# Detection and Response for HAFNIUM Activity **URL:** \ **Category:** Elastic Security\ **Created:** [March 4, 2021, 8:45pm UTC](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289 "2021-03-04T20:45:02Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![devonkerr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devonkerr/32/56711_2.png) [@devonkerr](https://discuss.elastic.co/u/devonkerr)\ **Post date:** [March 4, 2021, 8:45pm UTC](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/1 "2021-03-04T20:45:02Z")
# Detection and Response for HAFNIUM Activity ## Executive summary On March 2, 2021, Microsoft released a security update for on-premises Exchange servers to address vulnerabilities being exploited. Security vendors are seeing these vulnerabilities being actively exploited, confirming an imminent threat of leaving systems un-patched. Elastic Security Intelligence & Analytics shares information about detections for this activity, and observations about exploitation in the wild. ## Details On March 2, 2021, Microsoft released a [security update](https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/)describing several 0day exploits targeting on-premises Microsoft Exchange servers. Four published vulnerabilities relate to this activity, for which Microsoft released a [patch](https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server). The vulnerabilities include [CVE-2021-26855](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855), [CVE-2021-26857](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857), [CVE-2021-26858](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858), and [CVE-2021-27065](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065). As reported by [Volexity](https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/) and other security vendors, adversaries exploiting these vulnerabilities may install webshells that function as backdoors. With privileges of the IIS web server, adversaries harvested credentials, conducted reconnaissance, extracted and stole MailBox content and created new users. Elastic Security Intelligence & Analytics has summarized capabilities related to these behaviors to address affected users. Elastic has also observed evidence of this activity in our telemetry, and we’ve contacted affected customers. One behavior we observed was the deletion of the administrator account from the “Exchange Organization administrators” group (Figure 1) . > ![image (1)](https://us1.discourse-cdn.com/elastic/original/3X/8/6/8646a24870c67e4f845f353b1fbe06b17614371b.png) Figure 1 - Process ancestry of net group command removing administrator account Threat researchers observed unusual descendants (“cmd.exe”, “powershell.exe”) of the Exchange IIS webserver (“w3wp.exe”) that involved remote network connections (86.105.18[.]116). Our observations have been independently corroborated by [others](https://twitter.com/jhencinski/status/1367176083582427137?s=21) in the community (Figure 2) as malicious. While this activity resembles the HAFNIUM activity group, these observations may represent opportunistic or other threats. > ![](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e12e048e2ec9c115ff5a76d58682e0f740980a67.jpeg) Figure 2 - Adversary download of malicious BATCH script, observed by Elastic Elastic found that adversaries ran a malicious BATCH script (“1.bat”) which downloaded a legitimate version of the Opera browser (“opera\_browser.exe”) and a malicious DLL (“opera\_browser.dll”) before launching MSIExec (“msiexec.exe”). On execution, the Opera browser automatically loaded the malicious DLL due to a side-loading vulnerability, then injected shellcode into MSIExec. #### Overview - National Institute of Standards and Technology (NIST) assigned a critical [CVSS score](https://www.first.org/cvss/v3.1/specification-document) of 7.8 - 9.1 out of 10 based on remote code execution without authentication - The vulnerability affects on-premises Exchange servers which are self-managed - The initial activity was reported by Microsoft and attributed to “HAFNIUM,” which Microsoft describes as a China-based threat; note general adoption of this methodology by opportunistic threats is likely #### Timeline of events - March 2, 2021 - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065 issued to vulnerability - March 2, 2021 - Microsoft released patch - March 3, 2021 - Elastic observes post-exploitation activity via telemetry - March 4, 2021 - Elastic releases related public detection logic ## Impact Microsoft asserts that these vulnerabilities affect all on-premises Exchange servers (Exchange Server 2013, Exchange Server 2016 and Exchange Server 2019) and issued an update for