Story image

Exclusive: Fileless malware driving uptake of behavioural analytics

12 Nov 18

Article by LogRhythm Asia Pacific and Japan senior regional marketing director Joanne Wong

Over the past year, a new form of malware has emerged that is able to more successfully evade traditional detection and defence techniques.

As a result, it is seeing increased use by attackers in the wild, and if the amount of research being devoted to it right now is any indication, security practitioners are sufficiently worried.

Most organisations and users are across vectors that malware typically uses to spread - dodgy file attachments, infected USB drives and the like.

This malware works by storing its payload on disk as an executable file or script that is then unleashed.

Antivirus software is designed to detect the creation of these types of files and check them against signatures of known malware.

If malware is detected, the file is deleted or quarantined before it can execute and cause damage. 

However, a newer strain of malware is “fileless” - that is, it is designed to operate exclusively in computer memory.

To execute, it abuses existing software, applications and authorised protocols on a machine so it can carry out its designated malicious activity.

Fileless malware often finds its way into organisations via web browsers (or in combination with other vectors such as infected USB drives).

For example, a user could visit a compromised page, which then uses Flash to instruct PowerShell to connect to a stealth command and control server where it downloads a malicious script.

Fileless malware was first seen in the wild in April 2015.

An early example targeting local users was JS_POWMET, which hit businesses in the Asia Pacific region.

When JS_POWMET was uncovered in August last year, the researchers involved noted that the rarity of finding a completely end-to-end fileless attack.

Not only did it infect a machine without a trace, but it also left no evidence after the malicious payload had executed, making it very difficult to spot again in the future.

Traditional families of malware are also changing to execute on a fileless basis.

Microsoft researchers noted back in mid-2016 that Kovter, a type of click-fraud malware, had been updated to become “almost fileless”.

The change didn’t completely allow it to avoid detection. 

However, the trend to evolve file-based malware into fileless malware is further evidence of the increasing sophistication of cyber attacks that is making it significantly harder to stop threats from entering corporate networks and devices.

In addition to being triggered through web browsers, fileless malware is also known to exploit Microsoft Office applications and operating systems tools such as PowerShell (which is used to automate administration tasks on Windows), Visual Basic (VB) scripts and Windows Management Instrumentation (WMI).

McAfee uncovered a fileless malware campaign recently called Operation Gold Dragon that targeted the 2018 Winter Olympics, which was described as “an exemplary implementation of PowerShell malware in an attack”.

Fileless elements can also be found in other successful attacks.

Both the Petya and Wannacry ransomware outbreaks last year took advantage of “fileless techniques”, researchers have said.

Existing security strategies that incorporate file-based whitelisting, signature detection, hardware verification, pattern analysis or time stamping just won’t pick up fileless malware.

A potential weakness of fileless malware, however, is that as it works in-memory, it should only remain on the system until it is rebooted.

As a basic first step, regular system reboots are likely to deal with some fileless malware.

However, cybercriminals are now adding persistence to the malware code so that it resumes following a system restart.

Ultimately, the best approach is to use behavioural analytics, which monitor the activity of applications and services, including communications between processes, unauthorised requests to run applications, and changes to credentials or permission levels.

For example, while many of the processes involved in fileless malware entering a network via a web browser are normal in isolation, the fact they happen concurrently is less normal, meaning they can be flagged and shut down before damage is done.

White box losing out to brands in 100 GE switching market
H3C, Cisco and Huawei have all gained share in the growing competition in the data centre switching market.
Gartner names newcomer Exabeam a leader in SIEM
The vendor landscape for SIEM is evolving, with recent entrants bringing technologies optimised for analytics use cases.
52mil users affected by Google+’s second data breach
Google+ APIs will be shut down within the next 90 days, and the consumer platform will be disabled in April 2019 instead of August 2019 as originally planned.
Genesys PureCloud generates triple-digit revenue growth year on year
In Australia and New Zealand, the company boosted PureCloud revenue by nearly 100%.
Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
IDC: Standalone VR headset shipments grow 428.6% in 3Q18
The VR headset market returned to growth in 3Q18 after four consecutive quarters of decline and now makes up 97% of the combined market.
Kidd made Ingram Micro executive for cloud
Barbara Kidd has been promoted to cloud general manager as the company signs new vendors to its Cloud Marketplace.
Open source will be the next big thing for the channel
Channel firms should be on the lookout for opportunities across open source and more diverse software offerings like software-defined containers and storage.