Slashdot Mirror
Why Attackers Are Using C# For Post-PowerShell Attacks (forcepoint.com)
An anonymous Slashdot reader summarizes an article by a senior security researcher at Forecepoint Security Labs:
Among cyber criminals, there has been a trend in recent years for using more so called 'fileless' attacks. The driver for this is to avoid detection by anti-virus. PowerShell is often used in these attacks. Part of the strategy behind fileless attacks is related to the concept of 'living off the land', meaning that to blend in and avoid detection, attackers strive for only using the tools that are natively available on the target system, and preferably avoiding dropping executable files on the file system.
Recently, C# has received some attention in the security community, since it has some features that may make it more appealing to criminals than PowerShell. [Both C# and Powershell use the .NET runtime.] A Forcepoint researcher has summarized the evolvement of attack techniques in recent years, particularly looking at a recent security issue related to C# in a .NET utility in terms of fileless attacks.
From the article: A recent example of C# being used for offensive purposes is the PowerShell/C# 'combo attack' noted by Xavier Mertens earlier this month in which a malware sample used PowerShell to compile C# code on the fly. Also, a collection of adversary tools implemented in C# was released. Further, an improved way was published for injecting shellcode (.NET assembly) into memory via a C# application.... Given recent trends it seems likely that we'll start to see an increased number of attacks that utilize C# -- or combinations of C# and PowerShell such as that featured in Xavier Mertens' SANS blog -- in the coming months.
Recently, C# has received some attention in the security community, since it has some features that may make it more appealing to criminals than PowerShell. [Both C# and Powershell use the .NET runtime.] A Forcepoint researcher has summarized the evolvement of attack techniques in recent years, particularly looking at a recent security issue related to C# in a .NET utility in terms of fileless attacks.
From the article: A recent example of C# being used for offensive purposes is the PowerShell/C# 'combo attack' noted by Xavier Mertens earlier this month in which a malware sample used PowerShell to compile C# code on the fly. Also, a collection of adversary tools implemented in C# was released. Further, an improved way was published for injecting shellcode (.NET assembly) into memory via a C# application.... Given recent trends it seems likely that we'll start to see an increased number of attacks that utilize C# -- or combinations of C# and PowerShell such as that featured in Xavier Mertens' SANS blog -- in the coming months.
Is it true that Linux doesn't use either C# nor Powershell?
On the other hand, is there a way to disable C# / Powershell in windoze?
Thanks !
There has never been a single attack using VB.net.
Powershell itself can curl anything and execute anything. Or run Node, most systems have it because most apps need it. Or just download python and hack the planet with __pythonicpower__
It has the same power as any basic Linux shell. So singling out C# is entirely moot, and I question the motivation behind doing so.
They probably will discover this as a "new" idea in 10 to 20 years or so. MS and its community are always far, far behind.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Installing powershell implies installing a ceehash compiler?
Next you're gonna tell me there's a complete IDE hidden in the dotnet runtime crapolade. Which of the runtimes adds a hidden mail client, and which a hidden html browser?
Both PowerShell and C# (or any other .NET language) are Microsoft environments allowing to have a relatively easy access to any part of Windows. On the other hand, they seem to have a notable disadvantage with respect to other (compiled) languages to perform actions of this sort: you can get the source code either right away or after a quite straightforward decompilation process.
:)), it seems that relying on .NET/PowerShell isn't the most efficient/practical proceeding but the easiest one.
Even though I am not related to all the virus/vulnerability/invasion/damaging world at all (I just build, grow and share
Custom Solvers 2.0 = Alvaro Carballo Garcia = varocarbas.
When in Rome, do as the Romans do.
It is advisable to follow the conventions of the area you are in lest you draw attention to yourself... like from an antivirus application. This is an infiltration game on the binary level so it's best to look the part of an innocuous application.
Anons need not reply. Questions end with a question mark.
Fileless my ass. Fileless means the browser downloads the thing and puts it somewhere (RAM, possibly cache) and then executes it. This somehow becomes "magic" to the so-called "experts" -- "fileless". Wow.
Ever more often, I find it difficult to be proud of my trade. I then tell people I'm "shepherd", or "cook" or "carpenter". Or perhaps "fisher".
And if that were a grammar error, you would be right. It is a typo. Makes you a dumb spelling Nazi though, with obviously nothing worthwhile to contribute.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Shell, even the dumbed-down "Power"-shell seems to be to hard for them to code in....
It sounds like you have never experienced the joys of powershell programming. Dumbed-down is not an adjective I'd be using so flippantly.
I am Slashdot. Are you Slashdot as well?
When a narcissist is caught, that's when.
Mostly random stuff.
Just face it, you're nowhere near as smart as your auto-fart-smelling over the last few years makes you think.
Mostly random stuff.
To soft key-press on the second o. What else? Happens to me all the time.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
You wish. And you should stop deducing from yourself what others may do...
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
This must literally be THE FIRST TIME EVER we realized admin privileges can allow the user to execute arbitrary scripts.
Oh noes!
All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
Found the python developer
I object to power without constructive purpose. --Spock
You can actually avoid the brain dead powershell syntax and leverage the entire . NET namespace directly. In fact, given the sloppy nature of Windows system admins I recommend it since you never know what fucking powershell version is going to be on a particular server.
I object to power without constructive purpose. --Spock