Return to Top
esentutl[.]exe, whoami[.]exe, and net[.]exe Incident with Real Estate Partner on April 17, 2024
Topline Takeaways
- Industry target: Real Estate
- Attacker information:
- esentutl[.]exe /p
- whoami
- net[.]exe
- Was AV / EDR present?
- Threat assessment for partners:
- The APG predicts that it is almost certainly that threat actors will continue to abuse legitimate tools such as remote monitoring and management (RMM), whoami[.]exe, and net[.]exe to exploit real estate-related and other organizations over the next 12 months.
- Recommended remediations and mitigations:
- Regularly audit both environment and endpoints
- Scripting language controls
- Heuristics-based activity monitoring and remediation
esentutl[.]exe /p Incident Timeline for April 17, 2024
- 07:11 a.m. ET: Blackpoint’s MDR alerted to malicious activity on a user administrator account using remote management tools to move laterally to the device of their real estate client.
- 07:12 a.m. ET: An MDR analyst began initial triage and investigation, during which they observed the threat actor executing commands whoami[.]exe and net[.]exe for enumeration, as well as using esentutl[.]exe /p to check the integrity of the critical database file NTDS.dit./li>
- 07:18 a.m. ET: The analyst escalated the incident to senior SOC leadership.
- 07:37 a.m. ET: The SOC made contact with the partner about the incident and provided additional remediation advice.
- 07:44 a.m. ET: The SOC isolated the impacted endpoints from all external and internal communications out of an abundance of caution.
More About whoami[.]exe, net[.]exe, and esentutl[.]exe /p
whoami[.]exe
whoami is a command used in both Windows and Unix operating systems and can be used to display the current username and privilege information (8).
Threat actors use this tool for reconnaissance, gathering information that can then be used for persistence, lateral movement, and privilege escalation.
net[.]exe
net[.]exe is a Windows command used for administering network configurations, user accounts, and network shares which can be used to stop and start the IPv6 protocol.
The net[.]exe protocol is often used by threat actors to:
- Gather system and network information as part of discovery
- Laterally move through SMB/Windows Admin Shares using the “net use” commands
- Interact with services on targeted networks (9)
In 2023, the U.S. CISA released a #StopRansomware alert related to the BianLian ransomware operation, who has previously been observed using net[.]exe to add a user account to the local remote desktop user group (10).
esentutl[.]exe /p
The esentutl[.]exe is a command line tool that provides database utilities for the Windows Extensible Storage Engine (11).
Threat actors use this tool to extract saved login credentials and dump the contents of the NTDS.dit file, an ESE database used by Active Directory to store information about user accounts and passwords (12).
In 2018, researchers observed China-linked adversary group APT10 (also known as “menuPass,” “Stone Panda,” “Red Apollo,” and “HOGFISH”) using esentutl[.]exe to execute commands that dropped:
- A malicious loader DLL
- An encrypted shellcode
- A GUP, a free generic loader (13)
APG Threat Analysis of LotL Threat Actor Abuse of whoami[.]exe, net[.]exe, and esentutl[.]exe /p for 2024
The APG predicts that threat actors will almost certainly continue to use locally allowlisted applications such as esentutl[.]exe, whoami[.]exe, and net[.]exe over the next 12 months.
We base this assessment especially on threat actors’ frequent use and abuse of related remote management tools to gain initial access, persistence, and evade detection.
In fact, the U.S. CISA warned of threat actors using these types of tools in a 2023 advisory.
LotL techniques – including abusing whoami, net, and esentutl instances on victim devices – are common actions taken by threat actors. Using expected and known tools can often make detection more difficult, thus leading to more successful attacks (14).
Recommended LotL Threat Actor Abuse of whoami[.]exe, net[.]exe, and esentutl[.]exe /p Mitigations and Remediations
The APG recommends the following actions to help mitigate LotL techniques, including for the threat actor’s use of the abused scripts used during this incident.
- Minimize the use of – or implement strict controls on – the use of scripting languages. Threat actors rely on scripting languages, such as the JavaScript used in this incident, to deploy malware and conduct malicious activities.
- Audit RMM tools on your network to avoid threat actors either abusing currently installed RMM instances, or installing their own copies of that software that might be overlooked by traditional antivirus or endpoint detection and response (EDR) solutions. Remember to identify currently used and authorized software, while removing software that does not meet the established requirements for use (and finding acceptable alternatives for the end users who are employing that shadow IT for legitimate work instances).
- Implement behavioral monitoring of your environment to detect unusual patterns that could indicate threat actor activity, even when they’re using allowlisted and legitimate applications.
