di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

<p>Perspective & Findings</p>

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

<p>Recent Blog Posts</p>

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

cdr-blog.png

<p>Application file uploads from external, internal, or third parties are an emerging threat vector.</p><p>While traditional approaches like AV and Sandbox have been used by many organizations in an attempt to catch malicious content, they have severe drawbacks when it comes to speed, efficacy, and scale. CDR was created to address these concerns.</p><p>On paper, Content Disarm and Reconstruction (CDR) looks quite promising to prevent malicious file uploads. However, it falls short in production.</p><p>Below we discuss the history of CDR, its pros and cons, and a better alternative to malware prevention that will significantly reduce risk without friction for the business.</p>

Download Whitepaper

<p>File Upload Security</p>

DPA-Launch-PR.jpg

<p><span></span></p><p><span></span></p><h3>Content Disarm &amp; Reconstruction (CDR)</h3><p>CDR arrived on the scene as a new way of preventing malicious files from entering an environment. Instead of scanning, inspecting, or fully analyzing every file, CDR targets active content within files, such as macros and VBAs, that could be potentially exploited or have malicious intent. The benefit of this technology is that it can work very quickly to inoculate potentially malicious files, so it avoids the delays introduced by file sandboxing.</p><p><span></span></p><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Source: SaniTOX - Content Disarm & Reconstruction(CDR) Service*" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4834b6dbec9d696e/63d156275c5c9c52a32ec073/cdr-workflow-process.png" style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;" /><figcaption  style = "text-align: center;" style="text-align: center;">Source: SaniTOX - Content Disarm & Reconstruction(CDR) Service*</figcaption></figure><p></p><h3>Types of CDR</h3><p>There are three basic approaches to CDR:</p><ol><li><strong>Flat-file conversion</strong>: Takes any new file with active content and creates a flat copy of it in PDF form. While quick and effective at minimizing the attack surface, this method erases legitimate content such as macros, form fields, and hyperlinks, due to its inability to distinguish between malicious and benign files.</li><li><strong>Content stripping</strong>: Strips out active content and embedded objects and reconstructs the file in its original format to maintain some usability for the end user. The downside is that, once again, since CDR is unable to distinguish between malicious and benign files, legitimate content is destroyed, and admin interaction is frequently required to retrieve original files.</li><li><strong>Positive selection</strong>: Attempts to address the shortcomings of the previous two methods by rebuilding files based on templates which serves to maintain full functionality of the file after reconstruction. It does this by copying only known-good (positively selected) components to the reconstructed file. While this method cuts down on the amount of legitimate content that is removed or destroyed, it is most often inaccurate due to the lack of malware identification capabilities.</li></ol><h3>Top-3 Drawbacks of CDR for Malware Prevention</h3><p>In a 2021 report, Gartner states that, “<em>done well, CDR removes all threats from uploaded files without adding significant latency. &lt;sic&gt; The main disadvantage of CDR lies in the fact that it changes the files’ contents.</em>”</p><p>Because CDR modifies a file in transit, it has a relatively high probability of delivering a file that <a href="https://www.infusedinnovations.com/blog/secure-intelligent-workplace/what-is-content-disarm-and-reconstruction-cdr" target="_blank">cannot be edited</a> or has had significant changes to content such as text and images (see Figure 1). Common issues with CDR-manipulated files include compatibility and font issues that render documents that can no longer be edited, as well as images that are not properly reconstructed or lose their high resolution.</p><p></p><figure style = "margin: auto; text-align: center;width: autopx;"><img alt="Figure 1: CDR can lead to loss of functionality in documents (Source: Infused Innovations†)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt11051332963c5aa4/63d157e9b369f5745550b605/fig1-cdr-can-lead-to-loss-functionality-in-documents.png" style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;" /><figcaption  style = "text-align: center;" style="text-align: center;">Figure 1: CDR can lead to loss of functionality in documents (Source: Infused Innovations†)</figcaption></figure><p></p><p>CDR introduces additional work for the IT team in the following ways:</p><ul><li>Since the technology cannot distinguish between legitimate and malicious active content, the CDR tool must examine every file in detail.