Microsoft Exchange Server 2010 for completeness. Exchange Online is not affected. Notably, the initial attack requires on-premises Exchange servers to be accessible to the public Internet via port 443. Attackers with access to enterprises where Exchange servers are internally accessible may be able to exploit unpatched vulnerabilities related to this activity. The associated HAFNIUM exploit chain leverages multiple tactics and techniques categorized by the MITRE ATT&CK® framework: - Tactics - Techniques/Subtechniques ## Detection ##### Detection logic On March 4, 2021, Elastic released guidance describing Elastic Endpoint rules that target this cluster of activity (HAFNIUM) in the public repository: - [Potential Credential Access via Windows Utilities](https://github.com/elastic/detection-rules/blob/a0e86e20d6ad039dfe4446b28f3c29642b50385c/rules/windows/credential_access_cmdline_dump_tool.toml) - [Exporting Exchange Mailbox via PowerShell](https://github.com/elastic/detection-rules/blob/a0e86e20d6ad039dfe4446b28f3c29642b50385c/rules/windows/collection_email_powershell_exchange_mailbox.toml) - [Encrypting Files with WinRar or 7z](https://github.com/elastic/detection-rules/blob/a0e86e20d6ad039dfe4446b28f3c29642b50385c/rules/windows/collection_winrar_encryption.toml) - [Connection to Commonly Abused Web Services](https://github.com/elastic/detection-rules/blob/236c630c9032056487c8b9d8d7ddc09dfd3521cb/rules/windows/command_and_control_common_webservices.toml) - [PsExec Network Connection](https://github.com/elastic/detection-rules/blob/a0e86e20d6ad039dfe4446b28f3c29642b50385c/rules/windows/execution_psexec_lateral_movement_command.toml) - [Suspicious Process Execution via Renamed PsExec Executable](https://github.com/elastic/detection-rules/blob/a0e86e20d6ad039dfe4446b28f3c29642b50385c/rules/windows/execution_suspicious_psexesvc.toml) - [Remotely Started Services via RPC](https://github.com/elastic/detection-rules/blob/a0e86e20d6ad039dfe4446b28f3c29642b50385c/rules/windows/lateral_movement_remote_services.toml) - [User Account Creation](https://github.com/elastic/detection-rules/blob/a0e86e20d6ad039dfe4446b28f3c29642b50385c/rules/windows/persistence_user_account_creation.toml) Additionally, two new behavioral rules for Elastic Endpoint have been created in light of this newly reported activity: - [Microsoft Exchange Server UM Spawning Suspicious Processes](https://github.com/elastic/detection-rules/blob/7.12/rules/windows/initial_access_suspicious_ms_exchange_process.toml) - [Microsoft Exchange Server UM Writing Suspicious Files](https://github.com/elastic/detection-rules/blob/7.12/rules/windows/initial_access_suspicious_ms_exchange_files.toml) On March 4, 2021, Elastic also released guidance describing Elastic Endgame rules that target this cluster of activity. The following rules can be enabled: - Creation of an Archive File - Encrypting Files with 7Zip - Webshell Detection - PsExec Lateral Movement Command - Suspicious PowerShell Downloads - Enumeration of Administrator Accounts The following supplemental queries for Elastic Endgame may also be recommended: **Memory Dump via Comsvcs (Endgame EQL):** The detection logic in Figure 1 (below) identifies suspicious or unexpected use of a native application (“rundll32.exe”) to perform a process memory dump. This activity may indicate an attempt to obtain process memory from LSASS, which may contain credentials. > process where subtype.create and process\_name = “rundll32.exe” and command\_line == “MiniDump full” Figure 3 - Memory Dump via Comsvcs **Descendants of IIS (Endgame EQL):** The detection logic in Figure 2 (below) identifies unusual descendants of the IIS webserver process (“w3wp.exe”). This activity may indicate commands or other observable behaviors related to the use of a persistent webshell. > process where subtype.create and parent\_process\_name = “w3wp.exe” Figure 4 - Descendants of IIS **Creation of an Archive File (Endgame EQL):** The detection logic in Figure 3 (below) identifies file operations related to common archiving utilities. This activity may indicate an attempt to obtain process memory from LSASS, which may contain credentials. > file where not subtype.delete and wildcard(file\_name, “_.7z”, “_.rar”) Figure 5 - Creation of an Archive File ## Defensive recommendations 1. Review and [implement](https://www.elastic.co/guide/en/siem/guide/current/rules-ui-create.html#create-rule-ui) the above detection logic within your environment using technology such as Elastic Endpoint, Winlogbeat, Filebeat, Packetbeat, or Network Security Monitoring (NSM) platforms such as Zeek or Suricata. 