New Config Extractors, a 4-VTI Phishkit Behavior Detection Set, and 30+ New YARA Rules

VMRay's June detection highlights webinar showcases new behavioral threat identifiers (VTIs), config extractors, and Yara rules designed to counter evolving attacker techniques like living-off-the-land abuse and sophisticated phishing kits 3:19-3:52.

Key Takeaways:
• An updated VTI improves the identification of suspicious Office controls (like ActiveX and OLE objects) associated with known vulnerabilities, providing faster triage 5:33-8:03.
• A new defense evasion VTI detects malware, such as Squid Loader, attempting to bypass Windows Defender's emulator using the undocumented NtIsProcessInJob API call 8:12-10:58.
• A novel VTI identifies "ENV Loader," a technique that evades static detection by splitting malicious PowerShell commands across numerous environment variables before dynamically reconstructing them at runtime 11:04-13:06.
• Three new low-scoring VTIs work together to reliably detect Evil Proxy phishing pages by identifying embedded Microsoft password reset dialogs, line-broken login text, and suspicious connections to Microsoft authentication services 16:00-20:00.
• New configuration extractors were added for RHClient 2 (Setop Red) and the long-standing Ghost RAT malware families to extract high-quality IOCs 20:06-21:09.

These continuous updates ensure defenders can identify threats earlier and with greater confidence, even when attackers heavily obfuscate their payloads 33:20-33:32.

Sources:

• 3:19-3:52 Introduction to June detection updates
• 5:33-8:03 Suspicious Office controls and CVE association
• 8:12-10:58 Windows Defender emulator evasion via Squid Loader
• 11:04-13:06 ENV Loader PowerShell execution from environment variables
• 16:00-20:00 Evil Proxy phishing kit behavioral detection set
• 20:06-21:09 RHClient 2 and Ghost RAT config extractors