</li><li>Users who are expecting to receive a spreadsheet with macros from a trusted source will instead receive a flat file with the important functions disabled.</li><li>This in turn necessitates an interaction with a help desk to request the original file.</li><li>In some cases, the original file may not be available by the time the user requests it.</li></ul><p>CDR raises some very important business concerns:</p><ul><li>Often, IT must grant exceptions for certain files (or groups) or executive team members who cannot tolerate a delay or a chance that their document will not remain intact.</li><li>In addition, users who know this technology is in place have been known to avoid it and receive their files by different methods, such as a personal email account.</li><li>This negates any benefits the technology may have provided.</li></ul><p>CDR only provides protection for a limited amount of file types:</p><ul><li>CDR cannot sanitize portable executable files, such as EXE and DLL, and most image files.</li><li>This creates a wide security gap that must be addressed with a different solution and can also lead to a false sense of security.</li></ul><h3>A Better Approach: Malware Prevention</h3><p>As malicious file uploads grow in concern, organizations need a frictionless solution that can prevent malware at a speed and scale that meets the needs of the business. While CDR has some advantages over the traditional methods, we believe the disadvantages far outweigh the benefits.</p><p><a href="/prevention-for-applications" target="_self">Deep Instinct Prevention for Applications</a> is a unique malware prevention solution that is implemented without an agent via REST API or ICAP. With the same industry-leading static anti-malware engine that has been proven to prevent threats before they are allowed to execute on the endpoint, Deep Instinct meets the file scanning security requirements for all enterprises with the following:</p><p><strong>Fastest Speed</strong></p><ul><li>Makes a malicious vs benign verdict in &lt;20ms for unknown malware</li><li>Delivers decisions autonomously, without a reliance on threat intelligence feeds</li></ul><p><strong>Immense Scale</strong></p><ul><li>Scans millions of files per day without latency</li><li>Improves SOC efficiency by reducing false positives to &lt;0.1%</li></ul><p><strong>Highest Unknown Threat Efficacy</strong></p><ul><li>Prevents infected Office files and PDFs missed by other solutions</li><li>Stops ransomware before it can open and infect an environment</li></ul><p><strong>Utmost Privacy</strong></p><ul><li>Protects data privacy with no data ever leaving a customer’s environment</li></ul><p>Stopping unknown and zero-day threats from file uploads is paramount to reducing risk. If you are concerned about file uploads in your environment, it’s time to look at a modern prevention approach to stop the threats before they land inside. To learn more check out the white paper: <a href="https://info.deepinstinct.com/file-upload-security" target="_blank">File Upload Security: The Missing Category for a Comprehensive Security Posture</a>.</p><p><a href="/prevention-for-applications" target="_self">Deep Instinct Prevention for Applications</a> was designed specifically to address the need for file upload security, and it does so with unmatched speed (&lt;20ms verdict), efficacy (&gt;99% catch rate), and accuracy (&lt;0.1% false positive ratio), all while maintaining the content and integrity of original files.</p><p>To learn more about how you can protect yourself from malicious files anywhere they surface, <a href="/contact-us" target="_self">contact Deep Instinct today</a>.</p><h3>Resources</h3><ul><li><a href="/blog/malicious-office-files-20-years-of-microsoft-office-exploits" target="_self">Malicious Office files: 20+ Years of Microsoft Office Exploits</a></li><li><a href="/blog/pdf-as-a-weapon-of-choice-on-the-cybersecurity-battlefield " target="_self">PDF as a Weapon of Choice on the Cybersecurity Battlefield</a></li><li><a href="/blog/five-advantages-of-deep-learning-for-preventing-cybersecurity-threats" target="_self">5 Advantages of Deep Learning in Cybersecurity</a></li></ul><p></p><h3>Sources</h3><p>* <a href="https://sanitox.jiransecurity.com/scan/" target="_blank">https://sanitox.jiransecurity.com/scan/</a></p><p>† <span><a href="https://www.infusedinnovations.com/blog/secure-intelligent-workplace/what-is-content-disarm-and-reconstruction-cdr" target="_blank">https://www.infusedinnovations.com/blog/secure-intelligent-workplace/what-is-content-disarm-and-reconstruction-cdr</a></span></p>