2. Review and ensure that you have deployed the latest Microsoft [Security Updates](https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/) for Exchange Server, consider other [recommendations](https://www.microsoft.com/security/blog/2020/06/24/defending-exchange-servers-under-attack/) from Microsoft for Exchange hardening. 3. Maintain backups of your critical systems to aid in quick recovery. 4. Perform routine vulnerability scans of your systems and patch identified vulnerabilities. ## References 1. CVE-2021-26855 | Microsoft Server Remote Code Execution Vulnerability > **[Security Update Guide - Microsoft Security Response Center](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855)** 1. CVE-2021-26857 | Microsoft Server Remote Code Execution Vulnerability > **[Security Update Guide - Microsoft Security Response Center](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857)** 1. CVE-2021-26858 | Microsoft Server Remote Code Execution Vulnerability > **[Security Update Guide - Microsoft Security Response Center](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858)** 1. CVE-2021-27065 | Microsoft Server Remote Code Execution Vulnerability > **[Security Update Guide - Microsoft Security Response Center](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065)** 1. HAFNIUM targeting Exchange Servers with 0-day exploits [https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/](https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/) 1. Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities > **[Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day...](https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/)** > > \[UPDATE\] March 8, 2021 – Since original publication of this blog, Volexity has now observed that cyber espionage operations using the SSRF vulnerability CVE-2021-26855 started occurring on January 3, 2021, three \[…\] ## Indicators of Compromise Table 1 describes atomic indicators of compromise (IOCs) observed in this intrusion-set. IOCs observed by Elastic have been included for the community, and don't represent all IOCs associated with HAFNIUM or HAFNIUM-inspired intrusions. | Artifact | Note | SHA256 | | --- | --- | --- | | 1.bat | Batch Script, automates download and execution | Not recovered | | [shellcode] | Encrypted object | 4e3b7cb4cebe2b00645dda08a229f6fdc914a46968444c4afc99e675c926c8a2 | | opera\_browser.exe | Legitimate Opera browser application | 5aa7c379eb054a745d3c187f877fea6fe2b9bd3792365714a8a52c2504d4ac07 | | opera\_browser.dll | Malicious DLL, side-loaded by opera\_browser.exe | b212655aeb4700f247070ba5ca6d9c742793f108881d07e4d1cdc4ede175fcff | | 86.105.18[.]116 | Staging site, hosts files used in this activity cluster | N/A | Table 1 - Indicators of Compromise ---
**Author:** ![C0FFEEC0FFEE](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/c0ffeec0ffee/32/75111_2.png) [@C0FFEEC0FFEE](https://discuss.elastic.co/u/C0FFEEC0FFEE)\ **Post date:** [March 10, 2021, 5:56pm UTC](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/2 "2021-03-10T17:56:03Z")
I backported the SIEM rules to 7.10 syntax: [rules\_export\_hafnium\_7.10\_backport.ndjson (github.com)](https://github.com/C0FFEEC0FFEE/files/blob/main/rules_export_hafnium_7.10_backport.ndjson) ---
**Author:** ![dstepanic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dstepanic/32/84987_2.png) [@dstepanic](https://discuss.elastic.co/u/dstepanic)\ **Post date:** [March 10, 2021, 10:47pm UTC](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3 "2021-03-10T22:47:14Z")
# Update - Detection and Response for HAFNIUM Activity ## Executive summary Elastic Security Intelligence & Analytics has identified additional behaviors related to or inspired by HAFNIUM activity, as outlined in the prior [post](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289). This update contains additional post-exploitation details observed in Elastic telemetry indicating successful exploitation of recently-disclosed Microsoft Exchange vulnerabilities. While the details of this activity may resemble that attributed to the HAFNIUM threat group, we assess with moderate confidence that opportunistic or other threats are responsible. ## Details On March 4, 2021, Elastic Security identified evidence that Microsoft Exchange vulnerabilities ([CVE-2021-26855](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855), [CVE-2021-26857](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857), [CVE-2021-26858](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858), and [CVE-2021-27065](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065)) were being exploited via telemetry; with evidence of compromise as early as February 28, 2021. As we have continued to monitor telemetry for evidence these vulnerabilities