Executable Installer File Permissions Weakness

Executable Installer File Permissions Weakness [T1574.005]

Information

• Name: Executable Installer File Permissions Weakness

• ID: T1574.005

• Tactics: TA0003, TA0004, TA0005

• Technique: T1574

Introduction

Executable Installer File Permissions Weakness (T1574.005) is a sub-technique under the MITRE ATT&CK framework, categorized within the "Hijack Execution Flow" technique (T1574). Attackers exploit weak permissions on installer files and directories to gain unauthorized privileges or persistently execute malicious code. Typically, installers require elevated privileges, and improper permissions management may allow adversaries to replace or modify legitimate executable files, enabling privilege escalation or persistence.

Deep Dive Into Technique

Attackers leveraging Executable Installer File Permissions Weakness typically exploit misconfigured file system permissions on directories or executable files related to software installers. This exploitation involves:

• Identifying installer files or directories with weak permissions (e.g., writable by low-privileged users or groups).

• Replacing legitimate installer executables or scripts with malicious payloads.

• Modifying installer scripts or binaries to execute attacker-controlled code upon execution by a privileged user or automated deployment process.

Technical mechanisms and execution methods include:

• File Permission Enumeration: Attackers enumerate file and directory permissions using built-in system tools (e.g., icacls, cacls, ls -l, getfacl) or custom scripts to detect weak ACLs or permissions.

• Executable Replacement: Legitimate installer executables (e.g., MSI, EXE, scripts) are replaced or overwritten with malicious versions that execute attacker payloads.

• DLL Hijacking or DLL Side-Loading: Attackers place malicious DLLs in directories with weak permissions, causing legitimate installers to load and execute attacker-controlled DLLs.

• Scheduled Installer Execution: Attackers exploit automated deployment or scheduled tasks that periodically execute installers from directories with weak permissions.

Real-world procedures often involve:

• Exploiting software deployment directories with insecure permissions.

• Targeting installers in shared or temporary directories accessible by multiple users.

• Leveraging third-party software installers that are improperly configured or deployed without secure permissions.

When this Technique is Usually Used

Attackers typically use Executable Installer File Permissions Weakness in various attack scenarios and stages, including:

• Privilege Escalation: Attackers exploit weak permissions on installer executables or directories to escalate from standard user privileges to administrative or system-level privileges.

• Persistence: Malicious actors leverage weak installer permissions to maintain persistent access on targeted systems, ensuring malicious payload execution upon legitimate installer execution.

• Lateral Movement: Attackers exploit shared installation directories or network deployment locations with weak permissions to propagate across multiple hosts within an organization.

• Initial Access and Execution: Attackers may leverage publicly accessible installer directories or misconfigured software repositories to gain initial execution on targeted systems.

Typical attack scenarios include:

• Insider threats exploiting internal software deployment mechanisms.

• External attackers compromising user-level accounts and escalating privileges via installer permission weaknesses.

• Supply-chain attacks involving compromised third-party software installers.

How this Technique is Usually Detected

Detection of Executable Installer File Permissions Weakness typically involves monitoring, auditing, and proactive assessment methods:

• File Integrity Monitoring (FIM): Tools such as Tripwire, OSSEC, or built-in Windows File Integrity Monitoring capabilities can detect unauthorized changes to installer files or directories.

• Permission Auditing Tools: Regular use of tools like AccessChk, icacls, cacls, or automated scripts to identify overly permissive file or directory permissions.

• Endpoint Detection and Response (EDR): Solutions like CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint detect suspicious file modifications, execution anomalies, and unauthorized file replacements.

• Security Information and Event Management (SIEM): Aggregating and analyzing logs from file system activities, privilege escalations, and process executions can identify anomalies related to installer permission exploitation.

Specific Indicators of Compromise (IoCs) include:

• Unexpected changes to installer file hashes or digital signatures.

• Unusual file permission modifications or new executable files appearing in installer directories.

• Execution of installer files from unexpected or unauthorized locations.

• Suspicious DLL files appearing in installer directories or unusual DLL loads by installer executables.

• Logs indicating unauthorized file modifications or privilege escalation attempts.

Why it is Important to Detect This Technique

Early detection of Executable Installer File Permissions Weakness is crucial due to potential severe impacts on systems and networks:

• Privilege Escalation: Attackers can escalate privileges, gaining administrative or system-level access, enabling further exploitation and lateral movement.

• Persistence: Malicious actors can maintain persistent footholds within compromised systems, complicating remediation efforts.

• Integrity Compromise: Attackers can compromise legitimate software installers, undermining trust in software deployment processes and potentially causing widespread impact across an organization.

• Data Theft and Exfiltration: Elevated privileges gained through this technique enable attackers to access sensitive data, intellectual property, or confidential information.

• System Stability and Availability: Maliciously altered installers or DLLs may cause system instability, crashes, or denial-of-service conditions, impacting business operations.

Timely detection and remediation help organizations:

• Prevent privilege escalation and limit attackers' ability to move laterally.

• Maintain integrity and trust in software deployment processes.

• Reduce the risk of data breaches and sensitive data compromise.

• Minimize damage and disruption to critical business systems.

Examples

Real-world examples and attack scenarios involving Executable Installer File Permissions Weakness include:

• MSI Installer Permission Exploitation: Attackers identify MSI installer files located in directories writable by standard users. They replace legitimate MSI files with maliciously crafted installers. When a privileged user executes the installer, the attacker gains administrative privileges or executes malicious payloads.

  • Tools used: icacls, cacls, custom enumeration scripts, malicious MSI generator tools.

  • Impact: Privilege escalation, persistent access, system compromise.

• DLL Side-Loading via Weak Installer Directory Permissions: Attackers place malicious DLLs in directories with weak permissions. Legitimate installer executables inadvertently load these malicious DLLs, executing attacker-controlled code.

  • Tools used: DLL injection frameworks, custom-built malicious DLL payloads.

  • Impact: Privilege escalation, persistence, remote code execution.

• Third-party Software Deployment Exploitation: Attackers exploit weak permissions in third-party software deployment directories used by automated software distribution systems. Malicious executables replace legitimate installers, propagating malware across multiple systems.

  • Tools used: Custom malware payloads, file permission enumeration tools, automated exploit scripts.

  • Impact: Widespread system compromise, lateral movement, data exfiltration.

• Supply Chain Attacks: Attackers compromise software vendors or third-party installers distributed with improper permissions. Organizations downloading and executing compromised installers unknowingly execute malicious code.

  • Tools used: Malware embedded in compromised installers, automated installer modification tools.

  • Impact: Large-scale compromise, data breaches, significant reputational and operational damage.