CISA Shares Lessons Learned from an Incident Response Engagement

MITRE Techniques

• [T1595.002 ] Active Scanning: Vulnerability Scanning – The actors identified CVE-2024-36401 using Burp Suite/Burp Scanner and Burp Collaborator; quote: ‘…observed domains linked to Burp Collaborator…originating from the same IP address the cyber threat actors later used to exploit the GeoServer vulnerability…’
• [T1583.003 ] Acquire Infrastructure: Virtual Private Server – Actors used a commercially available VPS from a cloud provider to gain remote access and conduct operations; quote: ‘…leveraged a commercially available virtual private server (VPS) from a cloud infrastructure provider…’
• [T1190 ] Exploit Public-Facing Application – Actors exploited CVE-2024-36401 on two GeoServer instances to achieve RCE via eval injection; quote: ‘…exploited CVE 2024-36401…to gain RCE by performing “eval injection”…’
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – PowerShell was used to download payloads; quote: ‘…used PowerShell to download a payload.’
• [T1202 ] Indirect Command Execution – Actors executed commands indirectly via .php web shells and xp_cmdshell to evade detection; quote: ‘…employed indirect command execution via .php web shells and xp_cmdshell…’
• [T1197 ] BITS Jobs – Actors abused Background Intelligence Transfer Service jobs for defense evasion and file transfer; quote: ‘…abused Background Intelligence Transfer Service (BITS) jobs…’
• [T1053.003 ] Scheduled Task/Job: Cron – Cron jobs were used to establish persistence on compromised hosts; quote: ‘…cron jobs (scheduled commands that run automatically at specified times)…’
• [T1505.003 ] Server Software Component: Web Shell – Web shells (China Chopper and generic PHP shells) were uploaded to internet-facing hosts for persistence and command execution; quote: ‘…uploaded web shells such as China Chopper…’
• [T1078 ] Valid Accounts – Threat actors used valid accounts and created accounts (later deleted) to maintain persistence; quote: ‘…used valid accounts for persistence…’
• [T1068 ] Exploitation for Privilege Escalation – Actors attempted to use the dirtycow public exploit (CVE-2016-5195) to escalate privileges; quote: ‘…attempted to escalate privileges with the publicly available dirtycow tool…’
• [T1110 ] Brute Force – Brute force techniques were used to obtain passwords for lateral movement and privilege escalation; quote: ‘…primarily relied on brute force techniques to obtain passwords…’
• [T1087.001 ] Account Discovery: Local Account – Actors used commands like cat /etc/passwd to discover local users; quote: ‘…used cat /etc/passwd…’
• [T1083 ] File and Directory Discovery – Actors used directory and file listing commands (dir, type) on the SQL server to enumerate files and directories; quote: ‘…used dir c:, dir d:, dir e:, and type c: commands…’
• [T1046 ] Network Service Discovery – fscan was used to identify SSH listeners, FTP servers, and other services for lateral movement; quote: ‘…used fscan to identify SSH listeners and FTP servers.’
• [T1057 ] Process Discovery – Actors ran tasklist on the SQL server to enumerate running processes; quote: ‘…used tasklist on the SQL server.’
• [T1018 ] Remote System Discovery – Actors performed ping sweeps of hosts within specific subnets to find reachable systems; quote: ‘…performed ping sweeps of hosts within specific subnets.’
• [T1082 ] System Information Discovery – Commands like cat /etc/redhat-release and cat /etc/os-release were used to collect OS information; quote: ‘…used cat /etc/redhat-release and cat /etc/os-release…’
• [T1016 ] System Network Configuration Discovery – ipconfig was executed to check network configuration on compromised hosts; quote: ‘…used ipconfig to check GeoServer 1’s and the SQL server’s network configurations.’
• [T1049 ] System Network Connections Discovery – netstat and netstat -ano were used to list network connections for discovery; quote: ‘…executed commands such as netstat to obtain a listing of network connections…’
• [T1033 ] System Owner/User Discovery – whoami was used on the SQL server to determine the current user context; quote: ‘…used whoami on the SQL server.’
• [T1105 ] Ingress Tool Transfer – PowerShell and bitsadmin getfile were used to download payloads and tools to compromised hosts; quote: ‘…used PowerShell and bitsadmin getfile to download payloads.’
• [T1090 ] Proxy – The Stowaway multi-level proxy was used to establish C2 and forward traffic through the web server to access internal resources; quote: ‘…used Stowaway…to establish C2…forwarding traffic from their C2 server through the Web Server.’