1
00:00:00,120 --> 00:00:00,990
In this lesson,

2
00:00:00,990 --> 00:00:03,810
we're going to explore malware exploitation techniques.

3
00:00:03,810 --> 00:00:06,960
Now, a malware exploitation technique is a specific method

4
00:00:06,960 --> 00:00:08,610
by which malware code penetrates

5
00:00:08,610 --> 00:00:10,530
and infects a targeted system.

6
00:00:10,530 --> 00:00:13,470
Historically, malware would modify an executable file

7
00:00:13,470 --> 00:00:15,810
or assert a malicious macro into a document file

8
00:00:15,810 --> 00:00:17,550
on a target storage device to ensure

9
00:00:17,550 --> 00:00:19,860
that every time the file was open or run,

10
00:00:19,860 --> 00:00:21,330
that malware would be activated

11
00:00:21,330 --> 00:00:23,580
and ready to execute its malicious payload.

12
00:00:23,580 --> 00:00:26,100
Other types of malware, like worms, are instead

13
00:00:26,100 --> 00:00:28,140
going to focus on infecting the system's memory

14
00:00:28,140 --> 00:00:29,700
to leverage a remote procedure call

15
00:00:29,700 --> 00:00:32,369
over the organization's network to spread its malicious code

16
00:00:32,369 --> 00:00:34,260
across the entire enterprise.

17
00:00:34,260 --> 00:00:36,390
However, in modern enterprise networks,

18
00:00:36,390 --> 00:00:38,910
we're now seeing an evolution by malware that's created

19
00:00:38,910 --> 00:00:41,274
to utilize fileless malware technique instead.

20
00:00:41,274 --> 00:00:44,430
This modern type of malware will also bypass detection

21
00:00:44,430 --> 00:00:45,930
from signature-based security systems

22
00:00:45,930 --> 00:00:48,240
like antivirus and anti-malware solutions

23
00:00:48,240 --> 00:00:50,730
by directly executing the malicious code as a script

24
00:00:50,730 --> 00:00:52,770
or as a small piece of shell code.

25
00:00:52,770 --> 00:00:55,560
This fileless execution is going to be used to create a process

26
00:00:55,560 --> 00:00:57,240
in the system memory without relying

27
00:00:57,240 --> 00:00:59,850
on the local file system of that infected host.

28
00:00:59,850 --> 00:01:02,460
And this kind of fileless malware will also become harder

29
00:01:02,460 --> 00:01:05,129
to detect because it leaves behind very few traces

30
00:01:05,129 --> 00:01:06,720
or indicators of compromise

31
00:01:06,720 --> 00:01:10,230
in comparison to standard pieces of file-based malware.

32
00:01:10,230 --> 00:01:11,818
Now, some of these fileless malwares

33
00:01:11,818 --> 00:01:13,680
might temporarily write some data

34
00:01:13,680 --> 00:01:15,090
to a directory on your system,

35
00:01:15,090 --> 00:01:17,130
but they are designed to erase those artifacts

36
00:01:17,130 --> 00:01:18,690
after it finishes executing.

37
00:01:18,690 --> 00:01:21,750
So even these types are considered to be largely fileless

38
00:01:21,750 --> 00:01:22,770
due to the limited amount

39
00:01:22,770 --> 00:01:25,380
of evidence being left behind on the file system.

40
00:01:25,380 --> 00:01:28,195
So how does this modern type of malware work?

41
00:01:28,195 --> 00:01:31,080
Well, in general, most modern malware will use

42
00:01:31,080 --> 00:01:32,854
a basic two-stage deployment model.

43
00:01:32,854 --> 00:01:35,430
When a user accidentally clicks on a malicious link

44
00:01:35,430 --> 00:01:36,930
or opens a malicious file,

45
00:01:36,930 --> 00:01:39,150
the specific type of malware being installed is known

46
00:01:39,150 --> 00:01:41,940
as a stage one dropper or a downloader.

