Malware Detection is a Failing Strategy

by Smokescreen Team

Malware detection is a whack-a-mole game. Like the mythical hydra, when you chop off one head, three more appear, But that’s just half the issue.

Bypassing anti-malware systems is so trivial that attackers don’t treat it as a major obstacle. Even newbie pen-testers know how to go from off-the-shelf malware to “fully undetectable”. Believe me, the attackers have it automated, and commoditised.

Worse still, savvy attackers don’t even rely on malware to accomplish their mission objectives. Nowadays, they get by fine with:

Powershell
Provides practically any functionality an attacker wants. See the exemplary work by Matt Graeber on Powersploit and Nikhil Mittal with Nishang. When you can build tools on the box, why risk dropping a binary?

Legitimate administrative tools
Teamviewer, pstools, AmmyAdmin and the like. Organisations use these tools to legitimately administer their systems. Well, so do modern attackers. You’re unlikely to find an anti-malware solution that takes a chance blocking something that might be a critical tool for your IT ops team. Attackers know and exploit this free pass. Application white-listing, sandboxing, heuristics, and signatures all go for a toss.

Stolen credentials
The FIN-4 APT attacks exemplify how devastating malware-free attacks can be. Through the use of stolen credentials and legitimate access channels alone, an attacker has more than enough to succeed.

Dmitri Alperovitch of CrowdStrike said it well in his recent article:

Malware is responsible for only 40 percent of breaches and external attackers are increasingly leveraging malware-free intrusion approaches in order to blend in and fly under the radar by assuming insider credentials within victim organizations… Once the adversary was inside the network, they were able to move around using legitimate credentials and windows system administration tools, without actual use of malware.

As we said in the beginning, malware detection is a failing startegy. Stop solving the symptoms, and start solving the problem.

#malware #strategy