To help disambiguate the term fileless, we developed a comprehensive definition for fileless malware<\/a> as reference for understanding the wide range of fileless threats. We have also discussed at length the advanced capabilities in Microsoft Defender ATP that counter fileless techniques<\/a>.<\/p>\n\n\n\n I recently unearthed a widespread fileless campaign called Astaroth<\/a> that completely \u201clived off the land\u201d: it only ran system tools throughout a complex attack chain. The attack involved multiple steps that use various fileless techniques and proved a great real-world benchmark for Microsoft Defender ATP\u2019s capabilities against fileless threats.<\/p>\n\n\n\n In this blog, I will share my analysis of a fileless attack chain that demonstrates:<\/p>\n\n\n\n I was doing routine review of Windows Defender Antivirus telemetry when I noticed an anomaly from a detection algorithm designed to catch a specific fileless technique. Telemetry showed a sharp increase in the use of the Windows Management Instrumentation Command-line (WMIC) tool to run a script (a technique that MITRE refers to XSL Script Processing<\/a>), indicating a fileless attack.<\/p>\n\n\n\n Figure 1. Windows Defender Antivirus telemetry shows a sudden increase in suspicious activity<\/em><\/p>\n\n\n\n After some hunting, I discovered the campaign that aimed to run the Astaroth<\/a> backdoor directly in memory. Astaroth is a notorious info-stealing malware known for stealing sensitive information like credentials, keystrokes, and other data, which it exfiltrates and sends to a remote attacker. The attacker can then use stolen data to try moving laterally across networks, carry out financial theft, or sell victim information in the cybercriminal underground.<\/p>\n\n\n\n While the behavior may slightly vary in some instances, the attack generally followed these steps: A malicious link in a spear-phishing email leads to an LNK file. When double-clicked, the LNK file causes the execution of the WMIC tool with the \u201c\/Format\u201d parameter, which allows the download and execution of a JavaScript code. The JavaScript code in turn downloads payloads by abusing the Bitsadmin tool.<\/p>\n\n\n\n All the payloads are Base64-encoded and decoded using the Certutil tool. Two of them result in plain DLL files (the others remain encrypted). The Regsvr32 tool is then used to load one of the decoded DLLs, which in turn decrypts and loads other files until the final payload, Astaroth, is injected into the Userinit process.<\/p>\n\n\n\n Figure 2. Astaroth \u201cliving-off-the-land\u201d attack chain showing multiple legitimate tools abused<\/em><\/p>\n\n\n\n It\u2019s interesting to note that at no point during the attack chain is any file run that\u2019s not a system tool. This technique is called living off the land<\/a>: using legitimate tools that are already present on the target system to masquerade as regular activity.<\/p>\n\n\n\n The attack chain above shows only the Initial Access<\/a> and Execution<\/a> stages. In these stages, the attackers used fileless techniques to attempt to silently install the malware on target devices. Astaroth is a notorious information stealer with many other post-breach capabilities that are not discussed in this blog. Preventing the attack in these stages is critical.<\/p>\n\n\n\n Despite its use of \u201cinvisible\u201d techniques, the attack chain runs under the scrutiny of Microsoft Defender ATP. Multiple advanced technologies at the core of Windows Defender Antivirus<\/a> expose these techniques to spot and stop a wide range of attacks.<\/p>\n\n\n\n These protection technologies stop threats at first sight, use the power of the cloud, and leverage Microsoft\u2019s industry-leading optics to deliver effective protection. This defense-in-depth is observed in the way these technologies uncovered and blocked the attack at multiple points in Astaroth\u2019s complex attack chain.<\/p>\n\n\n\n Figure 3. Microsoft Defender ATP’s Antivirus solutions for fileless techniques used by Astaroth<\/em><\/p>\n\n\n\n For traditional, file-centric antivirus solutions, the only window of opportunity to detect this attack may be when the two DLLs are decoded after being downloaded\u2014after all, every executable used in the attack is non-malicious. If this were the case, this attack would pose a serious problem: since the DLLs use code obfuscation and are likely to change very rapidly between campaigns, focusing on these DLLs would be a vicious trap.<\/p>\n\n\n\n However, as mentioned, Microsoft Defender ATP’s Antivirus catches fileless techniques. Let\u2019s break down the attack steps, enumerate the techniques used using MITRE technique ID<\/a> as reference, and map the relevant Microsoft Defender ATP protection.