Hello, welcome to the Thursday, February 4th, 2021 edition of the Sandtonet Storm Center's Stormcast. My name is Johannes Ulrich. And today I'm recording from Jacksonville, Florida. Ever wonder how opening an Excel spreadsheet may end up launching Cobalt Strike on your system.

Well, Brad looked at a recent example of a malicious Excel spreadsheet that did exactly that.

You found it in a sandbox, and the first thing that the macro, of course, does as you launch it,

is it downloads what Brad believes is the System BC malware. System BC has been around for about one and a half years or so and has been

used as a proxy, but in this particular case it also then is being used to download Cobalt Strike,

but only if you are connected to an active directory domain.

This is behavior that has been spotted before, and for example, with the solar winds compromise,

this kind of behavior was often mentioned. And the idea here apparently

is that if you are connected to an active director domain, you're first of all less likely

sandbox that someone is using for Malware analysis. And also, you're more likely part of a larger organization that it may be

worthwhile to actually probe manually somewhat and possibly deploy some more customized

ransom error. Of course, Brad's Malar Analysis System is joined to an active directory domain

and that's why he was able

to spot that last part of the infection. And with everybody's eyes still being on solar winds,

solar winds did publish an update fixing three vulnerabilities, two of which are rated critical, one in the

Microsoft message queue, which can lead to remote code execution. Essentially, there is no

access control being done, plus the messages are then being deseralized in unsafe manner. So that way you can then trigger

deseralization vulnerability for a full remote code execution. We also do have today on Thursday

at noon Eastern time Special Lightning Summit scheduled,

where a few Sands instructors will sort of take their perspective

on the entire Solar Winds incident.

So hope to see some of you there should be a pretty exciting

...