Attackers Systematically Disable Security Tools Before Credential Theft
A sophisticated threat actor employed a multi-stage defense evasion strategy, disabling Microsoft Defender, Sysmon, and a Web Application Firewall before deploying Mimikatz for credential harvesting.
A recent cyberattack has highlighted a disturbing trend in advanced persistent threats: the systematic disabling of security infrastructure before executing core objectives like credential theft. In an incident detailed by Huntress, a threat actor initiated an intrusion on June 7th by compromising a web server and establishing a foothold via a steganographically hidden webshell concealed within an image file. This initial access point, named UA4fp7R.aspx, allowed the attacker to begin reconnaissance and expand their presence.
The true alarm was raised by the attacker's methodical approach to defense evasion. Before any credential dumping occurred, a series of scripts were executed to blind the environment. A batch script, identified as i.bat, first disabled IIS HTTP logging, cutting off a crucial source of web server activity data. This was followed by PowerShell commands designed to weaken Microsoft Defender, disabling real-time monitoring, behavior monitoring, script scanning, and sample submission. A companion PowerShell script, DisableDefender.ps1, further reinforced these changes before being deleted to cover its tracks.
Beyond disabling software-based defenses, the attacker actively terminated and manipulated system monitoring tools. The i.bat script utilized taskkill and Windows service controller commands to terminate Sysmon, Filebeat, and several endpoint security solutions, including products from Cortex, SentinelOne, and Dr.Web. To ensure these tools remained non-operational, the attacker also employed Image File Execution Options (IFEO) to force Sysmon, Filebeat, and SetACL into a debugger state, effectively freezing their processes and preventing any logging or detection.
Further dismantling security layers, the attacker used the appcmd utility to enumerate IIS sites and subsequently uninstalled the ModSecurity web application firewall. This removal eliminated protection against common web attacks such as SQL injection and cross-site scripting, clearing the path for potential follow-on exploitation.
With the defensive perimeter significantly degraded, the attacker proceeded to credential theft. They modified Windows registry settings to force the WDigest protocol to store passwords in plaintext memory, making them easier to extract. Tools identified as g.com and hs.com were used to harvest ODBC credentials from the registry and write stolen data to files named pass.txt and hash.txt. The Mimikatz kernel driver, mimidrv.sys, was then deployed to dump credentials directly from memory before being deleted.
Evidence suggests the attacker was prepared for further escalation. The recovered script contained commented-out code for a WMI event consumer designed to automatically clear Windows event logs, alongside commands to strip file permissions on critical Windows components. These elements indicate a plan to cover tracks and potentially gain deeper system access.
Before exfiltrating the environment, the attacker took steps to erase their presence, deleting generated files, wiping registry keys associated with WScript and Shell.Application, and clearing security, system, and application event logs. Fortunately, Huntress reported that the intrusion was contained before any data was exfiltrated, largely due to the SOC's timely detection of the initial enumeration activity.
This incident underscores the importance of robust security hygiene, including consistent patching, comprehensive logging across all systems, and the secure configuration of internet-facing servers. It also highlights the critical need for thorough incident response, ensuring that remediation efforts are completed before systems are brought back online to prevent attackers from re-establishing a foothold.