Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Taint Shared Content

Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally. A directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses Shortcut Modification of directory .LNK files that use Masquerading to look like the real directories, which are hidden through Hidden Files and Directories. The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts. (Citation: Retwin Directory Share Pivot) Adversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.

ID: T1080

Tactic(s): Lateral Movement

Platforms: Linux, macOS, Office Suite, SaaS, Windows

Data Sources: File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation

Version: 1.5

Created: 31 May 2017

Last Modified: 15 Oct 2024

Name	Description
Procedure Examples
H1N1	H1N1 has functionality to copy itself to network shares.(Citation: Cisco H1N1 Part 2)
Darkhotel	Darkhotel used a virus that propagates by infecting executables stored on shared drives.(Citation: Kaspersky Darkhotel)
RedCurl	RedCurl has placed modified LNK files on network drives for lateral movement.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)
Ramsay	Ramsay can spread itself by infecting other portable executable files on networks shared drives.(Citation: Eset Ramsay May 2020)
Gamaredon Group	Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.(Citation: ESET Gamaredon June 2020)
BRONZE BUTLER	BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.(Citation: Secureworks BRONZE BUTLER Oct 2017)
InvisiMole	InvisiMole can replace legitimate software or documents in the compromised network with their trojanized versions, in an attempt to propagate itself within the network.(Citation: ESET InvisiMole June 2020)
Cinnamon Tempest	Cinnamon Tempest has deployed ransomware from a batch file in a network share.(Citation: Microsoft Ransomware as a Service)
Conti	Conti can spread itself by infecting other remote machines via network shared drives.(Citation: Cybereason Conti Jan 2021)(Citation: CarbonBlack Conti July 2020)
Miner-C	Miner-C copies itself into the public folder of Network Attached Storage (NAS) devices and infects new victims who open the file.(Citation: Softpedia MinerC)
Stuxnet	Stuxnet infects remote servers via network shares and by infecting WinCC database views with malicious code.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)
Ursnif	Ursnif has copied itself to and infected files in network drives for propagation.(Citation: TrendMicro Ursnif Mar 2015)(Citation: TrendMicro Ursnif File Dec 2014)

Mitigation	Description
Mitigations
Taint Shared Content Mitigation	Protect shared folders by minimizing users who have write access. Use utilities that detect or mitigate common features used in exploitation, such as the Microsoft Enhanced Mitigation Experience Toolkit (EMET). Reduce potential lateral movement risk by using web-based document management and collaboration services that do not use network file and directory sharing. Identify potentially malicious software that may be used to taint content or may result from it and audit and/or block the unknown programs by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
Antivirus/Antimalware	Use signatures or heuristics to detect malicious software.
Execution Prevention	Block execution of code on a system through application control, and/or script blocking.
Restrict File and Directory Permissions	Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.
Exploit Protection	Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring.

Detection

Processes that write or overwrite many files to a network shared directory may be suspicious. Monitor processes that are executed from removable media for malicious or abnormal activity such as network connections due to Command and Control and possible network Discovery techniques. Frequently scan shared network directories for malicious files, hidden files, .LNK files, and other file types that may not typical exist in directories used to share specific types of content.

References

Связанные риски

Риск	Связи
Боковое перемещение злоумышленника по локальной сети из-за возможно добавления ВПО в ярлыки и файлы общих сетевых ресурсов в файловых службах и службы хранилища Конфиденциальность Целостность

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Taint Shared Content

Procedure Examples

Mitigations

Detection

References

Связанные риски

Каталоги