Understanding Post-Breach Attack Strategies
Most IT professionals focus on preventing attackers from gaining initial access to their systems. However, a recent incident investigated by Huntress Labs highlights the importance of understanding what attackers do once they're already inside.
After gaining access, attackers don't immediately start stealing data or dropping ransomware. Instead, they take time to settle in, creating backdoors, covering their tracks, and disabling security tools meant to catch them.
Initial Access and Reconnaissance
Huntress' security team first noticed suspicious activity tied to a Microsoft SQL Server process. Further investigation revealed that the attacker hadn't directly targeted the database. Instead, they found a webpage on the same server with a SQL injection vulnerability, which allowed the attacker to access the underlying Windows machine.
SQL injection remains one of the most common and preventable web application vulnerabilities. It occurs when a website passes user input directly to a database without proper validation.
Building a Foothold and Disabling Defenses
Once inside, the attacker ran a built-in Windows command to list running services, a common reconnaissance step. They then sent the results to a server they controlled, likely for later review or automated tooling.
The attacker then enabled Remote Desktop access, created a new user account, and added it to the local Administrators group. They logged in through Remote Desktop using the new account and disabled Windows Defender, but left other security monitoring tools untouched.
Installing Malicious Add-ons and Mining Cryptocurrency
The attacker installed malicious add-ons for the Internet Information Services (IIS) web server software, part of the BadIIS malware family. This allowed them to hijack legitimate website traffic for search-engine fraud and other malicious activities.
They also dropped a cryptocurrency mining program onto the machine, disguising the mining program's files and setting it up to run as a Windows service. The attacker used PowerShell scripts to bring in additional malicious tools and evade detection.
Lessons for Defenders
The incident highlights the importance of having a solid plan for locking down systems and watching for suspicious activity. Attackers who gain access can reshape the environment to suit their goals, often beyond just disabling antivirus and dropping malware.
The biggest lesson is that finding and fixing the entry point matters as much as cleaning up the mess left behind. In this case, the entry point was an unvalidated input field on a web page. If the team had removed the attacker's tools and accounts but never fixed the underlying SQL injection flaw, the attacker could have simply walked back in through the same open door.
Practical Steps to Take
To improve defenses, it's essential to start with the basics: know what you have, and build an inventory of all physical and virtual systems, applications, and their versions. From there, shrink the attack surface by removing unnecessary services and applications, and lock down access with multi-factor authentication (MFA).
Keep everything updated and monitored, and investigate the root cause of incidents to strengthen defenses. Attackers count on defenders stopping at surface-level cleanup, but digging deeper keeps the home field advantage with the defenders.
Source: BleepingComputer