{"id":18639,"date":"2021-05-17T18:27:02","date_gmt":"2021-05-17T18:27:02","guid":{"rendered":"https:\/\/www.esecurityplanet.com\/?p=18639"},"modified":"2021-06-18T18:51:08","modified_gmt":"2021-06-18T18:51:08","slug":"powershell-source-of-third-of-critical-security-threats","status":"publish","type":"post","link":"https:\/\/www.esecurityplanet.com\/threats\/powershell-source-of-third-of-critical-security-threats\/","title":{"rendered":"PowerShell Is Source of More Than a Third of Critical Security Threats"},"content":{"rendered":"

PowerShell was the source of more than a third of critical threats detected on endpoints in the second half of 2020, according to a Cisco research study released at the RSA Conference today.<\/p>\n

The top category of threats detected across endpoints by Cisco Secure Endpoint was dual-use tools leveraged for exploitation and post-exploitation tasks. PowerShell Empire, Cobalt Strike, PowerSploit, Metasploit and other such tools have legitimate uses, Cisco noted in the report<\/a>, but they’ve become part of the attacker toolkit too. Such “living off the land” tactics can avoid detection when deploying foreign tools or code to compromise systems.<\/p>\n

In second place was ransomware<\/a>, and after the recent Colonial Pipeline hack<\/a> probably needs no further comment.<\/p>\n

The third most frequently detected critical Indicator of Compromise (IoC) group was fileless malware – also a common PowerShell threat. This type of malware<\/a> does not use executable files and has no signature, making it challenging to detect. Fileless malware often manifests itself via suspicious process injections and registry activity. Common fileless malware types include Kovter, Poweliks, Divergent, and Lemon Duck.<\/p>\n

Dual-use tools were also responsible for the fourth most common threat: Credential dumping, which is used by hackers to scrape login credentials from a compromised machine. The most commonly detected tool was Mimikatz, which Cisco Secure Endpoint caught dumping credentials from memory.<\/p>\n

Those four categories are responsible for more than 80 percent of critical IoCs. The rest include threats like worms, remote access trojans (RATs), and banking trojans, with a mix of various downloaders, wipers, and rootkits.<\/p>\n

“Based on Cisco’s research, PowerShell is the source of more than a third of critical threats,” noted Gedeon Hombrebueno, Endpoint Security Product Manager for Cisco Secure.<\/p>\n

\"PowerShell<\/p>\n

Protecting PowerShell from Hackers<\/h2>\n

Hombrebueno told eSecurity Planet<\/em> that a “layered approach” is needed to secure PowerShell and other tools and utilities:<\/p>\n