47
00:01:41,940 --> 00:01:43,860
This piece of malware is usually going to be created

48
00:01:43,860 --> 00:01:46,290
as a lightweight shell code that can be executed

49
00:01:46,290 --> 00:01:47,640
on a given system.

50
00:01:47,640 --> 00:01:50,190
Now, you may have noticed, I just used three new terms

51
00:01:50,190 --> 00:01:51,630
that you may not be familiar with,

52
00:01:51,630 --> 00:01:53,220
so let me define those real quick.

53
00:01:53,220 --> 00:01:56,250
These are droppers, downloaders, and shell codes.

54
00:01:56,250 --> 00:01:58,920
Now, a dropper is a specific malware type designed

55
00:01:58,920 --> 00:02:01,170
to initiate or run other malware forms

56
00:02:01,170 --> 00:02:03,690
within a payload on an infected host.

57
00:02:03,690 --> 00:02:06,330
Downloaders, on the other hand, retrieve additional tools

58
00:02:06,330 --> 00:02:08,905
post the initial infection that's facilitated by a dropper.

59
00:02:08,905 --> 00:02:12,000
Meanwhile, the shell code is a broader term

60
00:02:12,000 --> 00:02:13,890
that encompasses lightweight code meant

61
00:02:13,890 --> 00:02:16,410
to execute an exploit on a given target.

62
00:02:16,410 --> 00:02:18,630
Now, the primary function of a stage one dropper

63
00:02:18,630 --> 00:02:21,060
or downloader is to retrieve additional portions

64
00:02:21,060 --> 00:02:24,360
of the malware code and trick the user into activating it.

65
00:02:24,360 --> 00:02:26,970
Once the stage one dropper or downloader is activated,

66
00:02:26,970 --> 00:02:29,610
it's going to then try to install a second stage downloader

67
00:02:29,610 --> 00:02:32,280
that will download and install a remote access Trojan

68
00:02:32,280 --> 00:02:34,290
to give the threat actor the ability to conduct command

69
00:02:34,290 --> 00:02:36,660
and control over the victimized system.

70
00:02:36,660 --> 00:02:38,070
Once this access is established

71
00:02:38,070 --> 00:02:39,660
using a stage two downloader,

72
00:02:39,660 --> 00:02:40,890
the threat actor can then focus

73
00:02:40,890 --> 00:02:42,840
on consolidating their position on the system

74
00:02:42,840 --> 00:02:44,700
by using remote access tools to identify

75
00:02:44,700 --> 00:02:47,130
and infect other systems across the network.

76
00:02:47,130 --> 00:02:48,600
As the attacker spreads their influence

77
00:02:48,600 --> 00:02:49,770
across the enterprise,

78
00:02:49,770 --> 00:02:51,840
they're looking to compromise high value targets

79
00:02:51,840 --> 00:02:53,520
like servers or domain controllers

80
00:02:53,520 --> 00:02:56,340
to give them an even stronger foothold into your network.

81
00:02:56,340 --> 00:02:58,710
But even if these premium targets remain elusive

82
00:02:58,710 --> 00:03:00,655
to the threat actor, they're still going to try to compromise

83
00:03:00,655 --> 00:03:02,858
as many additional workstations as possible

84
00:03:02,858 --> 00:03:04,950
to continually expand their permissions

85
00:03:04,950 --> 00:03:07,140
and footprint across your network.

86
00:03:07,140 --> 00:03:08,693
Now, once they've established a stronghold,

87
00:03:08,693 --> 00:03:10,350
the threat actor will then transition

88
00:03:10,350 --> 00:03:13,230
into the action on objectives phase of their attack.

89
00:03:13,230 --> 00:03:14,220
During this phase,

90
00:03:14,220 --> 00:03:16,590
the threat actor will execute their primary objectives

91
00:03:16,590 --> 00:03:18,210
whether that's data exfiltration,

92
00:03:18,210 --> 00:03:20,280
file encryption as part of a ransomware attack,

93
00:03:20,280 --> 00:03:21,660
or any other malicious activities

94
00:03:21,660 --> 00:03:24,090
that might help them meet their core objectives.

