On 2024-08-30, Blackpoint's MDR+R technology and Active SOC team stopped a threat actor attempting to use ProcDump within an Industrials partner's environment.
Blackpoint's MDR+R technology detected an Industrials partner's local administrator account mounting the ADMIN share and executing services.exe.
Initial investigation by the Active SOC found that the same user account used a Living-off-the-Land Binaries and Scripts (LOLBAS) technique, which abuses comsvcs.dll to dump credentials on the RDP server.
The threat actor also utilized ProcDump and Mimikatz to dump all credentials from the domain.
After dumping credentials, the threat actor pivoted to another user account to begin spreading throughout the network.
The threat actor further used a compromised user account to grab a binary, MENU63.DBR, which spawned a command prompt and executed a batch script, UPDDOTNET.BAT.
The binary in question was located on an internal IP address.
Additional analysis discovered that the threat actor was able to authenticate on the host from the partner’s SSL VPN.
After successfully connecting to the customer's SSL VPN IP range, the threat actor was able to escalate privileges to the local administrator account.
Active SOC analysts isolated all impacted devices before reaching out to the Industrials partner with additional details and to begin the remediation process of disabling user accounts and closing open ports from the SSL VPN.