Fileless threats are on the rise. These threats occur when cybercriminals use pre-existing software in victims’ systems to carry out attacks, instead of using a malicious attachment or file. More often than not, a criminal’s favorite tool for a fileless attack is PowerShell.
PowerShell is a hacker-favorite
PowerShell is a pre-existing command line interface (CLI) used by system administrators to automate routine tasks and manage system configuration. It is mostly used for script execution-based, post-exploitation attacks.
Hackers use PowerShell because it’s,
Effortless to gain privileged access: Gaining access to a tool like PowerShell means gaining access to every single system in the network, since administrators use it to monitor and execute commands in all of them, including Active Directory.
A whitelisted tool: PowerShell displays a trusted digital signature as a whitelisted tool. This means it is easy to surpass firewalls or other anti-malware software.
Easy to execute: There are numerous free PowerShell scripts hackers can easily access online for free to execute an attack. PowerShell is also an open source software (since 2016) which means it can be used to carry out every part of an attack kill chain.
Compatible with different operating systems: PowerShell is supported by Linux and macOS systems along with Windows.
Hackers use frameworks to execute PowerShell attacks
Over time, pen testers have identified frameworks and tools used by criminals to execute PowerShell attacks. Some of them include:
We’ll take a deeper look at Empire to understand how criminals can use a framework to execute an attack. Empire can be executed using three main components:
➤ a listener is a system that listens for an RDP connection
➤ a stager is a piece of code that can be used to execute malicious scripts in the victim’s system, using an agent
➤ an agent is a program that maintains the connection between the victim system and the listener
The attack is carried out using the following steps:
- The attacker downloads the Empire post-exploitation tool onto their system.
They set up a listener using the tool.
A launcher is created. A shell launcher helps replace the existing Windows 10 script with a custom shell script. This file is renamed to misguide the victim.
The victim downloads the malicious file from let’s say, a phishing website. They download it thinking it is a jpeg file but it is actually the launcher that connects the victim’s system with the listener.
Once the connection is established, the attacker looks for agents that can be used to execute malicious scripts.
If the agent found does not have higher privileges, the attacker proceeds to escalate them.
Once elevated privileges are obtained, the attacker can use these to execute various attacks. They could obtain password credentials using other post-exploitation tools like Mimikatz, for example.
Similar attacks can be executed using the other pen-testing tools and frameworks listed above. Cobalt Strike is a legitimate penetration testing tool whose cracked version has been used often to execute attacks.
Cybersecurity best practices to detect PowerShell attacks
Here are some security best practices you can implement in your organization to detect and curb PowerShell attacks:
- Code Signing: This means adding a digital certificate to an executable or script to track and avoid any tampering.
Just Enough Administration (JEA): In PowerShell, JEA helps limit the kind of administrative controls each user has, including privileged users.
Constrained language mode: Enabling this mode in PowerShell helps avoid certain scripts that can increase the vulnerability of systems to attacks.
Enable transcription, module, and script-block logging: Enabling logging will help track each PowerShell session, monitor executions of script and code, and record all information to aid analysis, including timestamps and metadata for each command.
Investing in a SIEM solution
Enabling logging is not enough. Continuous monitoring of logs is required to spot malicious scripts and detect possible PowerShell attacks. Investing in a SIEM solution and sending it the transcription, module and script block logs can help you track specific commands and executions that can indicate these attacks.
Here are some of the reports a security analyst can study to track possible indicators of PowerShell attacks with ManageEngine Log360, a MITRE ATT&CK-powered SIEM solution:
– Remote PowerShell session creation
-WMI spawning Windows PowerShell
– PowerShell download file
– PowerShell script run in-app data
– PowerShell encoded character syntax
– Malicious Base64 encoded PowerShell keywords in command lines
– Empire PowerShell launch parameters
To learn more about how Log360 reports can help you detect and prevent PowerShell-based attacks, download our free 45-day trial and sign up for a personalized demo with our product experts. Experience better cybersecurity today with Log360, a unified SIEM solution.