Understanding Fileless (or Non-Malware) Attacks and How to Stop Them

WHO NEEDS MALWARE?

UNDERSTANDING FILELESS ATTACKS AND HOW TO STOP THEM

1 What are fileless attacks

2 How does a fileless attack work

3 Real world examples

4 Why traditional approaches don’t work

5 The CrowdStrike approach

POOL QUESTION

HOW WOULD YOU RATE YOUR KNOWLEDGE OF FILELESS ATTACKS 1 TO 5 (1 = NONE. 5 = EXPERT)

WHAT IS A FILELESS ATTACK

An attack that does not require a malicious executable file

to be written to disk

THE REALITY OF FILELESS ATTACKS

Fileless techniques are not new

More prevalent than Ransomware 24% vs. 21%

78% of organizations are concerned about fileless attacks

Only 51% of breaches include malware - Source Verizon BDR 2017

Not all attacks are 100% fileless

80% of attacks use some fileless techniques - Source CrowdStrike Incident Response

FILELESS ATTACK TECHNIQUES

FILELESS

TECHINQUES

FILELESS INTRUSION TECHNIQUES OBSERVED BY THE FALCON PLATFORM

§ Spear phishing for credentials

§ Lateral movement using ‘living off the land’ tools (WMI, Unix commands, Powershell)

§ Registry persistence

§ Webshells

1.Attackeridentifiesorganizationwithvulnerable

webapplication

2.RemoteattackerusesSQLinjectionorother

vulnerabilitytodroppayload

3. Vulnerable webserver is

compromised and becomes

backdoor

WEBSHELL ATTACKS

FILELESS

TECHINQUES

FILELESS INTRUSION TECHNIQUES OBSERVED BY THE FALCON PLATFORM

§ Spear phishing for credentials

§ Lateral movement using ‘living off the land’ tools (WMI, Unix commands, Powershell)

§ Registry persistence

§ Webshells

§ Powershell-based credential dumpers

TOOL S

T E C H N I Q U E

HOW A FILELESS ATTACK TAKES PLACE

I N I T I A L C O M P R O M I S E

Remote access to a system using a

web browser. Can be web scripting

languageE.g. China Chopper

GAIN ACCESS

WebShell

C O M M A N D A N D C O N T R O L

Run system commands to

find out where we are

Sysinfo, Whoami

P R I V I L E G EE S C A L AT I O N

Run a PowerShell script such as

Mimikatz to dump credentials

DUMP CREDENTIALS

PowerShell

P E R S I S T E N C E

Modifies Registry to create a backdoor

E.g. On screen keyboard or sticky keys

MAINTAIN PERSISTENCE

Registry

E X F I LT R AT I O N

Uses system tools to gather data and

China Chopper Webshell to

exfiltrate data

EXFILTRATE DATA

VSSAdmin, Copy, NET use,

Webshell

REAL WORLD EXAMPLES

§ Fileless Malwre: Kovter

§ Fileless Attack: Nation State

KOVTER

§ Click-fraud

§ Fileless after initial infection

§ Hides encrypted malicious modules in the registry

§ Hides other malicious modules in PowerShell scripts

§ Uses shortcut file (.lnk) to download PowerShell scripts. The script launches PowerShell to start a shellcode

NATION STATE ATTACK

§ Weaponization: Spoofed website

§ Delivery: Spear phishing

§ PowerShell modules connect to a remote server

§ Install/run MimiKatz

§ Lateral movement through stolen credentials

MOVING LATERALLY WITHOUT MALWARE

Attacker sets the bait with a fake

website

Extract credentials from initial victim

Move laterally to other hosts

HOW TO PROTECT AGAINST FILELESS ATTACKS

HOW WOULD YOU RATE YOUR CURRENT LEVEL OF PROTECTION AGAINST FILELESS ATTACKS (1 = POOR – 5 = EXCELLENT)

EDUCATE

83%Rate traditional AV based signature efficacy good or excellent

WHY TRADITIONAL APPROACHES DON’T WORK

No file to analyze No artifacts left behind Blind if prevention fails

Uses legitimate applications No file to detonate Hands on keyboard

PROTECTS AGAINST ALL TYPES OF ATTACKSProtect against Known/Unknown Malware/Malware Free

