Thursday, September 7, 2017
New IIS functionality to help identify weak TLS usage
This post is authored by Andrew Marshall, Principal Security Program Manager, TwC Security, Yanbing Shi, Software Engineer, Internet Information Services Team, and Sourabh Shirhatti, Program Manager, Internet Information Services Team.
As a follow-up to our announcement regarding TLS 1.2 support at Microsoft, we are announcing new functionality in Windows Server 2012R2 and Windows Server 2016 to increase your awareness of clients connecting to your services with weak security protocols or cipher suites.
IIS logs can already be used to correlate client IP address, user agent string, and service URI. With the addition of the new custom logging fields detailed below, you will be able to quantify the usage of outdated security protocols and ciphers by clients connecting to your services.
To enable this new functionality, these four server variables need to be configured as the sources of the custom fields in IIS applicationHost.config. The custom logging can be configured on either server level or site level. Here is a sample site-level configuration:
<site name="Default Web Site" id="1" serverAutoStart="true"> <application path="/"> <virtualDirectory path="/" physicalPath="C:\inetpub\wwwroot" /> </application> <bindings> <binding protocol="https" bindingInformation="*:443:" /> </bindings> <logFile> <customFields> <clear /> <add logFieldName="crypt-protocol" sourceName="CRYPT_PROTOCOL" sourceType="ServerVariable" /> <add logFieldName="crypt-cipher" sourceName="CRYPT_CIPHER_ALG_ID" sourceType="ServerVariable" /> <add logFieldName="crypt-hash" sourceName="CRYPT_HASH_ALG_ID" sourceType="ServerVariable" /> <add logFieldName="crypt-keyexchange" sourceName="CRYPT_KEYEXCHANGE_ALG_ID" sourceType="ServerVariable" /> </customFields> </logFile> </site>
Each SSL info field is a hexadecimal number that maps to either a secure protocol version or cipher suite algorithm.
For an HTTP plain-text request, all four fields will be logged as ‘-‘.
A sample log and explanation of the new fields follows:
For more information visit Official Microsoft Documentation for Custom Logging Fields in IIS.
from Microsoft Secure Blog Staff
Wednesday, September 6, 2017
Interesting List of Windows Processes Killed by Malicious Software
Just a quick blog post about an interesting sample that I found today. Usually, modern pieces of malware implement anti-debugging and anti-VM techniques. They perform some checks against the target and when a positive result is found, they silently exit… Such checks might be testing the screen resolution, the activity of a connected user, the presence of files on the desktop, etc. But they also search for interesting processes that could reveal that they are being monitored or debugged. This is achieved via the GetProcessesByName system call. Example:
processName = "tool_executed_by_analyst"
processList = Process.GetProcessesByName(processName)
If processList.Count > 0 Then
' Process is running, exit silently...
Else
' Process is not running, do our malicious stuff...
End If
This time, the sample did not search for running processes. Instead is a stealthy exit, it just executed a long list of taskkill.exe commands with process names like this:
taskkill.exe /IM <string> /T /F
“/IM” refers to the process image name, “/T” means to terminate all child processes and “/F” means to kill the process forcefully. This is a quite agressive technique!
Some processes are well-known, others were more exotic. Here is the full list:
avpmapp.exe econceal.exe escanmon.exe escanpro.exe TRAYSSER.EXE TRAYICOS.EXE econser.exe VIEWTCP.EXE FSHDLL64.exe fsgk32.exe fshoster32.exe FSMA32.EXE fsorsp.exe fssm32.exe FSM32.EXE trigger.exe FProtTray.exe FPWin.exe FPAVServer.exe AVK.exe GdBgInx64.exe AVKProxy.exe GDScan.exe AVKWCtlx64.exe AVKService.exe AVKTray.exe GDKBFltExe32.exe GDSC.exe virusutilities.exe guardxservice.exe guardxkickoff_x64.exe iptray.exe freshclam.exe freshclamwrap.exe K7RTScan.exe K7FWSrvc.exe K7PSSrvc.exe K7EmlPxy.EXE K7TSecurity.exe K7AVScan.exe K7CrvSvc.exe K7SysMon.Exe K7TSMain.exe K7TSMngr.exe nanosvc.exe nanoav.exe nnf.exe nvcsvc.exe nbrowser.exe nseupdatesvc.exe nfservice.exe cmd.exetaskkill/IMnwscmon.exe njeeves2.exe nvcod.exe nvoy.exe zlhh.exe Zlh.exe nprosec.exe Zanda.exe NS.exe acs.exe op_mon.exe PSANHost.exe PSUAMain.exe PSUAService.exe AgentSvc.exe BDSSVC.EXE EMLPROXY.EXE OPSSVC.EXE ONLINENT.EXE QUHLPSVC.EXE SAPISSVC.EXE SCANNER.EXE SCANWSCS.EXE scproxysrv.exe ScSecSvc.exe SUPERAntiSpyware.exe SASCore64.exe SSUpdate64.exe SUPERDelete.exe SASTask.exe K7RTScan.exe K7FWSrvc.exe K7PSSrvc.exe K7EmlPxy.EXE K7TSecurity.exe K7AVScan.exe K7CrvSvc.exe K7SysMon.Exe K7TSMain.exe K7TSMngr.exe uiWinMgr.exe uiWatchDog.exe uiSeAgnt.exe PtWatchDog.exe PtSvcHost.exe PtSessionAgent.exe coreFrameworkHost.exe coreServiceShell.exe uiUpdateTray.exe VIPREUI.exe SBAMSvc.exe SBAMTray.exe SBPIMSvc.exe bavhm.exe BavSvc.exe BavTray.exe Bav.exe BavWebClient.exe BavUpdater.exe MCShieldCCC.exe MCShieldRTM.exe MCShieldDS.exe MCS-Uninstall.exe SDScan.exe SDFSSvc.exe SDWelcome.exe SDTray.exe UnThreat.exe utsvc.exe FortiClient.exe fcappdb.exe FCDBlog.exe FCHelper64.exe fmon.exe FortiESNAC.exe FortiProxy.exe FortiSSLVPNdaemon.exe FortiTray.exe FortiFW.exe FortiClient_Diagnostic_Tool.exe av_task.exe CertReg.exe FilMsg.exe FilUp.exe filwscc.exe filwscc.exe psview.exe quamgr.exe quamgr.exe schmgr.exe schmgr.exe twsscan.exe twssrv.exe UserReg.exe
[The post Interesting List of Windows Processes Killed by Malicious Software has been first published on /dev/random]
from Xavier
"Build a Security Awareness Escape Room - At the EU #SecAwareSummit"
from lspitzner
"OUCH! Newsletter is Out - Password Managers"
from lspitzner
Tuesday, September 5, 2017
"Leverage SANS Expertise: Enhanced Phishing Training Available"
from SANS SA
Sunday, September 3, 2017
[SANS ISC] AutoIT based malware back in the wild
I published the following diary on isc.sans.org: “AutoIT based malware back in the wild“.
One week ago I wrote a diary with an analysis of a malicious RAR archive that contained an AutoIT script. The technique was not new but I was curious to see if this was a one-shot or not. To search for juicy samples, VirusTotal Intelligence or “VTI” is a nice source. Thanks to the “Retro Hunt” feature, it is possible to search for specific samples that were submitted. The search conditions are based on YARA rules… [Read more]
[The post [SANS ISC] AutoIT based malware back in the wild has been first published on /dev/random]
from Xavier