MS-Office-Blog.png

<p>Weaponized Office documents pose a large risk to organizations. From embedded active content, such as scripts and HTML code in Word and PowerPoint files to Excel macros, this is an attack vector every organization must pay attention to. About one million companies worldwide use Office 365 and 70% of Fortune 500 companies <a href="https://webtribunal.net/blog/microsoft-statistics/#gref" target="_self">purchased O365</a> in 2020. As a result, nearly every business transaction involving a file transfer will likely be in a Microsoft Office format at risk of containing malware.&nbsp;</p><p>Not surprisingly, approximately <a href="https://atlasvpn.com/blog/microsoft-office-flaws-exploited-in-nearly-80-of-malware-attacks" target="_self">80% of all recent malware attacks</a> (Q1-22) involved exploiting MS Office weaknesses (see Figure 1). Office vulnerabilities offer multiple opportunities to hackers, from initial system infection to remote command/code execution, often allowing the attacker to modify system files while remaining undetected. <a href="https://www.deepinstinct.com/blog/unfolding-the-follina-zero-day-vulnerability" target="_self">Follina</a> and Trickbot are two recent examples of campaigns that operate by exploiting Office vulnerabilities. More about how these malware families exploit Office files later.&nbsp;</p><p>In 2021, Atlas VPN reported that <a href="https://atlasvpn.com/blog/43-of-all-malware-downloads-are-malicious-office-documents" target="_self">approximately 43% of all malware downloads are malicious</a> Office documents, a 3x increase from only 14% in 2020. The rapid expansion in the exploitation of MS Office flaws is concerning as most endpoint security vendors still focus their prevention efforts only on portable executable (PE) file types and cannot stop unknown malicious Office files from being downloaded and executed. While executable files do pack a punch, it is clear that attackers have shifted their tactics to malicious Office documents where they have the best chance to gain a foothold into an organization’s computing environment.&nbsp;</p><p></p><figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltcf20386e88cc8e1b" alt="Figure1: MS Office most likely to deliver malware " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcf20386e88cc8e1b/634f2c7bdcd7cf2a10750563/microsoft-office-most-likely-software-to-deliver-malware.png" /><figcaption  style = "text-align: center;" style="text-align: center;">Figure1: MS Office most likely to deliver malware (Source: https://atlasvpn.com/blog/microsoft-office-flaws-exploited-in-nearly-80-of-malware-attacks)</figcaption></figure><p></p><h3>Recent attacks using MS Office flaws&nbsp;</h3><p>Ever since Microsoft Office and digital documents have been around there have been vulnerabilities to exploit. Over 22 years ago, a vulnerability was discovered that allowed an attacker to successfully insert a Trojan Horse DLL into the same directory as a Microsoft Office 2000 document upon launch: <a href="https://www.cvedetails.com/cve/CVE-2000-0854/" target="_self">CVE-2000-0854</a>. This vulnerability scored a 10 out of 10, meaning total information disclosure, complete compromise of system integrity, and a total shutdown of the affected resource. Over the last two decades attackers have continuously found new ways to exploit the most widely used productivity suite. Organizations that don’t patch their systems quickly find themselves at significant&nbsp;risk.&nbsp;</p><p>Recently, threat actors have ramped up their exploitation of MS Office files even further, as demonstrated by the recent malware family dubbed Trickbot. Trickbot most often <a href="https://www.beyondtrust.com/blog/entry/trickbot-attack-chain-deconstructed-mitigated" target="_self">begins its infection with a Word document</a> (see Figure 2) that has embedded VBA code. While VBA code itself is not considered malicious, its presence in a Word document raises a red flag, and this technique is used by numerous attackers across several malware families. The document is written to trick the user into enabling macros (see screenshot below), at which point the VBA module containing malicious JavaScript code downloads the payload and establishes persistence on the system. Because of the amount of system information that Trickbot quickly collects, many other campaigns have been known to use it as an initial infection point.&nbsp;</p><p></p><figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt0edd6960bf9d4ba4" alt="Figure 2: Trickbot uses “tricky” tactics to launch its payload" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0edd6960bf9d4ba4/634f2c16a1828d22ebc8fd52/picture1.png" /><figcaption  style = "text-align: center;" style="text-align: center;">Figure 2: Trickbot uses “tricky” tactics to launch its payload (Source: https://www.fortinet.com/blog/threat-research/new-variant-of-trickbot-being-spread-by-word-document)</figcaption></figure><p></p><p>An even more recent campaign exploiting MS Office vulnerabilities is known as Follina. What makes Follina unique is that it manipulates a bug in the MSDT (Microsoft Support Diagnostic Tool) that allows code execution. MSDT is a tool that is used to collect information about a Windows system and send it to Microsoft Support for investigation. This utility can modify local PowerShell policies to allow execution of code. Follina is executed using an HTML file that calls MSDT and allows it to execute a PowerShell code. In this attack, rather than just sitting by and waiting for users to happen upon a URL with the malicious HTML file, attackers use<a href="https://www.deepinstinct.com/blog/unfolding-the-follina-zero-day-vulnerability" target="_self"> another technique</a> that involves modifying the relationship file (RELS) within a Microsoft OOXML (*.docx, for example), causing MS Office to automatically open the HTML file that then executes the code.