Subject: Engage Report: LATRODECTUS
Tactics: TA0003 Persistence
Technique: T1053.005 Scheduled Task/Job: Scheduled Task
Procedure:
LATRODECTUS malware utilizes scheduled tasks for persistence, executing a copy of itself and establishing a foothold in the compromised system.
Vulnerability: EAV0001 When adversaries interact with the environment or personas, they are vulnerable when they collect, observe, or manipulate system artifacts or information. Manipulated data may cause them to reveal behaviors, use additional or more advanced capabilities against the target, and/or impact their dwell time.
Engagement Opportunity:
Deploy a decoy system with a configuration that allows the creation and execution of scheduled tasks. Monitor the decoy for any attempts to establish persistence via scheduled tasks, which could indicate the presence of LATRODECTUS or similar malware.
Threat Actor: Financially motivated cybercriminals
Threat Objective:
To maintain persistence within a compromised system and potentially deliver additional payloads for further malicious activities.
Deception Opportunity:
Create a deceptive environment with a seemingly vulnerable scheduled task configuration. Monitor this environment for any unauthorized modifications or execution attempts, which could reveal the presence of LATRODECTUS or similar threats.
Sensor Data Placement: User-Mode
Observable Level: Core to Some Implementations of (Sub-)Technique
Scoring Rationale:
The abuse of scheduled tasks for persistence is a prevalent technique employed by various threat actors, including those using LATRODECTUS. While not all attacks rely on this method, it is common enough to be considered a core implementation of this sub-technique.
Link to Report:
Link to Report II.:
Additional Comments:
Monitoring scheduled task activity and implementing robust detection mechanisms for suspicious commands can significantly improve the security posture against threats like LATRODECTUS.
Possible elements:
MSG (Pseudocode):
# Malicious Sub-Graph Standard
# Node Format:
# [Node ID]: [Tactic] - [Technique] - [Procedure] ([Observable Level])
# Edge Format:
# [Source Node ID] --> [Destination Node ID] ([Exploited Vulnerability])
# Example: LATRODECTUS Attack Graph
[1]: Persistence [TA0003] - Scheduled Task/Job [T1053]: Scheduled Task [T1053.005] - Create scheduled task to execute LATRODECTUS (Core to Some Implementations of (Sub-)Technique)
[2]: Execution [TA0002] - Command and Scripting Interpreter [T1059] - Execute commands to download and run additional payloads (Lack of System Monitoring)
1 --> 2
# Pseudocode Standard
# Function Format:
# function [Tactic]_[Technique]([Input]):
# [Procedure]
# return [Output]
# Example: LATRODECTUS Pseudocode
function Persistence_Scheduled_Task_Job(malicious_lnk_file):
# Execute code to create scheduled task
return scheduled_task
function Execution_Command_and_Scripting_Interpreter(scheduled_task):
# Execute task to download and run additional payloads
return success