Finding the unknown unknowns, part 1

Tax season brings to mind two famous Donald Rumsfeld quotes — The first maligning IRS for an overly-complicated tax return process, but the second, and more relevant, about the fear of the “unknown unknowns” — things we do not know that we do not know.

If you were to ask a dozen SOC leaders “What does threat hunting mean to you?” you may get a dozen answers, but to us, a solid tenant of being able to detect “unknown unknowns” is being able to quickly detect and triage outliers across your detection stack. To some folks, imaging a world where they can detect a true needle in the haystack feels insurmountable, so throughout a series of blogs, we’ll propose concrete hunting techniques that will work to surface those interesting needles.

Below, we’ll highlight three pivots that we have used to uncover thousands of targeted threats inside hundreds of enterprise networks. This is not an exhaustive approach, does not require expensive whiz-bang tech, and will be not the last blog on this topic. This series of blogs is intended to demystify threat detection, and what will work equally well against red teams, targeted crimeware, or APT actors.

• Enterprises should be able to put eyeballs on each and every alert that contains a password protected object every single day. It’s highly unlikely you receive more than three alerts per day, and in the event one day you receive hundreds, they are likely all from the same scattershot spam-type campaign, and can be easily bucketed. The first step, of course, is being able to programmatically detect if your trusty vendor has found one of these threats.
• The world is a big place, and while you may be unlucky enough to be Aaron Aagaard working at AAA, you probably aren’t. If you are still one of the only people to see even a single fragment of a threat 24 hours later, it deserves an eyeball. Think initial dropped hash, delivery URL, c2 domain, etc.
• There is a small number of legitimate email deliverability monitoring tools. If an email contains a hidden mechanism to figure out if you opened the mail, that may deserve an eyeball, when combined with other indicators.

That being said, let’s highlight some examples of these techniques used in the wild to turn over interesting threats. These were found on VT but we run similar detections on our customer data.

---

Password-protected content

Enterprise tools rarely generate alerts for content that is password protected — think office docs, zip files, or rar archives. Take for example this password protected zip file targeting Israel, containing usage of Atera, legitimate IT management software. Although the password “123456” may not be complex, it shows an attacker with more than zero forethought crafted the email — this category of alert will show up no more than a couple times a day. There’s no substitute to a human eyeball giving a quick glance at a lure to improve the gut-tribution score. If an IT user is running an RDP-type tool, you’ll likely contextualize it, but in contrast, if a sales person is downloading VNC, you may have an issue

Figure 1: Israeli targets from a compromised IL sender

hash	filename	notes
8a2d14f60c0e69412856aa697706b9cbb8ceed524e4321c25332dad4618dff1e	digitalform.rar	pass protected ‘123456’
09e09503962a2a8022859e72b86ad8c69dcbf79839b71897c0bf8a4c4b9f4dd6	digitalform.msi	Atera dropper
a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2	AteraAgent.exe	“C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe” /i /IntegratorLogin=“ouamar.mounia[@]airalgerie.dz” /CompanyId=“1” /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId=“001Q3000009snPyIAI” /AgentId=“52e0fc3d-3662-47c2-a6da-c687c013c2d0”

Figure 2: payloads from Israeli phish

---

Frequency analysis to find outliers

When looking at true outliers, we want to very quickly be able to determine

• is this a false positive, as most outliers will be (your vendors may appreciate the QA!)
• is this a polymorphic threat that is defeating my “uniqueness” filters
• is this potentially targeted

Analyzing this email thread, one can tell right away that it is not a FP. The sender domain is clearly compromised to send the phish. Looking one layer deeper to understand whether it is polymorphic, you should first extract all URLs programmatically, and have a number of searches already executed. These enrichments should be cheap both computationally and time-wise.

Figure 3: An attacker leveraging a compromised site for hosting XSS->JS

URL	Why interesting?
http://kjghfkfgfdytku.infinityfreeapp[.]com/?usr=[removed]@ukr.net	Anytime there are zero google results for the base domain you should take note
https://gorod.dp[.]ua/eng/hotels/oneplace/image2.php?fotogal=1%22	Your eyes may notice an obvious XSS, but also consider that it is largely unnecessary. If you can get a victim to click on a link, and you aren’t trying to execute JS in a particular domain context, the only real reason is to leverage the reputation of the exploited domain. In this case, a Ukrainian hotel.
https://run.mocky[.]io/v3/da384ab3-f749-42d5-a076-40c248dece9b	If this were broadly distributed, you can expect dozens of scans/uploads on VT or Search - urlscan.io

Figure 4: Initial artifacts can be automatically extracted and enriched with public sources for frequency

The first url leverages a hidden image to track whether the email is opened, and by what type of client. This shady technique is rare but sadly not unheard of for mass mailers. Similarly, Meta recently noted noted an unrelated espionage actor that leveraged canary images inside word documents, to track where and if a benign document was opened. This tried and true technique is a worthwhile attribute to note, even if it requires a bit of manual tuning.
Examining a subset of other mocky-hosted JS, we can see related content, leveraging fingerprinting techniques from output from ipapi.co, used to detect details about the client. Although we shy away from leveraging other vendor names without confirmation, IBM recently put out a report that covers similar delivery from slices of this group, as did Proofpoint, Trend Micro, and TAG.

As a bonus for the first article in this series, we wanted to highlight how “decoy” content is an excellent indicator. More on this in part 2!

.bat file	windows update decoy

Figure 6: Decoy content – stick around for our next blog!

For an easier to parse list of indicators, please visit our GitHub page. Lastly, If you are a vendor, and wish to provide a statement of suspected attribution, please drop us a note, and we’ll add it for posterity.

Vendor	Threat Actor name
Proofpoint	TA422 (section 2 above)

Figure 7: Other validated vendor names for this actor

Acknowledgements

The authors would like to thank the reviewers, as well as peer vendors, for their comments and corrections. Specific thanks to Cybersixgill - Threat Intelligence Solutions | Cybersixgill for their assistance in reaching affected parties in Israel. Please get in touch at research@strikeready.com if you have corrections, or would like to collaborate on research.