Full Report
Evidence of a pre-existing exploit was rendered when the Huntress agent was added to an endpoint. Within minutes, and in part through the use of previously published threat intelligence, analysts were able to identify the issue and make recommendations to the customer to remediate the root cause.
Analysis Summary
# Incident Report: OWASSRF Exploitation and Finger.exe Data Exfiltration
## Executive Summary
In January 2024, an endpoint recently onboarded to the Huntress platform revealed evidence of a pre-existing compromise involving the OWASSRF vulnerability in Microsoft Exchange. Threat actors utilized the native Windows utility `finger.exe` to exfiltrate reconnaissance data to a known malicious IP address. Despite Windows Defender attempting remediation, the speed of the commands likely allowed for successful execution, highlighting the need for rapid patch management and monitoring of "Living off the Land" (LotL) techniques.
## Incident Details
- **Discovery Date:** January 2024 (27 minutes after agent installation)
- **Incident Date:** Approximately two weeks prior to discovery
- **Affected Organization:** Not disclosed
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** January 2024
- **Vector:** Exploitation of Microsoft Exchange (OWASSRF vulnerability)
- **Details:** The attacker utilized POST requests to the `/owa/[email protected]/powershell` endpoint, a hallmark of the OWASSRF exploit chain.
### Lateral Movement
- **Details:** The article focuses on the initial exploitation and reconnaissance; specific lateral movement to other endpoints was not detailed, though PowerShell was used to execute commands within the Exchange environment.
### Data Exfiltration/Impact
- **Details:** Reconnaissance data (result of `whoami` and system digits) was exfiltrated using the `finger.exe` utility. The attacker successfully bypassed the intended use of the protocol to tunnel information to a remote listener.
### Detection & Response
- **Detection:** Huntress SOC identified a Managed Antivirus (MAV) alert triggered by `finger.exe` shortly after agent installation.
- **Response:** Analysts correlated the IP **185.56.83[.]82** with previous threat intelligence from November 2023. Event logs were analyzed to confirm the exploit chain and remediation recommendations were provided to the customer.
## Attack Methodology
- **Initial Access:** OWASSRF (Exchange RCE Vulnerability).
- **Persistence:** Not explicitly detailed, but involved repeated PowerShell execution.
- **Privilege Escalation:** Exploitation of Exchange system privileges via PowerShell cmdlets.
- **Defense Evasion:** Use of Base64-encoded PowerShell commands and native "Living off the Land" binaries (`finger.exe`) to blend with legitimate traffic.
- **Credential Access:** Not disclosed.
- **Discovery:** Execution of `whoami` and other reconnaissance strings.
- **Exfiltration:** Protocol tunneling via `finger.exe`.
- **Impact:** Unauthorized remote command execution and data leakage.
## Impact Assessment
- **Financial:** Unknown; potential for high costs due to Exchange compromise.
- **Data Breach:** Exfiltration of system reconnaissance data; potential for full mailbox access via OWASSRF.
- **Operational:** Risk of full system takeover and further malware deployment.
- **Reputational:** Potential impact if customer data within Exchange was accessed.
## Indicators of Compromise
- **Network Indicators:**
- 185.56.83[.]82 (Malicious Listener)
- **File/Process Indicators:**
- `finger.exe` (Abnormal command-line usage)
- `MSExchange Management.evtx` (Event ID 6 containing Base64 encoded strings)
- **Behavioral Indicators:**
- POST requests to `/owa/[email protected]/powershell`
- Encoded PowerShell executed via `cmd.exe`
## Response Actions
- **Containment:** Customer advised to isolate the affected Exchange server.
- **Eradication:** Recommendation to patch Microsoft Exchange to mitigate the OWASSRF vulnerability.
- **Recovery:** Analysis of web logs and event logs to ensure no other persistence mechanisms remained.
## Lessons Learned
- **Speed of Execution:** Windows Defender's 17-second remediation window was insufficient to stop the `finger.exe` command from completing.
- **Importance of Historical Intel:** Previous documentation of the `finger.exe` technique allowed for near-instant identification of the threat actor's intent.
- **Deployment Visibility:** The value of EDR/MDR is proven by the immediate discovery of "dormant" or "legacy" infections upon installation.
## Recommendations
- **Patch Management:** Immediately apply all security updates for Microsoft Exchange Server.
- **Attack Surface Reduction:** Block the `finger` protocol (Port 79) at the network perimeter if not required for business operations.
- **Monitoring:** Implement alerting for suspicious use of native binaries like `finger.exe`, `certutil.exe`, and `powershell.exe` when communicating with external IP addresses.