Smash ‘n Grab vs the Persistent RAT

By cybadm June 24, 2017

We have all heard the news about WannaCry ransomware and how it continues its spread. However, skilled hackers are typically more interested in persistence than a mere smash ‘n grab action where some files get encrypted and they hope to squeeze a few hundred dollars out of each infected endpoint. The EternalBlue SMB exploit (MS017-010) was originally used by WannaCry ransomware and the Adylkuzz Bitcoin Miner. But now, in typical fashion, the exploit is being used for a more persistent game: exploit, pivot and persist.

Most recently, RATs (Remote Access Trojans) are being deployed in combination with the EternalBlue exploit. The danger of RATs, unlike the nuisance that is ransomware, is that they can stay inside the network undetected for months and stealthily creep through the systems, establishing beachheads that can be activated at any time using command and control techniques.

Ransomware CAN be stopped. Not only can you patch the EternalBlue SMB security flaw, but you can usually stop ransomware in its tracks because it is heuristically detectable. When ransomware starts encrypting files, it can be acted upon. For Windows users, check out FoolishIT’s CryptoPrevent Premium for an annual $15 fee. For Mac users, try out RansomWhere? by Objective-See, which continuously monitors the file system for creation of encrypted files by suspicious programs.

Cyber Threat Hunting…
Depending on how you conduct cyber threat hunting activities, you have a few choices for methodologies to hunt for Persistent RATs:

  1. Event & Data-centric Log Collection
  2. Network Traffic Analytics
  3. Forensic State Analysis of the Endpoint

My preferred method is not to rely on Event & Data-centric Log Collection because it often lacks sufficient data. This method requires a mature level of centralized logging and retention for a minimum of 6 months.

Network Traffic Analytics (NTA) can be a very useful tool if properly deployed. It is about the journey of understanding your network and ensuring that your IT Security team doesn't normalize deviance.

Lastly, Forensic State Analysis of the Endpoint (FSA) is essential for RAT hunting. This method allows detection even when a RAT is lying dormant, as it has no time dependencies and requires no baseline understanding.

For an effective cyber threat hunt, I recommend combining these three methods:

  1. Use Network Traffic Analytics to identify deviance that requires investigation.
  2. Use Forensic State Analysis to validate that a breach has occurred.
  3. Use Event & Data-centric Log Collection to augment data from the NTA + FSA hunt.

By using a layered defense-in-depth approach, you can effectively hunt for cyber threats. Happy Hunting!!!