Attackers Abuse Remote Desktop Protocol, Microsoft Binaries

Cyber defenders can better protect their organizations from hackers by keeping their eyes peeled for the unusual use of legitimate administrator tools as well as remote connectivity.

See Also: Combatting the Vulnerability Prioritization Challenge: A Guide to DVE Intelligence

A review by cybersecurity firm Sophos of 413 incidents it probed last year finds that network breaches figure in nearly half of incidents, followed by ransomware, which comprised 40% of incidents.

Whatever attackers’ intentions, keeping eyes peeled for unusual network activity is essential for blocking attackers who manage to break in. Key to that strategy is maintaining robust log data.

Sophos found logs weren’t available for 66% of cases investigated by its post-attack incident response team and 39% of cases flagged by its managed detection and response business. “The leading reason for missing logs in all cases was that they were simply unavailable (20%) to analysts during the investigation, followed by 17% of logs being cleared by the attackers and 7% missing due to insufficient retention periods,” it said.

For wiping logs, while attackers have a variety of tools and techniques at their disposal, one frequently deployed is the Windows Event Utility, webtutil.exe, which will generate Windows event log entries that can clue organizations into signs of attack. These trigger log IDs 1102 for security logs and 104 for system logs. “Organizations should consider configuring their security tools and threat hunts to detect this activity,” Sophos said.

Watching for signs of unusual activity is a top defensive tactic. That includes spotting hackers’ abuse of living-off-the-land binaries, aka LOLBins. These are tools that many organizations use for legitimate purposes. Many attackers hijack them for their own ends.

Using legitimate binaries helps attackers disguise their activity. “The main issue with LOLBins is they tend to generate a lot of noise,” Sophos said. “The challenge for IT teams is understanding where the signal exists.”

Investigators continue to find LOLBins tied to successful attacks. Cybersecurity firm Cisco Talos said that across its 2024 investigations, “LOLBins were the most prevalently used tools, enabling actors to blend in with normal traffic” (see: Hacker Tactics: Exploiting Edge Devices, Missing Multifactor).

Attackers’ most-used binaries, Cisco Talos found, included:

• PsExec: An official Microsoft tool – part of Sysinternals troubleshooting suite – that can execute processes on both local and remote systems. “Many ransomware operations use PsExec to run their payload on all systems in the domain,” Cisco Talos said.
• Impacket: Open source network auditing tool runs modules such as SecretsDump, designed to ransack Active Directory implementations for usernames and passwords.
• Mimikatz: Commercial red-team tool can dump credentials from a variety of sources, including from Windows Local Security Authority Subsystem Service, or LSASS, process memory, which stores user and domain admin credentials, as well as from registry hives and the data protection API – DPAPI – built into Windows operating systems.

Sophos likewise saw those tools being used in numerous attacks, as well as other such binaries as notepad.exe, cmd.exe, ping.exe and whoami.exe. Half of the top 20 most abused binaries were tools for enumerating enterprise networks, it said.

Another top tool is PowerShell. “We’re not going to suggest that IT teams stop using it, but there are some quick heuristics that can be applied using detection engineering,” Sophos said. “Was that PowerShell script heavily obfuscated, and did it reach out to the internet? If it did, it should probably be investigated.”

Lock Down RDP

Across all 2024 attacks it investigated, Sophos found the most-abused Microsoft tool to be Remote Desktop Protocol, which featured in 84% of the cases it investigated. In two-thirds of those cases, RDP was used by attackers solely for lateral movement inside a network.

For spotting malicious use of RDP, Sophos recommends taking a number of steps, including safeguarding all such connections using multifactor authentication – to make stolen credentials harder to use – as well as applying the principle of least privilege. “By constraining its use, and understanding what normal looks like, it becomes easier to detect anomalies,” it said.

When logging Windows events, successful authentication shows up with an event ID 4624, while a failed attempt has the event ID 4625. The former can be correlated with other attributes to help identify when attackers are using legitimate credentials, while the latter may reveal a brute-force attack.

Other data points for tripping alarms can include remote clients sporting an unusual time-zone bias, which gets set using Coordinated Universal Time. For example, a remote user based on the U.S. East Coast will likely have a UTC-5 offset, while a user based in Russia will have a UTC+3 offset.

Another flag can be a device with a non-standard corporate name attempting to create a remote connection. In 6% of cases investigated last year, Sophos found the hostname “kali” being used apparently after Kali Linux, the open source operating system that figures heavily in penetration testing and hacking.

Rapidly investigating signs of suspicious activity remains essential.

Attackers move faster than ever, with Sophos seeing their dwell time inside a network after breaking in averaging just two days. Median dwell time was seven days, or four days for ransomware and 11.5 days for all other types of attacks – reflecting how attackers may spend more time lurking on the network when they aren’t keen to unleash crypto-locking malware.

Sophos said it’s likely that dwell time can’t go lower. “Certain actions – for instance, exfiltrating the data – cannot go any faster, since they rely on human activity, data throughput or other fairly rigid time frames,” it said. “That’s not to say the attacks can’t be done faster, because they can, but the data shows that ransomware attacks have traditionally required longer timeframes than other attack types.”