Tracking Threat Actors’ Habits Can Improve Early Detection
Summary
Huntress explains how recurring attacker behaviors—including reused passwords, endpoint names, Windows utilities, and RMM deployment patterns—can help defenders identify activity earlier and build higher-confidence detections.
Key points
- Huntress describes attackers continuing to use familiar tactics across incidents, even when their initial access method changes.
- The article cites repeated use of Windows finger.exe for data exfiltration and recurring RMM deployments after endpoint compromise.
- Huntress analysts found that usernames and passwords used to create accounts, or secure archives during data staging, sometimes recur across incidents.
- Source endpoint names in login records can help validate incidents and flag suspicious or successful logins that stand out from an organization’s naming conventions.
- Tracking indicators as part of a threat cluster adds context about when they appeared in prior attack chains and what activity may follow.
- Huntress says recurring commands associated with Medusa ransomware activity were distinctive enough to support threat hunting for potentially affected organizations.
Article Details
- Defense Focus
- Use recurring attacker habits and cross-incident behavior to detect malicious activity earlier and disrupt follow-on actions.
- Detection Methods
- Track usernames and passwords repeatedly used to create accounts in known-malicious incidents, and correlate them with the point in the attack chain when the account was created.
- Monitor passwords used to secure archives during data staging.
- Correlate endpoint or workstation names from successful and failed login events; investigate names that recur across incidents or do not match the organization’s naming convention.
- Compare failed login attempts with subsequent successful logins to identify activity consistent with brute-force attacks.
- Hunt for recurring command sequences, including commands used to disable Windows Defender, and compare activity across endpoints and incidents.
- Look for repeated PowerShell file downloads and subsequent deployment of RMM software.
- Use recurring indicators in the context of threat clusters, including their timing and prior position in the attack chain, rather than assessing each indicator in isolation.
- Data Sources
- EDR telemetry for user creation events
- Windows successful and failed login events, including source endpoint or workstation names
- TeamViewer connections_incoming.txt logs
- Command and process activity, including PowerShell commands and security-tool changes
- Archive creation activity and associated passwords
- RMM installation and deployment activity
- Rule Types
- Behavioral detections based on reused usernames and passwords
- Cross-event and cross-incident correlation
- Sequence-based command and process hunting
- Anomaly detection for endpoint names and login activity
- Platforms
- Windows endpoints
- Defensive Actions
- Investigate account creation that uses credentials observed in known-malicious incidents, while accounting for legitimate onboarding activity.
- Correlate login names, source endpoint names, and event outcomes to distinguish suspicious activity from routine failures.
- Investigate recurring command sequences, PowerShell downloads, and RMM deployments together with their incident timing and endpoint context.
- Respond early when repeated indicators suggest an incident, before the actor can deepen access or continue follow-on activity.
MITRE ATT&CK
T1048 · Exfiltration Over Alternative ProtocolThe article describes file download and data exfiltration carried out using the native Windows utility finger.exe.T1059.001 · PowerShellThe observed incidents used PowerShell to download files.T1105 · Ingress Tool TransferPowerShell was used to download files from the same online location during the observed incidents.T1110 · Brute ForceThe article discusses identifying failed login attempts that lead to a successful login via a brute-force attack.T1136 · Create AccountThe article describes actors creating new user accounts on compromised systems.T1219 · Remote Access ToolsAfter compromising endpoints, actors installed RMM tools, including SimpleHelp, for persistence.T1562.001 · Disable or Modify ToolsThe article reports actors disabling Windows Defender or other security applications and describes hunting for a distinctive command sequence.
CVE
People
Dray AghaHuntress UK SOC manager who described incidents involving compromised endpoints and SimpleHelp RMM.Jennifer KoldeShared observations about threat clusters, habits, and past behavior in a Vertex blog post.Max RogersHuntress SOC senior director who shared a message about actors apparently compromising endpoints via CVE-2023-48788.
Malware
Vendors
HuntressFor example, Huntress has published several blog posts over the past year that have involved the use of the native Windows utility finger.exe associated with one particular IP address. Initial findings indicated thatMicrosoftMicrosoft Windows itself, and various RMM tools, can capture endpoint names from the source systems for logins, as well as failed login attempts, and this information can prove to be valuable not only for validating
Products
Huntress EDRA recent search across the previous 24 hours of Huntress EDR telemetry for user creation events resulted in over 92k responses. This number can vary based on the time of day the search is run, but the vast majority ofMicrosoft WindowsHuntress has published several blog posts over the past year that have involved the use of the native Windows utility finger.exe associated with one particular IP address. Initial findings indicated that the threatScreenConnectAnd as Max mentioned, threat actors were apparently compromising endpoints via this vulnerability to deploy ScreenConnect (or some other RMM tool), a tactic many MDRs have seen over time.SimpleHelp RMMAgain, threat actors accessed and compromised endpoints, and then installed additional RMM tools for persistence; in this case, SimpleHelp RMM.TeamViewerEarlier this year, Huntress published a blog post illustrating the use of remnant TeamViewer installations used in attempts to deploy ransomware. Based on the observed endpoint names in the TeamViewerWindows Defenderon May 23 and June 10, 2023. While many threat actors have been observed neutering or disabling Windows Defender (or other security applications), the specific sequence of commands observed was unique enough to
Tools
finger.exeseveral blog posts over the past year that have involved the use of the native Windows utility finger.exe associated with one particular IP address. Initial findings indicated that the threat cluster includedPowerShellthe observed incidents, the attack used and commands issued remained the same, including the use of PowerShell to download files from the same online location (i.e., https[:]//webhook[.]site), illustrated in Figure