Tag Archives: Malware

2026
Leave a comment
Info Security, Malware, Threat Hunt

APT41’s Dodgebox: Defense Evasion and Detection Strategies

While conducting threat hunting research, I came across a defense evasion behavior in APT41’s Dodgebox malware that I haven’t seen formally documented as its own technique in MITRE ATT&CK. This post walks through what I found, why it matters, and how to detect it.

The Technique

Dodgebox checks whether Control Flow Guard (CFG) is enabled on the system, and if it is, attempts to disable it.

CFG is a security feature built into modern Windows systems that restricts where an application can execute code. It’s designed to make it harder for attackers to exploit memory corruption vulnerabilities, like buffer overflows, to hijack control of a running program. When CFG is bypassed, an attacker significantly improves their odds of successful code execution and privilege escalation.

According to Zscaler’s ThreatLabz research on Dodgebox, the malware detects CFG status and, if active, modifies the LdrpHandleInvalidUserCallTarget function in ntdll.dll to disable it, effectively removing that security layer before proceeding.

Reference: Zscaler ThreatLabz, DodgeBox: A deep dive into the updated arsenal of APT41

A 10-by-10 grid of circular lights with some red illuminated points on a black circuit board.
AI Generated

Where This Sits in ATT&CK

This behavior maps cleanly to Defense Evasion, and specifically to the Disable or Modify Tools technique (currently T1685 in ATT&CK’s structure, previously catalogued under T1562.001). ATT&CK already documents APT41’s broader pattern of in-memory patching of security interfaces like AMSI and ETW inside ntdll.dll to evade detection without triggering obvious service termination events. The CFG check-and-disable behavior is consistent with that same pattern, but as of this writing, I haven’t found it documented as its own procedure example under any current sub-technique.

Worth noting separately: before disabling CFG, the malware first has to determine its status. That discovery step is arguably its own consideration, closer to System Information Discovery, and shouldn’t be conflated with the disable action itself.

Detection

    There are a few practical ways to check CFG status and hunt for this behavior.

    1. PowerShell – Per-Process Check
      • Get-ProcessMitigation lets you query the mitigation settings of a running process, including whether CFG is enabled:
        • Get-ProcessMitigation -System
      • If the result shows OFF, CFG is not enabled for that process. ON or NOTSET indicates CFG is enabled or set to the default configuration.
    2. PowerShell – Binary-level Check Across Systems
      • Get-PESecurity is a PowerShell module that examines Windows binaries to determine whether they were compiled with various security mitigations, including CFG. The relevant characteristic is stored as GUARD_CF with a value of 0x4000, which makes it possible to check for CFG support at the binary level rather than just the running-process level.
    3. EDR – Fleet-wide Check
      • If you’re running Microsoft Defender for Endpoint, Advanced Hunting can assess CFG status across your environment:
        • DeviceTvmSecureConfigurationAssessment
        • | where ConfigurationID == "scid-2020"
        • | project DeviceName, OSPlatform, IsCompliant, Context
        • | join kind=leftouter (DeviceInfo | project DeviceName, PublicIP, IsAzureADJoined) on DeviceName
        • | summarize count() by IsCompliant, OSPlatform
      • This gives you a fleet-wide compliance view rather than a single host check, which is more useful for spotting systems where CFG has been disabled outside of normal configuration management.
    CFG Status
    SCID-2020

    If your organization has visibility into CFG status at scale, whether through EDR telemetry, binary analysis, or process mitigation checks, it’s worth adding to your detection coverage. This is a small, quiet step in an attack chain, but it’s also a step that’s currently easy to miss.

    References

    Tagged , , , , ,
    2019
    Leave a comment
    Guide, Info Security, Malware, Original, Review, Technology

    How Free Web Filtering Software Can Protect You System?

    Update

    On August 1, 2016, Blue Coat, Inc. (K9’s parent company) was acquired by Symantec™. As can be imagined Blue Coat and Symantec had a handful of similar products and unfortunately, it didn’t make sense to maintain two competing products. it was decided to “end-of-life” K9 Web Protection.
    Effective immediately, K9 Web Protection is no longer available for purchase or download. Technical Support for K9 will end on June 30, 2019.

