In its M-Trends report, the breach investigations company found that more often than before, APT groups are using Windows Management Instrumentation (WMI) and PowerShell to move laterally, harvest credentials, and search for useful information within Windows environments.
“Attackers are using built in components of Windows that are extremely powerful but relatively obscure in lieu of a lot of the things where attackers needed to previously use specialized tools or malware,” Ryan Kazanciyan, technical director at Mandiant, told SecurityWeek. “They are not necessarily ways to infect a system from scratch, but they are ways that attackers can remain persistent in an environment and evade detection for a much longer period by using some of these advanced techniques,” he said.
Additionally, Mandiant's report found that free credential-stealing tools have made harvesting passwords and escalating privileges in a Windows environment much easier. Mandiant experts found that attackers typically used two techniques: “Pass-the-hash” to authenticate with stolen NTLM hashes, and using the “Mimikatz” tool to recover plaintext passwords from memory. Concerningly, Mandiant said that it did not see a single instance when a victims’ anti-virus software detected or blocked Mimikatz, despite the tool’s popularity."
Link to Original Source