Attackers Use Trusted Windows Tools to Evade Process Analysis and Maintain Access
Summary
Huntress describes attackers using trusted Windows utilities and scripts to evade process analysis, execute payloads, and establish persistence through logon mechanisms and scheduled tasks.
Key points
- One campaign used RegSvr32.exe with scrobj.dll to download and execute an XML Scriptlet, and ODBCConf.exe with a response file to install silently.
- Another incident used a Scheduled Task to launch mshta.exe, which ran VBScript and cmd.exe; PowerShell then downloaded a payload from hxxp://bit[.]ly/2kTzFCQ and executed it with Invoke-Expression.
- The article describes persistence through a Run key value and logon script in one incident, and a Scheduled Task running every three hours with SYSTEM privileges in another.
- Huntress says its endpoint agent looks for persistent footholds as a complement to detecting malicious payload execution.
- The article recommends sharing threat intelligence and references the Living Off The Land Binaries and Scripts and MITRE ATT&CK knowledge bases.
Article Details
- Attack Vectors
- Abuse of trusted Windows utilities, including RegSvr32.exe with scrobj.dll to download and execute an XML Scriptlet (Squiblydoo).
- Use of ODBCConf.exe with a response file and the REGSVR action to silently install.
- A Scheduled Task launched mshta.exe, which ran VBScript to spawn cmd.exe; cmd.exe invoked PowerShell to download a payload, which was executed with Invoke-Expression.
- Persistence through Run Key Value and Logon Script mechanisms, and through a Scheduled Task configured to run every three hours with SYSTEM privileges.
- Defensive Notes
- Monitor process behavior and chains of trusted Windows utilities for suspicious execution and payload-download activity.
- Inspect persistence mechanisms, including Run Keys, Logon Scripts, and Scheduled Tasks, for unexpected entries.
- The article describes Huntress endpoint monitoring for persistent footholds as a complementary way to uncover evasive threats.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxp[:]//bit[.]ly/2kTzFCQ | Shortened URL identified in the incident as the source from which PowerShell downloaded a payload. |
MITRE ATT&CK
T1037.001 · Logon Script (Windows)A Logon Script was used to spawn evasive processes when a user logged in.T1053.005 · Scheduled TaskA Scheduled Task launched mshta.exe in one incident and was also used to run a payload every three hours with SYSTEM privileges in another.T1059.001 · PowerShellcmd.exe invoked PowerShell to download a payload, which was executed with Invoke-Expression.T1059.003 · Windows Command ShellThe VBScript spawned cmd.exe, which ran the /c command.T1059.005 · Visual BasicVBScript was executed through mshta.exe.T1218.005 · Mshtamshta.exe executed VBScript code in the second incident.T1218.010 · Regsvr32RegSvr32.exe and scrobj.dll were used to download and execute an XML Scriptlet (Squiblydoo).T1218.011 · Rundll32ODBCConf.exe was used with a response file and the REGSVR action to silently install.T1547.001 · Registry Run Keys / Startup FolderRun Key Value was used to spawn evasive processes at user logon.