December 5, 2016 By Douglas Bonderud 2 min read

Cybercriminals have moved beyond brute force. Rather than spinning up smash-and-grab attacks, many now infect single machines and then perform reconnaissance to prioritize their next network targets.

CFO put it simply: “The strategy of defending a perimeter to keep attackers out is no longer sufficient. Organizations instead need to assume that their network will be penetrated.” Malicious actors are biding their time, discovering what they can before stepping up their efforts.

But how do IT administrators detect and deflect recon attacks? A pair of Microsoft researchers developed a way to help IT departments stay safe, known as SAMRi10.

Flying Blind

Recon attacks are now a key part of cybercriminals’ threat chain. While infecting single machines without detection isn’t difficult, crashing randomly around corporate networks tends to attract attention. As a result, fraudsters developed ways to quietly map company connections and determine the most lucrative next step.

According to Bleeping Computer, Windows’ Security Account Manager (SAM), which contains all information about user accounts, makes this easier for many fraudsters. Authorized users can conduct Security Account Manager Remote (SAMR) queries to return information about local and domain users, aliases, memberships and other critical network data.

While computers separate from larger network domains are largely problem-free, since they only hold local user data, those attached to the corporate system at large can help point cybercriminals in the direction of sensitive or mission-critical information.

Since SAMR queries happen regularly in both Windows 10 and Windows Server 2016 environments, fraudsters can easily avoid red flags as long as they establish access on one PC. These queries under control of attackers give them eyes in every corner of the network but leave admins flying blind.

Good SAMRi10

Microsoft researchers Itai Grady and Tal Be’ery developed a counter-recon tool by the clever name of SAMRi10, pronounced “Samaritan,” to limit the reach of recon-minded attackers. As noted by the The Register, SAMRi10 is a PowerShell script that system admins can execute to limit the ability of users to perform SAMR queries.

The tool leverages a registry key present in Windows 10 and newer versions of Microsoft’s OS, HKLM/System/CurrentControlSet/Control/Lsa/RestrictRemoteSAM. This allows system administrators to restrict SAMR actions to admins only and create a separate user group if they need to authorize specific personnel who don’t have admin status.

So far, the tool has performed well against popular recon software such as PowerSploit and BloodHound, and the Microsoft team encouraged all security admins to consider reviewing the full documentation.

No Good Deed…

While Grady and Be’ery have certainly performed a good deed for Windows 10 users, it’s worth noting that SAMRi10 doesn’t work on any previous version of the OS, and Windows 10 has only 22 percent of the current market share. In other words, shutting down this recon pipeline doesn’t trip up attackers anywhere else.

But a recent Cyber Scoop article pointed to another way forward: The Department of Homeland Security (DHS) wants Silicon Valley companies to turn the tables on cyberattackers by developing deception techniques designed to confuse and frustrate any attempt at recon.

Observation is the new cybercriminal watchword. Tools such as SAMRi10 and a focus on taking the fight to shifty cyber spies, however, may help tip the scales in favor of IT security.

More from

Recent CrowdStrike outage: What you should know

3 min read - On Friday, July 19, 2024, nearly 8.5 million Microsoft devices were affected by a faulty system update, causing a major outage of businesses and services worldwide. This equates to nearly 1% of all Microsoft systems globally and has led to significant disruptions to airlines, police departments, banks, hospitals, emergency call centers and hundreds of thousands of other private and public businesses. What caused this outage in Microsoft systems? The global outage of specific Microsoft-enabled systems and servers was isolated to…

White House mandates stricter cybersecurity for R&D institutions

2 min read - Federal cyber regulation is edging further into research and development (R&D) and higher education. A recent memo from the Office of Science and Technology Policy (OSTP) states that certain covered institutions will be required to implement cybersecurity programs for R&D security. These mandates will also apply to institutions of higher education that support R&D. Beyond strengthening the overall U.S. security posture, this move is also in direct response to growing threats posed by the People's Republic of China (PRC), as…

New memo reveals Biden’s cybersecurity priorities through fiscal year 2026

2 min read - On July 10, 2024, the White House released a new memo regarding the Biden administration’s cybersecurity investment priorities, initially proposed in July 2022. This new memorandum now marks the third time the Office of the National Cyber Director (ONCD), headed by Harry Coker, has released updated priorities and outlined procedures regarding the five core pillars of the National Cybersecurity Strategy Implementation Plan (NCSIP), now relevant through fiscal year 2026. Key highlights from the FY26 memorandum In the latest annual version…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today