Digital Deception: The LESLIELOADER Campaign's Mastery of Malware Misdirection

Indicators of Compromise

Notes

<div><b>CONCLUSION</b></div><div>The discovery of LESLIELOADER, inextricably linked to the SPARKRAT malware, underlines a salient fact in the field of cyber security: the threat landscape is in a state of rapid evolution. This evolution is a testament to the relentless creativity of cyber attackers in their quest to breach digital security measures. LESLIELOADER's advanced capabilities, which enable it to bypass defences and sneakily infiltrate legitimate system processes, point to a significant intensification in cyber warfare strategies. This underscores the imperative for cyber security experts to continuously improve detection and defence mechanisms. It is clear that countering such volatile threats requires not only vigilance, but also a proactive and collaborative approach to sharing insights and strengthening defences within the cyber security community.</div><div><br></div>

Mitigation

<div><b>MITIGATIONS</b></div><div><b><br></b></div><div>Below are some of the methods used by threat actors within this campaign.<br></div><div><b><br></b></div><div><b>Ingress Tool Transfer</b></div><div>Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).</div><div><br></div><div>On Windows, adversaries may use various utilities to download tools, such as copy, finger, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as curl, scp, sftp, tftp, rsync, finger, and wget.</div><div><br></div><div>Adversaries may also abuse installers and package managers, such as yum or winget, to download tools to victim hosts.</div><div><br></div><div>Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.</div><div><br></div><div><h2 class="pt-3" id="mitigations" style="box-sizing: border-box; margin-top: 0px; margin-bottom: 0.5rem; line-height: 1.2; font-size: 2rem; font-family: Roboto-Light, sans-serif; color: rgb(57, 67, 76); letter-spacing: normal; padding-top: 1rem !important;">Mitigations</h2><div class="tables-mobile" style="box-sizing: border-box; overflow-y: auto; color: rgb(57, 67, 76); font-family: Roboto-Regular, sans-serif; font-size: 16px;"><table class="table table-bordered table-alternate mt-2" style="box-sizing: border-box; border-collapse: collapse; width: 1367.25px; margin-bottom: 1rem; color: rgb(33, 37, 41); border: 1px solid rgb(223, 223, 223); margin-top: 0.5rem !important; background-color: rgb(242, 242, 242) !important; empty-cells: hide;"><thead style="box-sizing: border-box;"><tr style="box-sizing: border-box;"><th style="box-sizing: border-box; text-align: inherit; padding: 0.6rem; vertical-align: bottom; border-width: 1px 1px 2px; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); border-image: initial; font-size: 0.9rem;">ID</th><th style="box-sizing: border-box; text-align: inherit; padding: 0.6rem; vertical-align: bottom; border-width: 1px 1px 2px; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); border-image: initial; font-size: 0.9rem;">Mitigation</th><th style="box-sizing: border-box; text-align: inherit; padding: 0.6rem; vertical-align: bottom; border-width: 1px 1px 2px; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); border-image: initial; font-size: 0.9rem;">Description</th></tr></thead><tbody style="box-sizing: border-box; background: white; color: rgb(57, 67, 76);"><tr style="box-sizing: border-box;"><td style="box-sizing: border-box; padding: 0.75rem; vertical-align: top; border: 1px solid rgb(223, 223, 223);"><a href="https://attack.mitre.org/mitigations/M1031" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">M1031</a></td><td style="box-sizing: border-box; padding: 0.75rem; vertical-align: top; border: 1px solid rgb(223, 223, 223);"><a href="https://attack.mitre.org/mitigations/M1031" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Network Intrusion Prevention</a></td><td style="box-sizing: border-box; padding: 0.75rem; vertical-align: top; border: 1px solid rgb(223, 223, 223);"><p style="box-sizing: border-box; margin-bottom: 0px;">Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.<span id="scite-ref-510-a" class="scite-citeref-number" style="box-sizing: border-box;"><span style="box-sizing: border-box; position: relative; font-size: 12px; line-height: 0; vertical-align: baseline; top: -0.5em;"><a href="https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" target="_blank" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">[510]</a></span></span></p></td></tr></tbody></table></div><h2 class="pt-3" id="detection" style="box-sizing: border-box; margin-top: 0px; margin-bottom: 0.5rem; line-height: 1.2; font-size: 2rem; font-family: Roboto-Light, sans-serif; color: rgb(57, 67, 76); letter-spacing: normal; padding-top: 1rem !important;">Detection</h2><div class="tables-mobile" style="box-sizing: border-box; overflow-y: auto; color: rgb(57, 67, 76); font-family: Roboto-Regular, sans-serif; font-size: 16px;"><table class="table datasources-table table-bordered" style="box-sizing: border-box; border-collapse: collapse; width: 1367.25px; margin-bottom: 1rem; color: rgb(33, 37, 41); border: 1px solid rgb(223, 223, 223); empty-cells: hide;"><thead style="box-sizing: border-box;"><tr style="box-sizing: border-box; background: rgb(242, 242, 242); border-bottom: 1px solid rgb(223, 223, 223);"><th class="p-2" style="box-sizing: border-box; text-align: inherit; padding: 0.6rem; vertical-align: bottom; border-width: 1px 1px 2px; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); border-image: initial; font-size: 0.9rem;">ID</th><th class="p-2 nowrap" style="box-sizing: