Windows Defender Advanced Threat Protection (Windows Defender ATP) is a post-breach solution that alerts security operations (SecOps) personnel about hostile activity. As the nature of attacks evolve, Windows Defender ATP must advance so that it continues to help SecOps personnel uncover and address the attacks.
With increasing security investments from Microsoft—read how Windows 10 continues to raise the bar against a spectrum of attacks—and other vendors, the cost and complexity of delivering successful exploits has swelled. For example, the trend towards virtualization-based security is forcing attacks to incorporate at least two exploits: one to compromise the sandboxed application and another to break out of the sandbox. We are now seeing exploit developers charge as high as hundreds of thousands of dollars for remote code execution and kernel exploits, pricing out some attackers from the market.
Unfortunately, advanced and apex attackers (see Figure 1) can still afford to develop or purchase zero-day exploits. To protect their investments, these attackers put more emphasis in evading detection. They rely heavily on in-memory attacks and kernel privilege escalation to avoid touching the disk and remain extremely stealthy.
This blog post kicks off a three-part series showcasing the investments made by Microsoft to enhance instrumentation and detection of in-memory techniques. The series covers detection improvements for cross-process code injection, kernel escalation and tampering, and in-memory exploitation. In this first post, we focus on cross-process injection and illustrate how enhancements that will be available in the Creators Update for Windows Defender ATP detect a broad set of attack activity: from commodity malware that attempt to hide from plain view to sophisticated activity groups that engage in targeted attacks.
To test how Windows Defender ATP can help your organization detect, investigate, and respond to advanced attacks, sign up for a free trial.
Read these related blog posts: Detecting reflective DLL loading with Windows Defender ATP, Detecting stealthier cross-process injection techniques with Windows Defender ATP: Process hollowing and atom bombing.
Cross-process injection can be used to provide an attacker more visibility into normal processes. For example, injected code can record keystrokes sent to an affected process. At the same time, this method hides malicious code and enables process migration, which can be used for organizational persistence.
Cross-process injection is inherently stealthy because it conceals malicious code inside benign processes. Even when a process has been injected with malicious code, its loaded images (the executable and library files associated with the process) continue to point to legitimate files on disk as shown in Figure 2. This shows a clear advantage over running malicious code in its own process space, which necessitates that the code reside on disk as an image file that is subject to inspection by antimalware and is easily recovered as forensic evidence.
By enabling process migration, cross-process injection allows attacks to stay active. In a drive-by-download attack, for instance, an attacker can gain control of the browser process and disable its sandbox. To execute malicious code beyond the lifecycle of the browser, which may terminate at any time, the attacker migrates the malicious code to a long-lived process, such as winlogon.exe, using cross-process injection. The risk of a user powering down the machine and erasing the malware remains, but an apex attacker overcomes this by staying active on multiple devices on the enterprise network. If one device is indeed restarted and the malicious code erased, the attacker can easily move laterally back to that device.
Cross-process injection is basically a two-fold process.
First, malicious code is placed into a new or existing executable page within a remote process. Attackers typically use the Win32 APIs VirtualAllocEx and CreateFileMapping/MapViewOfSection to allocate new executable pages. They then use VirtualProtectEx to turn existing pages into executable and writeable pages.
Next, the injected malicious code is executed through control of the thread and execution context. In many notable cases, attackers use the API CreateRemoteThread to create a new thread in a remote process. They then use APIs SetThreadContext and QueueUserAPC to redirect the existing thread to an arbitrary address.
While there are legitimate uses for the aforementioned APIs—they are used for debugging, diagnostics, management, and security—particular combinations of process names and execution behaviors often indicate malicious activity. For the technically inclined, techniques such as process hollowing (described by Tan Chew Keong in his paper “Dynamic Forking of Win32 EXE”) and AtomBombing are good examples of these malicious combinations.
In Creators Update for Windows Defender ATP, we have instrumented related function calls and built statistical models to detect a broad range of malicious injection techniques used in the wild. To determine how these enhancements effectively uncover hostile activities that leverage cross-process injection, we tested the enhancements against the following real-world cases: a targeted attack, a remote access tool (RAT), and cryptocurrency mining malware.
GOLD is an activity group that primarily seeks out intellectual property and other valuable digital assets. This activity group has an interesting way of obtaining a foothold in enterprise networks. Instead of actively pursuing targets through spear-phishing, GOLD uses established distribution sites for license-key generators (keygens) to infect a wide array of victims—all users who download and execute keygens from the distribution sites. The group then assesses each of the victims and aggressively pursues those in certain industries.
