Content Injection

Key Points:

• Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.

• Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with "lawful interception."

• Look for file creation events for suspicious files (Event ID 4663).

• Look for process creation events for suspicious processes (Event ID 4668)

• Look for suspicious network traffic.

Adversaries can access and communicate with victims by injecting malicious content into online traffic, either in the middle of client-server communications or as fake responses to legitimate server requests. This often exploits compromised ISP channels, enabling further payload deliveries to compromised systems.

Detection

File Creation

Monitor for unexpected and abnormal file creations that may indicate malicious content injected through online network communications.

• Example: An unexpected executable file created in the user's AppData folder.

• Windows Event Log: Event ID 4663 in the Security log (An attempt was made to access an object).

Windows Event 4663 example:

An attempt was made to access an object.
Subject:
  Security ID: SYSTEM
  Account Name: WIN-SERVER$
  Account Domain: WORKGROUP
  Logon ID: 0x3E7
Object:
  Object Name: C:\Users\user\AppData\Local\Temp\malicious.exe
  Object Type: File
Process Information:
  Process ID: 0x1f4
  Process Name: C:\Windows\System32\cmd.exe
Access Request Information:
  Accesses: WriteData (or AddFile)
  Access Mask: 0x2

• This log entry indicates an attempt to access (write or create) a file.

• Security ID, Account Name, and Account Domain - identify the user account involved.

• Object Name - points to the file path, here indicating a potentially suspicious executable in the Temp folder.

• Process Information - shows the process that attempted the file creation, in this case, cmd.exe, which is notable as command-line tools can be used in attacks.

• Accesses:WriteData - For a file object, the right to write data to the file. For a directory object, the right to create a file in the directory (FILE_ADD_FILE).

  • AddFile - For a directory, the right to create a file in the directory.

Process Creation

• Example: A browser process creating unexpected child processes or executable files.

• Windows Event Log: Event ID 4688 in the Security log (A new process has been created).

Windows Event ID 4688 example:

A new process has been created.
Subject:
  Security ID: SYSTEM
  Account Name: WIN-SERVER$
  Account Domain: WORKGROUP
  Logon ID: 0x3E7
New Process ID: 0x1f4
New Process Name: C:\Program Files (x86)\Internet Explorer\iexplore.exe
Token Elevation Type: TokenElevationTypeDefault (1)
Creator Process ID: 0x1e0
Creator Process Name: C:\Windows\Explorer.exe
Process Command Line: "C:\Program Files (x86)\Internet Explorer\iexplore.exe"

• This log records the creation of a new process.

• Security ID and related fields again provide account information.

• New Process ID and Name detail the process started, here iexplore.exe, Internet Explorer.

• Creator Process ID and Name indicate the initiating process, in this case, Explorer.exe.

• Process Command Line gives the command used to start the process, which can reveal whether additional, potentially malicious, parameters were used.

Network Traffic Content

• Example: Unusual outbound traffic to unknown domains or IP addresses.

• Windows Event Log: No direct Windows Event Log; typically monitored using network traffic analysis tools.

• If an EDR solution is in place, reference the file/process creations with outbound network connections or DNS requests.

Mitigation

Restrict Web-Based Content

• Consider blocking download/transfer and execution of potentially uncommon file types known to be used in adversary campaigns.

  • Executable files (.exe, .dll, .scr, .bat, .ps1).

  • Script files (.vbs, .js).

  • Office documents with macros (.docm, .xlsm).

  • Compressed files (.zip, .rar).

  • Portable Executable (PE).

  • Dynamic link library files (.dll).

Encrypt Sensitive Information

• Where possible, ensure that online traffic is appropriately encrypted through services such as trusted VPNs.

  • Use HTTPS Protocols: Ensure websites use HTTPS to encrypt data in transit. This is crucial for any site handling sensitive information.

  • Encrypt Database Information: Use encryption for data at rest, especially for databases storing sensitive information.

  • Email Encryption: Implement email encryption solutions for sensitive communications.

  • File Encryption: Encourage the use of encrypted file formats, especially for documents containing personal or confidential data.

  • Training and Policies: Regularly train staff on the importance of encryption and establish clear policies for handling sensitive data.