It is common to associate malware
with a file that we download and run unnoticed. Although this concept is not
entirely wrong, the reality is that we can also find malware that does not
require any file on the system to perform its malicious activity. This type of
threat is known as fileless malware, a concept that is not new and has been in
use since the early 2000s.
Fileless malware attacks make use
of the operating system's own tools and processes through a technique known as
“Living off the Land” or “Living off the Earth”, which allow it to carry out
its malicious activity using pre-installed elements and without dropping
additional executables in the victim's system. In other words, it uses
functionalities of the operating system against the user himself. This makes it
difficult to detect, as the malicious code runs through legitimate processes.
What Is The “Living Off The Land” Technique?
This is a technique used by
cybercriminals with more advanced knowledge to make their activities more
difficult to detect on the victim's computer or network, since it allows them,
among other things, to evade multiple security controls.
It consists of loading and
executing malicious code entirely from the computer's memory without affecting
the file system. Consequently, it generates little or no forensic artifacts
that can be analyzed later.
It is important to clarify that
this is a post-exploitation technique. In other words, the victim must first
have allowed the malicious code to enter their system in some way. For example,
when opening a Microsoft Office file with a malicious macro embedded or a PDF
document containing malicious JavaScript code. These are very common infection
vectors, but there are many others.
There is also the possibility
that the threat is 100% fileless if the attacker exploits some serious
vulnerability in the system and the malware is loaded into memory only through
network packets. This has been seen, for example, with the SMB / Exploit. Double
Pulsar backdoor, which exploits a vulnerability in the SMB 1.0 protocol. A
threat that is still active in LATAM today.
Difficulty Establishing Persistence
Now, attackers have a downside.
RAM is volatile and is removed, for example, by restarting the computer. This
forces, in most cases, that cybercriminals establish some persistence mechanism
for their malware. Although some are more sophisticated than others, in all
cases we can find some trace of this activity that will allow us to determine
its presence in the team.
In addition to the aforementioned
case of Double Pulsar, we have recently seen this technique in the “Operation
Ghost” malware campaign developed by the group “The Dukes”, also known as APT #
29. The fileless backdoors used by the organization.
How to Detect a Fileless Malware Infection?
The answer depends on the type of
malware and the logging and auditing policy that was initially adopted. In
general, if the malware has tried to persist on your computer, it has most
likely created identifiable registry entries, scheduled tasks, or WMI
subscriptions. However, if the malware did not establish persistence, it may
not be possible to detect it, unless there has been a generation of corresponding
logs prior to the incident.
For more advanced malware such as
Double Pulsar, even generating logs, detection can be difficult, since the
affected memory belongs to the Windows kernel and the applications will not be
able to detect this activity. For this reason, analyzing network traffic and
preventing infection by following the steps that we will mention later is
essential.
How to Avoid Fileless Malware Infection?
Do not open attachments that have
come to us by mail if the source is not trusted.
Disable automatic macro execution
in Office, as it is a common propagation mechanism. Macros can be disabled
globally via Group Policy.
Use total security
solutions that analyze network traffic.
Use security solutions that
analyze suspicious behavior in memory. These solutions are capable of
identifying memory-resident malware.
Keep the operating system and
applications with their security updates up to date.
Comments
Post a Comment