were being exploited, we wanted to provide the community with additional information around this cluster of emerging threat activity. The earliest evidence of observed post-exploitation for this cluster of activity occurred on February 28, 2021. Elastic observed a significant increase in post-exploitation activity related to compromised environments from last week’s published Microsoft Exchange Server vulnerabilities. Threat researchers found inconsistent methodologies present in this activity, which may indicate more than one group pursuing reconnaissance and credential-harvesting objectives. In several customer environments, adversaries deployed [batch scripts](https://www.virustotal.com/gui/file/2f907f2da760bbadc713d710166a68e73895a75cb695b4890c63aea453e838c0/detection) that automated several functions including account enumeration, credential-harvesting and network discovery. The Security Account Manager (SAM), System and Security hives can be used to obtain plaintext or other credentials. Data staged and stolen from enterprises included similar materials, example commands are depicted in Figure 1: > cmd /c reg save hklm\sam C:\windows\temp\debugsms\sam > cmd /c reg save hklm\system C:\windows\temp\debugsms\system > cmd /c reg save hklm\security C:\windows\temp\debugsms\security Figure 1 - Commands used to dump sensitive data from Windows Registry By collecting this data, the adversary obtains Windows account password hashes and sensitive data that may provide insights into the environment and opportunities for additional lateral movement pivots within the network. Figure 2 depicts a process tree of this activity ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/2/7256d3ff489198398538e02e4999c2b4600eb911.png) Figure 2 - Process tree of SAM registry hive being dumped Along with the captured registry hives, network enumeration and discovery data was collected using the following commands in Figure 3. > cmd /c ipconfig /all > cmd /c arp -a Figure 3 - Network discovery commands Reconnaissance output was being staged and compressed on March 8 and March 9 using the Windows [makecab](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/makecab) utility. Using this tool, adversaries compressed reconnaissance output and hive data together then altered output files to masquerade as GIF or PNG image files. An example of this command appears in Figure 4. > cmd /c makecab /f c:\windows\temp\REDACTED.log /d compressiontype=lzx /d compressionmemory=21 /d maxdisksize=10240000000 /d diskdirectorytemplate="C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth" /d cabinetnametemplate=REDACTED.gif Figure 4 - makecab command used to compress collected data Below is an image showing the typical contents of these cabinet files in Figure 5. ![folder](https://us1.discourse-cdn.com/elastic/original/3X/4/9/49857dbecd8d44dc47622fc67b8d1b1a21baba07.png) Figure 5 - CAB contents including registry hives and network information During these periods of activity, adversaries also removed malicious and staged files to prevent their discovery. This behavior was executed through the Exchange IIS webserver process (“w3wp.exe”) and executed almost 24 hours after the registry hives were stolen in some cases. Figure 6 depicts a process lineage in which the adversary uses scripts to clean up after themselves. ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef5048dcc578b9fe4510ace50e879c18bb549918.png) Figure 6 - Process tree of cleanup command Threat researchers identified evidence of adversaries modifying the configuration of Windows Remote Management to enable compatibility listeners, a setting which allows traffic on port 443 as well as starting the WinRM service using the quickconfig command as seen in Figure 7. > cmd /c winrm set winrm/config/service @{EnableCompatibilityHttpsListener="true"} > cmd /c winrm quickconfig -q Figure 7 - WinRM configuration commands Each of the previously discussed commands were executed in succession triggered through a scheduled task named “WwanSvcdcs” created from the batch file as depicted in Figure 8. > schtasks /create /ru system /tn "\Microsoft\Windows\WwanSvcdcs" /tr "cmd /c c:\windows\temp\TMP23875.bat" /sc once /st 23:59 Figure 8 - Scheduled task set-up and execution #### Overview - Elastic Security confirmed that recently disclosed Microsoft Exchange vulnerabilities were being exploited by at least one and possibly several threat groups - Analysis suggests that batch scripts used in more than one instance performed automation of host/network discovery, account enumeration, credential-harvesting, data staging, data theft and tidying functions - Organizations were targeted in several industries including