Meterpreter/Metasploit

[kurt2121]

Does Malwarebytes detect different variations of meterpreter or other metasploit infections? Would a meterpreter infection be identified as meterpreter or just something generic?

 

Also, what version of malwarebytes started using HIPS? Thanks guys

[Aura]

Hi kurt2121

Quote

Also, what version of malwarebytes started using HIPS? Thanks guys

As far as I know, there are no HIPS functionnality in Malwarebytes (Anti-Malware or 3.0).

Quote

Does Malwarebytes detect different variations of meterpreter or other metasploit infections?

I don't have an answer for that, but I guess Malwarebytes would detect the payload that is being dropped on the system, and/or block the connections being made from your system if the outbound host is malicious.

[Z3R0_OS]

Depends on how the Meterpreter shell is deployed
if it's deployed in memory by an exploit  it's game over
but if the user had to download a exe it may catch it

[Aura]

Quote

if it's deployed in memory by an exploit  it's game over
 

Malwarebytes Anti-Exploit layer should kick in.

[Z3R0_OS]

On 10/5/2017 at 12:27 AM, Aura said:

Malwarebytes Anti-Exploit layer should kick in.

Apparently it doesn't work against SMB exploits like eternablue or PSexec so...
I could be wrong though ...

[Aura]

These are network-based exploits, and MBAE doesn't protect against these.

[exile360]

3 hours ago, Aura said:

These are network-based exploits, and MBAE doesn't protect against these.

Correct, however we do target browser exploits and script/file based exploits including those attached to emails or downloaded as documents, images, audio/video files and many other attack vectors and formats and we also shield a large list of software known to be frequently targeted by exploits specifically with additional protection measures to detect and stop exploit attempts.  Most of the time it is one of these methods that is used for the initial attack, and in fact if I recall correctly, it was a script attached to an email that was used to get the EternalBlue/WannaCrypt0r threats into networks from the start and it simply spread through the networks from the first infected endpoint via the SMB exploit (since it requires local network access to work I believe, and can't be directly exploited remotely, though I could be mistaken on that point).

That said, we're always working on additional features and layers to extend our proactive protection capabilities.

Edited October 6, 2017 by exile360

[Z3R0_OS]

I'd advised the addition of A network exploit detection Shield considering how many people are hit with eternablue and other network based RCE
therefore currently Meterpreter can sneak pass and uninstall Malwarebytes via a Network RCE (Remote code execution) exploit 

[exile360]

2 hours ago, Z3R0_OS said:

I'd advised the addition of A network exploit detection Shield considering how many people are hit with eternablue and other network based RCE
therefore currently Meterpreter can sneak pass and uninstall Malwarebytes via a Network RCE (Remote code execution) exploit 

Thanks, yes I agree.  In fact, right after the EternalBlue/WannaCrypt0r outbreak one of my first suggestions to the Product team was to develop an anti-exploit module for network based exploit attacks.  I do not know if they plan to implement one, but if not, I'm certain they'll come up with some other creative solution to these types of attacks and threats.

[Z3R0_OS]

Can  malwarebytes detect in memory objects Like a Meterpreter shell if it has not been deployed on the disk but in memory

[exile360]

If it is in memory as an exploit, meaning injected into another process and/or attempting some form of known exploit attack such as a buffer overrun or other illegal procedure which is often used by exploits then yes, it should be possible for Malwarebytes to detect and stop the exploit shell.  I assume that's how the exploit works, but I'm not certain as I'm not an expert in that area.