Full Report
Huntress analyzed a credential dumping attack where threat actors disabled Defender, killed monitoring tools, and used Mimikatz to steal credentials.
Analysis Summary
# Tool/Technique: Defence Impairment & Credential Dumping (i.bat)
## Overview
This entry details a coordinated attack sequence where threat actors utilized a custom batch script (`i.bat`) to systematically dismantle host security controls. The primary purpose of this technique is to "blind" security operations centers (SOC) and automated endpoint protection platforms (EPP) prior to executing Mimikatz for credential harvesting, thereby increasing the success rate of the attack and avoiding detection.
## Technical Details
- **Type:** Technique / Attack Script
- **Platform:** Windows (specifically targeting IIS/Adobe ColdFusion servers)
- **Capabilities:** Disabling AV/EDR, killing monitoring processes, log clearing, security service uninstallation, and credential dumping.
- **First Seen:** June 7, 2024 (as reported by Huntress)
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- T1562.001 - Impair Defenses: Disable or Modify Tools
- T1070.001 - Indicator Removal: Clear Windows Event Logs
- T1070.006 - Indicator Removal: Timestomp
- T1027.003 - Obfuscation: Steganography
- **TA0006 - Credential Access**
- T1003.001 - OS Credential Dumping: LSA Secrets (Mimikatz)
## Functionality
### Core Capabilities
- **Security Software Termination:** Force-kills processes associated with monitoring tools, specifically **Sysmon** and **Filebeat**.
- **AV Disablement:** Tampering with and disabling **Microsoft Defender** configurations.
- **Credential Protection Downgrade:** Modifies registry settings to downgrade **WDigest** credential protection, forcing the system to store credentials in clear text in memory for Mimikatz retrieval.
- **WAF Removal:** Attempts to uninstall the **ModSecurity** Web Application Firewall (WAF) to facilitate further web-based exploitation.
### Advanced Features
- **Log Suppression:** Disabling IIS logs and using WMI Event Consumers to systematically clear Windows Event Logs.
- **Steganography:** Use of a steganographic webshell to hide malicious commands within seemingly benign image files or data.
- **Timestomping:** Modifying file timestamps to blend malicious files with legitimate system files and evade forensic discovery.
## Indicators of Compromise
- **File Names:** `i.bat` (Malicious batch script used for defense impairment)
- **Registry Keys:** (Associated with WDigest downgrade) `HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest`
- **Behavioral Indicators:**
- Execution of `taskkill` against `sysmon.exe` or `filebeat.exe`.
- PowerShell or CMD commands modifying Defender settings (`Set-MpPreference`).
- Sudden cessation of IIS or Windows Event logging.
- Unexpected uninstallation of security software (ModSecurity).
## Associated Threat Actors
- While specific group names were not attributed in the report, the tradecraft aligns with **Ransomware Affiliates** and **Advanced Persistent Threat (APT)** groups targeting vulnerable Adobe ColdFusion instances.
## Detection Methods
- **Signature-based detection:** Scanning for the `i.bat` script content and known Mimikatz binaries.
- **Behavioral detection:**
- Monitoring for suspicious WMI Event Consumer creation.
- Alerting on registry modifications to `SecurityProviders\WDigest`.
- Identifying `taskkill` commands targeting security-related PIDs.
- Detecting "Log Cleared" events (Event ID 1102).
## Mitigation Strategies
- **Patch Management:** Immediate patching of Adobe ColdFusion vulnerabilities (**CVE-2023-26360**, **CVE-2023-29298**, **CVE-2023-29300**).
- **Hardening:** Disable WDigest authentication if not strictly required.
- **Access Control:** Restrict administrative privileges to prevent the execution of scripts that modify system services or Defender settings.
- **Incident Response Integrity:** Ensure servers remain offline and isolated until remediation is fully verified to prevent re-infection upon reconnection.
## Related Tools/Techniques
- **Mimikatz:** The primary credential dumper used at the end of the impairment chain.
- **Adobe ColdFusion Exploitation:** The likely initial access vector.
- **WMI Event Subscriptions:** Used for persistence and log clearing.