&nbsp;</p><p>Other campaigns have turned to obfuscation and padding in their droppers to help their VBA and scripts bypass endpoint security solutions. In the resurrection of the Emotet malware family, attackers disguised their actions by hiding code snippets in random cells within an Excel file, subsequently calling those code snippets from within obfuscated scripts written in different coding languages. You can read more about this example and several others in <a href="https://www.deepinstinct.com/blog" target="_self">blogs</a> from Deep Instinct’s Threat Research team.&nbsp;</p><h3>How can you prevent malicious Office docs?&nbsp;</h3><p>Microsoft Office and pdf attacks have grown in number and sophistication over the last few&nbsp;years. But what’s even more worrisome is that most endpoint security solutions, especially those in the Endpoint Detection and Response category, are only able to prevent both known and unknown files of the portable executable type, such as EXE and DLL files. Also, most EDR solutions lack static analysis to stop the threat until after the files have been executed and they see the behaviors, which is too late to prevent damage. This is precisely why <a href="https://www.deepinstinct.com/endpoint-detection-response" target="_self">you need Deep Instinct even if you have an EDR</a>.&nbsp;</p><p>The importance of preventing malicious document files before they execute and hit local storage cannot be overstated, especially when it comes to unknown or zero-day attacks hidden in malicious files. In the case of ransomware, crypto-miners, and wipers, they work so fast that post-execution detection is too late. And as we saw with the Trickbot campaign, if the file hits a system, chances are the user will interact with it before an EDR will catch it. &nbsp;</p><p>Amidst all this bad news about the rise in exploitation of MS Office flaws there is some good news:&nbsp;</p><p>Deep Learning-driven static analysis provides a way to prevent malicious Office documents before they execute or enter storage. By scanning the full content of a file in under 20 milliseconds, Deep Instinct determines that the file is malicious and prevents it before it can write to disk, end up in your public or private cloud storage, or be uploaded through Web applications. Deep Instinct does not rely on known threat intelligence feeds and can stop unknown threats before they are seen in the wild.&nbsp;</p><p>Deep Instinct is the only solution that prevented Follina before anyone knew it existed (see Figure 3 below). We prevent known and unknown malicious attacks hidden in files across all Office modules (such as OLE, OOXML, RELS, XL4, ActiveX, and LNK). With &lt;0.1% false positives, a &gt;99% unknown threat efficacy and a decision in &lt;20 milliseconds, Deep Instinct is providing the enterprise with prevention capabilities to lower risk and focus on what really matters – your business.&nbsp;</p><p></p><figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt3798f8a67c0d098a" alt="Figure 3: A document file that leverages Follina to execute malicious commands is prevented by the Deep Instinct agent before it gets a chance to run. " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3798f8a67c0d098a/634f2d01be627424e775b5ef/deep-instinct-threat-prevented-alert.png" /><figcaption  style = "text-align: center;" style="text-align: center;">Figure 3: A document file that leverages Follina to execute malicious commands is prevented by the Deep Instinct agent before it gets a chance to run. </figcaption></figure><p></p><p>If you’d like to learn more about our unknown malware, <a href="https://www.deepinstinct.com/ransomware-protection-solution" target="_self">ransomware</a>, and <a href="https://www.deepinstinct.com/zero-day-attacks" target="_self">zero-day prevention</a> capabilities we’d be delighted to <a href="https://info.deepinstinct.com/request-a-demo" target="_self">give you a demo</a>.&nbsp;</p><p>Further reading:&nbsp;</p><ul><li><a href="https://www.deepinstinct.com/blog/how-your-regular-microsoft-office-file-is-open-to-manipulation" target="_self">How your regular microsoft office file is open to manipulation</a></li><li><a href="https://www.deepinstinct.com/blog/unfolding-the-follina-zero-day-vulnerability" target="_self">Unfolding the Follina zero-day vulnerability</a></li><li><a href="https://www.deepinstinct.com/blog/8-reasons-why-edr-is-not-enough" target="_self">8 reasons EDR is not enough</a></li><li><a href="https://www.deepinstinct.com/blog/types-of-dropper-malware-in-microsoft-office" target="_self">Types of dropper malware in Microsoft Office</a></li></ul><p>Resources&nbsp;:&nbsp;</p><ul><li><a href="https://atlasvpn.com/blog/microsoft-office-flaws-exploited-in-nearly-80-of-malware-attacks" target="_self">Malicious Office flaws exploited in nearly 80% of malware attacks</a></li><li><a href="https://www.fortinet.com/blog/threat-research/new-variant-of-trickbot-being-spread-by-word-document" target="_self">New Variant of Trickbot Being Spread by Word Document</a></li></ul><p>&nbsp;</p>

