In this lesson,
we're going to explore malware exploitation techniques.
Now, a malware exploitation technique is a specific method
by which malware code penetrates
and infects a targeted system.
Historically, malware would modify an executable file
or assert a malicious macro into a document file
on a target storage device to ensure
that every time the file was open or run,
that malware would be activated
and ready to execute its malicious payload.
Other types of malware, like worms, are instead
going to focus on infecting the system's memory
to leverage a remote procedure call
over the organization's network to spread its malicious code
across the entire enterprise.
However, in modern enterprise networks,
we're now seeing an evolution by malware that's created
to utilize fileless malware technique instead.
This modern type of malware will also bypass detection
from signature-based security systems
like antivirus and anti-malware solutions
by directly executing the malicious code as a script
or as a small piece of shell code.
This fileless execution is going to be used to create a process
in the system memory without relying
on the local file system of that infected host.
And this kind of fileless malware will also become harder
to detect because it leaves behind very few traces
or indicators of compromise
in comparison to standard pieces of file-based malware.
Now, some of these fileless malwares
might temporarily write some data
to a directory on your system,
but they are designed to erase those artifacts
after it finishes executing.
So even these types are considered to be largely fileless
due to the limited amount
of evidence being left behind on the file system.
So how does this modern type of malware work?
Well, in general, most modern malware will use
a basic two-stage deployment model.
When a user accidentally clicks on a malicious link
or opens a malicious file,
the specific type of malware being installed is known
as a stage one dropper or a downloader.
This piece of malware is usually going to be created
as a lightweight shell code that can be executed
on a given system.
Now, you may have noticed, I just used three new terms
that you may not be familiar with,
so let me define those real quick.
These are droppers, downloaders, and shell codes.
Now, a dropper is a specific malware type designed
to initiate or run other malware forms
within a payload on an infected host.
Downloaders, on the other hand, retrieve additional tools
post the initial infection that's facilitated by a dropper.
Meanwhile, the shell code is a broader term
that encompasses lightweight code meant
to execute an exploit on a given target.
Now, the primary function of a stage one dropper
or downloader is to retrieve additional portions
of the malware code and trick the user into activating it.
Once the stage one dropper or downloader is activated,
it's going to then try to install a second stage downloader
that will download and install a remote access Trojan
to give the threat actor the ability to conduct command
and control over the victimized system.
Once this access is established
using a stage two downloader,
the threat actor can then focus
on consolidating their position on the system
by using remote access tools to identify
and infect other systems across the network.
As the attacker spreads their influence
across the enterprise,
they're looking to compromise high value targets
like servers or domain controllers
to give them an even stronger foothold into your network.
But even if these premium targets remain elusive
to the threat actor, they're still going to try to compromise
as many additional workstations as possible
to continually expand their permissions
and footprint across your network.
Now, once they've established a stronghold,
the threat actor will then transition
into the action on objectives phase of their attack.
During this phase,
the threat actor will execute their primary objectives
whether that's data exfiltration,
file encryption as part of a ransomware attack,
or any other malicious activities
that might help them meet their core objectives.
Now, once stage one and stage two malware has been installed
and utilized, the final step
of their attack is to conduct concealment.
Concealment is going to be used to help threat actors prolong
their unauthorized access on your systems
by hiding their tracks, erasing log files
and hiding any evidence of their malicious activities
up to this point.
Now malware can be delivered
to a system using many different techniques
including code injection, masquerading, DLL injection
DLL sideloading and process hollowing
to deploy the threat actor's malicious code
into your system.
For example,
code injection is used to disguise the malicious code
by running it with the identification
of a legitimate process.
These various malware deployment methods can also
be combined with anti-forensic strategies like encryption,
compression and obfuscation to make it more challenging
for cyber defense professionals to detect
and analyze these malicious threats.
Now, in some of the more modern incident responses
that I've worked on, we've also seen a rise
in a sophisticated strategy known as living off the land,
and this has been adopted
by numerous advanced persistent threats
and criminal organizations in their attacks.
In living off the land, the threat actors are actually
going to try to exploit the standard system tools
to conduct their malicious activities and intrusions.
For example, PowerShell is a standard tool that's installed
by default on many Windows systems and servers.
PowerShell can be manipulated to conduct lots
of different types of malicious activities, though.
Since these tools are installed by default
in the operating system, it means that it's really easy
for an attacker to obscure their malicious activities
by making the detection of those activities more difficult
by relying on internal PowerShell commands
as opposed to downloading additional malicious code.
As a cybersecurity professional, it is really important
that you're aware of these types of techniques
to ensure your system is well protected against them.