Response When Minutes Matter: RDP — Remote Desktop Pwnage, Part 1

Welcome to the CrowdStrike® Falcon Complete^TM team’s first “Tales from the Trenches” blog, where we describe a recent intrusion that shows how the Falcon Complete managed detection and response (MDR) service operates as an extension of the customer’s security team to quickly detect, investigate and contain an active attacker before they’re able to complete their goal. Once this intrusion was contained, the Falcon Complete team was able to clean and remediate the affected hosts without a need for reimaging or disrupting the customer’s business operations. With the ongoing COVID-19 pandemic crisis, many organizations have had to act quickly to ensure their security operations are capable of operating 100% remotely. In many cases, this has led to an increase in misconfigured services and applications that are publicly exposed. A simple misconfiguration of a publicly accessible server/application can quickly lead to adversarial compromise.

Join us as we take you step-by-step through our methodologies — including the initial detection, triage and investigation that ultimately led to us thwarting the threat actor and bringing the customer back to a clean and operational state.

The Initial Detection

The incident began when Falcon Complete received a high-severity machine learning (ML) detection for the unknown binary wmiic.exe on a host within the customer's environment. The binary appeared to be attempting to masquerade as the legitimate Windows utility wmic.exe, which is a command-line utility used to interface with Windows Management Instrumentation (WMI). Reviewing the detection details further indicated that the unknown binary was quarantined on attempted execution, effectively neutralizing the threat.

For many organizations, the story would stop right there. However, the Falcon Complete team thoroughly reviewed the detection and its associated process explorer tree to identify any further activity. Reviewing this tree revealed that this binary had a parent process of cmd.exe, and a grandparent process of an unknown and suspicious binary, azure bak2.exe. Leveraging CrowdStrike’s internal malware analysis platform, we were able to determine that the grandparent process of azure bak2.exe was actually a self-extracting .rar file. On execution, it wrote numerous binaries to disk including an XMRig coinminer variant (this was the initial wmiic.exe binary), a remote administrative tool (AmmyyAdmin), as well as GMER, which is a security tool that can be used to tamper with the operation of other security products or rootkits.

Figure 1: WMIIC.EXE process execution tree

After this quick triage of the detection details and process execution tree, it became clear that a more thorough investigation was warranted, and we attempted to remotely connect to the affected host via Falcon’s Real Time Response (RTR) for additional investigation and remediation efforts. One of the key differentiators of Falcon Complete is the ability to remotely investigate and perform remediation or countermeasures on malicious activity as opposed to simply escalating to the customer for review and action. This capability could mean the difference between additional compromise and the successful containment of a bad actor.

While attempting to connect to the affected host, we discovered that the host was offline. Although an offline host is not always a suspicious or malicious sign in itself, we identified this host as a domain controller, and therefore the outage was likely anomalous. We immediately reached out to the customer to validate whether this server being offline was intentional or potentially related to the malicious activity. Once the customer confirmed that the domain controller outage was not expected, the severity of the investigation increased, and we shifted into the scoping phase of the incident response to help identify additional malicious activity and have a better understanding of the extent of the compromise.

Investigation with Endpoint Detection and Response (EDR) Data

The CrowdStrike Endpoint Activity Monitoring (EAM) application gives the Falcon Complete team and Falcon customers the ability to gain real-time insight into attacks and to search the execution data collected by Falcon Insight^TM EDR. This provides a powerful capability to quickly investigate and scope the extent of compromise in an intrusion. We leverage EAM to quickly search for known indicators of attack (IOAs) across all endpoints within a customer’s environment. Once additional hosts are identified, further investigation can be performed to potentially identify additional IOAs and continue scoping activities. The scoping phase is an iterative process we perform until we have a full understanding of the extent of compromise, at which point we shift to containment and remediation activities. Quickly searching for known IOAs led to discovering numerous other hosts with the same files being written to disk around the same time frame.

Figure 2:

 

EAM output for IOC query across the customer’s environment. Each line indicates a unique host that has been seen with the binary

With these new compromised hosts identified, we began to look for commonalities and discovered that the same account was being used to write these files to disk. Using this new indicator, we performed additional EAM queries to identify any hosts with a successful authentication via the compromised account.

When we investigated the lateral movement, we determined that the authentication to each host was via logon type 10, indicating access via Remote Desktop Protocol (RDP), and we obtained a list of remote IP addresses used as a source of the malicious activity.