Malicious Office files: 20+ Years of Microsoft Office Exploits

EDR-bypass.png

<p>In Star Wars Episode IV, Obi Wan used his “Jedi mind tricks” to fool storm troopers into allowing Luke and him to pass through the security checkpoint with R2-D2 and C3P0 undetected – even though they <em>were </em>in fact the droids they were looking for.</p><p>Much in the same way, savvy cyber criminals have developed their own set of “Jedi mind tricks” to fool many security tools – EDR solutions included – into looking the other way while malicious shellcodes sneak past undetected. Bypass techniques are increasingly used by attackers to avoid detection while they do their damage.</p><p>This post will explore different <a href="/news/deep-instinct-2022-threat-landscape-report-finds-125-percent-increase-threat-types" target="_self">evasion methods</a> and propose ways to protect against them to ensure the attackers don’t land inside your environment.</p><h2>Three Methods Attackers Use to Bypass EDR</h2><p>Below are three ways that attackers can <a href="/blog/new-fileless-attacks-found-in-event-logs" target="_self">bypass EDR solutions</a>: AMSI bypass, unhooking, and reflective DLL loading. Read more about each method and learn how Deep Instinct helps prevent these EDR bypass techniques.</p><h3>1. AMSI bypass</h3><p>AMSI (Anti-Malware Scan Interface) is Microsoft’s framework that allows third-party anti-malware solutions to have visibility into Microsoft components and applications, such as PowerShell, script engines, .NET framework, and WMI. EDR solutions use this framework to scan files, memory, and/or streams for malicious payloads.</p><p>Because these are the toolkits that cyber criminals frequently use in crafting attacks against Windows devices, it makes sense that the more advanced attackers would find ways around AMSI in order to be successful.</p><p>There are several different methods attackers may use to bypass AMSI, such as reflection, COM server hijacking, and memory patching. An example of a recent attack using AMSI bypass methods is the <a href="https://threatpost.com/agent-tesla-microsoft-asmi/163581/" target="_self">Agent Tesla remote access trojan (RAT)</a> that used the memory patching method to avoid detection of its stage-2 loader and final payload.</p><p><strong>How do you prevent AMSI bypass methods?</strong></p><p>This all sounds like pretty scary stuff, right? The very interface that Microsoft created to enable endpoint security to <em>not</em> be evaded is now being evaded itself.</p><p>Deep Instinct prevents AMSI bypass methods using in-memory protection that terminates any process attempting to subvert AMSI. For a more detailed look into AMSI <a href="/blog/what-s-new-in-deep-instinct-3-0 " target="_self">bypass methods and security tool responses</a>, check out the slides from our Black Hat session, <a href="https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Korkos-AMSI-and-Bypass.pdf" target="_self">AMSI Unchained</a>.</p><h3>2. Unhooking</h3><p>To understand the unhooking technique, you must have a base understanding of what “hooking” is. APIs (application programming interfaces) are the interface by which code is used to make things happen on a computer system. Windows has a set of APIs (such as <em>syscall</em>) that can be called to execute instructions that require direct system or kernel-level access. As stated in the previous attack method, most EDR solutions use the gateway <em>ntdll.dll </em>by “hooking” into it to watch for suspicious calls to memory.</p><p>Unhooking refers to a method that attackers can use to load a fresh, unhooked version of <em>ntdll.dll</em> AFTER Windows has already loaded the EDR-hooked version at process launch. At this point the EDR is flying blind to any code that is running and it is unable to monitor the return address for any API calls made, rendering it useless. A thorough hacker will go so far as to “re-hook” the EDR at the end of his operation to cover their tracks. You can read more about how unhooking works in <a href="https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis" target="_self">this “red team” article</a> about bypassing EDR to dump credentials.</p><p><strong>What can we do to prevent unhooking?</strong></p><p>Just as with direct system calls, the unhooking method attempts to <a href="/blog/evading-antivirus-detection-with-inline-hooks" target="_self">evade detection</a> by preventing an EDR from doing its job. Deep Instinct addresses this issue by preventing modification of our agent’s hooks by monitoring for changes to those memory regions. Any attempts to access these memory areas are deemed malicious and will be prevented.</p><h3>3. Reflective DLL loading</h3><p>Reflective DLL loading is a Remote Code Injection technique by which an attacker will load a DLL from memory into an existing process instead of loading it from disk. EDR solutions generally protect a system by monitoring DLLs as they’re loaded from disk, so reflective DLL loading provides another way to work silently under the EDR’s radar. This method is often used in conjunction with one or more of the other techniques we’ve already discussed and it is used heavily in the <a href="https://www.cobaltstrike.com/blog/cobalt-strike-4-4-the-one-with-the-reconnect-button/" target="_self">Cobalt Strike</a> and <a href="https://pentestlab.blog/2017/04/04/dll-injection/" target="_self">Metasploit</a> frameworks that are a big part of the modern attacker’s toolkit.