    It is unfortunate to see K9 Web Protection go. I am not aware of an alternative free software that provides the same level of protection at a premium quality. However, for those interested in alternatives to K9 Web Protection, I would recommend you can start with Quad9 and OpenDNS Home. While neither of them provides everything that K9 did, but they still protect your system against most common online threats.

    “We may think one layer of security will protect us – for example, antivirus. Unfortunately for that approach, history has proven that, although single-focus solutions are useful in stopping specific attacks, the capabilities of advanced malware are so broad that such protections inevitably fail.” – Jerry Shenk, Layered Security: Why It Works.

    Making use of layered security for personal use is of the utmost importance as I have covered a couple of times in the past: here, here, and here. Just as I have done in the past, I will use this post to share another tool that you can explore to support your personal layered security strategy.

    My never-ending curiosity to explore and test new technologies can sometimes lead me to stumble upon genuinely impressive solutions. Fortunately for you, I believe this tool falls into that category.

    K9 Web Protection is the software that I have been testing for some months now, and I must say, I’ve been truly pleased with its results. The software falls under the Web Filter category, which places a restriction on websites that you can visit. Web Filtering is used in two major cases. The first is to permit parents to control the sort of content accessible to their children, offering their kids a safe environment to learn and explore online. The second is for businesses who wish to prevent their employees from accessing websites that do not pertain to their jobs.

    However, in addition to the above-mentioned, from my experience using this software on a daily basis, I have come across other benefits:

    • Real-time malware protection“helps identify and block illegal or undesirable content in real time, including malware-infected sites. You also benefit from the WebPulse cloud service, a growing community of more than 62 million users who provide more than six billion real-time Web content ratings per day.”
      • You can learn more about web filtering and intelligence here.
    • Automatic content ratings“New websites and web pages are created every minute, and no one person can possibly rate or categorize all of them. To ensure protection against new or previously unrated websites, Blue Coat’s patent-pending Dynamic Real-Time Rating™ (DRTR) technology automatically determines the category of an unrated web page, and allows or blocks it according to your specifications.”

    Another advantage of the K9 Web Protection is that it is backed by Blue Coat (acquired by Symantec in 2016),  the leader in Web Security “with an impressive portfolio of integrated technologies serving as a trusted platform to deliver Cloud Generation Security to more than 15,000 customers worldwide.”

    This solution is truly an “enterprise-class security software designed for home computers.” Also, did I mention that it’s free! “As part of the Blue Coat Community Outreach Program, K9 Web Protection is free for home use. You can also purchase a license to use K9 Web Protection for business, government, non-profit, or other use.”

    I will do a quick overview of the installation and usage of the software, but you can find a well-documented quick start guide and user manual here:

    Installation and Usage Overview:

    installk9

    • The installation process should take a couple of minutes to complete as it is self-explanatory.
    • Upon completion, the application’s interface will open in your browser:

    K9_Browser_admin_page

    • To view or modify any of the configurations, you will be prompted to enter the password you created during installation.
    • Here are some of the options and details you can access from the Setup page:

