Query Details
Detecting Brazen Bamboos Forti Client Exploit A KQL Approach
Query
// Detecting BrazenBamboo's FortiClient Exploit: A KQL Approach // Volexity has identified and reported a vulnerability in Fortinet's Windows VPN client, FortiClient, where user credentials remain in process memory post-authentication. This flaw has been exploited by the threat actor BrazenBamboo through their DEEPDATA malware. BrazenBamboo is also known for the LIGHTSPY malware family. Volexity reported this vulnerability to Fortinet on July 18, 2024, and it was acknowledged on July 24, 2024. However, as of November 15, 2024, the issue remains unresolved, and no CVE number has been assigned. // The SHA1 file hash of the FortiClient VPN client indicates that nearly 22.8K organizations using Microsoft Defender for Endpoint (MDE) are at risk, highlighting a significant attack surface. To assist defenders, I have included the Volexity blog with comprehensive Indicators of Compromise (IOCs) in the comment section, enabling them to update their monitoring tools for potential BrazenBamboo threat activity. Additionally, I have developed a KQL detection for the DEEPDATA loader. // https://www.volexity.com/blog/2024/11/15/brazenbamboo-weaponizes-forticlient-vulnerability-to-steal-vpn-credentials-via-deepdata/ let EndpointWithFortiClient = DeviceTvmSoftwareInventory | where SoftwareName has "forticlient" | distinct DeviceId; let NewCreatedLowPrevalenceDLL = DeviceFileEvents | where ActionType == "FileCreated" | where FileName endswith ".dll" | invoke FileProfile(SHA1,10000) | where GlobalPrevalence <= 50 | join kind=leftouter DeviceFileCertificateInfo on SHA1 | where SignatureState == "Unsigned" | distinct FileName; DeviceEvents | where ActionType == @"DriverLoad" | where FileName endswith ".dll" | where FileName has_any(NewCreatedLowPrevalenceDLL) | where DeviceId has_any(EndpointWithFortiClient)
Explanation
This query is designed to detect potential exploitation of a vulnerability in Fortinet's FortiClient VPN software by a threat actor known as BrazenBamboo. Here's a simplified breakdown of what the query does:
-
Identify Devices with FortiClient: The query first identifies devices that have the FortiClient software installed by searching through the software inventory and listing unique device IDs.
-
Detect New and Rare DLL Files: It then looks for newly created DLL files (dynamic link libraries) on these devices. The query filters these files to find those that are rare globally (low prevalence) and unsigned, which could indicate suspicious activity.
-
Monitor for Suspicious Driver Loads: Finally, the query checks for any driver load events involving these rare DLL files on devices with FortiClient installed. This step helps identify if any suspicious DLLs are being loaded as drivers, which could be a sign of exploitation.
Overall, the query is part of a security measure to detect and respond to potential threats from the BrazenBamboo group exploiting the FortiClient vulnerability. It helps security teams monitor and protect their systems from unauthorized access or data theft.
Details
Steven Lim
Released: November 19, 2024
Tables
Keywords
Operators