Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

4/28/2017
01:50 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Fileless Malware Attacks Continue to Gain Steam

Endpoint woes grow as fileless attacks grow in prevalence and file-based attacks remain largely undetected by AV engines.

New research shows that attackers are increasingly beating security detection at the gateway and on the endpoint by initiating attacks that don't drop malicious files at all, thus evading file-based detection. And even when they do use malicious files, once they get past the gateway filtering, the typical detection mechanisms aren't picking them up. 

The most recent study comes by way of SentinelOne, which published its Enterprise Risk Index today. This report examines attacks that made it past the gateway and onto endpoints. One of the most damning statistics from the study is the fact that once file-based malware has been filtered by the gateway, it's largely undetectable by AV. 

"One of the more interesting findings from this study is how few pieces of malware actually have signatures within AV engines. Our research team found that only half of file-based attacks had been submitted to malware repositories and, of those, only 20 percent made it to AV engines," says Jeremiah Grossman, chief of security strategy at SentinelOne. "This is yet another data point illustrating how incredibly quickly malware evolves and the impossibility for any signature-based AV solution to keep up."

It's startling considering how many of today's enterprise compromises start at the endpoint and traditional endpoint protections can't even keep up with the file-based malware attacks we've seen for years now. And now the landscape is getting even more complicated, as file-less malware attacks start to rise in prominence. File-less malware attacks evade detection by avoiding the drop of malicious files in favor of methods such as storing information in system memory, leveraging PowerShell or Windows registry, or using malicious macros.

According to SentinelOne's risk index, nearly two in 10 attacks that reach the endpoint start as in-memory attacks that are virtually undetectable to AV systems, no matter how quickly they update signatures.

"In-memory attacks don’t leave detectable artifacts on the file system, and as such, modern anti-malware solutions must watch what processes are actually running, not just what is saved on the system," explains Grossman. "If enterprises don’t have solid protections in place to address in-memory attacks, they’ll get infected; it’s just that simple."

The four months' worth of data from last fall that was compiled for this report, the percentage of endpoint attacks instantiated as in-memory attacks doubled. Last month, Carbon Black released a study among security researchers that showed that close to two-thirds of them have seen an increase in non-malware attacks since the beginning of 2016. This figure includes not only in-memory attacks, but also PowerShell-based attacks, remote logins, WMI-based attacks, and macro attacks. 

[Check out "Rise of the Machines: How Machine Learning Can Improve Cyber Securityduring Interop ITX, May 15-19, at the MGM Grand in Las Vegas. To learn more about this presentation, other Interop security tracks, or to register click on the live links.]

Many organizations only look to identify threats at a single point in time – when a file is written to disk. Malicious files are only part of the problem.

"Cybercriminals are increasingly leveraging non-malware attacks because they provide the path of least resistance and are designed to evade traditional prevention approaches," says Mike Viscuso, co-founder and CTO of Carbon Black. "Once an attack has gained foothold on an enterprise, an attacker will move laterally leveraging existing tools on the operating system. For organizations not prepared to sniff out this kind of behavior, the attack will remain virtually invisible and cause a number of problems.” 

Viscuso says that practitioners need to have non-malware attacks on their radar because at this point, more than half of successful breaches come at the hands of these types of attacks. Anecdotal evidence continues to mount to support the worries of researchers like Grossman and Vicuso. For example, today security start-up Morphisec published details about a politically-motivated attack campaign against Israeli organizations that leans heavily on file-less attack techniques.

In this example, attackers compromised email accounts for high-profile individuals at Ben-Gurion University and sent malformed Word documents in reply to legitimate emails that were designed to take advantage of a Word vulnerability that was patched earlier this month. The documents weaponized with malicious macros installed a fileless variant of the Helminth Trojan agent.

"With many organizations taking high-risk vulnerabilities seriously and patching them as fast as possible, attackers can no longer exploit them," writes Michael Gorelik, vice president of research and development for Morphisec. "We therefore expect that the pendulum will swing back from vulnerability exploits to marco-based campaigns."

Related Content:

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
eaglei15
50%
50%
eaglei15,
User Rank: Strategist
5/4/2017 | 9:34:31 AM
Memory forensics
Checkout Cybeats https://www.cybeats.com that has the functionality of automatic memory forensics and the only solution that can identify threat unknown to traditional approaches.
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16649
PUBLISHED: 2019-09-21
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the...
CVE-2019-16650
PUBLISHED: 2019-09-21
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the se...
CVE-2019-15138
PUBLISHED: 2019-09-20
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
CVE-2019-6145
PUBLISHED: 2019-09-20
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs ...
CVE-2019-6649
PUBLISHED: 2019-09-20
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.