- Home >
- Services >
- Access to Knowledge >
- Trend Monitor >
- Domain of Application >
- Trend snippet: Criminal abuse of security tools
Trends in Security Information
The HSD Trendmonitor is designed to provide access to relevant content on various subjects in the safety and security domain, to identify relevant developments and to connect knowledge and organisations. The safety and security domain encompasses a vast number of subjects. Four relevant taxonomies (type of threat or opportunity, victim, source of threat and domain of application) have been constructed in order to visualize all of these subjects. The taxonomies and related category descriptions have been carefully composed according to other taxonomies, European and international standards and our own expertise.
In order to identify safety and security related trends, relevant reports and HSD news articles are continuously scanned, analysed and classified by hand according to the four taxonomies. This results in a wide array of observations, which we call ‘Trend Snippets’. Multiple Trend Snippets combined can provide insights into safety and security trends. The size of the circles shows the relative weight of the topic, the filters can be used to further select the most relevant content for you. If you have an addition, question or remark, drop us a line at info@securitydelta.nl.
visible on larger screens only
Please expand your browser window.
Or enjoy this interactive application on your desktop or laptop.
Criminal abuse of security tools
element of complex, manually operated ransomware break-in attacks. In fact, both the quantity and variety of the attack tools we observed during attacks seemed to increase.
Software originally designed for the “red team” segment of the industry comprises the bring your own attack method. Attackers, in this case, deploy and use off-the-shelf security tools that are commonly used by network administrators and penetration testers. These include tools such as Cobalt Strike and elements of the Metasploit framework, designed for use in security assessments and technical tests.
Using your own strengths against you: Criminal abuse of security tools Some attacks don’t involve malware at all, or wait to deliver malware until the very end of the attack, instead using just the tools already on the operating systems running on computers across a network. Other criminals may leverage the power of a range of tools used by two large segments of the information security industry: incident responders and penetration testers. The information security community has defined the style of attacks that involve very little or no malware, but instead harness the existing components of the operating system or popular software packages, pular software packages, as living-off-the-land (LOL). These attacks usually involve one or more forms of automation in the form of native scripting such as PowerShell, batch files, or VBScript scripts, collectively referred to as LOLscripts. The attackers use these LOLscripts to execute sequences of commands using living-off-the-land binaries (applications), colloquially called LOLbins. Software originally designed for the “red team” segment of the industry comprises the bring your own attack method. Attackers, in this case, deploy and use off-the-shelf security tools that are commonly used by network administrators and penetration testers. These include tools such as Cobalt Strike and elements of the Metasploit framework, designed for use in security assessments and technical tests.
These tools are valuable to attackers for a number of reasons: Because they’re often used in a legitimate capacity (to audit or otherwise improve system security) it can also be difficult for anti-virus or security solutions to detect such tools or activity outright. As such, Sophos must rely more heavily on the study of the LOLscripted behavior to identify potential malicious activity. And of course, it’s easier to use something that’s already been created than to build your own tools from scratch.
While the use of LOLscripts and reverse shells wasn’t new the past year, in 2020 they became a ubiquitous element of complex, manually operated ransomware break-in attacks. In fact, both the quantity and variety of the attack tools we observed during attacks seemed to increase.
The wide variety of attack tools range from commercially available applications to open source GitHub repositories, with functionalities that may include: Ì Botnet-like command-and-control frameworks Ì Shellcode generation and obfuscation Ì Anti-virus evasion and sandbox detection Ì Password or credential extraction Ì Kerberoasting (maintaining persistence of Domain Admin privileges) Ì The ability to brute force passwords used by a variety of services Ì System data exfiltration Most of these types of tools contain benign payloads or no payload at all in their “out of the box” state, but in the past, we have been able to detect many of these tools engaging in malicious activity based on contextual information acquired via our behavioral detection technologies. According to our telemetry, the ten attack tools we have seen most commonly in use are (in order of frequency of use) Metasploit, BloodHound, mimikatz, PowerShell Empire, Cobalt Strike, Veil Evasion, Hydra THC, Enigma, Nishang, and Shellter. Metasploit is far and away the most commonly seen tool, appearing about twice as often as the next most-common attack tool, BloodHound. Sophos currently tracks the use of 99 different attack tools; it seems unlikely that we’ll see a reprieve from attackers continuing to take advantage of these well-written tools throughout 2021.