    k9_block_categories.PNG

    • Web Categories to Block: choosing one of the available levels allows you to block selected categories of websites.
    • Time Restrictions: 3 options are available to block web access depending on the time of day. Unrestricted places no restrictions on web access. NightGuard blocks all web access during contiguous blocks of time every day. Custom enables you to choose days of the week and time periods to block all web access.
    • Web Site Exceptions: Allows you to create lists of websites to “always block” or “always allow.” Blocking Effects: “Bark When Blocked” plays a barking sound when a web page is blocked. Make sure the sound is enabled and not muted. Show Admin Options displays options on blocked web pages which enable administrators to view the blocked web page. Enable Time Out allows you to block all web access if too many web pages are blocked in a given period of time
    • URL Keywords: Allows you to enter keywords which, if found in a URL, cause a “block page” to display. Safe Search: “Redirect to K9 Safe Search” will redirect searches to various search engines through K9’s Safe Search. This provides a safer search experience than other search engines provide. Force Safe Search will prevent users from disabling Safe Search functionality provided by various websites.
    • Other Settings: “Update to Beta” enables you to get advance copies of new K9 Web Protection software undergoing development. Blue Coat distributes Beta versions so that K9 gets used in “real world” environments before being released as a final version. Please note that Beta versions might be incomplete and less stable than final versions. “Filter Secure Traffic” enables K9 to block secure websites (i.e. sites that use the HTTPS protocol).
    • Password/Email: Allows you to change your K9 administrator password or e-mail address.
    • K9 Update: Installs software updates if available.
    • View Activity Summary: This tab shows a summary of all “Web Activity” on your computer: To view more details, click the “Category” or “Requests” links. On these pages, you have the option of grouping the data by month or by day. To view Administrative Events details, click the “View All” link. (Some of these activities are as a result of automatic browser and toolbar updates, for example, and might display URL formats with which you are not familiar.) By selecting “Clear Logs”, all your activity data will be cleared; however, three days’ worth of administrative events will be retained.k9_activity_summary

    As you can see from the above, the information provided here is extremely granular and it allows you to not only get an easy view of your browsing behavior but also the behaviors of the various system and application components. I have been using this solution in conjunction with other traditional protective mechanisms, such as anti-virus, and the benefits have been massive.

    For instance, sometimes, while surfing the internet, I would see a certain URL get blocked or a visit history to a certain category in a website without a recollection of visiting that website. However, after investigations, I found that some components of a software installed on my computer or an extension in my browser is the reason behind that activity.

    “The malware ecosystem has changed drastically in the past 10 years, to the point that the old precautions are just no longer enough” – Malwarebytes LABS. I have been using K9 Web Protection on many of my personal computers because I have been impressed with it, so I thought to share it here. I believe it provides that extra layer of protection that we can all appreciate in a world where cyber threats are on the rise. In addition, I believe this solution is a wonderful option for those that are less familiar with common cyber threat vectors (i.e. parents) and can easily fall for phishing emails or click on an adware as they browse the internet.

    As we have known for some time, “there is no single solution for the information security problems we face today. A combination of many different kinds of security tools is required to protect you from modern threats…” and I believe K9 Web Protection is among the best tools we have today, so you should definitely equip yourself with it if you are going to create a safe web environment for yourself, your kids, your employees, and everyone around you!

     

    Tagged , , , , , , , , ,
    2015
    Digital Forensics, Guide, Info Security, Security Blogs

    How do botnets work?

    How does it feel to know that your personal computer can be remotely controlled by someone without your knowledge for ill purposes? Or worse, instead of a single individual having this unauthorized access to your system it can be a group of people over the internet that controls what your computer does and how it does it. In the field of Information Security, if your system is involved in such control it is considered a bot: a computer system being controlled by an automated malicious program. In addition, your computer system can be part of a larger group of infected computer systems and these collections of infected computers create botnets. Casually, these bots are also referred to as zombies and the remote controller is called the botmaster. So how are these bots born and grow into botnets?

    According to Damballa, an independent security firm’s annual threat report, “at its peak in 2010, the total number of unique botnet victims grew by 654 percent, with an average incremental growth of 8 percent per week ”. Originally, these bots are developed by tech-savvy criminals who develop the malicious bot code and then usually release on the open internet. While on the internet, the bot can perform numerous malicious functions based on its code design but it most cases it spreads itself across the internet by searching for vulnerable, unprotected computers to infect. After compromising victims’ computers, these bots quickly hide their presence in difficult to find locations, such as computer operating system files. The botmaster’s goal here is to maintain the compromised system behavior as normal as possible so the victim does not become suspicious. Common activities that bots perform at this stage involve registering themselves as the trusted program in any anti-virus program that might be on the victim’s computer. Moreover, to maintain persistence, bots add their operations in systems startup functions which results in bots automatically reactivating even after shutdown/restart. Throughout this process, bots continue to report back to the botmaster and wait for further instructions.

