“Dynamic Shellcode Protection” is Designed to Expose Fileless Malware, Ransomware and Remote Access Agents

OXFORD, U.K.  — Marzo 4, 2021 —

Sophos, a global leader in next-generation cybersecurity, today revealed a new defense against adversaries trying to evade detection by loading fileless malware, ransomware and remote access agents into the temporary memory of compromised computers. In a new blog post, “Covert Code Faces a Heap of Trouble in Memory,” Sophos researchers detail how they discovered that covert attack code is injected directly into the dynamic “Heap” region of computer memory and then tries to obtain additional “Heap” memory with code execution rights, a behavior not seen in ordinary software. The researchers developed a new protection that is triggered whenever such “Heap-Heap” memory allocation behavior is detected.

The defense, called Dynamic Shellcode Protection, will make it significantly harder for adversaries to use memory as part of their arsenal of defense evasion techniques.

As Sophos recently reported in a series of articles on the realities of Conti ransomware, the memory of compromised computers is a popular hiding place for adversaries looking to conceal their presence from defenders while they load and execute the remote access agents that will serve as enablers for the rest of the attack. In the case of Conti, the remote access agent used was Cobalt Strike.

“Preventing attackers from taking hold in a compromised network is the goal of defenders everywhere,” said Mark Loman, director of engineering, Sophos. “This goal is critical because once a remote access agent has been installed, it can facilitate most of the active adversary tactics that take place during the attack. These include execution, credential access, privilege escalation, discovery, lateral movement, collection, exfiltration, and the release of the ransomware.

“Code intended for malicious use evades detection by being heavily obfuscated and packed and loaded directly into memory. Computer memory is not routinely scanned by security tools so that even when the code is de-obfuscated and unpacked in order to run, its presence is often not detected. Sophos has identified a characteristic – ‘Heap-Heap’ memory allocation – that is typical across multi-stage remote access agents and other attack code being loaded into memory and has built protection against it.”

Dynamic Shellcode Protection is based on the fact that code such as applications are stored in memory regions that have “execution” rights. This enables the apps to run. However, the apps generally need some additional, temporary, in-memory workspace, for example to unpack or store data. This variable workspace is commonly called “Heap” memory. Apps can request their Heap memory allocation to come with execution rights.

In most cyberattacks, however, the loader for a remote access agent is injected directly into Heap memory. It then needs to obtain further executable memory from the Heap in order to accommodate the needs of the inbound remote access agent. This is referred to as “Heap-Heap” memory allocation behavior.

Sophos researchers realized that such behaviour was a clear indicator of potentially suspicious activity and designed a practical protection that blocks the allocation of execution permissions from one Heap memory to another. In doing so, the protection can intercept many cyberattacks involving remote access agents, fileless malware and ransomware, while being compatible with normal applications.

“When a process, regardless of whether it is malicious or benign, violates the Heap memory allocation barrier, the Dynamic Shellcode Protection will block it and notify defenders. Security professionals can then take a closer look at what is going on,” said Loman. “The new protection is not meant as a silver bullet for all attacks, but it does mean that adversaries face a new obstacle that blocks a fundamental behavior of their stealthy code. We hope this will make attackers’ jobs harder and more complicated. The Dynamic Shellcode Protection does not rely on the cloud or machine learning. As such it represents a paradigm shift in the ongoing battle against many obfuscated malware and memory-delivered post-exploitation agents, including Cobalt Strike Beacon.”

Dynamic Shellcode Protection is integrated into Sophos Intercept X.

General Advice for Defending Against Ransomware

  • Shut down internet-facing remote desktop protocol (RDP) to deny cybercriminals access to networks
  • If you need access to RDP, put it behind a VPN connection
  • Use layered security to prevent, protect and detect cyberattacks, including endpoint detection and response (EDR) capabilities and managed response teams who watch networks 24/7
  • Be aware of the five early indicators an attacker is present to stop ransomware attacks
  • Have an effective incident response plan in place and update it as needed. If you don’t feel confident you have the skills or resources in place to do this, to monitor threats or to respond to emergency incidents, consider turning to external experts for help

Informazioni su Sophos

Sophos, leader mondiale e innovatore nelle soluzioni di sicurezza avanzate per neutralizzare i cyberattacchi, tra cui servizi MDR (Managed Detection and Response) e incident response, mette a disposizione delle aziende un’ampia gamma di soluzioni di sicurezza per endpoint, network, email e cloud al fine di supportarle nella lotta ai cyber attacchi. In quanto uno dei principali provider di cybersecurity, Sophos protegge oltre 600.000 realtà e più di 100 milioni di utenti a livello globale da potenziali minacce, ransomware, phishing, malware e altro. I servizi e le soluzioni di Sophos vengono gestiti attraverso la console Sophos Central, basata su cloud, e si incentra su Sophos X-Ops, l'unità di threat intelligence cross-domain dell'azienda. Sophos X-Ops ottimizza l’intero ecosistema adattivo di cybersecurity di Sophos, che include un data lake centralizzato, che si avvale di una ricca serie di API aperti, resi disponibili ai clienti, ai partner, agli sviluppatori e ad altri fornitori di cyber security e information technology. Sophos fornisce cybersecurity as a service alle aziende che necessitano di soluzioni chiavi in mano interamente gestite. I clienti possono scegliere di gestire la propria cybersecurity direttamente con la piattaforma di Sophos per le operazioni di sicurezza o di adottare un approccio ibrido, integrando i propri servizi con quelli di Sophos, come il threat hunting e la remediation. Sophos distribuisce i propri prodotti attraverso partner e fornitori di servizi gestiti (MSP) in tutto il mondo. Sophos ha sede a Oxford, nel Regno Unito. Ulteriori informazioni sono disponibili su www.sophos.it.