December 5, 2016 By Douglas Bonderud 2 min read

Cybercriminals have moved beyond brute force. Rather than spinning up smash-and-grab attacks, many now infect single machines and then perform reconnaissance to prioritize their next network targets.

CFO put it simply: “The strategy of defending a perimeter to keep attackers out is no longer sufficient. Organizations instead need to assume that their network will be penetrated.” Malicious actors are biding their time, discovering what they can before stepping up their efforts.

But how do IT administrators detect and deflect recon attacks? A pair of Microsoft researchers developed a way to help IT departments stay safe, known as SAMRi10.

Flying Blind

Recon attacks are now a key part of cybercriminals’ threat chain. While infecting single machines without detection isn’t difficult, crashing randomly around corporate networks tends to attract attention. As a result, fraudsters developed ways to quietly map company connections and determine the most lucrative next step.

According to Bleeping Computer, Windows’ Security Account Manager (SAM), which contains all information about user accounts, makes this easier for many fraudsters. Authorized users can conduct Security Account Manager Remote (SAMR) queries to return information about local and domain users, aliases, memberships and other critical network data.

While computers separate from larger network domains are largely problem-free, since they only hold local user data, those attached to the corporate system at large can help point cybercriminals in the direction of sensitive or mission-critical information.

Since SAMR queries happen regularly in both Windows 10 and Windows Server 2016 environments, fraudsters can easily avoid red flags as long as they establish access on one PC. These queries under control of attackers give them eyes in every corner of the network but leave admins flying blind.

Good SAMRi10

Microsoft researchers Itai Grady and Tal Be’ery developed a counter-recon tool by the clever name of SAMRi10, pronounced “Samaritan,” to limit the reach of recon-minded attackers. As noted by the The Register, SAMRi10 is a PowerShell script that system admins can execute to limit the ability of users to perform SAMR queries.

The tool leverages a registry key present in Windows 10 and newer versions of Microsoft’s OS, HKLM/System/CurrentControlSet/Control/Lsa/RestrictRemoteSAM. This allows system administrators to restrict SAMR actions to admins only and create a separate user group if they need to authorize specific personnel who don’t have admin status.

So far, the tool has performed well against popular recon software such as PowerSploit and BloodHound, and the Microsoft team encouraged all security admins to consider reviewing the full documentation.

No Good Deed…

While Grady and Be’ery have certainly performed a good deed for Windows 10 users, it’s worth noting that SAMRi10 doesn’t work on any previous version of the OS, and Windows 10 has only 22 percent of the current market share. In other words, shutting down this recon pipeline doesn’t trip up attackers anywhere else.

But a recent Cyber Scoop article pointed to another way forward: The Department of Homeland Security (DHS) wants Silicon Valley companies to turn the tables on cyberattackers by developing deception techniques designed to confuse and frustrate any attempt at recon.

Observation is the new cybercriminal watchword. Tools such as SAMRi10 and a focus on taking the fight to shifty cyber spies, however, may help tip the scales in favor of IT security.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today