Will the Real Msiexec Please Stand Up? Exploit Leads to Data Exfiltration

MITRE Techniques

• [T1190] Exploit Public-Facing Application – The intrusion began with the exploitation of an internet-facing instance of ManageEngine SupportCenter Plus via CVE-2021-44077. “The intrusion began with the exploitation of an internet-facing instance of ManageEngine SupportCenter Plus via CVE-2021-44077…”
• [T1572] Protocol Tunneling – A batch script was used to facilitate RDP tunneling and Plink, creating an SSH tunnel for remote access. “a batch script is used to facilitate rdp tunneling including the use of Plink.”
• [T1012] Query Registry – The attacker queried the registry to check WDIGest status. “query registry checking to see if WDigest was enabled.”
• [T1003] OS Credential Dumping – The LSASS dump was performed to harvest credentials. “the threat actors performed an LSASS dump on the system… the plaintext credentials…”
• [T1087] Account Discovery – Enumeration included user/OS information and current user sessions. “Enumeration on the system included querying network configuration, a list of domain joined computers, user and OS information, and current user sessions…”
• [T1057] Process Discovery – Discovery activities included listing running processes. “current user sessions on the beachhead” and related process enumerations.
• [T1021.001] Remote Services: Remote Desktop Protocol – Lateral movement to three other servers via RDP. “From the beachhead, lateral movement was conducted to three other servers via RDP…”
• [T1059.001] Command and Scripting Interpreter: PowerShell – Web shell commands were executed via PowerShell. “The GET requests ran PowerShell commands…”
• [T1047] Windows Management Instrumentation – Involvement of WMIC/WMIC-like commands during recon and discovery. “WMIC computersystem get domain” appears in the discovery data.
• [T1070.004] File Deletion – The LSASS dump was deleted to hide traces. “deleted the dump file to hide their traces.”
• [T1078.002] Domain Account – Actions were conducted from the account whose password was extracted from LSASS. “rest of the actions were conducted from the account whose password was extracted from the LSASS dump.”
• [T1112] Modify Registry – WDIGest UseLogonCredential was enabled and later checked. “WDigest UseLogonCredential” and subsequent enablement.
• [T1036] Masquerading – msiexec.exe was uploaded as a dropper to blend in and exploit CVE-2021-44077. “an attacker uploaded a binary named msiexec.exe… not the legitimate Microsoft msiexec.exe, rather it is a dropper…”
• [T1505.003] Server Software Component: Web Shell – A web shell fm2.jsp provided remote control over the beachhead. “web shell dropped to the beachhead during the exploitation process was the only form of persistence observed…”