Attackers Used Windows Finger Utility to Exfiltrate Data from an Exchange Server
Summary
Huntress analysts observed an attacker use finger.exe on an MS Exchange server to download a file and send directory and process names to a remote endpoint over unencrypted TCP port 79.
Key points
- The attacker created a webshell on an MS Exchange server; Huntress EDR recorded process creation activity.
- Using finger.exe, the attacker downloaded a file to the endpoint and sent names of text files in the Windows Temp folder and running processes to a remote endpoint.
- The information was sent unencrypted over TCP port 79, with the commands run under the SYSTEM account.
- The attacker also used 185.56.83.82 in curl.exe and PowerShell commands to download and launch files.
- Huntress recommended understanding which native utilities are used legitimately, monitoring their use, and removing utilities that are not needed.
Article Details
- Attack Vectors
- A threat actor created a webshell on an MSExchange server and used native Windows utilities, including finger.exe, to download files and send endpoint data to a remote endpoint.
- The actor used finger.exe to send filenames from C:\Windows\Temp and process names to a remote endpoint unencrypted over TCP port 79.
- The IP address 185.56.83.82 was used in curl.exe and PowerShell commands to download files to the endpoint and launch them.
- Defensive Notes
- Monitor use of native utilities such as finger.exe and investigate whether their activity is legitimate in the environment.
- Consider removing native binaries that are not needed for legitimate purposes.
- Review process-creation telemetry for suspicious use of finger.exe, rundll32.exe, curl.exe, and certutil.exe.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 185[.]56[.]83[.]82 | IP address the threat actor used in curl.exe and PowerShell commands to download and launch files; the article reports malicious classifications from VirusTotal vendors. |
MITRE ATT&CK
T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolThe actor sent filenames and process names to a remote endpoint unencrypted over TCP port 79; the article explicitly maps this activity to T1048.003.T1057 · Process DiscoveryThe actor ran tasklist and sent the resulting process names to a remote endpoint.T1059.001 · PowerShellThe article reports that the actor used PowerShell commands to download files to the endpoint and launch them.T1059.003 · Windows Command ShellThe actor used cmd.exe to run finger.exe and commands that enumerated files and processes.T1083 · File and Directory DiscoveryThe actor enumerated text files in C:\Windows\Temp and sent the filenames to a remote endpoint.T1105 · Ingress Tool TransferThe threat actor used finger.exe to download a file to the endpoint; the article also explicitly maps this activity to T1105.
People
Products
Microsoft WindowsThere are a number of tools provided in a standard Windows installation that have legitimate uses, but some tools can also be used for malicious purposes as well.MSExchangedata from the endpoint. In this particular case, the threat actor was able to create a webshell on an MSExchange server. This particular endpoint was not running Windows Defender, and was therefore not monitored viaWindows Defenderwas able to create a webshell on an MSExchange server. This particular endpoint was not running Windows Defender, and was therefore not monitored via Huntress’ Managed Antivirus feature; however, Huntress Managed
Tools
certutil.exemuch of the threat actor’s activity was detected, such as their use of rundll32.exe, curl.exe, and certutil.exe.curlIn fact, much of the threat actor’s activity was detected, such as their use of rundll32.exe, curl.exe, and certutil.exe.finger.exeWindows operating system that can all be used for data ingress (MITRE ATT&CK T1105). One such tool is finger.exe, which is intended to allow a user to query a system for information about logged-in users, but it canPowerShell“finger” commands, the IP address 185.56.83.82 was also used by the threat actor in both curl.exe and PowerShell commands to download files to the endpoint and launch them. At the time of this writing, the IP addressRundll32creation information. In fact, much of the threat actor’s activity was detected, such as their use of rundll32.exe, curl.exe, and certutil.exe.