Phishing is Evolving Quickly

Phishing kits are Evolving 

SaaS Attacks 

SAML Jacking 

    It’s not just application-level lateral movement and persistence to worry about, though. It’s possible the attacker can start moving laterally across other user accounts. If they have selected their targets well, they might even find they have admin access to some downstream SaaS application that has been configured for SAML logins using Okta. 

    For example, maybe they compromise a finance employee who has admin access to their business expenses SaaS application. Then the attacker might be able to use a new technique like SAMLjacking to start attacking other users in a watering hole attack to achieve lateral movement. 

    There are many options for lateral movement and persistence after an account compromise, so simple containment actions like password resets for SSO credentials are not nearly enough to contain a knowledgeable attacker. 

    Update IR playbooks to to deal with SSO account compromise, factoring in lateral movement and persistence across cloud apps. This really necessitates that you understand what business apps your organization is using, how they are accessed (e.g. SSO or username and password) and what functionality exists that could be abused by an attacker. 

https://www.lab539.com/aitm 

Tools :: no vnc :: EvilnoVNC :: Modlishka 

Read More ::

• from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud
• 6-months-tracking-aitm-campaigns 
• https://blog.thinkst.com/2024/01/defending-against-the-attack-of-the-cloned-websites.html 
• https://zolder.io/using-honeytokens-to-detect-aitm-phishing-attacks-on-your-microsoft-365-tenant/

WMI Commands

• Get-WmiObject -class Win32_Product
  • Gets a listing of all the installed software on a machine.
• Get-WmiObject - class Win32_Account
  • Gets a listing of all the user accounts
• Get-WmiObject - class Win32_BIOS
  
  • Many times used by malware to determine if the host is a virtual machine or not.
• Set up a remote windows command
  • $command =  "ipconfig /all >> c:\users\all users\desktop\results.txt"
  • $cmd = "cmd.exe /c $command"
  • Invoke-Method -class Win32_Process -name Create -ArgumentList $cmd -ComputerName \\Desktopname\
• wmic /node:172.16.27.38 process call create "cmd.exe /c /net user dude /add"
• uses WMIC to add a user on a remote machine

Powershell Fun

•  Link Ref
  
• Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList cmd.exe 
• Invoke-CimMethod -ClassName Win32_Process -MethodName create -Arguments @{commandline="notepad.exe"}
  

 

One Attack Example

1. From a powershell command prompt, attacker launches WMIC with the intent of creating a process on the remote machine and adding a user to that remote machine.
   1. wmic /node:172.16.27.38 process call create "cmd.exe /c /net user dude /add"
2. On the remote machine wmiprvse.exe gets the call and will run the commands. To find this attack in Carbon Black, check out this search:
   1. process_name:cmd.exe AND parent_name:wmiprvse.exe AND childproc_name:net.exe cmdline:user
   2. Event IDs on the remote machine are:
      1. 4720; 4722; 4738; 4732