ListPlanting (T1055.015)
ListPlanting [T1055.015]
Last updated
ListPlanting [T1055.015]
Last updated
Name: ListPlanting
ID: T1055.015
Tactics: ,
Technique:
ListPlanting (T1055.015) is a sub-technique within the MITRE ATT&CK framework categorized under the Process Injection (T1055) technique. It involves the manipulation of window message handling functions in graphical user interface (GUI) applications, particularly exploiting the ListView control. Attackers leverage this method to inject malicious code into legitimate processes, effectively disguising their activities and evading detection mechanisms. By manipulating GUI controls, attackers can cause legitimate processes to execute arbitrary code, thus maintaining stealth and persistence within compromised environments.
ListPlanting specifically targets GUI applications that use ListView controls, a common Windows control used for displaying lists of items. Attackers exploit the message-handling mechanisms inherent in Windows GUI components, particularly the ListView control, to inject and execute malicious code. The technique typically involves the following steps:
Identifying a target application: Attackers select processes that have ListView controls, such as Windows Explorer or other GUI-based applications.
Injecting malicious payload:
Malicious actors inject shellcode or malicious commands into the memory space of the targeted process. This injection can be performed using standard Windows APIs (e.g., WriteProcessMemory, VirtualAllocEx) or through reflective DLL injection techniques.
Manipulating ListView messages:
Attackers send specially crafted Windows messages to the ListView control (e.g., LVM_SETITEMPOSITION, LVM_SETITEMTEXT) to trigger the execution of injected code. These messages are legitimate and commonly used by GUI applications, making detection difficult.
Execution of malicious payload: Once the payload is triggered via the manipulated ListView messages, the legitimate process executes the malicious code within its own memory space, effectively camouflaging the attacker’s activities.
The primary advantage of ListPlanting is stealth, as it leverages legitimate Windows GUI interactions and message-passing mechanisms, making it challenging to detect via traditional antivirus and endpoint detection and response (EDR) solutions.
Attackers typically use ListPlanting at various stages of intrusion, including initial access, persistence, defense evasion, and privilege escalation. Common scenarios include:
Initial Access and Execution:
Delivering and executing malicious payloads within legitimate GUI applications to bypass initial detection mechanisms.
Exploiting user interaction with GUI applications to trigger malicious code execution.
Persistence:
Maintaining persistence by injecting malicious payloads into processes that run persistently or are frequently used by users (e.g., Windows Explorer).
Ensuring that malicious code executes repeatedly without explicit attacker intervention.
Defense Evasion:
Hiding malicious activities by executing payloads within legitimate processes, thus blending malicious actions with normal system behavior.
Bypassing antivirus and endpoint protection solutions that typically monitor external executable launches rather than internal GUI control manipulations.
Privilege Escalation:
Injecting payloads into higher-privileged processes to escalate privileges and gain administrative or system-level access.
Detecting ListPlanting requires specialized monitoring and detection strategies, including:
Behavioral Monitoring:
Monitoring unusual interactions and message passing between processes, particularly those involving GUI controls such as ListView.
Detecting anomalous Windows messages targeting ListView controls (LVM_SETITEMPOSITION, LVM_SETITEMTEXT, etc.) from unexpected or unknown processes.
Memory Analysis:
Regularly scanning process memory for unusual or suspicious code injections, particularly in GUI-based processes.
Using endpoint detection and response (EDR) solutions capable of identifying reflective DLL injections or unusual memory allocations.
API Hooking and Monitoring:
Monitoring the invocation of Windows APIs related to process memory manipulation (WriteProcessMemory, VirtualAllocEx, CreateRemoteThread).
Identifying suspicious patterns of API calls that indicate injection attempts.
Process Anomaly Detection:
Monitoring legitimate processes for unusual behavior, such as unexpected network connections, file system access, or registry modifications.
Identifying abnormal execution patterns within GUI applications, such as unexpected code execution triggered by GUI interactions.
Indicators of Compromise (IoCs):
Unusual Windows messages sent to GUI applications, particularly ListView controls.
Suspicious DLLs or shellcode loaded into legitimate GUI processes.
Unusual memory allocations or modifications within trusted processes.
Unexpected outbound network connections initiated by GUI applications.
Detecting ListPlanting is critical due to its potential impacts on system and network security, including:
Stealth and Persistence:
Attackers can maintain long-term, persistent access to compromised systems by embedding malicious code within trusted processes, making remediation and eradication difficult.
Privilege Escalation:
Injection into higher-privileged processes can lead to full administrative or system-level compromise, enabling attackers to escalate privileges and gain complete control over affected systems.
Defense Evasion:
Traditional antivirus and endpoint security solutions may fail to detect malicious activities embedded within legitimate GUI interactions, allowing attackers to operate undetected.
Data Exfiltration and Espionage:
Attackers can leverage compromised GUI processes to exfiltrate sensitive data or conduct espionage activities without raising suspicion.
System Stability and Integrity:
Injected malicious code can cause instability, crashes, or corruption within legitimate applications, potentially disrupting business operations and impacting user productivity.
Early detection of ListPlanting significantly reduces the risk of prolonged compromise, limits potential damage, and enhances overall security posture by enabling rapid incident response and remediation.
Real-world examples and attack scenarios involving ListPlanting include:
FIN7 Group Attacks:
FIN7, a financially motivated cybercriminal group, has utilized ListPlanting techniques to inject malicious payloads into legitimate GUI applications, evading detection and stealing sensitive financial information.
Attackers employed reflective DLL injection and manipulated ListView controls within legitimate processes like Windows Explorer to execute malicious payloads covertly.
APT32 (OceanLotus) Campaigns:
APT32, also known as OceanLotus, has leveraged GUI-based injection techniques, including ListPlanting, to compromise Southeast Asian organizations.
Attackers injected malicious payloads into GUI applications, exploiting legitimate Windows messages to trigger payload execution and maintain persistence.
Cobalt Strike Framework:
The popular penetration testing and adversary emulation tool Cobalt Strike includes capabilities for reflective DLL injection and GUI-based manipulation, allowing attackers to perform ListPlanting-like attacks during red team engagements.
Attackers frequently use Cobalt Strike’s advanced injection techniques to evade detection and simulate sophisticated adversaries.
Impacts Observed:
Theft of sensitive financial, intellectual property, and personal data.
Long-term persistence within compromised networks, evading traditional detection mechanisms.
Escalation of privileges leading to full administrative control of compromised systems.
Significant business disruption through system instability, application crashes, and data corruption.