Full Report
Huntress analyzed a credential dumping attack where threat actors disabled Defender, killed monitoring tools, and used Mimikatz to steal credentials.
Analysis Summary
# Tool/Technique: Defence Impairment & Credential Dumping (i.bat)
## Overview
This attack involves a multi-stage defense impairment sequence designed to blind security monitoring and disable active protections on a Windows server. The primary purpose is to prepare the environment for successful credential theft via Mimikatz while minimizing the risk of detection or automated blocking.
## Technical Details
- **Type:** Technique / Attack Script (Batch-based)
- **Platform:** Windows (specifically targeting IIS/ColdFusion web servers)
- **Capabilities:** Disables security software (Defender, Sysmon, Filebeat), tampers with logs, downgrades authentication security, and dumps credentials.
- **First Seen:** June 7, 2024 (as reported by Huntress)
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- **T1562.001 - Impair Defenses: Disable or Modify Tools** (Disabling Defender, Sysmon, Filebeat)
- **T1070.001 - Indicator Removal: Clear Windows Event Logs** (WMI Event Consumer)
- **T1070.006 - Indicator Removal: Timestomping**
- **T1027.003 - Obfuscation/Steganography** (Steganographic webshell)
- **TA0006 - Credential Access**
- **T1003.001 - OS Credential Dumping: LSA Secrets** (Mimikatz)
- **T1562.006 - Impair Defenses: Modify Authentication Process** (WDigest Downgrade)
- **TA0007 - Discovery**
- **T1087 - Account Discovery**
## Functionality
### Core Capabilities
- **Security Software Termination:** Forcefully stops and disables services for Microsoft Defender, Sysmon, and Filebeat.
- **WAF Removal:** Uninstalls ModSecurity Web Application Firewall (WAF) to facilitate further web-based attacks.
- **Credential Dumping:** Executes Mimikatz to extract clear-text passwords and hashes from memory.
- **Log Suppression:** Disables IIS logging and uses WMI to clear Windows Event Logs to hide activity.
### Advanced Features
- **WDigest Downgrade:** Modifies the registry to enable WDigest authentication, forcing Windows to store credentials in clear text in memory for Mimikatz to harvest.
- **Steganography:** Uses webshells hidden within image files or other non-executable formats to bypass file integrity monitoring.
- **Defense Impairment Scripting (`i.bat`):** Orchestrates nearly a dozen impairment commands in a single batch file for rapid execution.
## Indicators of Compromise
- **File Names:** `i.bat`, `mimikatz.exe` (or renamed variants).
- **Registry Keys:**
- `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest` (Setting `UseLogonCredential` to `1`).
- **Behavioral Indicators:**
- Sudden cessation of Sysmon or Filebeat heartbeats.
- PowerShell or CMD execution of `sc stop` or `sc config` targeting security services.
- WMI activity related to `ClearEventLog()`.
- `lsass.exe` memory access by unverified non-system processes.
## Associated Threat Actors
- While specific groups were not named in the report, the TTPs (Adobe ColdFusion exploitation and WDigest downgrading) are frequently associated with various **Ransomware-as-a-Service (RaaS)** affiliates and sophisticated **Initial Access Brokers (IABs)**.
## Detection Methods
- **Behavioral Detection:** Monitor for modifications to the WDigest registry key and unauthorized service state changes (stopping Defender/Sysmon).
- **Process Monitoring:** Alert on `cmd.exe` or `powershell.exe` spawning from web server processes (`w3wp.exe`, `tomcat.exe`) executing `net stop` or `taskkill`.
- **Log Analysis:** Detect "holes" in logging or the specific execution of WMI event consumers used to clear logs.
## Mitigation Strategies
- **Patch Management:** Immediately patch Adobe ColdFusion vulnerabilities (CVE-2023-26360, CVE-2023-29298, CVE-2023-29300).
- **Hardening:** Disable WDigest authentication via Group Policy to prevent clear-text credential storage.
- **Tamper Protection:** Enable "Tamper Protection" in Microsoft Defender to prevent scripts from disabling the antivirus service.
- **Egress Filtering:** Limit the ability of web servers to communicate with unknown external IP addresses to prevent tool downloads.
## Related Tools/Techniques
- **[Mimikatz]**: The industry-standard tool for credential theft.
- **[Timestomping]**: Used to manipulate file timestamps to evade forensic timelines.
- **[WMI Event Consumers]**: Used for persistence and log wiping.