Huntress Details Seven Ways Attackers Evade Security Defenses
Summary
Huntress examines seven defense-evasion examples, including security-tool exclusions, agent removal, obfuscated scripts, malicious LNK files, AMSI/ETW bypass, user deception and reflective loading.
Key points
- Attackers can use privileged PowerShell to add Defender exclusions for selected paths, processes or files, leaving the security tool active but limiting what it monitors.
- Huntress describes an attempt to uninstall its agent and a separate use of Backstab, which uses a Sysinternals component to terminate protected AV and EDR processes.
- One obfuscated PowerShell script added a malicious domain user; another sample was identified in a sandbox as a byte-heavy AsyncRAT variant attempting to contact new50[.]noip[.]me.
- A malicious executable concealed in an LNK shortcut used a familiar icon and light XOR encryption to evade scrutiny and encourage a user to run it.
- The article describes an AMSI/ETW bypass that requires an executable on disk to launch PowerShell without those security mechanisms, creating another opportunity for detection.
- In a partner-investigated case, a fake QuickBooks program displayed a pop-up directing the user to an attacker-controlled mobile number after the machine was compromised.
- Huntress observed a payload injected into the legitimate CasPol.exe process; the activity included TCP connections that suggested possible C2 and dropped .BAT files.
Article Details
- Attack Vectors
- Threat actors modified Microsoft Defender exclusions using a privileged PowerShell prompt to prevent selected paths, processes, and files from generating alerts.
- An adversary partially executed the Huntress agent uninstall process.
- Backstab used a legitimate component from the SysInternals suite to terminate protected antivirus and EDR processes.
- Malicious PowerShell scripts used layers of encoding and encryption to obscure their contents; an AsyncRAT variant attempted to contact new50[.]noip[.]me.
- An executable was embedded in a LNK shortcut disguised with a familiar Chrome or Spotify icon; the technique also used light XOR encryption.
- A malicious executable bypassed AMSI and ETW to run PowerShell commands that would otherwise be blocked or logged.
- A threat actor impersonated QuickBooks to prompt a user to call an attacker-controlled mobile number.
- A malicious payload was reflectively loaded into the legitimate CasPol.exe process; the resulting activity included TCP connections and dropped .BAT files.
- Defensive Notes
- Monitor changes to security-product exclusions, since exclusions can leave a solution appearing active while preventing it from alerting on selected items.
- Monitor attempts to uninstall or terminate security agents and protected antivirus or EDR processes.
- Use sandbox execution to investigate heavily obfuscated scripts when manual decoding is not practical.
- Monitor for suspicious executable activity associated with AMSI or ETW bypasses; the article notes that the bypass technique requires an initiating executable on disk.
- Monitor in-memory activity and trusted-process behavior, including unexpected network connections or file drops from processes such as CasPol.exe.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | new50[.]noip[.]me | Domain the article says an AsyncRAT variant tried to reach. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationMalicious PowerShell scripts used layers of encoding, encryption, and obfuscation to conceal their intent.T1027.004 · Compile After DeliveryThe article describes an AsyncRAT variant using aspnet_compiler.exe to compile a malicious executable after it reached the target machine.T1036 · MasqueradingAn executable was embedded in a LNK shortcut and disguised with a familiar Chrome or Spotify icon.T1055 · Process InjectionThe article describes a malicious payload injected into the CasPol.exe process.T1059.001 · PowerShellMalicious PowerShell scripts and one-liners were used, including to modify Defender exclusions and run after AMSI and ETW bypass.T1140 · Deobfuscate/Decode Files or InformationThe LNK-to-EXE technique used light XOR encryption to encrypt and then decrypt the executable bytes.T1204 · User ExecutionA fake QuickBooks program prompted the user to call an attacker-controlled mobile number.T1204.001 · Malicious LinkThe disguised LNK shortcut relied on a user clicking it to execute the embedded executable.T1562.001 · Disable or Modify ToolsThreat actors changed Defender exclusions and attempted to impair security agents or terminate protected AV and EDR processes.T1620 · Reflective Code LoadingA malicious payload was reflectively loaded into the memory of the legitimate CasPol.exe binary.
People
Cat ContilloHuntress colleague identified as the investigator of the fake QuickBooks case.Dray AghaAuthor of the article.John FerrellQuoted on threat actors' use of effective techniques.John HammondHuntress colleague consulted about obfuscated scripts.Matt AndersonHuntress colleague who discussed cases involving agent impairment and reflective loading.Megan BroomHuntress account executive consulted about the shortcut-based user-targeting technique.Sharon MartinHuntress Lead Product Owner asked for comment on security-tool impairment.
Malware
Vendors
HuntressIn this article, we’re going to descend into the Huntress dungeon and peruse some caged cases that are all to do with defense evasion. We’ll bring some friends along for the journey and get their insight.Microsoftbinary. This means that no alarms are usually tripped, and no attention brought on by using a trusted Microsoft binary—a sort of bait-and-switch trick used by the adversary. The extract of malware below shows how theWindows Sysinternalskey facets of a security solution. Specifically, Backstab uses a legitimate component from the SysInternals suite of tools to kill the ‘protected’ process of the AVs and EDRs, thus gifting a threat actor a
Products
CasPol.exeIn a recent case seen by Huntress, a payload was injected into CasPol.exe—a legitimate, trusted binary. This means that no alarms are usually tripped, and no attention brought on by using a trusted Microsoft binary—aDefenderPowerShell script. The beginning of this PowerShell script leveraged the built-in functionality of Defender to modify what kind of paths, processes and files Defender would and wouldn’t alert on.Huntress agentWe had a case where the threat actor was attempting to manipulate and impair the Huntress agent. They partially succeeded in executing the uninstall process of our agent(s).QuickBooksWe had a case brought to our attention by a partner. The threat actor compromised a machine, planted a number of insidious persistence roots, masqueraded as accounting software QuickBooks….all to end up with a pop up:
Tools
aspnet_compiler.exeThis was not obfuscated and the aspnet_compiler.exe line is a known technique of AsyncRAT to compile the malicious executable once it had reached the target machine (T1027.004).Backstabwho had the sense to subvert security solutions earlier in their campaign. An especially insidious tool, Backstab, was leveraged by the threat actor to blind particular key facets of a security solution. Specifically,PowerShellmy colleague, Matt Anderson, detailed a case where the threat actor brought over a huge malicious PowerShell script. The beginning of this PowerShell script leveraged the built-in functionality of Defender to