The Mistaken PowDesk Threat Intel

Dall-E created powdesk logo

Available with no paywall on github.

In January 2020, Clearsky wrote a report detailing an alleged new piece of malware deployed by APT34 that they refer to as “PowDesk”. When I read their blog post, I suspected that the “malware” they were reporting on was not, in fact, malware but legitimate software mistaken for malware.

Throughout the report, the details don’t show anything explicitly malicious or a plausible scenario by which an adversary could use them. This story is an excellent example of the “Malicious colored glasses” and “Threat Narrative” fallacies I discuss in “Common Cyber Threat Intel Biases”.

Even after the publisher of LanDesk confirmed it was not malicious just days after the Clearsky report, most vendors continued to detect this as malware in 2023.

Key Analyst Points:

Malicious Colored Glasses — seeing new information through the lens of “maliciousness” rather than understanding the facts.
Threat Narrative Fallacy — constructing a seemingly coherent story about a threat, then fitting the facts to the story.
Improve range — don’t just study malware and threat actors, but also learn about software development, deployment, and base rates to better assess the likelihood of misuse.
Question assumptions — trace the story to its origins, is the foundation strong enough to support the layers on top.
Incorrect intelligence can have downstream consequences — a mislabeled yara rule led to faulty attribution and association with long term consequences.

What happened?

This story traces back to 2018 when Unit42 produced a report on Dark Hydrus. This report was turned into Yara rules, which later detected a new upload to VT. This upload was construed as part of ongoing activity and subsequently blogged. The benign software hash, legitimate domain, and even IP address were consequently picked up by antivirus, threat intelligence, and many other vendors who propagated the faulty intelligence for almost four years.

The publisher of LanDesk, Ivanti, even issued an advisory after investigating the issue. Their investigation determined there was no malware involved and they were able to positively identify it as an intentional customer coded deployment.

In December 2023, 57/73 antivirus engines classify this file as malicious on virustotal. The downstream consequences of this verdict include this file being used in machine learning algorithms and security products resulting in potential false positives for legitimate Bat2Exe and LanDesk users. Once this file was labelled as malicious, there appeared to be no method available to revert its status among vendors.

Dissecting the origins

Here is a timeline of the events that covers how the intelligence was sourced, processed and later mistakenly used:

2018–07–27 — Unit42 report on “Dark Dydrus” calling out “OneDrive.bat”, derived from a Bat2Exe binary used in an attack
2018–08–02 — Commit of DarkHydrus yara rules
2019–12–13–8406ca490c60ec41569b35f31f1860ff4663bba44d1daac64760ecdfe694203d submitted to VT
2019–12–13 — detected on VT by Thor APT scanner as “RULE: APT_OilRig_Dropped_Aug18_1”
2020–01–09 — Clearsky Powdesk report
2020–01–15 — Ivanti (publisher of LanDesk), advisory that Powdesk is not malware
2022–06–22 — Github issue reporting falsepositive on yara sig

If we take a look at the original Yara rule, we can see that it was written in good faith based on hashes provided in the Unit42 report. The only issue is the direct attribution to DarkHydrus in the name and description. I believe this rule metadata is what later leads to the mistaken attribution.

rule APT_DarkHydrus_Jul18_4 {
   meta:
      description = "Detects strings found in malware samples in APT report in DarkHydrus"
      author = "Florian Roth"
      reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
      date = "2018-07-28"
      hash1 = "d428d79f58425d831c2ee0a73f04749715e8c4dd30ccd81d92fe17485e6dfcda"
      hash1 = "a547a02eb4fcb8f446da9b50838503de0d46f9bb2fd197c9ff63021243ea6d88"
   strings:
      $s1 = "Error #bdembed1 -- Quiting" fullword ascii
      $s2 = "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
      $s3 = "\\a.txt" fullword ascii
      $s4 = "command.com" fullword ascii /* Goodware String - occured 91 times */
      $s6 = "DFDHERGDCV" fullword ascii
      $s7 = "DFDHERGGZV" fullword ascii
      $s8 = "%s%s%s%s%s%s%s%s" fullword ascii /* Goodware String - occured 4 times */
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and 5 of them
}

In July 2022 a github issue was submitted to change this rule based on the observation that it detects “BDARGO Advanced BAT to EXE converter” packaged binaries instead of APT34 binaries. This issue led to a modification of the rule, updating its metadata and name to clearly indicate suspicion and identify the specific tool.

Later iterations of this rule identify the bat2exe tool specifically as suspicious and remove attribution to a threat actor.

/* previously: APT_DarkHydrus_Jul18_4 */
rule SUSP_BAT2EXE_BDargo_Converted_BAT {
   meta:
      description = "Detects binaries created with BDARGO Advanced BAT to EXE converter"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.majorgeeks.com/files/details/advanced_bat_to_exe_converter.html"
      date = "2018-07-28"
      modified = "2022-06-23"
      score = 45
      hash1 = "d428d79f58425d831c2ee0a73f04749715e8c4dd30ccd81d92fe17485e6dfcda"
      hash1 = "a547a02eb4fcb8f446da9b50838503de0d46f9bb2fd197c9ff63021243ea6d88"
      id = "c9da4184-1530-5525-bdba-2dcc8a221bb1"
   strings:
      $s1 = "Error #bdembed1 -- Quiting" fullword ascii
      $s2 = "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
      $s3 = "\\a.txt" ascii
      $s4 = "command.com" fullword ascii /* Goodware String - occured 91 times */
      $s6 = "DFDHERGDCV" fullword ascii
      $s7 = "DFDHERGGZV" fullword ascii
      $s8 = "%s%s%s%s%s%s%s%s" fullword ascii /* Goodware String - occured 4 times */
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and 5 of them
}

Conclusion

The mistaken attribution of the PowDesk malware can lead to downstream sources detecting the benign Bat2Exe or LanDesk software as malicious. Many detection engines and services use machine learning and similarity approaches to find malware, by labeling this software as malware, the data is polluted with false positive data.