Protect Against Zero-Day Attacks

Endpoint Detection and Response

Managed Threat Hunting

BENEFITS

FALCON ENDPOINT PROTECTION

MachineLearning

IOABehavioral

Blocking

Block Known Bad

ExploitMitigation

PROCESSINJECTSATHREADINTOSYSTEMPROCESS

INJECTEDTHREADREADSCREDENTIALSFROMTHESYSTEMPROCESSMEMORY

DUMPEDCREDENTIALSAREUSEDTOLOGININTOEXCHANGESERVER

MAILBOXESAREEXPORTEDOUTOFEXCHANGE

INDICATORS OF ATTACK

PROCESSCONDUCTSRECONNAISSANCE

PROCESSELEVATESPRIVILEGES

WEBSERVEREXECUTESAPROCESS

KEY TAKEAWAYS

THE THREAT IS REAL TRADITIONAL AV IS NOT ENOUGH CURRENT DEFENSES

DO NOT WORK

NEED TO THINK BEYOND MALWARE AND FOCUS ON

STOPPING THE BREACH

Questions?Please submit all questions in the Q&A chat

right below the presentation slides

Contact Us

Additional Information

JoinWeeklyDemos

crowdstrike.com/productdemos

FeaturedAsset:HowAdversariesUseFileless AttacksTo

EvadeYourSecurity

Link in Resource List

Website: crowdstrike.comEmail: info@crowdstrike.comNumber: 1.888.512.8902 (US)

Understanding Fileless (or Non-Malware) Attacks and How to Stop Them

Technology

An emerging threat Fileless malware: a survey and research ... · detection system. The fileless malware attack is catastrophic for any enterprise because of its persistence, and

Beyond Whitelisting: Fileless Attacks Against Linux · 2019-03-05 · Fileless Malware - Definition “… a variant of computer related malicious software that exists exclusively

(160820) #fitalk fileless malware forensics

Protecting Your POS System from PoSeidon and Other Malware Attacks

Cortex XDR - nextgenfw.cz · picture of every threat and automatically revealing the root ... exploits, malware, ransomware, and fileless attacks. It in-cludes the broadest set of

DOING MORE WITH LESS: A STUDY OF FILELESS INFECTION ATTACKS · DOING MORE WITH LESS: A STUDY OF FILELESS INFECTION ATTACKS RIVERA & INOCENCIO VIRUS BULLETIN CONFERENCE SEPTEMBER 2015

Protecting from Zero-Day Malware Attacks - Idosi.org

Analysing Phishing & Malware Attacks for Neither Fun nor Profit

Threat Modeling of Banking Malware-Based Attacks - … · PART III-Using PASTA™ for threat modeling of banking-malware attacks . OWASP ... Perform a risk assessment of online banking

Osterman Research WHITE PAPER O...Fileless malware, e.g., rogue browser extensions 49% Accidental breaches of sensitive or confidential data by employees 49% Malware getting into your

Fileless attacks against enterprise networks - Kaspersky Lab · PDF fileFileless attacks against enterprise networks ... the Metasploit Msfvenom utility with the following command

From Malware Signatures to Anti-Virus Assisted Attacks · From Malware Signatures to Anti-Virus Assisted Attacks Christian Wressnegger, Kevin Freeman, Fabian Yamaguchi, and Konrad

how to tear down modern Malware or latest in Targeted Attacks · how to tear down modern Malware or latest in Targeted Attacks . ... Detection Evasion and Resilience By design, malware

MALWARE - Stony Brook Universityseclab.cs.sunysb.edu/sekar/cse509/ln/malwarenotes.pdf · MALWARE Motivation behind malware ... such large scale attacks, ... that apart from the general

Is Your Business Safe From Malware And Targeted Attacks

Prevent Malware attacks with F5 WebSafe and MobileSafe

Understanding Fileless Attacks on Linux-based IoT Devices ...alfchen/fan_mobisys19.pdfUnderstanding Fileless Attacks on Linux-based IoT Devices with ... was under DDoS attack by Mirai,

Defending Web Infrastructures from Malware Attacks · PDF filekrona — up to £580000” by a single Malware attack ... *Ref. ... Banking Malware Attacks resemble

Hidden in plain sight? - Blackhoodie · 2020-05-29 · [Whitepaper] - Who needs malware, How advasaries use fileless attacks to evade your security [Blog] - Attack Mitre Process Hollowing

Raimund genes from traditional malware to targeted attacks