</p><figure style = "float: none;width: autopx;max-width:auto;"><a href="https://pentestlab.blog/2017/04/04/dll-injection/" target="_blank"><img asset_uid="blt141b0c9ccde95150" alt="Figure 1: Example of reflective DLL creation and injection using the Metasploit framework" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt141b0c9ccde95150/630d019afe190b157474c99c/figure-1-reflective-dll-creation-example.png"/></a><figcaption >Figure 1: Example of reflective DLL creation and injection using the Metasploit framework</figcaption></figure><p><strong></strong></p><p><strong>Is there any way to stop an attacker from using reflective DLLs?</strong></p><p>Deep Instinct provides protection against this technique by monitoring allocation of local memory areas used in reflective DLL loading and preventing PE (portable executable) loading attempts from those memory areas. Figure 2 shows an example of Deep Instinct preventing this type of attack.</p><figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="bltd8e34847594b49bd" alt="Figure 2: Deep Instinct provides behavioral protection against Reflective DLL loading" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd8e34847594b49bd/630d019ac12c8404ed2a6edf/figure-2-deep-instinct-protects-against-reflective-dll-loading.png" /><figcaption >Figure 2: Deep Instinct provides behavioral protection against Reflective DLL loading</figcaption></figure><h2><br/>What does this mean for EDR?</h2><p>We’ve seen just a few of the many ways that threat actors with the right toolkits – which are easy to find and implement even for the less sophisticated hacker – can bypass even the most advanced EDR protections. That’s because EDR’s strength lies in detecting malicious behavior after the threat has landed in your environment, which is too late to stop advanced attacks like ransomware.</p><p>We aren’t advising you drop your EDR – we are advocating for improving prevention. Prevention needs to be the first line of defense to stop known, unknown, ransomware, and zero-day threats. While EDR solutions are great at identifying known malicious threats and activity to identify an attack while it attempts to steal data and do damage, there is a big gap in true prevention to stop unknown threats before they can land on an endpoint, server, or enter storage.</p><p>We are at an inflection point where attackers are becoming increasingly adept at bypassing the security controls put in place. <a href="https://info.deepinstinct.com/8-reasons-why-edr-is-not-enough" target="_self">EDR is not enough</a> to stop the most advanced threats. Advances in AI and solutions that employ deep learning are providing us with the armor to guard against these “Jedi mind tricks,” preventing unknown malware, ransomware, and zero-day threats from executing in your environment. Stopping these advanced threats before they can encrypt, exfiltrate, or achieve persistence offers the protection organizations need in an increasingly complex and harmful threat environment. The result is lower risk, improved SOC efficiency, and increased overall effectiveness of your entire security stack.</p><p>Don’t let attackers bypass your EDR. For more information, <a href="/contact-us" target="_self">Contact Us</a> or <a href="/request-a-demo" target="_self">Request a Demo</a>.</p><h2>Further Reading:</h2><ul><li><a href="/blog/8-reasons-why-edr-is-not-enough " target="_self">https://www.deepinstinct.com/blog/8-reasons-why-edr-is-not-enough</a></li><li><a href="/blog/evading-antivirus-detection-with-inline-hooks " target="_self">https://www.deepinstinct.com/blog/evading-antivirus-detection-with-inline-hooks</a></li><li><a href="/blog/cobalt-strike-post-exploitation-attackers-toolkit" target="_self">https://www.deepinstinct.com/blog/cobalt-strike-post-exploitation-attackers-toolkit</a></li></ul><h2>References</h2><p><strong>Agent Tesla Trojan ‘Kneecaps’ Microsoft’s Anti-Malware Interface</strong><strong><br/></strong><a href="https://threatpost.com/agent-tesla-microsoft-asmi/163581/" target="_self">https://threatpost.com/agent-tesla-microsoft-asmi/163581/</a></p><p><strong>A new BluStealer Loader Uses Direct Syscalls to Evade EDRs</strong><strong><br/></strong><a href="https://blog.minerva-labs.com/a-new-blustealer-loader-uses-direct-syscalls-to-evade-edrs" target="_self">https://blog.minerva-labs.com/a-new-blustealer-loader-uses-direct-syscalls-to-evade-edrs</a></p><p><strong>BluStealer Malware Targets Cookies, Passwords, and Cryptocurrency Wallets</strong><strong><br/></strong><a href="https://www.cyclonis.com/bluestealer-malware-targets-cookies-passwords-cryptocurrency-wallets/" target="_self">https://www.cyclonis.com/bluestealer-malware-targets-cookies-passwords-cryptocurrency-wallets/</a></p><p><strong>Bypassing Cylance and other AVs/EDRs by Unhooking Windows APIs</strong><strong><br/></strong><a href="https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis" target="_self">https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis</a></p><p><strong>Cobalt Strike 4.4: The One with the Reconnect Button</strong><strong><br/></strong><a href="https://www.cobaltstrike.com/blog/cobalt-strike-4-4-the-one-with-the-reconnect-button/" target="_self">https://www.cobaltstrike.com/blog/cobalt-strike-4-4-the-one-with-the-reconnect-button/</a></p><p><strong>DLL Injection</strong><strong><br/></strong><a href="https://pentestlab.blog/2017/04/04/dll-injection/" target="_self">https://pentestlab.blog/2017/04/04/dll-injection/</a></p>

