Edit Publication: The “Hikit” rootkit: advanced and persistent attack techniques (part 1)

You do not have permission to edit this page, for the following reason:

The action you have requested is limited to users in the group: Users.

Image:
Legend:
Botnet:
Malware:
Exploit kit:
Services:
Target:
Origin:
Campaign:
Feature:
Strings:
Distribution vector:
Vulnerability:
CCProtocol:
Programming language:
Botnet/malware group:
Operation/working group:
Year:
Date:
Editor/Conference:
Link:
DOI:
Author:
Type:
Abstract:	We first encountered this malware during a sweep of thousands of systems in a victim environment for Indicators of Compromise (IOCs), using our Mandiant Intelligent Response (MIR) platform. The attacker already had administrator privileges to the entire corporate Windows domain and had compromised numerous systems. Fortunately, we had several indicators gathered during the onset of the investigation that we could use during initial MIR sweeps. For instance, we knew they were fond of using the old-but-reliable“sticky keys” technique, whereby “sethc.exe” is overwritten with a copy of “cmd.exe” to provide unauthenticated access during RDP logon. (Carnal0wnage’s blog has a nice succinct write-up of this attack here.)

Free text:

Summary:

This is a minor edit

Watch this page