Breach Assessment - The Curious Case of the Comburglar w/ Troy Wojewoda

Black Hills Information Security’s Troy Wojewoda details the "Comb Burglar" campaign, where threat actors abused the legitimate user_feed_synchronization scheduled task to execute malicious COM handlers via dllhost.exe, maintaining stealthy persistence and C2 capabilities.

Key Takeaways:
• The threat actor modified the benign user_feed_synchronization scheduled task to invoke a malicious COM handler, bypassing traditional executable-based detection by leveraging dllhost.exe to run a surrogate DLL 12:30
• Import table hashing (impash) proved to be a high-fidelity indicator for this campaign, allowing researchers to identify multiple compromised assets and artifacts across the environment despite file hash variations 28:45
• Threat actors registered new domains and uploaded artifacts to VirusTotal to test detection, highlighting the importance of monitoring domain registration timelines and analyzing compile timestamps to detect evasion attempts 35:10
• Effective breach assessments require proactive threat hunting across multiple telemetry pillars (cloud, identity, network, host) to identify undetected activity, rather than relying solely on reactive incident response to known IOCs 15:20
• Defense strategies should focus on behavioral anomalies, such as scheduled tasks invoking COM handlers that reference DLLs outside of protected system directories, rather than just blocking specific IP addresses which can be easily rotated 42:15

This case underscores the critical need for proactive breach assessments and behavioral hunting to uncover sophisticated, low-and-slow intrusions that evade standard signature-based defenses.

Sources:

• 12:30 Explanation of the "Comb Burglar" technique using COM handlers
• 28:45 Value of Import Table Hashing (impash) in detection
• 35:10 Analysis of domain registration and VirusTotal testing artifacts
• 15:20 Overview of breach assessment methodology and telemetry pillar