{"id":19883,"date":"2022-08-18T09:00:53","date_gmt":"2022-08-18T17:00:53","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/08\/18\/news-13616\/"},"modified":"2022-08-18T09:00:53","modified_gmt":"2022-08-18T17:00:53","slug":"news-13616","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/08\/18\/news-13616\/","title":{"rendered":"Hardware-based threat defense against increasingly complex cryptojackers"},"content":{"rendered":"

Credit to Author: Microsoft 365 Defender Threat Intelligence Team| Date: Thu, 18 Aug 2022 17:00:00 +0000<\/strong><\/p>\n

Even with the dip in the value of cryptocurrencies in the past few months, cryptojackers \u2013 trojanized coin miners that attackers distribute to use compromised devices\u2019 computing power for their objectives \u2013 continue to be widespread. In the past several months, Microsoft Defender Antivirus detected cryptojackers on hundreds of thousands of devices every month. These threats also continue to evolve: recent cryptojackers have become stealthier, leveraging living-off-the-land binaries (LOLBins) to evade detection.<\/p>\n

\"Column
Figure 1. Chart showing number of devices on which Microsoft Defender Antivirus detected cryptojackers from January to July 2022.<\/em><\/figcaption><\/figure>\n

To provide advanced protection against these increasingly complex and evasive threats, Microsoft Defender Antivirus uses various sensors and detection technologies, including its integration with Intel\u00ae Threat Detection Technology (TDT)<\/a>, which applies machine learning to low-level CPU telemetry to detect threats even when the malware is obfuscated and can evade security tools.<\/p>\n

Using this silicon-based threat detection, Defender analyzes signals from the CPU performance monitoring unit (PMU) to detect malware code execution \u201cfingerprint\u201d at run time and gain unique insights into malware at their final execution point, the CPU. The combined actions of monitoring at the hardware level, analyzing patterns of CPU usage, and using threat intelligence and machine learning at the software level enable the technology to defend against cryptojacking effectively.<\/p>\n

In this blog post, we share details from our monitoring and observation of cryptojackers and how the integration of Intel TDT and Microsoft Defender Antivirus detects and blocks this complex threat.<\/p>\n

Looking at the current cryptojacker landscape<\/h2>\n

There are many ways to force a device to mine cryptocurrency without a user\u2019s knowledge or consent. The three most common approaches used by cryptojackers are the following:<\/p>\n