypass

To stay away from many Detection techniques and Defenders, Attackers using extra layers of obfuscation by new application whitelisting bypass techniques.

According to FireEye , The regsvr32.exe  application whitelisting bypass exploit done by few Groups

  1. APT19 in their 2017 campaign against law firms
  2. The cyber espionage group APT32 heavily obfuscates their backdoors and scripts
  3. Mandiant consultants observed APT32 implement additional command argument obfuscation in April 2017
Regsvr32 is a command-line utility to register and unregister OLE controls, such as DLLs and ActiveX controls in the Windows Registry. Regsvr32.exe is installed in the %systemroot%\System32 folder in Windows XP and later versions of Windows.

APT32 used cmd.exe obfuscation techniques to attempt to break signature-based detection of this argument ,Instead of using the argument /i:https for the regsvr32.exe bypass.

FireEye Identified New obfuscation Technique in both JavaScript and cmd.exe levels and perform the initial infection, it hiding shortcut files (LNK files) in their DOCX and RTF phishing documents. Read more here for complete Analyse.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Pure Crypter Uses Multiple Evasion Methods to Bypass Windows 11 24H2 Security Features

Pure Crypter, a well-known malware-as-a-service (MaaS) loader, has been recognized as a crucial tool for…

5 minutes ago

Attackers Exploit Microsoft Entra Billing Roles to Escalate Privileges

A recent discovery by security researchers at BeyondTrust has revealed a critical, yet by-design, security…

18 minutes ago

Microsoft Reveals Techniques for Defending Against Evolving AiTM Attacks

Microsoft has exposed the escalating sophistication of phishing attacks, particularly focusing on Adversary-in-the-Middle (AiTM) techniques…

33 minutes ago

Critical Icinga 2 Vulnerability Allows Attackers to Obtain Valid Certificates

A critical vulnerability (CVE-2025-48057) has been discovered in Icinga 2, the widely used open-source monitoring…

52 minutes ago

Hackers Use Gh0st RAT to Hijack Internet Café Systems for Crypto Mining

Hackers have been targeting Internet cafés in South Korea since the second half of 2024,…

58 minutes ago

Windows 11 Security Update for 22H2 & 23H2 May Cause Recovery Errors

A recent Windows 11 security update, KB5058405, released on May 13, 2025, has caused significant…

1 hour ago