Full Report
This blog is a follow-up on our How to Crush Cybercriminals with Managed Antivirus webinar. We'll dive deeper through a threat analysis lens.
Analysis Summary
# Tool/Technique: MSSQL Bruteforce & Defense Evasion Script
## Overview
This attack involves an initial access vector via a brute-forced internet-facing SQL server, followed by the execution of a malicious batch script designed to blind security software (Microsoft Defender) and establish a foothold for network enumeration.
## Technical Details
- **Type:** Technique / Malicious Script
- **Platform:** Windows (MSSQL Servers)
- **Capabilities:** Credential brute-forcing, defense evasion (AV blinding), network enumeration, and command execution via shell.
- **First Seen:** Case study published July 21, 2022.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application]
- [T1110.001 - Brute Force: Password Cracking]
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
- **[TA0007 - Discovery]**
- [T1046 - Network Service Scanning]
- [T1016 - System Network Configuration Discovery]
- **[TA0011 - Command and Control]**
- [T1105 - Ingress Tool Transfer]
## Functionality
### Core Capabilities
- **Initial Access:** Targeting port 1433 (MSSQL) to gain unauthorized entry through password spraying or brute force.
- **Payload Delivery:** Downloading a `.txt` file containing batch commands renamed to execute as a script.
- **Defense Evasion:** Automatically adding a wide array of exclusions to Microsoft Defender to prevent the detection of malicious binaries and scripts.
### Advanced Features
- **AV Blinding:** The script targets specific file paths, extensions (e.g., `.exe`, `.dll`, `.bat`), and process names, ensuring that subsequent tools (like Meterpreter) can operate without triggering alerts.
- **Network Enumeration:** Post-infection, the actor uses native commands to map the internal network environment.
## Indicators of Compromise
- **File Names:** Malicious batch scripts often disguised as `.txt` files before execution.
- **Network Indicators:**
- Incoming traffic to port `1433` from unauthorized external IPs.
- C2/Callback stagers associated with **Meterpreter**.
- **Behavioral Indicators:**
- `cmd.exe` or `powershell.exe` spawned by `sqlservr.exe`.
- Multiple `Add-MpPreference -ExclusionPath` or similar commands to modify Defender settings.
- Unusual outbound network connections from a database server.
## Associated Threat Actors
- While specific named groups are not mentioned in this article, these techniques are commonly associated with **Ransomware affiliates** and **Initial Access Brokers (IABs)** targeting misconfigured database servers.
## Detection Methods
- **Behavioral detection:** Monitoring for the execution of commands that modify Antivirus exclusion lists.
- **EDR Monitoring:** Identifying processes (like MSSQL) spawning shells or command interpreters.
- **External Scanning:** Regular audits of internet-exposed services (External Recon) to identify open port 1433.
## Mitigation Strategies
- **Prevention measures:**
- Disable direct internet access to SQL servers; use a VPN or Gateway.
- Implement strict account lockout policies to prevent brute-force attacks.
- **Hardening recommendations:**
- Restrict "xp_cmdshell" execution in MSSQL.
- Monitor and alert on any changes to Microsoft Defender exclusion lists.
- Practice the principle of least privilege for SQL service accounts.
## Related Tools/Techniques
- **Meterpreter:** A sub-tool of the Metasploit framework used for post-exploitation.
- **Qilin Ransomware:** Mentioned as a related threat utilizing similar initial access or lateral movement patterns.
- **Password Spraying:** A common technique used alongside brute force to gain initial entry.