Jedi Mind Tricks to Bypass Endpoint Detection & Response (EDR)

blog-event-logs.png

<p>Just when you thought MITRE had identified all attacker TTPs (tactics, techniques, and procedures) something new pops up! Most recently, <a href="https://threatpost.com/attackers-use-event-logs-to-hide-fileless-malware/179484/" target="_self">researchers have discovered a malicious campaign</a> utilizing a never-before-seen technique for quietly planting <a href="/glossary/fileless-malware-definition" target="_self">fileless malware</a> on target machines. This attack hides malicious code in event logs by injecting it into the Windows Key Management Service event logging process (as well as other legitimate processes).</p><h2>Rise of fileless attacks</h2><p>This is yet another example of attackers innovating their attack techniques. In this case, it’s in the form of a <a href="/prevent-fileless-malware" target="_self">fileless attack</a>, an attack method that has become very popular because of its ability to evade exisiting security controls. Figure 1 below explains how prevalent these attacks have become.</p><p></p><figure style = "margin: auto; text-align: center;width: 600px;"><a href="https://www.infosecurity-magazine.com/opinions/fileless-attacks-malware/"><img asset_uid="bltb324628bc79621be" alt="Figure 1: Fileless attacks are growing in number and bypassing traditional endpoint security" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb324628bc79621be/6283be5f3b9b8554904a0888/figure-1-fileless-attacks-growing.png"/></a><figcaption  style = "text-align: center;" style="text-align: center;">Figure 1: Fileless attacks are growing in number and bypassing traditional endpoint security</figcaption></figure><h2>&nbsp;</h2><h2 style="text-align: left;">How are attackers using event logs to hide fileless malware?</h2><p>There are three stages that attackers are using to hide fileless malware in Windows Event Logs. We’ll describe each stage in depth below and show why Deep Instinct’s solutions are effective in combatting this new form of fileless attacks.</p><h3>Stage 1: Drive-by download</h3><p>While not a new method, drive-by downloads are still an effective technique to deliver malware to an endpoint.</p><p>In this particular case, attackers send victims to legitimate websites where they are tricked into downloading a compressed archive of two powerful commercial penetration testing tools, Cobalt Strike and SilentBreak. Each of these tools is armed with AES decryptors that are used to avoid detection. If Cobalt Strike sounds familiar, that’s because it has been used frequently in recent attack campaigns.</p><p><a href="/blog/cobalt-strike-post-exploitation-attackers-toolkit" target="_self">Cobalt Strike</a> is a legitimate toolkit for white hat hackers and penetration testers, and because of its ease of use and availability, it’s usage increased by <a href="https://www.bankinfosecurity.com/attackers-increasingly-using-cobalt-strike-a-16959" target="_self">161% between 2019 and 2020</a>—and continues to rise* (Figure 2).</p><h3>How does Deep Instinct help?</h3><p>For this particular phase of the attack, Deep Instinct’s static analysis provides a key protection—correctly identifying and preventing the threats within the archive, even if the payload were modified to avoid identification.</p><p></p><figure style = "margin: auto; text-align: center;width: 595px;"><img asset_uid="blt463134676b018b2a" alt="Figure 2: Number of organizations impacted by attacks using Cobalt Strike is increasing substantially" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt463134676b018b2a/6283bf44ce671353d507ccb0/figure-2-orgs-impacted-by-colbat-strike-chart.jpeg" /><figcaption  style = "text-align: center;" style="text-align: center;">Figure 2: Number of organizations impacted by attacks using Cobalt Strike is increasing substantially</figcaption></figure><h3>&nbsp;</h3><h3>Stage 2: Injecting the shellcode</h3><p>Once the tools are downloaded to the system, attackers utilize their capabilites to inject code into trusted system processes or applications. In this case, the Windows KMS (Key Management System) logging process is the perfect “trojan horse” because it is both “hiding in plain sight” and not a place threat hunters are accustomed to looking for malicious shellcode. The reason why it’s classified as fileless is that there are no portable executables or document files with macros. This is also why the detection process becomes very sticky for <a href="/endpoint-detection-response" target="_self">traditional endpoint security platforms</a> as the malicious code is injected into and runs within legitimate system processes. Nothing appears out of the ordinary in the normal operation of the system.