Malware, Incident Response, and Digital Forensics: What You Need to Know

Posted November 8, 2019

Since we opened the castle doors, GreyCastle Security has responded to hundreds of cybersecurity incidents, from basic adware infections to organizationally crippling malware. In many of these cases, we’ve noticed that the attack vectors to these incidents have been both similar and not surprising:

People are still clicking on things. They’re still opening attachments that they shouldn’t be. Or, employees are misusing their privileges in an environment to gain access to information that they shouldn’t. In some cases, there are misconfigurations that allow attackers to brute force and get into a network. The important thing to note is that most, if not all, of these incidents are caused by user error.

Currently, there is a big misconception that certain pieces of malware or certain security incidents that completely bring down an organization are the cause of government entities attacking each other or are due to a super sophisticated malware that’s never been seen before. That’s just not the case.

Over time, GreyCastle Security has seen more impacting and more crippling malware affecting organizations. This type of malware takes data, propagates across networks, and brings organizations down. This malware is not a “you only see it once” kind of thing. It’s very common. There are campaigns going around right now that distribute this self-propagating, exfiltrating malware. Two specific cases that we’ve seen in the past year that we’d like to touch on here are SamSam and Emotet. (Unfortunately, although the actors behind SamSam have been arrested, when one type of malware is eradicated, there are five more to take its place.)

SamSam was a very “manual” ransomware deployment. SamSam and other samples like it don’t require end users to click on anything. Instead, they exploit Remote Desktop Protocol by brute forcing weak user credentials. Many infected organizations had a username of “administrator” and no set password. Some of the other hallmarks of SamSam include:

Backup Deletion
Domain Administrator Escalation
Domain Encryption
~1 Week from Access to Deployment

Think about your own network. Now imagine that ransomware has hit on all Windows-based domain-connected systems… and then when you try to get to your backups, which also happened to be domain-connected, you find that they are gone. How would you recover from that? In many cases, your security team will (or should) already have processes and procedures in place that allow you to resume operations in a timely manner.

However, things become complicated when your team is dealing with a more impacting malware such as Emotet.

There are stages to the Emotet malware. It is not just a ransomware deployment and it is not just a malware infection. In the first stage, someone will click on an attachment and their computer will become infected. From there, Emotet will begin propagating either by abusing privileges or it will escalate its privileges. Due to the multistage infection process, your system is not just infected with Emotet – you will also be infected with TrickBot (a banking trojan) and, eventually, ransomware will drop on all infected systems. The hallmarks of Emotet are:

Phishing
Privilege Escalation/Abuse
Propagation to Domain Systems
Exfiltration
Ransomware Deployment
~3 Weeks from Initial Infection to Ransomware

In the case of Emotet, you are not just dealing with ransomware. You are also trying to discern what was taken. You need to find a way to “prove the negative” and prove that nothing was taken. This is extremely important during these investigations.

Malware variants such as Emotet are becoming much more common. We often see organizations that have hundreds or thousands of systems that are becoming infected. How do they prove that nothing was taken from any system? It is extremely difficult to do so, because to be as close to 100% positive as possible, you must examine every system.

During GreyCastle Security’s incident response service, we often get the same question: “When do we start recovering our systems and stop worrying about what happened?”

In truth, every business is different, but it’s likely your organization will need to:

Understand the process and goals for incident response and digital forensics
Determine the best method to respond to organizationally crippling incidents
Determine the best method for constructing and deploying an incident response team

To do this, let’s take a look at the basics.

What is incident response?

The NIST glossary defines an incident as a “violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices.” (Ex. Email Account Compromise, Ransomware Attack, Intrusion Attempts, Denial of Service)

The objectives for incident response include:

Prepare for an effective incident response effort
Detect and analyze attack vectors, indicators or compromise
Identification of IoCs, attack vectors, or sources of precursors and indicators
Contain and eradicate the threat, allowing the organization to resume normal business operations
Perform lessons-learned to mitigate the risk of future, similar security incidents and improve the organization’s overall security posture

What is digital forensics?

The NIST glossary defines digital forensics as “the application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody for the data.” (Ex. HR Investigation, Root Cause Analysis, Exfiltration Analysis, Fraud/Theft, eDiscovery)

The objectives for digital forensics include:

Identify and acquire potential sources of data collection
Examine acquired evidence to assess and extract relevant information
Analyze examined evidence to draw conclusions
Report and present findings of relevance

The most important thing to note is: incident response and digital forensics are not the same thing.

Incident response is a way to coordinate an organization’s response to a cybersecurity event. Additionally, incident response is not on the same “level” as digital forensics. Digital forensics is a sub-function of incident response; it doesn’t work the other way around.