<\/p>\n\n\n\n <\/p>\n\n\n\n The victim receives an email with a malicious URL:<\/p>\n\n\n\n The URL uses misleading names like certidao.htm<\/em> (Portuguese for \u201ccertificate\u201d), abrir_documento.htm<\/em> (\u201copen document\u201d), pedido.htm<\/em> (\u201corder\u201d), etc.<\/p>\n\n\n\n When clicked, the malicious link redirects the victim to the ZIP archive certidao.htm.zip<\/em>, which contains a similarly misleading named LNK file certidao.htm.lnk<\/em>. When clicked, the LNK file runs an obfuscated BAT command-line.<\/p>\n\n\n\n MITRE techniques observed:<\/em><\/p>\n\n\n\n Microsoft Defender ATP’s Antivirus protection:<\/p>\n\n\n\n <\/p>\n\n\n\n The BAT command runs the system tool WMIC.exe<\/em>:<\/p>\n\n\n\n The use of the parameter \/format<\/em> causes WMIC to download the file v.txt<\/em>, which is an XSL file hosted on a legitimate-looking domain. The XSL file hosts an obfuscated JavaScript that is automatically run by WMIC. This JavaScript code simply runs WMIC again.<\/p>\n\n\n\n MITRE techniques observed:<\/p>\n\n\n\n Microsoft Defender ATP’s Antivirus protection:<\/span><\/p>\n\n\n\n <\/p>\n\n\n\n WMIC is run in a fashion similar to the previous step:<\/p>\n\n\n\n WMIC downloads vv.txt<\/em>, another XSL file containing an obfuscated JavaScript code, which uses the Bitsadmin, Certutil, and Regsvr32 tools for the next steps.<\/p>\n\n\n\n MITRE techniques observed:<\/p>\n\n\n\n Microsoft Defender ATP’s Antivirus protection:<\/span><\/p>\n\n\n\n <\/p>\n\n\n\n Multiple instances of Bitsadmin are run to download additional payloads:<\/p>\n\n\n\n The payloads are Base64-encoded<\/a> and have file names like: falxconxrenwb.~<\/em>, falxconxrenw64.~<\/em>, falxconxrenwxa.~<\/em>, falxconxrenwxb.~<\/em>, falxconxrenw98.~<\/em>, falxconxrenwgx.gif<\/em>, falxfonxrenwg.gif<\/em>.<\/p>\n\n\n\n MITRE techniques observed:<\/p>\n\n\n\n Microsoft Defender ATP’s Antivirus protection:<\/span><\/p>\n\n\n\n <\/p>\n\n\n\n The Certutil system tool is used to decode the downloaded payloads:<\/p>\n\n\n\n Only a couple of files are decoded to a DLL; most are still encrypted\/obfuscated.<\/p>\n\n\n\n MITRE technique observed:<\/p>\n\n\n\n Microsoft Defender ATP’s Antivirus protection:<\/span><\/p>\n\n\n\n <\/p>\n\n\n\n One of the decoded payload files (a DLL) is run within the contexct of the Regsvr32 system tool:<\/p>\n\n\n\n The file falxconxrenw64.~<\/em> is a proxy: it loads and runs a second DLL, falxconxrenw98.~<\/em>, and passes it to a third DLL that is obtained by reading files falxconxrenwxa.~<\/em> and falxconxrenwxb.~<\/em>. The DLL falxconxrenw98.~<\/em> then reflectively loads the third DLL.<\/p>\n\n\n\n MITRE techniques observed:<\/p>\n\n\n\n Microsoft Defender ATP’s Antivirus protection:<\/span><\/p>\n\n\n\n <\/p>\n\n\n\n The newly loaded DLL reads and decrypts the file falxconxrenwgx.gif<\/em> into a DLL. It runs the system tool userinit.exe<\/em> into which it injects the decrypted DLL. The file falxconxrenwgx.gif<\/em> is again a proxy that reads, decrypts, and reflectively loads the DLL falxconxrenwg.gif<\/em>. This last DLL is the malicious info stealer known as Astaroth<\/a>.<\/p>\n\n\n\n MITRE techniques observed:<\/p>\n\n\n\n Microsoft Defender ATP’s Antivirus protection:<\/span><\/p>\n\n\n\n The strength of Microsoft Defender ATP’s Antivirus engines in exposing fileless techniques add to the capabilities of the unified endpoint protection platform<\/a>. Activities related to fileless techniques are reported in Microsoft Defender Security Center as alerts, so security operations teams can further investigate and respond to attacks using endpoint detection and response, advanced hunting, and other capabilities in Microsoft Defender ATP.<\/p>\n\n\n\n Figure 4. Details of Windows Defender Antivirus detections of fileless techniques and malware reported in Microsoft Defender Security Center; details also indicate whether threat is remediated, as was the case with the Astaroth attack<\/em><\/p>\n\n\n\n The rest of Microsoft Defender ATP’s capabilities beyond Antivirus enable security operations teams to detect and remediate fileless threats and other attacks. Notably, Microsoft Defender ATP endpoint detection and response<\/a> (EDR) has strong and durable detections for fileless and living-off-the-land techniques across the entire attack chain.<\/p>\n\n\n\n Figure 5. Alerts in Microsoft Defender Security Center showing detection of fileless techniques by antivirus and EDR capabilities<\/em><\/p>\n\n\n\n We also published a threat analytics<\/a> report on living-off-the-land binaries to help security operations assess organizational security posture and resilience against these threats. New Microsoft Defender ATP services like threat and vulnerability management<\/a> and Microsoft Threat Experts<\/a> (managed threat hunting), further assist organizations in defending against fileless threats.