As a user launches a keygen package downloaded from the website operated by GOLD, the package drops two executables: the actual keygen and the Gatak malware implant. Gatak proceeds to inject itself into one of the many legitimate system processes using the CreateRemoteThread API. The sample we tested launches the rundll32.exe process, allocates memory in the process, writes malicious code to that location, and executes the malicious code using CreateRemoteThread calls. Upon successful injection, Gatak removes itself from disk, going fileless. Meanwhile, code injected in the rundll32.exe process communicates with command-and-control (C&C) servers, giving GOLD attackers control over the infected device.
With Creators Update, Windows Defender ATP will uncover breaches involving Gatak by detecting its cross-process injection technique, among other detection mechanisms it can use. Figure 3 shows the alert on the Windows Defender ATP Creators Update portal.
The second piece of malicious activity we used to test our new detections for cross-process injection is a variant of the Fynloski remote access tool (RAT). This RAT was freely available until 2012 and is still in use today in multiple attack campaigns. It provides a broad set of functionality, including capturing screenshots, exfiltrating files, and recording keystrokes. It is distributed by different vectors, including spear-phishing, downloaders, and exploit kits.
Instead of using the more common CreateRemoteThread cross-process injection technique described in preceding sections, Fynloski leverages the QueueUserAPC API to hide its presence. QueueUserAPC is a function for requesting the execution of procedures asynchronously. Attackers can use QueueUserAPC to inject arbitrary code cross-process by provisioning malicious code in the target process and pointing QueueUserAPC to execute this code.
With Creators Updates, Windows Defender ATP will detect these API calls and display an alert with a corresponding timeline that outlines this behavior as shown in Figure 4.
Commodity malware uses cross-process injection techniques for the same reason attackers use them in targeted attacks—they want to remain hidden long enough to accomplish their objectives.
In this article, we dissect the CoinMiner malware, which steals computing resources to mine cryptographic currencies such as Bitcoins. It uses SetThreadContext API for cross-process injection, copying malicious code into allocated executable memory similar to the CreateRemoteThread technique. To execute the malicious code, it first obtains a list of existing threads from the target process using CreateToolhelp32Snapshot API. It then modifies the control registers of a thread to point to the memory address of the injected malicious code using the SetThreadContext API.
Our sample of CoinMiner launches notepad.exe and injects its mining code into that process. Subsequently, the affected notepad.exe process connects to the Monero Mining Pool (xmr[.]crypto-pool[.]fr) to submit mined cryptocurrency. Windows Defender ATP, as shown in Figure 5, will detect the injection technique and provide important context, such as the connection to the mining pool, to help SecOps personnel understand and address the infection.
Like other in-memory techniques, cross-process injection can evade antimalware and other security solutions that focus on inspecting files on disk. With Creators Update, Windows Defender ATP will provide SecOps personnel with additional capabilities to uncover malicious activities leveraging cross-process injection. By leveraging statistical models and analyzing large data sets in the cloud, these enhancements cover code injection techniques used in a variety of attacks, including commodity malware infections and sophisticated breaches.
Windows Defender ATP also provides detailed event timelines as well as other contextual information that SecOps personnel can use to quickly understand the nature of attacks and take response actions.
For more information about Windows Defender ATP, check out its features and capabilities and read about why a post-breach detection approach is a key component of any enterprise security stack. Several features planned for release with Creators Update are currently available to all users as part of the public preview.
Windows Defender ATP is built into the core of Windows 10 Enterprise and can be evaluated free of charge.
Hashes
Infrastructure
Detecting reflective DLL loading with Windows Defender ATP
Questions, concerns, or insights on this story? Join discussions at the Microsoft community and Windows Defender Security Intelligence.
Follow us on Twitter @WDSecurity and Facebook Windows Defender Security Intelligence.
Kerberoasting, a well-known Active Directory (AD) attack vector, enables threat actors to steal credentials and navigate through devices and networks. Microsoft is sharing recommended actions administrators can take now to help prevent successful Kerberoasting cyberattacks.
Microsoft researchers found multiple vulnerabilities in OpenVPN that could lead to an attack chain allowing remote code execution and local privilege escalation. This attack chain could enable attackers to gain full control over targeted endpoints, potentially resulting in data breaches, system compromise, and unauthorized access to sensitive information.
Today, ahead of the Microsoft Build 2024 conference, we announced a new class of Windows computers, Copilot+ PC. Alongside this exciting new class of computers, we are introducing important security features and updates that make Windows 11 more secure for users and organizations, and give developers the tools to prioritize security.
Discover how to fortify your organization's cybersecurity defense with this practical guide on digital forensics from Microsoft's Incident Response team.
