The document discusses advanced persistent threats (APTs), which are targeted cyberattacks that remain undetected for extended periods, often employing techniques initially associated with nation-state actors but now also used by cybercriminals. It outlines the mechanisms of an APT attack, including delivery, exploitation, installation, and lateral movement within networks, emphasizing the importance of identifying and detecting early signs of such attacks. To mitigate risks, organizations are advised to understand their assets, vulnerabilities, and adversaries while implementing robust multi-layered security measures.

1. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
DefCamp
Adrian Tudor
Leo Neagu
November 2018
1
Catch Me If You Can – Finding APTs in your network

2. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
2
• An Advanced Persistent Threat (APT) is a cyberattack that will “fly under the
radar” and your AV/IDS will not let you know about it
What is an APT?

3. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
3
• targeted cyberattack in which an intruder gains access to a network
• remains undetected for an extended period of time
• traditionally has been associated with nation-state players
• in the last few years, the tools and techniques used by a few APT actors have
also been adopted by various cybercriminals groups.
What is an APT?
Key elements of an APT attack
- targeted SCADA systems and is believed to be responsible for causing
substantial damage to Iran's nuclear program (2010)

4. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
4
• Focus on
• Delivery
• Exploitation
• Installation
• Command and Control
• Action and Objectives
APT attack mechanism

5. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
5
APT attack mechanism

6. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
6
• Vector of compromise
APT attack mechanism - Delivery

7. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
7
Exploitation with
malicious links
APT Exploitation and Installation

8. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
8
APT Exploitation and Installation

9. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
9
Quasar RAT – Easy to use/deploy NetWire malware
APT Exploitation and Installation

10. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
10
Quasar RAT – Easy to use/deploy - Demo
APT Exploitation and Installation

11. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
11
APT Installation

12. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
12
- Creating services that sound legit
- Task schedule
- Malware installed as Microsoft Office Add-in. When MS Word starts, malware
executed
- DLL hijacking
- and many more
APT Installation – Persistence

13. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
13
- .bash_profile and
.bashrc
- Accessibility
Features
- Account
Manipulation
- AppCert DLLs
- AppInit DLLs
- Application
Shimming
- Authentication
Package
- BITS Jobs
- Bootkit
- Browser
Extensions
- Change Default
File Association
- Component
Firmware
- Component Object
Model Hijacking
- Create Account
- DLL Search Order
Hijacking
- Dylib Hijacking
- External Remote
Services
- File System
Permissions
Weakness
- Hidden Files and
Directories
- Hooking
- Hypervisor
- Image File
Execution Options
Injection
- Kernel Modules
and Extensions
- Launch Agent
- Launch Daemon
- Launchctl
- LC_LOAD_DYLIB
Addition
- Local Job
Scheduling
- Login Item
- Logon Scripts
- LSASS Driver
- Modify Existing
Service
- Netsh Helper DLL
- New Service
- Office Application
Startup
- Path Interception
- Plist Modification
- Port Knocking
- Port Monitors
- Rc.common
- Re-opened
Applications
- Redundant Access
- Registry Run Keys
/ Startup Folder
- Scheduled Task
- Screensaver
- Security Support
Provider
- Service Registry
Permissions
Weakness
- Setuid and Setgid
- Shortcut
Modification
- SIP and Trust
Provider Hijacking
- Startup Items
- System Firmware
- Time Providers
- Trap
- Valid Accounts
- Web Shell
- Windows
Management
Instrumentation
Event Subscription
- Winlogon Helper
DLL
APT Installation – Persistence
You can find more detailed information on https://attack.mitre.org

14. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
14
• PERSISTENCE USING UNIVERSAL WINDOWS PLATFORM APPS (APPX)
APT Installation – Persistence

15. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
15
PERSISTENCE USING UNIVERSAL WINDOWS PLATFORM APPS (APPX)
APT Installation – Persistence
reg add
HKCUSoftwareClassesActivatableClassesPackageMicrosoft.People_10.1807.2131.
0_x64__8wekyb3d8bbweDebugInformationx4c7a3b7dy2188y46d4ya362y19ac5a580
5e5x.AppX368sbpk1kx658x0p332evjk2v0y02kxp.mca /v DebugPath /d
"C:UsersIEUserAppDataRoamingSubDirClient.exe"
Reference: ODDVAR MOE : https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/
Persistence using the People app

16. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
16
Moving laterally inside the environment, compromising additional targets and getting
closer to high value assets using different tools and techniques:
- Enumerate password data from memory using commonly available password
dumpers (Mimikatz)
- Net.exe to connect to network shares using net use commands with compromised
credentials
- Spread through the local network by using PsExec
- Windows Management Instrumentation (WMI) to interact with local and remote
systems
APT Lateral movement

17. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
17
- Recognizing an APT attack early in the kill chain is a tough job
- The attackers prefer to work slow blending with regular network activity and using
tools already available in the environment (PowerShell, WMI, net.exe etc.)
How can I tell I’m targeted?

18. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
18
- Large outbound network traffic should raise questions, especially if the amount
transferred is out of the regular trendline
- Quite often APT attacks are detected when the data gathered already has been
exfiltrated, sometimes even months later
Data exfiltration: to late to detect?

19. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
19
The reason behind the spike
- A web shell present on a IIS server (China Chopper)
- A password encrypted RAR archive was exfiltrated
- Further analysis of the RAM memory revealed the preparation of
the data being exfiltrated

20. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
20
Are you ready to detect an APT?
Assess your
current state
• Identify your assets
• Know your
vulnerabilities
Know your
enemies
• Threat Intelligence
feeds
• Tools, tactics and
procedures used by
threat actors
Design and
implement your
vision
• Multi-layered
endpoint & network
protection
• Threat Hunting

21. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
21
Let’s go Threat Hunting – look for hidden threats
Start the
hunt
Refine
the hunt
Response
Large
unexpected
data flows
Remote
access via
RDP
Scheduled
tasks
Phishing
campaigns
Encoded
PowerShell
commands
Net.exe
use

22. Classification: //Secureworks/Public Use:© SecureWorks, Inc.
22
QUESTIONS?
THANK YOU!