Windows Management Instrumentation

They use valid administrative tools that are already native to the environment.

PowerShell, WMI, PSEsec.

So because they use legitimate tools, their lateral movement just blends seamlessly into the established normal baseline we talked about earlier.

Exactly.

Exactly.

They use native built-in system tools, things like PowerShell or Windows Management Instrumentation to move laterally across a network.

So they're using the IT team's own tools against them?

Spot on.

You can't read those values out.

Under the hood, the driver uses the WMI, which is a firmware interface that a lot of laptop vendors also use.

It exposes everything through SysFS and the files under slash SFS.

So true Linux fashion, overclocking your CPU starts out as echoing a number into a file and rebooting, which honestly is the most linux way possible to do it i mean you know and i mean that with love

Okay, I have to play devil's advocate here.

If we know the exact mechanics of these attacks, if PowerShell, WMI, and these specific diagnostic tools are the primary vehicles for these devastating breaches, why don't organizations just shut them off? Like, why doesn't the IT department just disable PowerShell across the entire network?

That is the ultimate frustration for network defenders.

You cannot simply block these tools because they are the central nervous system of a modern Windows domain.

Ah, okay.

System administrators rely on PowerShell and WMI every single hour of the day to deploy software patches, configure security settings, and monitor the health of thousands of machines simultaneously.

If you disable those tools, the IT department is paralyzed, and the network would quickly collapse under its own unmanaged weight.

So the attackers are weaponizing the very tools required to maintain the network because they are using the exact same administrative commands as the legitimate IT team.

Bitdefender recovered 12 custom .NET plugins supporting process, system network file, and command operations for this rat.

Particularly interesting here is, uh, command executing, command execution plugin using W- WMI rather than spawning CMD, uh, helping kinda break, uh, more of that conventional suspicious parent-child process, even though we do talk about WMI, and it's still something you should consider, but it's not necessarily the first thing you consider.

Spice Rat was delivered through, um, calibre-signed e-book edit executable, which then would sideload, um, a malicious calibre launcher DLL.

The loader decrypts the Spice Rat payload and disguises it as a .HLP extension.

And, um, there's still a lot of tried and true stuff inside of this if you look within, in between the lines a bit and understand kind of how some of this stuff function.

Starting from the back and working up, the Node.js activity, understanding what Node's doing in your environment, if you're supposed to even be leveraging Node in your environment, suspicious parent-child processes, all of that stuff is commonplace right now.

Uh, I did mention that they, uh, one of the RATs was specifically WMI based as far as its process execution, so definitely be paying attention to, you know, relationships with and use of WMI for command execution.

Um, another one too, just I'll, I'll do the third one because I thought this one was valuable.

An attacker doesn't want to lose access just because someone restarted their laptop.

So APT simulator might create a deceptive scheduled task or modify a run registry key or maybe establish a malicious WMI event subscription.

These are the quiet architectural changes attackers use to maintain a foothold.

Right.

You can kind of do whatever you want to with it.

We added, uh, SH, WMI.

Uh, WMI is over S&P, SMB, MRPC, and, uh, HTTP as well.

So there's a billion different ways you can talk.

So you can build, build an integration that shells into random boxes if you want to at this point, and dumps data, and then brings it either to RunZero or out of RunZero at that point.

And I guess there are some restrictions in terms of where it runs and how you set credentials and encryption, things like that.

But we've done... basically made it very easy to build anything you want to in the product just by typing in a sentence saying, "Go do the thing."

thing."I didn't even know WMI was still a thing.