Full Report
Huntress continues to see MSSQL server systems being attacked, and in recent incidents have seen overlap with previous incidents, not only in the use of LOLBins, but also in IP addresses used by the threat actor.
Analysis Summary
# Incident Report: MSSQL to ScreenConnect Exploitation Attempt
## Executive Summary
Huntress SOC analysts identified a series of automated attacks targeting endpoints running MSSQL Server, specifically those integrated with Fortinet Enterprise Management Server (EMS). The threat actor utilized `xp_cmdshell` to execute living-off-the-land binaries (LOLBins) like `finger.exe` and PowerShell in an attempt to deploy unauthorized ScreenConnect (ConnectWise Control) agents. While the automated scripts failed to execute properly due to syntax errors and missing dependencies, the activity highlights persistent targeting of exposed database services by known threat actors.
## Incident Details
- **Discovery Date:** March 28, 2024 (Publication Date)
- **Incident Date:** Late March 2024
- **Affected Organization:** Multiple (3 identified endpoints)
- **Sector:** Various (Users of Fortinet EMS)
- **Geography:** Global / Distributed
## Timeline of Events
### Initial Access
- **Date/Time:** 21:28:33 UTC & 21:34:13 UTC
- **Vector:** Likely exploitation of MSSQL via weak credentials or vulnerability in a parent application (Fortinet EMS).
- **Details:** Attackers gained the ability to execute stored procedures, triggering MSSQL Event ID 15281 (blocked access to `xp_cmdshell`) followed by the successful activation and use of the procedure.
### Lateral Movement
- **Details:** No successful lateral movement was observed as the initial payload execution failed; however, the attempt to install ScreenConnect suggests an intent to establish a persistent remote access beachhead for future movement.
### Data Exfiltration/Impact
- **Details:** No data exfiltration was confirmed in this specific incident. The attackers attempted to use `finger.exe` for initial reconnaissance/heartbeat, a technique previously associated with data exfiltration in related campaigns.
### Detection & Response
- **Discovery:** Triggered by EDR telemetry alerts on suspicious child processes of `sqlservr.exe`.
- **Response:** Analysts developed investigative timelines from Windows Event Logs and EDR telemetry to verify the failure of the automated scripts and recommend remediation of the entry point.
## Attack Methodology
- **Initial Access:** MSSQL Service exploitation (specifically targeting Fortinet EMS installations).
- **Persistence:** Attempted installation of ConnectWise Control (ScreenConnect) MSI via PowerShell.
- **Privilege Escalation:** Use of `xp_cmdshell` to execute commands in the context of the SQL Service account.
- **Defense Evasion:** Use of decimal-encoded PowerShell commands (e.g., character codes separated by "+") and LOLBins (`finger.exe`).
- **Discovery:** Reconnaissance via the `finger` protocol to an external C2.
- **Execution:** `msiexec` for MSI installation and PowerShell `Invoke-Expression`.
- **Impact:** Intent was unauthorized remote control/access.
## Impact Assessment
- **Financial:** Minimal (Prevention successful).
- **Data Breach:** None reported.
- **Operational:** Low; temporary service investigation and required patching/configuration hardening.
- **Reputational:** N/A.
## Indicators of Compromise
- **Network Indicators:**
- `185.56.83[.]82` (Associated with `finger.exe` activity)
- `95.179.241[.]10:23963` (Source for `ConnectWiseControl.ClientSetup.msi`)
- **Behavioral Indicators:**
- `sqlservr.exe` spawning `cmd.exe` or `powershell.exe`.
- Execution of `finger.exe` with external IP addresses.
- Automated decimal-encoded command strings in process command lines.
## Response Actions
- **Containment:** Monitored the automated failures; alerted customers to the suspicious activity.
- **Eradication:** Recommended disabling `xp_cmdshell` and auditing MSSQL account permissions.
- **Recovery:** Advised patching of Fortinet EMS and securing the underlying MSSQL instances.
## Lessons Learned
- **Automation Failures:** The attacker's scripts failed due to missing directory slashes in the decimal-encoded commands, proving that even automated threats can be foiled by poor scripting.
- **Service Hardening:** MSSQL remains a primary target; `xp_cmdshell` should be disabled by default unless strictly necessary.
- **Tool Overlap:** The reuse of the `185.56.83[.]82` IP across different campaigns indicates a stable infrastructure used by this specific threat actor.
## Recommendations
- **Disable xp_cmdshell:** Ensure this stored procedure is disabled on all MSSQL instances.
- **Patch Management:** Immediately update Fortinet EMS to the latest version to mitigate known vulnerabilities.
- **Egress Filtering:** Block outbound traffic on non-standard ports and protocols (e.g., Finger/port 79) from database servers.
- **Least Privilege:** Run MSSQL services under low-privilege service accounts to limit the impact of a process breakout.