OVERRULED: Containing a Potentially Destructive Adversary

The actor leveraged a publicly available exploit for CVE-2017-0213 to escalate privileges, publicly available Windows SysInternals PROCDUMP to dump the LSASS process, and publicly available MIMIKATZ to presumably steal additional credentials.

Cyber Command's July 2019 CVE-2017-11774 indicators, which FireEye also attributes to APT33.

The actor leveraged stolen credentials and RULER’s module that exploits CVE-2017-11774 (RULER.HOMEPAGE), modifying numerous users’ Outlook client homepages for code execution and persistence.

Figure 1: Attacker’s homepage exploit (CVE-2017-11774)

SensePost's identification and responsible disclosure of CVE-2017-11774 was no different.

This is understandable, as some defenders may first learn of successful CVE-2017-11774 exploitation when observing Outlook spawning processes resulting in malicious code execution.