HOW TO DETECT COBALT STRIKE BEACON PATCH
HOW TO DETECT COBALT STRIKE BEACON CODE
HOW TO DETECT COBALT STRIKE BEACON DOWNLOAD
HOW TO DETECT COBALT STRIKE BEACON WINDOWS

The infrastructure we associate with DEV-0365 has several overlaps in behavior and unique identifying characteristics of Cobalt Strike infrastructure that suggest it was created or managed by a distinct set of operators. MSTIC tracks a large cluster of cybercriminal activity involving Cobalt Strike infrastructure under the name DEV-0365. Attack chain of DEV-0413 campaign that used CVE-2021-40444 DEV-0413 observed exploiting CVE-2021-40444ДЄs part of MicrosoftвЂ™s ongoing commitment to tracking both nation state and cybercriminal threat actors, we refer to the unidentified threat actor as a вЂњdevelopment groupвЂќ and utilize a threat actor naming structure with a prefix of вЂњDEVвЂќ to indicate an emerging threat group or unique activity during the tracking and investigation phases before MSTIC reaches high confidence about the origin or identity of the actor behind an operation. However, in this instance, when opened without a mark of the web present, the documentвЂ™s payload executed immediately without user interaction вЂ“ indicating the abuse of a vulnerability.ДЇigure 2.

This invokes Protected Mode in Microsoft Office, requiring user interaction to disable it to run content such as macros.

HOW TO DETECT COBALT STRIKE BEACON WINDOWS

The original exploit vector: an externally targeted oleObject relationship definition bearing an MHTML handler prefix pointed at an HTML file hosted on infrastructure that has similar qualities to the Cobalt Strike Beacon infrastructure that the loaderвЂ™s payload communicates with.Д¬ontent that is downloaded from an external source is tagged by the Windows operating system with a mark of the web, indicating it was downloaded from a potentially untrusted source. The DLL retrieves remotely hosted shellcode (in this instance, a custom Cobalt Strike Beacon loader) and loads it into wabmig.exe (Microsoft address import tool.)ДЇigure 1.

HOW TO DETECT COBALT STRIKE BEACON DOWNLOAD

The exploit document used an external oleObject relationship to embed exploitative JavaScript within MIME HTML remotely hosted content that results in (1) the download of a CAB file containing a DLL bearing an INF file extension, (2) decompression of that CAB file, and (3) execution of a function within that DLL. The initial campaigns in August 2021 likely originated from emails impersonating contracts and legal agreements, where the documents themselves were hosted on file-sharing sites.

Our colleagues at RiskIQ conducted their own analysis and coordinated with Microsoft in publishing this research. This blog details our in-depth analysis of the attacks that used the CVE-2021-40444, provides detection details and investigation guidance for Microsoft 365 Defender customers, and lists mitigation steps for hardening networks against this and similar attacks.

HOW TO DETECT COBALT STRIKE BEACON PATCH

Customers are advised to apply the security patch for CVE-2021-40444 to fully mitigate this vulnerability. This illustrates the importance of investing in attack surface reduction, credential hygiene, and lateral movement mitigations. While these attacks used a vulnerability to access entry point devices and run highly-privileged code, the secondary actions taken by the attackers still rely on stealing credentials and moving laterally to cause organization-wide impact. Customers who enabled attack surface reduction rules to block Office from creating child processes are not impacted by the exploitation technique used in these attacks. The observed attack vector relies on a malicious ActiveX control that could be loaded by the browser rendering engine using a malicious Office document. These loaders communicated with an infrastructure that Microsoft associates with multiple cybercriminal campaigns, including human-operated ransomware. These attacks used the vulnerability, tracked as CVE-2021-40444, as part of an initial access campaign that distributed custom Cobalt Strike Beacon loaders.

HOW TO DETECT COBALT STRIKE BEACON CODE

In August, Microsoft Threat Intelligence Center (MSTIC) identified a small number of attacks (less than 10) that attempted to exploit a remote code execution vulnerability in MSHTML using specially crafted Microsoft Office documents.

SSO solution: Secure app access with single sign-on.

Identity & access management Identity & access management.

App & email security App & email security.

How to detect cobalt strike beacon