Huntress Traces Obfuscated PowerShell Reverse Shell to SSH Persistence
Summary
Huntress investigated an encoded PowerShell command on a partner’s system, tracing it to an SSH reverse shell and scheduled-task persistence. The process lineage pointed to the partner’s ScreenConnect instance.
Key points
- Huntress said its Managed EDR alerted on an encoded PowerShell command running on a partner’s computer.
- The command’s parent process was the partner’s ScreenConnect instance, which Huntress said indicated attacker access to the ScreenConnect host.
- Analysis of the payload revealed a firewall rule for inbound SSH, a dropped SSH executable, and a scheduled task for persistence.
- A batch script set up an SSH reverse-shell listener connecting to an IP address found in the script.
- Huntress recommended enabling and checking two-factor authentication and strong credentials on RMM accounts, monitoring anomalous inbound and outbound traffic, and considering IDS/IPS controls.
Article Details
- Attack Vectors
- An attacker accessed a partner's ScreenConnect instance and ran an encoded PowerShell command.
- The command used PowerShell Invoke-WebRequest to retrieve content from an attacker staging domain.
- Retrieved scripts added an inbound SSH firewall rule, dropped an SSH executable, and configured a scheduled task to persistently launch a reverse-shell listener.
- The reverse shell connected back to an IPv4 address returned by the staging content.
- Defensive Notes
- Enable and verify two-factor authentication and strong credentials for RMM accounts.
- Monitor incoming and outgoing network traffic for anomalous behavior.
- Consider deploying an intrusion detection and prevention system.
- Educate users not to download untrusted files or software.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | onerecovery[.]click | Attacker staging domain whose returned content included scripts used to establish a reverse shell and persistence. |
| IPV4 | 88[.]119[.]175[.]55 | IP address identified in the retrieved content and used as the reverse-shell callback destination. |
MITRE ATT&CK
T1053.005 · Scheduled TaskA scheduled task was created to persistently launch the SSH reverse-shell listener.T1059.001 · PowerShellThe attacker ran an encoded PowerShell command that retrieved and processed staging content.T1059.003 · Windows Command ShellThe go.bat batch script was used to run the reverse-shell listener setup.T1095 · Non-Application Layer ProtocolThe payload established a reverse-shell connection to the specified IP address.T1105 · Ingress Tool TransferPowerShell Invoke-WebRequest retrieved script content from the staging domain.T1543.003 · Windows ServiceThe script added a firewall rule allowing inbound SSH connections.
Vendors
Products
CyberChefWe headed straight over to CyberChef so we could see what was actually happening with this script. The decoded Base64 text was unscrambled to this simple (but daunting) one-liner:ScreenConnectWe looked into the parent process to see what spawned this task and were horrified to discover that it was the partner’s ScreenConnect instance.urlscan.ioIf you look at the website with a tool like urlscan.io, all you’d see is "loading..." and the source from the site doesn't show anything interesting either.