<\/p>\n\n\n\n Through signal-sharing and orchestration of threat remediation across Microsoft\u2019s security technologies, these protections are further amplified in Microsoft Threat Protection<\/a>, Microsoft\u2019s comprehensive security solution for the modern workplace. For this Astaroth campaign, Office 365 Advanced Threat Protection (Office 365 ATP<\/a>) detects the emails with malicious links that start the infection chain.<\/p>\n\n\n\n Microsoft Threat Protection<\/a> secures identities, endpoints, email and data, apps, and infrastructure.<\/p>\n\n\n\n To come back to one of my original points in this blog post, being fileless doesn\u2019t mean being invisible; it certainly doesn\u2019t mean being undetectable.<\/p>\n\n\n\n An analogy: Pretend you are transported to the world of H.G. Wells\u2019 The Invisible Man<\/a> and can render yourself invisible. You think, great, you can walk straight into a bank and steal money. However, you soon realize that things are not as simple as they sound. When you walk out in the open and it\u2019s cold, your breath\u2019s condensation gives away your position; depending on the type of the ground, you can leave visible footmarks; if it\u2019s raining, water splashing on you creates a visible outline. If you manage to get inside the bank, you still make noise that security guards can hear. Motion detection sensors can feel your presence, and infrared cameras can still see your body heat. Even if you can open a safe or a vault, these storage devices may trigger an alert, or someone may simply notice the safe opening. Not to mention that if you somehow manage to grab the money and put them in a bag, people are likely to notice a bag that\u2019s walking itself out of the bank.<\/p>\n\n\n\n Being invisible may help you for some things, but you should not be under the illusion that you are invincible. The same applies to fileless malware: abusing fileless techniques does not put malware beyond the reach or visibility of security software. On the contrary, some of the fileless techniques may be so unusual and anomalous that they draw immediate attention to the malware, in the same way that a bag of money moving by itself would.<\/p>\n\n\n\n Using invisible techniques and being actually invisible are two different things. Using advanced technologies, Microsoft Defender ATP exposes fileless threats like Astaroth before these attacks can cause more damage.<\/p>\n\n\n\n <\/p>\n\n\n\n Andrea Lelli<\/em><\/strong> <\/p>\n\n\n\n <\/p>\n\n\n\n Questions, concerns, or insights on this story? Join discussions at the Microsoft Defender ATP community<\/a>.<\/p>\n\n\n\n\n
Exposing a fileless info-stealing campaign with Microsoft Defender ATP’s Antivirus<\/h2>\n\n\n\n
![\"Windows](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/08\/fig1-wmic-related-attacks.png\")
<\/figure>\n\n\n\n![\"Astaroth](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/08\/fig1a-astaroth-attack-chain.png\")
<\/figure>\n\n\n\n![\"Microsoft](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/08\/fig2b-microsoft-defender-atp-next-gen-protection.png\")
<\/figure>\n\n\n\n
\n\n\n\nStep 1: Arrival<\/h3>\n\n\n\n
![\"screenshot\"](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/08\/1-URL.png\")
<\/figure>\n\n\n\n\n
\n
\n\n\n\nStep 2: WMIC abuse, part 1<\/h3>\n\n\n\n
![\"screenshot\"](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/08\/2-wmic.png\")
<\/figure>\n\n\n\n\n
\n
\n\n\n\nStep 3: WMIC abuse, part 2<\/h3>\n\n\n\n
![\"screenshot\"](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/08\/3-wmic.png\")
<\/figure>\n\n\n\n\n
\n
\n\n\n\nStep 4: Bitsadmin abuse<\/h3>\n\n\n\n
![\"screenshot\"](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/08\/4-bitsadmin.png\")
<\/figure>\n\n\n\n\n
\n
\n\n\n\nStep 5: Certutil abuse<\/h3>\n\n\n\n
![\"screenshot\"](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/08\/5-certutil.png\")
<\/figure>\n\n\n\n\n
\n
\n\n\n\nStep 6: Regsvr32 abuse<\/h3>\n\n\n\n
![\"screenshot\"](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/08\/6-regsvr2.png\")
<\/figure>\n\n\n\n\n
\n
\n\n\n\nStep 7: Userinit abuse<\/h3>\n\n\n\n
\n
\n
Comprehensive protection against fileless attacks with Microsoft Threat Protection<\/h2>\n\n\n\n
![\"screenshot\"](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/07\/c1-Windows-Defender-AV-detection-in-Microsoft-Defender-Security-Center.png\")
<\/figure>\n\n\n\n![\"Details](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/07\/d1-Windows-Defender-AV-detection-in-Microsoft-Defender-Security-Center.png\")
<\/figure>\n\n\n\n![\"screenshot\"](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/07\/a1-astaroth_alert_Microsoft-Defender-ATP.png\")
<\/figure>\n\n\n\n![\"Alerts](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/07\/b1-astaroth_alert_Microsoft-Defender-ATP.png\")
<\/figure>\n\n\n\nConclusion: Fileless threats are not invisible<\/h2>\n\n\n\n
Microsoft Defender ATP Research<\/em><\/p>\n\n\n\n
\n\n\n\nTalk to us<\/h2>\n\n\n\n