New Threat From Fileless Powershell Exploits

Businesses now face the growing threat of fileless hacking and fileless malware attacks facilitated by the PowerShell scripting language that is already built-in to Windows.

Surge Reported

The latest McAfee Labs threat report shows what an emerging and dangerous threat the exploiting of the PowerShell scripting language has become. Taking the last quarter of 2017, the adoption of fileless malware via Microsoft PowerShell showed a 432% surge.

How Does It Work?

Microsoft PowerShell is a scripting language that’s built-in to the Windows OS. Its main legitimate uses include running background commands, checking services installed on the system, terminating processes, and the managing configurations of systems and servers.

The Microsoft PowerShell scripting language provides access to your computer’s inner core, including unrestricted access to Windows APIs. Also, because it is a legitimate part of your computer’s Operating System, any commands it executes are usually ignored by security software, and it provides no signature for antivirus software to detect. Another crucial aspect of Powershell is that it can run remotely through WinRM. For these reasons, it has become an ideal route for cyber-criminals.

Controlling Computers Using Powershell

A hack via Powershell involves attackers getting to PowerShell remotely through WinRM, enabling them to get through Windows Firewall, run more PowerShell scripts complete with admin control. Even if WinRM is turned off, it can be turned on remotely through WMI using a single line of code.

Also, through Powershell, once an attacker obtains a username and password for one computer, the path to complete compromise of the whole enterprise system is laid open.

Recent Fileless Malware Attacks

It has been reported that PowerShell malware arrives via spam email, and it is the embedded code in the email that contains the PowerShell commands. This code usually contains instructions to download another payload to carry out the primary malicious activity.

The McAfee Threat report shows how recent attacks have used Powershell to download malware of the Bartallex (.bat and .vbs files) and Dridex families onto the systems of victims in what are now popularly known as fileless malware attacks.

What Does This Mean For Your Business?

The combination of PowerShell providing legitimate access to computer’s and its subsequent ability to be ignored by security software, as well as the ability to run it remotely through WinRM make it a low risk, low cost and potentially and potentially high return tactic for cyber-criminals. This means that fileless hacks and fileless malware attacks are now a serious and present risk to businesses and organisations of all kinds.

The stealth factor, plus the fact that it goes under the radar of normal antivirus software makes detection very difficult. The one clear chance to stop it appears to be not opening the malicious email that contains the code that begins the attack. Companies and organisations need to make sure that all staff are trained to recognise and resist social engineering tactics, and to be made aware of the risk of downloading and installing applications that they do not understand or trust.