Article Content Mandiant has observed APT29 using a stealthy backdoor that we call POSHSPY In the investigations Mandiant has conducted, it appeared that APT29 deployed POSHSPY as a secondary backdoor for use if they lost access to their primary backdoors POSHSPY makes the most of using built-in Windows features – so-called “living off the land” – to make an especially stealthy backdoor Every aspect of POSHSPY is efficient and covert Later in that same engagement, the attacker updated the deployment of the backdoor to use WMI for storage and persistence Mandiant has since identified POSHSPY in several other environments compromised by APT29 over the past two years We first discussed APT29’s use of this backdoor as part of our “No Easy Breach” talk For additional details on how we first identified this backdoor, and the epic investigation it was part of, see the slides and presentation WMI provides many administrative capabilities on local and remote systems, including querying system information, starting and stopping processes, and setting conditional triggers WMI classes can contain methods (code) and properties (data) Users with sufficient system-level privileges can define custom classes or extend the functionality of the many default classes Attackers often use this functionality to persist the execution of backdoors at system start up WMI Consumers specify an action to be performed, including executing a command, running a script, adding an entry to a log, or sending an email A FilterToConsumerBinding associates Consumers to Filters Creating a WMI permanent event subscription requires administrative privileges on a system We have observed APT29 use WMI to persist a backdoor and also store the PowerShell backdoor code To store the code, APT29 created a new WMI class and added a text property to it in order to store a string value This allowed them to install a persistent backdoor without leaving any artifacts on the system’s hard drive, outside of the WMI repository This “fileless” backdoor methodology made the identification of the backdoor much more difficult using standard host analysis techniques The WindowsParentalControlsMigration consumer was configured to silently execute a base64-encoded PowerShell command The PowerShell command contained the payload storage location and encryption keys Figure 2 displays the command, called the “CommandLineTemplate”, executed by the WindowsParentalControlsMigration consumer The backdoor contains several notable capabilities, including: 1 Downloading and executing PowerShell code as an EncodedCommand   2 Modifying the Standard Information timestamps (created, modified, accessed) of every downloaded executable to match a randomly selected file from the System32 directory that was created prior to 2013   4 Deriving C2 URLs from a Domain Generation Algorithm (DGA) using lists of domain names, subdomains, top-level domains (TLDs), Uniform Resource Identifiers (URIs), file names, and file extensions   6 Using either custom cookie names and values or randomly-generated cookie names and values for each network connection   8 Uploading data in 2048-byte chunks   9 Appending a file signature header to all encrypted data, prior to upload or download, by randomly selecting from the file types:  ICO GIF JPG PNG MP3 BMP    The sample in this example used 11 legitimate domains owned by an organization located near the victim When combined with the other options in the DGA, 550 unique C2 URLs could be generated Infrequent beaconing, use of DGA and compromised infrastructure for C2, and appended file headers used to bypass content inspection made this backdoor difficult to identify using typical network monitoring techniques Conclusion POSHSPY is an excellent example of the skill and craftiness of APT29 By “living off the land” they were able to make an extremely discrete backdoor that they can deploy alongside their more conventional and noisier backdoor families, in order to help ensure persistence even after remediation As stealthy as POSHSPY can be, it comes to light quickly if you know where to look Enabling and monitoring enhanced PowerShell logging can capture malicious code as it executes and legitimate WMI persistence is so rare that malicious persistence quickly stands out when enumerating it across an environment This is one of several sneaky backdoor families that we have identified, including an off-the-shelf domain fronting backdoor and HAMMERTOSS When responding to an APT29 breach, it is vital to increase visibility, fully scope the incident before responding and thoroughly analyze accessed systems that don't contain known malware
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Mandiant has observed APT29 using a stealthy backdoor that we call POSHSPY In the investigations Mandiant has conducted, it appeared that APT29 deployed POSHSPY as a secondary backdoor for use if they lost access to their primary backdoors POSHSPY makes the most of using built-in Windows features – so-called “living off the land” – to make an especially stealthy backdoor Every aspect of POSHSPY is efficient and covert Later in that same engagement, the attacker updated the deployment of the backdoor to use WMI for storage and persistence Mandiant has since identified POSHSPY in several other environments compromised by APT29 over the past two years We first discussed APT29’s use of this backdoor as part of our “No Easy Breach” talk For additional details on how we first identified this backdoor, and the epic investigation it was part of, see the slides and presentation WMI provides many administrative capabilities on local and remote systems, including querying system information, starting and stopping processes, and setting conditional triggers WMI classes can contain methods (code) and properties (data) Users with sufficient system-level privileges can define custom classes or extend the functionality of the many default classes Attackers often use this functionality to persist the execution of backdoors at system start up WMI Consumers specify an action to be performed, including executing a command, running a script, adding an entry to a log, or sending an email A FilterToConsumerBinding associates Consumers to Filters Creating a WMI permanent event subscription requires administrative privileges on a system We have observed APT29 use WMI to persist a backdoor and also store the PowerShell backdoor code To store the code, APT29 created a new WMI class and added a text property to it in order to store a string value This allowed them to install a persistent backdoor without leaving any artifacts on the system’s hard drive, outside of the WMI repository This “fileless” backdoor methodology made the identification of the backdoor much more difficult using standard host analysis techniques The WindowsParentalControlsMigration consumer was configured to silently execute a base64-encoded PowerShell command The PowerShell command contained the payload storage location and encryption keys Figure 2 displays the command, called the “CommandLineTemplate”, executed by the WindowsParentalControlsMigration consumer The backdoor contains several notable capabilities, including: 1 Downloading and executing PowerShell code as an EncodedCommand   2 Modifying the Standard Information timestamps (created, modified, accessed) of every downloaded executable to match a randomly selected file from the System32 directory that was created prior to 2013   4 Deriving C2 URLs from a Domain Generation Algorithm (DGA) using lists of domain names, subdomains, top-level domains (TLDs), Uniform Resource Identifiers (URIs), file names, and file extensions   6 Using either custom cookie names and values or randomly-generated cookie names and values for each network connection   8 Uploading data in 2048-byte chunks   9 Appending a file signature header to all encrypted data, prior to upload or download, by randomly selecting from the file types:  ICO GIF JPG PNG MP3 BMP    The sample in this example used 11 legitimate domains owned by an organization located near the victim When combined with the other options in the DGA, 550 unique C2 URLs could be generated Infrequent beaconing, use of DGA and compromised infrastructure for C2, and appended file headers used to bypass content inspection made this backdoor difficult to identify using typical network monitoring techniques Conclusion POSHSPY is an excellent example of the skill and craftiness of APT29 By “living off the land” they were able to make an extremely discrete backdoor that they can deploy alongside their more conventional and noisier backdoor families, in order to help ensure persistence even after remediation As stealthy as POSHSPY can be, it comes to light quickly if you know where to look Enabling and monitoring enhanced PowerShell logging can capture malicious code as it executes and legitimate WMI persistence is so rare that malicious persistence quickly stands out when enumerating it across an environment This is one of several sneaky backdoor families that we have identified, including an off-the-shelf domain fronting backdoor and HAMMERTOSS When responding to an APT29 breach, it is vital to increase visibility, fully scope the incident before responding and thoroughly analyze accessed systems that don't contain known malware ### Response: .