A new process injection technique named Mockingjay, not to be confused with the 2010 science fiction novel by Suzanne Collins which is part of The Hunger Games series, could be exploited by threat actors to bypass security solutions to execute malicious code on compromised systems. Unlike traditional methods, Mockingjay leverages legitimate DLLs with RWX (read, write, execute) sections to evade EDR hooks and inject code into remote processes.[1]
Process injection involves executing arbitrary code within the address space of a trusted running process, allowing attackers to run malicious code without detection. Common process injection techniques include DLL injection, PE (portable executable) injection, reflective DLL injection, thread execution hijacking, process hollowing, mapping injection, and APC (asynchronous procedure call) injection. Mockingjay sets itself apart by avoiding commonly abused Windows API calls, special permissions, memory allocation, or starting new threads, thereby reducing detection opportunities.
The injection is executed without space allocation, setting permissions, or even starting a thread," researchers Thiago Peixoto, Felipe Duarte, and Ido Naor said in a report. The uniqueness of this technique is that it requires a vulnerable DLL and copying code to the right section.
Some of the well-known process injection techniques include dynamic link library (DLL) injection, portable executable injection, thread execution hijacking, process hollowing, and process Doppelgänging, among others.
Each of these methods requires a combination of specific system calls and Windows APIs to carry out the injection, thereby allowing defenders to craft appropriate detection and mitigation procedures. What sets Mockingjay stands apart is that it subverts these security layers by eliminating the need to execute Windows APIs usually monitored by security solutions by leveraging pre-existing Windows portable executable files that contain a default memory block protected with Read-Write-Execute (RWX) permissions.
This is accomplished using msys-2.0.dll, which comes with a "generous 16 KB of available RWX space," making it an ideal candidate to load malicious code and fly under the radar. However, it's worth noting that there could be other such susceptible DLLs with similar characteristics.
Researchers said it explored two different methods self-injection and remote process injection to achieve code injection in a manner that not only improves the attack efficiency, but also circumvents detection. In the first approach, a custom application is utilized to directly load the vulnerable DLL into its address space and ultimately execute the desired code using the RWX section. Remote process injection, on the other hand, entails using the RWX section in the vulnerable DLL to perform process injection in a remote process such as ssh.exe.
The uniqueness of this technique lies in the fact that there is no need to allocate memory, set permissions or create a new thread within the target process to initiate the execution of our injected code, the researchers said. This differentiation sets this strategy apart from other existing techniques and makes it challenging for Endpoint Detection and Response (EDR) systems to detect this method.
The findings come weeks after cybersecurity firm SpecterOps detailed a new method that exploits a legitimate Visual Studio deployment technology called ClickOnce to achieve arbitrary code execution and obtain initial access. ClickOnce is a deployment technology that enables developers to create self-updating Windows-based applications that can be installed and run with minimal user interaction. Visual Studio provides full support for publishing and updating applications deployed with ClickOnce technology if you have developed your projects with Visual Basic and Visual C#. For information about deploying Visual C++ applications, see ClickOnce Deployment for Visual C++ Applications.
This article is presented at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments, or assistance, please get in touch with the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
[1] https://thehackernews.com/2023/06/new-mockingjay-process-injection.html
Comments