Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

7/18/2019
03:20 PM
Jai Vijayan
Jai Vijayan
Slideshows
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

8 Legit Tools and Utilities That Cybercriminals Commonly Misuse

Threat actors are increasingly 'living off the land,' using publicly available management and administration tools to conceal malicious activity.
Previous
1 of 9
Next

Image Source: Shutterstock

Image Source: Shutterstock

Cybercriminals have long used legitimate management and administration tools to break into enterprise networks, move laterally within them, and maintain persistence.

Lately, though, use of these so-called living-off-the-land tactics has increased substantially.

Positive Technologies recently analyzed the tools that 29 advanced persistent threat groups are currently using in their campaigns worldwide. Its study shows that more than half of them leverage legitimate, publicly available penetration testing and systems administration tools to develop their attacks after gaining an initial foothold on a network.

The reason? Such tools allow attackers to hide their activities in a sea of legitimate traffic. "Threat actors increasingly leverage dual-use tools or tools that are already preinstalled on targeted systems to carry out cyberattacks," said Fortinet in a recent report.

This makes it harder for defenders to spot malicious activity and makes attack attribution much more difficult. "Unfortunately, adversaries can use a wide range of legitimate tools to accomplish their goals and hide in plain sight," Fortinet said.

Here, according to security experts, are eight of the mostly commonly abused legitimate utilities and tools.

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Previous
1 of 9
Next
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
tdsan
50%
50%
tdsan,
User Rank: Ninja
7/19/2019 | 4:08:46 PM
Powershelll can do most of what is listed
powershellcandomostofthis,thesearejustexamples
  • ps-invoke-[replacedtest5]psexec)
  • ps-gwmiwin32_product(wmic)
  • ps-enable-psremoting--force,winrm(vnc)
  • ps-winrmsetwinrm/config/client'@{trustedhosts=*"}(remoteaccess)

powershellcanbeusedtoaccomplishalmostanything.

todd
TvRepair247
50%
50%
TvRepair247,
User Rank: Apprentice
7/25/2019 | 2:25:41 AM
Cybercriminals Commonly Misuse
accounting for almost half of all crimes in the country.

But just a fraction of offenses is reported to the police because victims either feel embarrassed or believe little can be done to catch those responsible. If facing any problem related to a printer please visit Tv Repair for any technical support assistance

According to the survey the total number of all offenses in the 12 months to September topped 11.8 million, of which 3.6 million were a fraud and further 2 million were related to computer misuse.

The next most common offense was theft with 3.5 million cases, while there were 1.2 million incidents of criminal damage and 1.3 million offenses of violence against the person.
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19325
PUBLISHED: 2020-02-17
SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built...
CVE-2020-1693
PUBLISHED: 2020-02-17
A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute arbi...
CVE-2020-1828
PUBLISHED: 2020-02-17
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have an input validation vulnerability where the IPSec module does not validate a field in a specific message. ...
CVE-2020-1857
PUBLISHED: 2020-02-17
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have an information leakage vulnerability. Due to improper processing of some data, a local authent...
CVE-2020-1858
PUBLISHED: 2020-02-17
Huawei products NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; Secospace USG6600 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100; and USG9500 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have a denial of service vulnerability. Att...