{"id":88808,"date":"2018-05-11T08:00:40","date_gmt":"2018-05-11T15:00:40","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=88808"},"modified":"2025-06-02T20:31:23","modified_gmt":"2025-06-03T03:31:23","slug":"mcafee-protects-against-doppelganging-technique","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/mcafee-protects-against-doppelganging-technique\/","title":{"rendered":"McAfee Protects Against Doppelg\u00e4nging Technique"},"content":{"rendered":"

This blog was co-written with Brook Schoenfield.<\/em><\/p>\n

That adversaries adopt new techniques is a known fact. However, the speed they include new innovative techniques to bypass end-point security and or evade sandboxing appears to be at an ever-increasing pace. Indeed, adversary adoption is often faster than the InfoSec industry can implement and test effective countermeasures. For example, in December 2017, a tool was released to hide PowerShell in a graphic file. Within 7 days of the release, McAfee Advanced Threat Research started to see the technique being exploited by a Nation State actor. From announcement to inclusion, test and use in production within 7 days is impressive.<\/p>\n

This week, security-researchers from Kaspersky discovered that an actor was applying the so-called Process Doppelg\u00e4nging technique in what has been named the \u201cSynAck\u201d ransomware. (https:\/\/securelist.com\/synack-targeted-ransomware-uses-the-doppelganging-technique\/85431\/)<\/p>\n

So What is the Process Doppelg\u00e4nging Technique in a Nutshell?<\/h2>\n

Using this technique gives the malware writer an ability to run malicious code\/executable under the cover of a legitimate executable by using the transaction features of the NTFS filesystem (Windows Transactional NTFS API).<\/p>\n

McAfee Detects and Protects<\/h2>\n

Since the initial release of this technique in December 2017, McAfee Labs has been investigating this technique and how we might protect our customers. In contrast to adversaries who can release mistakes in code and implementation, we simply cannot. We have to thoroughly test to ensure that when we release our solution it detects correctly and does not disrupt or break other software.<\/p>\n

McAfee\u2019s Product Security Incident Team (PSIRT), working in coordination with McAfee\u2019s product teams1<\/sup> delivered a protection to Process Doppelg\u00e4nging in two of McAfee\u2019s product suites (see below for more detail). McAfee\u2019s protection has tested effective against EnSilo\u2019s original proof of concept (PoC) and other examples. As an example, we tested recent malware using the technique against our detection feature with success:<\/p>\n

\"\"<\/p>\n

McAfee\u2019s protection prevents\u00a0execution of a file if changes to it are contained within a Windows NTFS transaction. There are no legitimate uses for the Transactional API to be used\u00a0in this way, so far as McAfee know.<\/p>\n

Details of products that include protection against Process Doppelg\u00e4nging follow:<\/p>\n