95
00:03:24,090 --> 00:03:26,580
Now, once stage one and stage two malware has been installed

96
00:03:26,580 --> 00:03:28,080
and utilized, the final step

97
00:03:28,080 --> 00:03:30,420
of their attack is to conduct concealment.

98
00:03:30,420 --> 00:03:32,820
Concealment is going to be used to help threat actors prolong

99
00:03:32,820 --> 00:03:34,710
their unauthorized access on your systems

100
00:03:34,710 --> 00:03:36,960
by hiding their tracks, erasing log files

101
00:03:36,960 --> 00:03:39,060
and hiding any evidence of their malicious activities

102
00:03:39,060 --> 00:03:40,380
up to this point.

103
00:03:40,380 --> 00:03:41,520
Now malware can be delivered

104
00:03:41,520 --> 00:03:43,440
to a system using many different techniques

105
00:03:43,440 --> 00:03:46,680
including code injection, masquerading, DLL injection

106
00:03:46,680 --> 00:03:49,020
DLL sideloading and process hollowing

107
00:03:49,020 --> 00:03:50,730
to deploy the threat actor's malicious code

108
00:03:50,730 --> 00:03:51,990
into your system.

109
00:03:51,990 --> 00:03:52,950
For example,

110
00:03:52,950 --> 00:03:54,990
code injection is used to disguise the malicious code

111
00:03:54,990 --> 00:03:56,490
by running it with the identification

112
00:03:56,490 --> 00:03:58,260
of a legitimate process.

113
00:03:58,260 --> 00:04:00,210
These various malware deployment methods can also

114
00:04:00,210 --> 00:04:03,000
be combined with anti-forensic strategies like encryption,

115
00:04:03,000 --> 00:04:05,760
compression and obfuscation to make it more challenging

116
00:04:05,760 --> 00:04:07,710
for cyber defense professionals to detect

117
00:04:07,710 --> 00:04:09,900
and analyze these malicious threats.

118
00:04:09,900 --> 00:04:11,760
Now, in some of the more modern incident responses

119
00:04:11,760 --> 00:04:13,680
that I've worked on, we've also seen a rise

120
00:04:13,680 --> 00:04:16,589
in a sophisticated strategy known as living off the land,

121
00:04:16,589 --> 00:04:17,519
and this has been adopted

122
00:04:17,519 --> 00:04:19,320
by numerous advanced persistent threats

123
00:04:19,320 --> 00:04:21,990
and criminal organizations in their attacks.

124
00:04:21,990 --> 00:04:24,240
In living off the land, the threat actors are actually

125
00:04:24,240 --> 00:04:26,154
going to try to exploit the standard system tools

126
00:04:26,154 --> 00:04:29,100
to conduct their malicious activities and intrusions.

127
00:04:29,100 --> 00:04:31,800
For example, PowerShell is a standard tool that's installed

128
00:04:31,800 --> 00:04:34,530
by default on many Windows systems and servers.

129
00:04:34,530 --> 00:04:36,420
PowerShell can be manipulated to conduct lots

130
00:04:36,420 --> 00:04:38,460
of different types of malicious activities, though.

131
00:04:38,460 --> 00:04:40,230
Since these tools are installed by default

132
00:04:40,230 --> 00:04:42,138
in the operating system, it means that it's really easy

133
00:04:42,138 --> 00:04:44,676
for an attacker to obscure their malicious activities

134
00:04:44,676 --> 00:04:47,135
by making the detection of those activities more difficult

135
00:04:47,135 --> 00:04:49,650
by relying on internal PowerShell commands

136
00:04:49,650 --> 00:04:52,260
as opposed to downloading additional malicious code.

137
00:04:52,260 --> 00:04:54,600
As a cybersecurity professional, it is really important

138
00:04:54,600 --> 00:04:56,220
that you're aware of these types of techniques

139
00:04:56,220 --> 00:04:58,870
to ensure your system is well protected against them.