Threat-hunting activity builds on VirusTotal Intelligence to track LOLBAS-based behavior and related sample sets from October–November 2023, tying observed techniques to groups like APT33 and The Gorgon Group. The post highlights Start-BitsTransfer, WMI Event Subscription, and PowerShell-based in-memory payloads (including Cobalt Strike and Metasploit) as key attack vectors across actors such as APT37 and Konni. #LOLBAS #StartBitsTransfer #WMI #PowerShell #CobaltStrike #Metasploit #APT33 #TheGorgonGroup #APT37 #Konni
Keypoints
- LOLBAS (Living Off The Land Binaries) are increasingly used by attackers to gain footholds and proceed with further actions.
- Start-BitsTransfer is shown as an alternative to bitsadmin.exe for downloading payloads, including reconstruction via Base64-encoded data.
- WMI Event Subscriptions are leveraged for execution and persistence during lateral movement.
- PowerShell capabilities are used to inject payloads (e.g., Cobalt Strike) into memory, sometimes via obfuscated or encoded commands.
- VirusTotal Intelligence queries and Sigma rules can detect these patterns and be translated into Livehunt/YARA rules for automation.
- Observed links span multiple threat groups (e.g., APT33, The Gorgon Group, APT37, Konni), illustrating cross-group usage of these techniques.
MITRE Techniques
- [T1105] Ingress Tool Transfer – Start-BitsTransfer is used to download payloads. “Start-BitsTransfer is a cmdlet that supports the download of multiple files, which seems to be an alternative for adversaries to the most commonly used bitsadmin.exe binary.”
- [T1047] Windows Management Instrumentation – WMI event subscriptions are used for execution and persistence. “This technique is used by threat actors during lateral movement mainly for execution and persistence. To achieve this the WMI event subscription points to the payload to execute.”
- [T1059.001] PowerShell – PowerShell is used to inject Cobalt Strike in binary form into memory. “PowerShell is one of the most used scripting languages by attackers. In particular, the following code injects Cobalt Strike in binary form into memory.”
- [T1055] Process Injection – Payload is loaded in memory (injection into memory). “injects in memory the payload in binary form into memory.”
- [T1027] Obfuscated/Compressed Files and Information – Data is decoded and decompressed from Base64 to reconstruct payload. “FromBase64String” and “Decompress” are used to reconstruct the payload.
- [T1059.003] Windows Command Shell – Cmd.exe is used to launch PowerShell with hidden and minimized windows. “cmd.exe /b /c start /b /min PowerShell.exe …”
Indicators of Compromise
- [Domain] security.lomiasecure[.]net – used as a download source in Start-BitsTransfer examples
- [File name] node.txt, node.exe – payload components reconstructed from Base64 data
- [File name] GoogleUpdate.exe – observed in WMI-based delivery/persistence context
- [File path] C:UsersPublicnode.txt – destination for downloaded payload
- and 2 more hashes
Read more: https://blog.virustotal.com/2023/11/actionable-threat-intel-vi-day-in.html