Cyritex Security Labs | 22 attack techniques associated with SHELLSTING have been incorporated into the Breach and Attack Simulation library!

SHELLSTING is a downloader written in C++. Once it is dropped onto an attacker-controlled foothold, it can download payloads from a hacker's remote server hardcoded in its code and inject them into Windows processes.

In the initial access tactics or the delivery phase of the kill chain, attackers can use phishing emails to deliver the SHELLSTING tool, and in the C&C tactics or C&C phase of the kill chain, attackers can use other tools to download and deliver SHELLSTING, ultimately achieving execution and process injection on the foothold to bypass defenses and gain full control.

Figure 1: ATT&CK Tactics and Techniques (Image source: https://attack.mitre.org/)

▌Simulated Attack Library Update

You can already select verification actions related to SHELLSTING in our platform to perform attack simulations, testing your terminal/host defense mechanisms' ability to detect and defend against such attack techniques.

In particular, you can execute SHELLSTING's Windows process injection through the protected sandbox of CyVerify, allowing you to determine whether your current terminal/host defense mechanisms can defend against its attack at the very last second, without worrying about the various impacts of its destructiveness in case it is not defended against. CyVerify's protected sandbox will ensure its security without causing any impact.