</p><p>This type of attack also poses a <a href="/blog/8-reasons-why-edr-is-not-enough" target="_self">risk for Endpoint Detection and Response (EDR) solutions</a> because it’s written specifically to evade detection. Subsequently, EDR machine learning models must be re-trained to spot this activity and add it to their behavioral analysis engines. This is a human-led process that takes time to implement and requires an update to the core functionality of the security system.</p><p>Another concern is that EDRs are well-known for logging high rates of false positives, which means that many organizations put exceptions in place for well-known system processes and directories to avoid blocking legitimate business activity and cut down on help desk overhead.</p><h3>Deep Instinct’s approach to fileless attacks</h3><p>Deep Instinct takes a different approach to provide <a href="/prevent-fileless-malware" target="_self">prevention against fileless attacks</a> utilizing our built-in Memory Protection functionality. The self-learning nature of Deep Instinct means that we can predict and prevent never-before-seen attacks. Human intervention is not necessary to update our deep learning brain to protect against new attacker innovation. The end result is immediate, pre-execution prevention of known, unknown, and zero-day threats.</p><h3>Stage 3: The big pay(load)off</h3><p>In the final phase of this new fileless attack, attackers are doing what threat actors do: delivering one payload to rule them all.</p><p>The payload used in this particular campaign is one of two remote access trojans (RATs) designed to gain complete remote control over the infected system. In addition to using a new technique of hiding malicious code in event logs, the actual code used and elements of the remote access tools do not hold any similarities to past campaigns. This is yet another cause for concern for EPP/EDR solutions because their detection mechanisms are trained to look for code snippets that will tie back to existing campaigns to correctly classify and identify the threat group and take appropriate action early in the process.</p><h3>More accurate prevention with Deep Instinct</h3><p>Deep Instinct’s approach does not make decisions based on static-weighted, human-fed data points. The advantage is that the behaviors, code, and tools used in this attack will all be evaluated independent of any external influence. The result is a more accurate decision that can be made in a shorter amount of time to understand the threat and prevent damage.</p><h2>Fileless Malware finds its match in Deep Learning</h2><p>Fileless attacks pose a significant threat for security solutions like antivirus and EDR. Signature-based engines and machine learning decision models fall short in detecting unknown, never-before-seen attacks. New attacks can be predicted and prevented with a deep learning-based solution, which is exactly where Deep Instinct comes in. With the only <a href="/why-deep-instinct" target="_self">deep learning framework developed for cybersecurity</a>, Deep Instinct takes a multi-layered appraoch to prevent &gt;99% of unknown threats with a &lt;0.1% false positive rate.</p><p>For more information on how Deep Instinct can <a href="/prevent-fileless-malware" target="_self">prevent fileless attacks</a> <a href="/contact-us" target="_self">contact us</a>.</p><h2>Further reading:</h2><ul><li><a href="/blog/evading-antivirus-detection-with-inline-hooks" target="_self">https://www.deepinstinct.com/blog/evading-antivirus-detection-with-inline-hooks</a></li><li><a href="/blog/do-not-exchange-it-has-a-shell-inside" target="_self">https://www.deepinstinct.com/blog/do-not-exchange-it-has-a-shell-inside</a></li><li><a href="/blog/what-makes-powershell-a-challenge-for-cybersecurity-solutions" target="_self">https://www.deepinstinct.com/blog/what-makes-powershell-a-challenge-for-cybersecurity-solutions</a></li><li><a href="/blog/cobalt-strike-post-exploitation-attackers-toolkit" target="_self">https://www.deepinstinct.com/blog/cobalt-strike-post-exploitation-attackers-toolkit</a></li></ul><h2>Resources</h2><p><a href="https://threatpost.com/attackers-use-event-logs-to-hide-fileless-malware/179484/" target="_self">Attackers Use Event Logs to Hide Fileless Malware<br/></a>Researchers have discovered a malicious campaign utilizing a never-before-seen technique for quietly planting fileless malware on target machines.</p><p><a href="https://www.bankinfosecurity.com/attackers-increasingly-using-cobalt-strike-a-16959" target="_self">Attackers Increasingly Using Cobalt Strike<br/></a>Report: Pen Testing Tool a Favorite Among Lower-Level Threat Groups</p><p><a href="https://www.infosecurity-magazine.com/opinions/fileless-attacks-malware/" target="_self">Fileless Attacks: Addressing Evolving Malware Threats<br/></a>Unlike traditional malware attacks, fileless malware does not require installing code on software or systems. Fileless payloads are instead used to infect computer memory, using pre-installed system tools to execute a ‘living off the land’ attack.</p>

What’s Hiding in Your Event Logs?

Discover how Deep Instinct DSX protects your NAS storage more effectively than Trellix.