You are working in a newly established SOC where there is still a lot of work to do to make it fully functional. As part of gathering intel you were assigned a task to study a threat report released in 2022 and suggest some useful outcomes for your SOC.
The report in question is the Red Canary 2022 Threat Detection Report, based on analysis of over 30,000 confirmed threats detected across customer environments throughout 2021.
The report covers Log4j under the Supply Chain Compromises trend section. Log4j is a popular Java logging library that was hit with a remote code execution vulnerability in December 2021. Initial exploitation was primarily coinminers and botnets, with internet-facing VMware Horizon servers becoming a key target.
From the Top Techniques table on page 73, T1059: Command and Scripting Interpreter topped the list at 53.4% of customers affected, with PowerShell (T1059.001) and Windows Command Shell (T1059.003) as the dominant sub-techniques.
The Vulnerabilities trend section covers two major Exchange Server vulnerability chains:
Both resulted in web shell deployment and in some cases ransomware.
This refers to PrintNightmare, which abuses the Print Spooler service. The vulnerability allows an adversary to connect to a remote host without authentication, cause it to load a malicious DLL, and gain SYSTEM-level code execution via the print spooler service (running as SYSTEM).
From the User-Initiated Initial Access and individual threat sections:
From the SocGholish and Gootkit detection sections, the detection analytic for JavaScript execution identifies:
process == wscript.exe
&&
command_line_includes (.zip && .js)
The Windows Script Host (wscript.exe) is the parent process responsible for executing the malicious JavaScript files.
From the Ransomware affiliate model table, three malware families are listed as precursors leading to Conti:
| Malware Family | Ransomware Group |
|---|---|
| Qbot | Conti |
| Bazar | Conti |
| IcedID | Conti |
From the Linux Coinminers trend section, the Take Action box specifically calls out patch management and names two outdated applications frequently exploited by coinminers:
“Many of the coinminers we saw exploited flaws in outdated applications like JBoss and WebLogic”
From the Ransomware > Beyond Encryption section, an adversary known as Fancy Lazarus (no affiliation with Fancy Bear or Lazarus Group) extorted victims by threatening to conduct a DDoS attack if they didn’t pay.
From the Ransomware Take Action section, internet-facing RDP connections without multi-factor authentication are explicitly called out as a common ransomware vector, making MFA for any accounts that can log in via RDP a high priority.
Source: Red Canary 2022 Threat Detection Report