# Detection and Response for HAFNIUM Activity **URL:** \ **Category:** Elastic Security\ **Created:** [March 4, 2021, 8:45pm UTC](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289 "2021-03-04T20:45:02Z")\ **Posts on this page:** 1\ **Showing post:** 3
**Author:** ![dstepanic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dstepanic/32/84987_2.png) [@dstepanic](https://discuss.elastic.co/u/dstepanic)\ **Post date:** [March 10, 2021, 10:47pm UTC](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3 "2021-03-10T22:47:14Z")
# Update - Detection and Response for HAFNIUM Activity ## Executive summary Elastic Security Intelligence & Analytics has identified additional behaviors related to or inspired by HAFNIUM activity, as outlined in the prior [post](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289). This update contains additional post-exploitation details observed in Elastic telemetry indicating successful exploitation of recently-disclosed Microsoft Exchange vulnerabilities. While the details of this activity may resemble that attributed to the HAFNIUM threat group, we assess with moderate confidence that opportunistic or other threats are responsible. ## Details On March 4, 2021, Elastic Security identified evidence that Microsoft Exchange vulnerabilities ([CVE-2021-26855](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855), [CVE-2021-26857](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857), [CVE-2021-26858](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858), and [CVE-2021-27065](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065)) were being exploited via telemetry; with evidence of compromise as early as February 28, 2021. As we have continued to monitor telemetry for evidence these vulnerabilities were being exploited, we wanted to provide the community with additional information around this cluster of emerging threat activity. The earliest evidence of observed post-exploitation for this cluster of activity occurred on February 28, 2021. Elastic observed a significant increase in post-exploitation activity related to compromised environments from last week’s published Microsoft Exchange Server vulnerabilities. Threat researchers found inconsistent methodologies present in this activity, which may indicate more than one group pursuing reconnaissance and credential-harvesting objectives. In several customer environments, adversaries deployed [batch scripts](https://www.virustotal.com/gui/file/2f907f2da760bbadc713d710166a68e73895a75cb695b4890c63aea453e838c0/detection) that automated several functions including account enumeration, credential-harvesting and network discovery. The Security Account Manager (SAM), System and Security hives can be used to obtain plaintext or other credentials. Data staged and stolen from enterprises included similar materials, example commands are depicted in Figure 1: > cmd /c reg save hklm\sam C:\windows\temp\debugsms\sam > cmd /c reg save hklm\system C:\windows\temp\debugsms\system > cmd /c reg save hklm\security C:\windows\temp\debugsms\security Figure 1 - Commands used to dump sensitive data from Windows Registry By collecting this data, the adversary obtains Windows account password hashes and sensitive data that may provide insights into the environment and opportunities for additional lateral movement pivots within the network. Figure 2 depicts a process tree of this activity ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/2/7256d3ff489198398538e02e4999c2b4600eb911.png) Figure 2 - Process tree of SAM registry hive being dumped Along with the captured registry hives, network enumeration and discovery data was collected using the following commands in Figure 3. > cmd /c ipconfig /all > cmd /c arp -a Figure 3 - Network discovery commands Reconnaissance output was being staged and compressed on March 8 and March 9 using the Windows [makecab](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/makecab) utility. Using this tool, adversaries compressed reconnaissance output and hive data together then altered output files to masquerade as GIF or PNG image files. An example of this command appears in Figure 4. > cmd /c makecab /f c:\windows\temp\REDACTED.log /d compressiontype=lzx /d compressionmemory=21 /d maxdisksize=10240000000 /d diskdirectorytemplate="C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth" /d cabinetnametemplate=REDACTED.gif Figure 4 - makecab command used to compress collected data Below is an image showing the typical contents of these cabinet files in Figure 5. ![folder](https://us1.discourse-cdn.com/elastic/original/3X/4/9/49857dbecd8d44dc47622fc67b8d1b1a21baba07.png) Figure 5 - CAB contents including registry hives and network information During these periods of activity, adversaries also removed malicious and staged files to prevent their discovery. This behavior was executed through the Exchange IIS webserver process (“w3wp.exe”) and executed almost 24 hours after the registry hives were stolen in some cases. Figure 6 depicts a process lineage in which the adversary uses scripts to clean up after themselves. ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef5048dcc578b9fe4510ace50e879c18bb549918.png) Figure 6 - Process tree of cleanup command Threat researchers identified evidence of adversaries modifying the configuration of Windows Remote Management to enable compatibility listeners, a setting which allows traffic on port 443 as well as starting the WinRM service using the quickconfig command as seen in Figure 7. > cmd /c winrm set winrm/config/service @{EnableCompatibilityHttpsListener="true"} > cmd /c winrm quickconfig -q Figure 7 - WinRM configuration commands Each of the previously discussed commands were executed in succession triggered through a scheduled task named “WwanSvcdcs” created from the batch file as depicted in Figure 8. > schtasks /create /ru system /tn "\Microsoft\Windows\WwanSvcdcs" /tr "cmd /c c:\windows\temp\TMP23875.bat" /sc once /st 23:59 Figure 8 - Scheduled task set-up and execution #### Overview - Elastic Security confirmed that recently disclosed Microsoft Exchange vulnerabilities were being exploited by at least one and possibly several threat groups - Analysis suggests that batch scripts used in more than one instance performed automation of host/network discovery, account enumeration, credential-harvesting, data staging, data theft and tidying functions - Organizations were targeted in several industries including technical consulting, financial services and entertainment #### Timeline of events - February 28, 2021 - Earliest evidence of Exchange Organization administrator enumeration - March 2, 2021 - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065 issued to vulnerability - March 2, 2021 - Microsoft releases patch - March 3, 2021 - Earliest attempted post-exploitation activity in several customer environments - March 4, 2021 - Elastic releases initial Discuss post and public detection logic - March 5-9, 2021 - Additional post-exploitation activity in customer environments - March 10, 2021 - Elastic releases follow-up describing newly-observed activity with detection logic ## Impact The post-exploitation behaviors observed leverage multiple tactics and techniques categorized by the MITRE ATT&CK® framework: - Tactics - Techniques ## Detection ##### Detection logic On March 10, 2021, Elastic released guidance describing Elastic Endpoint rules that target this post-exploitation activity described in the public repository: - [Credential Acquisition via Registry Hive Dumping](https://github.com/elastic/detection-rules/blob/2fe48e32254c5591470e026f5b2922de5a5f580f/rules/windows/credential_access_dump_registry_hives.toml) - [Local Scheduled Task Commands](https://github.com/elastic/detection-rules/blob/2fe48e32254c5591470e026f5b2922de5a5f580f/rules/windows/persistence_local_scheduled_task_commands.toml) - [Microsoft Exchange Worker Spawning Suspicious Processes](https://github.com/elastic/detection-rules/blob/main/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml) The following supplemental queries for Elastic Endgame may also be recommended: **Suspicious Microsoft Cabinet Maker execution (Endgame EQL)** Identifies the execution of Microsoft Cabinet Maker from suspicious directories or with suspicious process argument, this may indicate data staging activity as a preparation step for exfiltration: > process where subtype.create and original\_file\_name = “makecab.exe” and wildcard(command\_line, “\*Microsoft\\Exchange Server\\*”, “\*inetpub\\wwwroot\*”) Figure 9-1 - Suspicious Microsoft Cabinet Maker execution directory > process where subtype.create and original\_file\_name = “makecab.exe” and wildcard(command\_line, "\*cabinetnametemplate=\*.png", "\*cabinetnametemplate=\*.jpg", "\*cabinetnametemplate=\*.gif", "\*cabinetnametemplate=\*.jpeg", “\*cabinetnametemplate=\*.jpe”, “\*cabinetnametemplate=\*.bmp” Figure 9-2 - Suspicious Microsoft Cabinet Template Extensions **Suspicious Scheduled Task Creation (Endgame EQL)** Identifies the creation of a scheduled task with suspicious path (tasks within \Microsoft\Windows path are rarely created using schtasks.exe utility): > process where subtype.create and original\_file\_name = “schtasks.exe” and command\_line == “\*create\* \\Microsoft\\Windows\\*” Figure 10 - Suspicious Scheduled Task Creation For additional detection logic, our first [post](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289) related to the HAFNIUM activity is strongly recommended for review. ## References 1. Detection and Response for HAFNIUM Activity > [@Detection and Response for HAFNIUM Activity](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289): > > Detection and Response for HAFNIUM Activity Executive summary On March 2, 2021, Microsoft released a security update for on-premises Exchange servers to address vulnerabilities being exploited. Security vendors are seeing these vulnerabilities being actively exploited, confirming an imminent threat of leaving systems un-patched. Elastic Security Intelligence & Analytics shares information about detections for this activity, and observations about exploitation in the wild. Details On March 2, 20… 1. HAFNIUM targeting Exchange Servers with 0-day exploits [https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/](https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/) ## Indicators of Compromise Table 1 describes atomic indicators of compromise (IOCs) observed in this intrusion-set. IOCs observed by Elastic have been included for the community, and don't represent all IOCs associated with HAFNIUM or HAFNIUM-inspired intrusions. | Artifact | Note | SHA256 | | --- | --- | --- | | xx.bat | Batch Script | 2f907f2da760bbadc713d710166a68e73895a75cb695b4890c63aea453e838c0 | --- _[View the full topic](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289)._