A question was posed to our team by one of the engineers; had we seen the new Chrome and Microsoft zero-day exploits using RSA NetWitness Endpoint? I honestly didn't even know about these exploits and so I had to do some research. I found the initial Google Blog post here: Google Online Security Blog: Disclosing vulnerabilities to protect users across platforms. The first vulnerability (NVD - CVE-2019-5786) is the Google Chrome vulnerability and the second was disclosed to Microsoft by Google but as of the time I am writing this, no patch had been released by Microsoft.
Other articles and blogs that talk about these zero-days say they are being used in conjunction with each other. There was no proof of concept code nor any exploits I could use from the research I did. I did see some articles talking about these being exploited in the wild but I couldn’t find any other details. The second zero day is a Windows 7 32 bit privilege escalation vulnerability which does a null pointer dereference in win32k.sys. I found a similar privilege escalation exploit for CVE-2014-4113 and successfully exploited a box in my sandbox environment while it had an NetWitness Endpoint agent on it. The two IIOCs that fired that would help detect this attack were:
IIOC 1 - “Creates process and creates remote thread on same file”
IIOC 2 - “Unsigned creates remote thread”
The remote thread in this case was on notepad.exe which is common of Meterpreter.
The exploit I used can be found here: https://www.exploit-db.com/exploits/35101. It also does a null pointer dereference in win32k.sys similar to the Microsoft zero-day. Below are some screenshots of what I saw from the attacker side and the NetWitness Endpoint side.
Here you can see the the exploit being injected in process ID 444.
Here is the entry in RSA NetWitness Endpoint.
Another entry is lsass.exe opening notepad.exe after the remote thread creation. I believe this is the actual privilege escalation taking place. It also makes sense because the timestamp matches exactly to the timestamp in Kali.
Here are the IIOCs which I believe are the initial meterpreter session based on timestamps. It's still an indication of suspicious activity and when combined with lsass.exe opening the same remote thread process, it raises even more alarms.
I gave this to the engineer in hopes that the new Microsoft zero-day could be detected in the same way and even though we don't know the details of the Google Chrome vulnerability, we do know they are being exploited together. This could help possibly identify this attack that has been seen in the wild. Also, on another note, the fact that two zero-days are being exploited in the wild together just screams of a well-funded advanced adversary and it's a relief to know that our tool out-of-the-box should be able to help find this type of activity.
