VNC

Behavioral Detection of Unauthorized VNC Remote Control Sessions

Disable or Remove Feature or Program: Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures:

Remove Legacy Software:

• Use Case: Disable or remove older versions of software that no longer receive updates or security patches (e.g., legacy Java, Adobe Flash).
• Implementation: A company removes Flash Player from all employee systems after it has reached its end-of-life date.

Disable Unused Features:

• Use Case: Turn off unnecessary operating system features like SMBv1, Telnet, or RDP if they are not required.
• Implementation: Disable SMBv1 in a Windows environment to mitigate vulnerabilities like EternalBlue.

Control Applications Installed by Users:

• Use Case: Prevent users from installing unauthorized software via group policies or other management tools.
• Implementation: Block user installations of unauthorized file-sharing applications (e.g., BitTorrent clients) in an enterprise environment.

Remove Unnecessary Services:

• Use Case: Identify and disable unnecessary default services running on endpoints, servers, or network devices.
• Implementation: Disable unused administrative shares (e.g., C$, ADMIN$) on workstations.

Restrict Add-ons and Plugins:

• Use Case: Remove or disable browser plugins and add-ons that are not needed for business purposes.
• Implementation: Disable Java and ActiveX plugins in web browsers to prevent drive-by attacks.

Filter Network Traffic: Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures:

Ingress Traffic Filtering:

• Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers.
• Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges.

Egress Traffic Filtering:

• Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications.
• Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected.

Protocol-Based Filtering:

• Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs.
• Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue.

Network Segmentation:

• Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized.
• Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems.

Application Layer Filtering:

• Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic.
• Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.

Audit: Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures.

Auditing is applicable to all systems used within an organization, from the front door of a building to accessing a file on a fileserver. It is considered more critical for regulated industries such as, healthcare, finance and government where compliance requirements demand stringent tracking of user and system activates.This mitigation can be implemented through the following measures:

System Audit:

• Use Case: Regularly assess system configurations to ensure compliance with organizational security policies.
• Implementation: Use tools to scan for deviations from established benchmarks.

Permission Audits:

• Use Case: Review file and folder permissions to minimize the risk of unauthorized access or privilege escalation.
• Implementation: Run access reviews to identify users or groups with excessive permissions.

Software Audits:

• Use Case: Identify outdated, unsupported, or insecure software that could serve as an attack vector.
• Implementation: Use inventory and vulnerability scanning tools to detect outdated versions and recommend secure alternatives.

Configuration Audits:

• Use Case: Evaluate system and network configurations to ensure secure settings (e.g., disabled SMBv1, enabled MFA).
• Implementation: Implement automated configuration scanning tools like SCAP (Security Content Automation Protocol) to identify non-compliant systems.

Network Audits:

• Use Case: Examine network traffic, firewall rules, and endpoint communications to identify unauthorized or insecure connections.
• Implementation: Utilize tools such as Wireshark, or Zeek to monitor and log suspicious network behavior.

Limit Software Installation: Prevent users or groups from installing unauthorized or unapproved software to reduce the risk of introducing malicious or vulnerable applications. This can be achieved through allowlists, software restriction policies, endpoint management tools, and least privilege access principles. This mitigation can be implemented through the following measures:

Application Whitelisting

• Implement Microsoft AppLocker or Windows Defender Application Control (WDAC) to create and enforce allowlists for approved software.
• Whitelist applications based on file hash, path, or digital signatures.

Restrict User Permissions

• Remove local administrator rights for all non-IT users.
• Use Role-Based Access Control (RBAC) to restrict installation permissions to privileged accounts only.

Software Restriction Policies (SRP)

• Use GPO to configure SRP to deny execution of binaries from directories such as %AppData%, %Temp%, and external drives.
• Restrict specific file types (.exe, .bat, .msi, .js, .vbs) to trusted directories only.

Endpoint Management Solutions

• Deploy tools like Microsoft Intune, SCCM, or Jamf for centralized software management.
• Maintain a list of approved software, versions, and updates across the enterprise.

Monitor Software Installation Events

• Enable logging of software installation events and monitor Windows Event ID 4688 and Event ID 11707 for software installs.
• Use SIEM or EDR tools to alert on attempts to install unapproved software.

Implement Software Inventory Management

• Use tools like OSQuery or Wazuh to scan for unauthorized software on endpoints and servers.
• Conduct regular audits to detect and remove unapproved software.

Tools for Implementation

Application Whitelisting:

• Microsoft AppLocker
• Windows Defender Application Control (WDAC)

Endpoint Management:

• Microsoft Intune
• SCCM (System Center Configuration Manager)
• Jamf Pro (macOS)
• Puppet or Ansible for automation

Software Restriction Policies:

• Group Policy Object (GPO)
• Microsoft Software Restriction Policies (SRP)

Monitoring and Logging:

• Splunk
• OSQuery
• Wazuh (open-source SIEM and XDR)
• EDRs

Inventory Management and Auditing:

• OSQuery
• Wazuh