    Below lists some of the common operations that bots can perform on behalf of its botmaster:

    Sending
    Stealing
    DoS (Denial of Service)
    Clickfraud
    They send
    – spam
    – viruses
    – spyware
    They steal personal and private information and communicate it back to the malicious user:
    – credit card numbers
    – bank credentials
    – other sensitive personal information
    Launching denial of service (DoS) attacks against a specified target. Cybercriminals extort money from Web site owners, in exchange for regaining control of the compromised sites.
    Fraudsters use bots to boost Web advertising billings by automatically clicking on Internet ad

    As the chart above states, there are numerous functions that bots can perform. However, recently bots have mainly been used to conduct Distributed Denial of Service (DDoS) attacks: utilizing hundreds or thousands of bots from around the whole world against a single target.  Botmaster’s goal with DDoS is to use thousands of bots with numerous botnets to attempt to access the same resource simultaneously. This overwhelms the resource with thousands of requests per second thus making the resource unreachable. This inaccessibility of the resource has severe effects on legitimate users and requests. According to FBI, “botnet attacks have resulted in the overall loss of millions of dollars from financial institutions and other major U.S. businesses. They’ve also affected universities, hospitals, defense contractors, law enforcement, and all levels of government”.

    A misconception exists that if your system does not hold any valuable information or if you do not use your system to conduct online financial transactions than an adversary is less likely to target your system. Unfortunately, as much as we would like this to be true, it is not the case. For botnets, the most valuable element is your system’s storage and your internet speed. Our personal computers are now capable of storing and processing terabytes of information seamlessly and are able to use our high-speed internet to transfer this information.  As stated by a malware researcher team from Dell SecureWorks, botnets “allows a single person or a group to leverage the power of lots of computers and lots of bandwidth that they wouldn’t be able to afford on their own”.

    ——————————————————————-

    http://www.fbi.gov/news/news_blog/botnets-101

    https://www.damballa.com/press/2011_02_15PR.php

    http://news.discovery.com/tech/what-are-botnets-110304.htm

    http://us.norton.com/botnet/

    Tagged , , , , , ,
    2014
    Leave a comment
    Digital Forensics, Guide, Info Security

    Finding Known Evil With Nessus – Part 2

    This post is a continuation of my earlier post about finding a known-bad process with Nessus vulnerability scans. In this post, I will share my experience after I finished running my first scan using this new scan policy.

    Unlike the regular vulnerability scans, the duration of this scan was much less. The reason for this was because the scan policy consisted of only selected plugins. However, even with only selected plugins, the scan results were very comprehensive.

    First, the scan result shows the MD5 hash of the suspicious process. Now you can take this MD5 hash and search sites like VirusTotal but on the scan results page, you will find a direct link to a Tenable website that will provide additional information about the suspicious process. This information is similar to what you would find on VirusTotal but with little less information. In my case, I still searched VirusTotal for more detailed information.

    Second, the scan result shows the path of where the suspicious process is located on the target system. Obviously, this is great because now you don’t have to search the system and locate the executable in question. But what’s even better is that the scan results even show all the instances of that suspicious process that the scan found. For example, in my test scan, the same suspicious process was located under numerous user profiles.

    With the above information in hand, you can quickly develop you indicators of compromise (IOCs) and begin your investigation. My initial step was to review all the processes on my target machine and identify the process ID (PID) of the executable that the scanner identified. From here you can look at all the network connections related to this process, the system handles, any additional sub-processes, etc.

    Overall, I am satisfied with what I have seen so far. I think that it is great that Tenable has incorporated these checks because in my option it makes perfect sense to check for known bad stuff during the time that you have already allocated for vulnerability scans. However, I would recommend that you separate your suspicious process and vulnerability data because do you not want to alarm the system owners without properly doing your own investigation. The easiest way to do this is by creating two different repositories and then drafting different reports/dashboards from each of those repositories.

    My final comment is that if you have Nessus (I used SecurityCenter); please try to run this scan with the new scan policy. You can find the link to download this scan policy in my first post. Let me know what you guys think!

    Tagged , ,
    ← Older posts
    Advertisements