technical consulting, financial services and entertainment #### Timeline of events - February 28, 2021 - Earliest evidence of Exchange Organization administrator enumeration - March 2, 2021 - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065 issued to vulnerability - March 2, 2021 - Microsoft releases patch - March 3, 2021 - Earliest attempted post-exploitation activity in several customer environments - March 4, 2021 - Elastic releases initial Discuss post and public detection logic - March 5-9, 2021 - Additional post-exploitation activity in customer environments - March 10, 2021 - Elastic releases follow-up describing newly-observed activity with detection logic ## Impact The post-exploitation behaviors observed leverage multiple tactics and techniques categorized by the MITRE ATT&CK® framework: - Tactics - Techniques ## Detection ##### Detection logic On March 10, 2021, Elastic released guidance describing Elastic Endpoint rules that target this post-exploitation activity described in the public repository: - [Credential Acquisition via Registry Hive Dumping](https://github.com/elastic/detection-rules/blob/2fe48e32254c5591470e026f5b2922de5a5f580f/rules/windows/credential_access_dump_registry_hives.toml) - [Local Scheduled Task Commands](https://github.com/elastic/detection-rules/blob/2fe48e32254c5591470e026f5b2922de5a5f580f/rules/windows/persistence_local_scheduled_task_commands.toml) - [Microsoft Exchange Worker Spawning Suspicious Processes](https://github.com/elastic/detection-rules/blob/main/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml) The following supplemental queries for Elastic Endgame may also be recommended: **Suspicious Microsoft Cabinet Maker execution (Endgame EQL)** Identifies the execution of Microsoft Cabinet Maker from suspicious directories or with suspicious process argument, this may indicate data staging activity as a preparation step for exfiltration: > process where subtype.create and original\_file\_name = “makecab.exe” and wildcard(command\_line, “\*Microsoft\\Exchange Server\\*”, “\*inetpub\\wwwroot\*”) Figure 9-1 - Suspicious Microsoft Cabinet Maker execution directory > process where subtype.create and original\_file\_name = “makecab.exe” and wildcard(command\_line, "\*cabinetnametemplate=\*.png", "\*cabinetnametemplate=\*.jpg", "\*cabinetnametemplate=\*.gif", "\*cabinetnametemplate=\*.jpeg", “\*cabinetnametemplate=\*.jpe”, “\*cabinetnametemplate=\*.bmp” Figure 9-2 - Suspicious Microsoft Cabinet Template Extensions **Suspicious Scheduled Task Creation (Endgame EQL)** Identifies the creation of a scheduled task with suspicious path (tasks within \Microsoft\Windows path are rarely created using schtasks.exe utility): > process where subtype.create and original\_file\_name = “schtasks.exe” and command\_line == “\*create\* \\Microsoft\\Windows\\*” Figure 10 - Suspicious Scheduled Task Creation For additional detection logic, our first [post](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289) related to the HAFNIUM activity is strongly recommended for review. ## References 1. Detection and Response for HAFNIUM Activity > [@Detection and Response for HAFNIUM Activity](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289): > > Detection and Response for HAFNIUM Activity Executive summary On March 2, 2021, Microsoft released a security update for on-premises Exchange servers to address vulnerabilities being exploited. Security vendors are seeing these vulnerabilities being actively exploited, confirming an imminent threat of leaving systems un-patched. Elastic Security Intelligence & Analytics shares information about detections for this activity, and observations about exploitation in the wild. Details On March 2, 20… 1. HAFNIUM targeting Exchange Servers with 0-day exploits [https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/](https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/) ## Indicators of Compromise Table 1 describes atomic indicators of compromise (IOCs) observed in this intrusion-set. IOCs observed by Elastic have been included for the community, and don't represent all IOCs associated with HAFNIUM or HAFNIUM-inspired intrusions. | Artifact | Note | SHA256 | | --- | --- | --- | | xx.bat | Batch Script | 2f907f2da760bbadc713d710166a68e73895a75cb695b4890c63aea453e838c0 | ---
**Author:** ![devonkerr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devonkerr/32/56711_2.png) [@devonkerr](https://discuss.elastic.co/u/devonkerr)\ **Post date:** [September 21, 2021, 11:51am UTC](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/5 "2021-09-21T11:51:25Z")
This topic was automatically closed 100 days after the last reply. New replies are no longer allowed.