Among threat actors, Cobalt Strike is recognized as an advanced suite of tools for penetration testing that offers a wide range of features.
The detection of Cobalt Strike beacons has improved with the advent of modern security solutions. In order to deploy toolkits in a creative manner, threat actors are looking for innovative means of deploying them.
In order to side-load malicious DLLs, the threat actors are exploiting the command line tool MPCmdRun.exe of Microsoft Defender.
Those three files are:-
- A Windows CL utility
- A DLL file
- A LOG file
In Windows Defender, there is a command-line utility named MpCmdRun.exe that can be used to perform a number of tasks. It could execute or perform the following key tasks:-
- Commands to scan for malware
- Collect information
- Restore items
- Perform diagnostic tracing
As soon as MpCmdRun.exe is run, a legitimate DLL file (mpclient.dll) will be loaded, which is necessary to ensure the correct operation of the program.
At this stage, from the “c0000015.log” file, an encrypted Cobalt Strike payload was loaded which was later decrypted by the executed code. During the earlier stages of the attack, there were two other files that were dropped along with this file.
This event shows that LockBit operators have switched to Windows Defender command line tools from VMware. But, it is not yet clear why the threat actors have switched.
These days, it’s very common for users to evade EDR and AV detection with such tools, so evaluating the security controls of an organization is extremely important.