{"id":30109,"date":"2020-07-07T06:00:34","date_gmt":"2020-07-07T12:00:34","guid":{"rendered":"https://www.webroot.com/blog/?p=30109"},"modified":"2020-09-21T13:45:24","modified_gmt":"2020-09-21T19:45:24","slug":"evasive-scripts-what-they-are-and-what-were-doing-about-them","status":"publish","type":"post","link":"https://www.webroot.com/blog/2020\/07\/07\/evasive-scripts-what-they-are-and-what-were-doing-about-them\/","title":{"rendered":"Evasive Scripts: What They Are, and What We\u2019re Doing About Them"},"content":{"rendered":"\n

\u201cWhat\u2019s an evasive attack? At a very basic level, it\u2019s exactly what it\nsounds like; it\u2019s a cyberattack that\u2019s designed to hide from you,\u201d says Grayson\nMilbourne, Security Intelligence Director at Webroot, an OpenText company.<\/p>\n\n\n\n

Based on Grayson\u2019s initial explanation, you can imagine\nthat evasive tactics are pretty common throughout cybercriminal activities. But\nthey\u2019re especially prevalent in the context of scripts. Scripts are pieces of\ncode that can automate processes on a computer system. They have tons of\nlegitimate uses, but, when used maliciously, they can be extremely effective\nand difficult to detect or block. <\/p>\n\n\n\n

With Grayson\u2019s\nhelp, we\u2019ll talk you through some of the common script evasion techniques that\ncriminals use.<\/p>\n\n\n\n

LolBins<\/h2>\n\n\n\n

Living off the\nLand Binaries (\u201cLoLBins\u201d) are\napplications that a Windows\u00ae system already has on it by default. Funny name\naside, they\u2019re extremely useful for attackers because they provide a way to\ncarry out common steps of an attack<\/a> without having to\ndownload anything new onto the target system. For example, criminals can use\nthem to create persistency (i.e. enable the infection to continue operating\nafter a reboot), spread throughout networked devices, bypass user access\ncontrols, and extracting passwords or other sensitive information.<\/p>\n\n\n\n

There are dozens of\nLoLBins<\/a> for criminals to choose from that are native to the Windows\nOS, such as powershell.exe, certutil.exe, regsr32.exe, and many more.\nAdditionally, there are a variety of common third party applications that are\npretty easy to exploit if present, such as java.exe, winword.exe, and\nexcel.exe.<\/p>\n\n\n\n

According to Grayson, this is one of the ways malicious hackers disguise their activities, because default OS applications are unlikely to be detected or blocked by an antimalware solution. He warns, \u201cunless you have strong visibility into the exact commands that these processes are executing, then it can be very hard to detect malicious behavior originating from LoLBins.<\/p>\n\n\n\n

Script Content Obfuscation <\/h2>\n\n\n\n

Like LoLBins and\nscripting overall, hiding the true content or behavior of a script\u2014or content \u201cobfuscation\u201d\u2014has completely\nlegitimate purposes. But, in terms of malicious hacking, it\u2019s pretty\nself-explanatory why obfuscation would lend itself to criminal activities. The\nwhole point is not to get caught, right? So it makes sense that you\u2019d take\nsteps to hide bad activities to avoid detection. The screenshots below show an\nexample of obfuscated code (top), with its de-obfuscated version (bottom). <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Fileless and\nEvasive Execution <\/h2>\n\n\n\n

Using scripts,\nit\u2019s actually possible to execute actions on a system without needing a file.\nBasically, a script can be written to allocate memory on the system, then write\nshellcode to that memory, then pass control to that memory. That means the\nmalicious functions are carried out in memory, without a file, which makes\ndetecting the origin of the infection (not to mention stopping it) extremely\ndifficult.<\/p>\n\n\n\n

Grayson explains,\n\u201cone of the issues with\nfileless execution is that, usually, the memory gets cleared when you reboot\nyour computer. That means a fileless infection\u2019s execution could be stopped\njust be restarting the system. Persistence after a reboot is pretty top-of-mind\nfor cybercriminals, and they\u2019re always working on new methods to do it.\u201d <\/p>\n\n\n\n

Staying\nProtected<\/h2>\n\n\n\n

The Windows\u00ae 10 operating system now includes Microsoft\u2019s Anti-Malware Scan\nInterface (AMSI) to help combat the growing use of malicious and obfuscated\nscripts. That means one of the first things you can do to help keep yourself\nsafe is to ensure any Windows devices you own are on the most up-to-date OS\nversion. <\/p>\n\n\n\n

Additionally, there are several other easy steps that can help ensure an effective and resilient cybersecurity strategy. <\/p>\n\n\n\n