Full Report
Get to know 2024’s three biggest cyber threats—RMM abuse, BYOVD attacks, and WebDAV abuse—and learn how to defend your business from these rising risks.
Analysis Summary
# Tool/Technique: Remote Monitoring and Management (RMM) Abuse
## Overview
RMM abuse involves threat actors leveraging legitimate remote management software to maintain persistent access, move laterally, and execute commands within a target network. Because these tools are signed and often allow administrative control, they frequently bypass traditional security alerts.
## Technical Details
- **Type**: Technique / Attack Tool exploitation
- **Platform**: Windows, macOS, Linux
- **Capabilities**: Remote desktop access, file transfer, script execution, system monitoring.
- **First Seen**: Increasing trend noted since January 2024 (214% increase).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1133 - External Remote Services]
- [T1078 - Valid Accounts]
- **[TA0003 - Persistence]**
- [T1105 - Ingress Tool Transfer]
- **[TA0008 - Lateral Movement]**
- [T1210 - Exploitation of Remote Services]
## Functionality
### Core Capabilities
- **Remote Access:** Providing a direct GUI or CLI to the victim machine.
- **Persistence:** Maintaining access even after reboots by installing RMM agents as services.
- **File Manipulation:** Uploading malware or staging tools and exfiltrating data.
### Advanced Features
- **Exploitation of Known Vulnerabilities:** Specifically utilizing exploits like CVE-2024-1709 (ScreenConnect) to gain unauthorized administrative access.
- **Rogue Installations:** Deploying unapproved RMM agents (shadow IT) to create backdoors that bypass corporate security policies.
## Indicators of Compromise
- **File Names:** `ScreenConnect.Client.exe`, `AnyDesk.exe`, `AteraAgent.exe`, `TeamViewer.exe`.
- **Network Indicators:** Connections to `*.screenconnect[.]com`, `*.anydesk[.]com`, `*.atera[.]com`.
- **Behavioral Indicators:**
- Installation of RMM software by non-administrative users.
- RMM processes executing PowerShell or Command Prompt.
- Unrecognized RMM agents running as System services.
## Associated Threat Actors
- General Ransomware groups
- Financial motivated actors leveraging infostealers
## Detection Methods
- **Behavioral detection:** Alerting on the execution of RMM installers from temp directories or downloads folders.
- **Inventory Audit:** Cross-referencing installed software against an authorized list of RMM tools.
## Mitigation Strategies
- **MFA:** Enforce Multi-Factor Authentication for all RMM access.
- **Software Restriction Policies:** Use Allow-listing to prevent the execution of unapproved RMM binaries.
- **Access Control:** Limit RMM installation privileges to specific administrative service accounts.
## Related Tools/Techniques
- AnyDesk, ScreenConnect, Atera, ZohoAssist, LogMeIn, TeamViewer, Ninja, Domotz, Auvik, Naverisk, Kaseya VSA.
---
# Tool/Technique: Bring Your Own Vulnerable Driver (BYOVD)
## Overview
BYOVD is a technique where an attacker installs a legitimate, digitally signed driver that contains a known security vulnerability. By exploiting this vulnerability, the attacker can execute code with kernel-level privileges.
## Technical Details
- **Type**: Technique
- **Platform**: Windows (Kernel Mode)
- **Capabilities**: EDR/AV termination, privilege escalation, kernel memory manipulation.
- **First Seen**: Surge in frequency (4x increase) noted in 2024.
## MITRE ATT&CK Mapping
- **[TA0004 - Privilege Escalation]**
- [T1068 - Exploitation for Privilege Escalation]
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
## Functionality
### Core Capabilities
- **Kernel Access:** Gaining the highest level of system permissions.
- **EDR Evasion:** Disabling or tampering with security agents from the kernel, where the security software resides.
### Advanced Features
- **Anti-EDR/Tampering:** Used in nearly 25% of observed ransomware attacks to "blind" security teams before encryption.
## Indicators of Compromise
- **File Hashes:** Vary by the specific vulnerable driver being "brought" (e.g., old versions of Dell, Capcom, or RTCore drivers).
- **Behavioral Indicators:**
- Loading of known vulnerable drivers (Driver Load events).
- Unexpected termination of security service processes (e.g., `MsMpEng.exe`, `CylanceSvc.exe`).
## Associated Threat Actors
- Ransomware operators (multiple variants).
## Detection Methods
- **Driver Monitoring:** Monitoring for the loading of drivers with known CVEs.
- **YARA Rules:** Scanning for headers of known vulnerable drivers in unexpected directories.
## Mitigation Strategies
- **Driver Blocklisting:** Enabling Windows Microsoft Recommended Driver Block Rules.
- **HVCI:** Enabling Hypervisor-Protected Code Integrity (VBS) to prevent unsigned or malicious code execution in the kernel.
---
# Tool/Technique: WebDAV Abuse
## Overview
WebDAV (Web Distributed Authoring and Versioning) is an extension of HTTP that allows clients to perform remote Web content authoring operations. Attackers abuse this protocol to bypass security filters that block standard SMB file sharing.
## Technical Details
- **Type**: Technique
- **Platform**: Windows
- **Capabilities**: Bypassing firewalls, credential harvesting, delivery of malicious payloads.
- **First Seen**: Increasing prevalence in 2024 for initial access.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566 - Phishing]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
## Functionality
### Core Capabilities
- **Firewall Evasion:** Using Port 80/443 (HTTP/S) to move files, which is typically open, unlike Port 445 (SMB).
- **Credential Theft:** Prompting users for credentials when connecting to a remote WebDAV share.
## Indicators of Compromise
- **Network Indicators:** Outbound connections to external IPs via `svchost.exe` (WebClient service) over port 80 or 443.
- **Behavioral Indicators:** `rundll32.exe` calling `davclnt.dll`.
## Detection Methods
- **Network Monitoring:** Inspecting traffic for unusual WebDAV "PROPFIND" or "OPTIONS" requests to external domains.
- **Process Monitoring:** Tracking the activity of the `WebClient` service.
## Mitigation Strategies
- **Disable WebClient Service:** Disable the "WebClient" service on workstations if not required.
- **Block Outbound SMB/WebDAV:** Restrict outbound traffic on common file-sharing ports to trusted internal zones.
## Related Tools/Techniques
- SMB (Server Message Block)
- Phishing via LNK or ZIP files containing WebDAV links.