Polyglot files have to fit in several file format specifications and respond differently depending on the calling program.
This poses a significant risk to endpoint detection and response (EDR) systems and file uploaders, which mainly rely on format identification for analysis.
By evading correct classification, polyglots can leap over feature extraction routines or signature comparisons found in malware detection systems.
Research by the following researchers from Oak Ridge National Laboratory and Assured Information Security indicates that polyglots are threats to commercial EDR tools, with 0% detection of malicious polyglots recorded during tests by some vendors:-
The dependence on standard formats for efficient malware detection makes it vulnerable to this kind of attack whereby files can be created that are valid in multiple formats.
"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo
There is a critical gap in computer security research because no one has done an extensive study on how threat actors use these artifacts and how they are detected.
Polyglot files in malware campaigns were found to play a significant role in the tactics of APT groups.
To carry out an analysis, they developed Fazah, a tool imitating real-life polyglot creation methods.
Researchers trained PolyConv, a deep learning model that attained over 99% F1 score for both binary and multi-label classifications of polyglots.
These were not very effective compared to already existing tools used to identify files.
For image-based polyglots, the most popular means was via custom CDR tool (ImSan) which is more efficient than YARA rules in sanitizing it with 100% efficacy.
This research fills essential gaps within cybersecurity defenses against this advanced threat by providing useful information on techniques of detecting and mitigating them as well as awareness of polyglot format detection strategies.
Threat actors often use polyglots to avoid detection and bypass commercial security tools.
Out of the 30 different polyglot samples found in these cyber-attack chains 15 instances were detected.
Common combinations are JAR+JPG and HTA+CHM, which are used by groups such as Lazarus and IcedID.
PolyConv based on MalConv and PolyCat using CatBoost machine learning models demonstrate encouraging results in the detection of polyglots through byte-level features and format-agnostic approaches.
With mime-type and n-gram features added, the performance of PolyCat improved.
For this reason, detecting polyglots becomes an important way of increasing our cybersecurity defenses against advancing dangers.
Here below we have mentioned all the recommendations:-
Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…