border-box; text-align: inherit; padding: 0.6rem; vertical-align: bottom; border-width: 1px 1px 2px; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); border-image: initial; font-size: 0.9rem;">Data Source</th><th class="p-2 nowrap" style="box-sizing: border-box; text-align: inherit; padding: 0.6rem; vertical-align: bottom; border-width: 1px 1px 2px; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); border-image: initial; font-size: 0.9rem;">Data Component</th><th class="p-2" style="box-sizing: border-box; text-align: inherit; padding: 0.6rem; vertical-align: bottom; border-width: 1px 1px 2px; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); border-image: initial; font-size: 0.9rem;">Detects</th></tr></thead><tbody style="box-sizing: border-box;"><tr class="datasource" id="uses-DS0017" style="box-sizing: border-box;"><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial;"><a href="https://attack.mitre.org/datasources/DS0017" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">DS0017</a></td><td class="nowrap" style="box-sizing: border-box; padding: 10px; vertical-align: top; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial;"><a href="https://attack.mitre.org/datasources/DS0017" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Command</a></td><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border: 1px solid rgb(223, 223, 223);"><a href="https://attack.mitre.org/datasources/DS0017/#Command%20Execution" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Command Execution</a></td><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border: 1px solid rgb(223, 223, 223);"><p style="box-sizing: border-box; margin-bottom: 0px;">Monitor executed commands and arguments for suspicious activity associated with downloading external content.</p></td></tr><tr class="datasource" id="uses-DS0022" style="box-sizing: border-box;"><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial;"><a href="https://attack.mitre.org/datasources/DS0022" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">DS0022</a></td><td class="nowrap" style="box-sizing: border-box; padding: 10px; vertical-align: top; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial;"><a href="https://attack.mitre.org/datasources/DS0022" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">File</a></td><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border: 1px solid rgb(223, 223, 223);"><a href="https://attack.mitre.org/datasources/DS0022/#File%20Creation" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">File Creation</a></td><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border: 1px solid rgb(223, 223, 223);"><p style="box-sizing: border-box; margin-bottom: 0px;">Monitor for file creation and files transferred into the network</p></td></tr><tr class="datasource" id="uses-DS0029" style="box-sizing: border-box;"><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial;"><a href="https://attack.mitre.org/datasources/DS0029" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">DS0029</a></td><td class="nowrap" style="box-sizing: border-box; padding: 10px; vertical-align: top; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial;"><a href="https://attack.mitre.org/datasources/DS0029" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Network Traffic</a></td><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border: 1px solid rgb(223, 223, 223);"><a href="https://attack.mitre.org/datasources/DS0029/#Network%20Connection%20Creation" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Network Connection Creation</a></td><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border: 1px solid rgb(223, 223, 223);"><p style="box-sizing: border-box; margin-bottom: 0px;">Monitor for newly constructed network connections that are sent or received by untrusted hosts or creating files on-system may be suspicious. Use of utilities, such as FTP, that does not normally occur may also be suspicious.</p></td></tr><tr class="datacomponent datasource" id="uses-DS0029-Network Traffic Content" style="box-sizing: border-box; border-left: none;"><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex;"></td><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex;"></td><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border: 1px solid rgb(223, 223, 223);"><a href="https://attack.mitre.org/datasources/DS0029/#Network%20Traffic%20Content" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Network Traffic Content</a></td><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border: 1px solid rgb(223, 223, 223);"><p style="box-sizing: border-box; margin-bottom: 0px;">Monitor network traffic content for files and other potentially malicious content, especially data coming in from abnormal/unknown domain and IPs.</p></td></tr><tr class="datacomponent datasource" id="uses-DS0029-Network Traffic Flow" style="box-sizing: border-box; border-bottom: 1px solid rgb(223, 223, 223); border-left: none;"><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex;"></td><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex;"></td><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border: 1px solid rgb(223, 223, 223);"><a href="https://attack.mitre.org/datasources/DS0029/#Network%20Traffic%20Flow" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Network Traffic Flow</a></td><td style="box-sizing: border-box; padding: 10px; vertical-align: top; border: 1px solid rgb(223, 223, 223);"><p style="box-sizing: border-box; margin-bottom: 0px;">Monitor network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.</p></td></tr></tbody></table></div></div>