Alias

Machines used for software development are restless with churn, and on a network of over 2,000 endpoints running developer tools, scripts, and automated processes, an attacker has endless activity to hide in.

Unless trained eyes are watching.

A trusted tool abused

An EDR alert caught our analyst’s attention. A process on an endpoint had tried to open an outbound connection to an external IP address, and web protection blocked it.

Our analyst checked the address against external threat intelligence and confirmed it was known command-and-control (C2) infrastructure. Then they turned to the process behind it. The executable was WMIATRTL.exe, a file with an unremarkable name, almost certainly designed to be mistaken for a system component on a busy Windows machine.

Using the Active Response Shell, our analyst connected to the endpoint and retrieved the file. A file hash check confirmed the executable was a NetSupport client, a legitimate remote administration tool that sysadmins recognize, operating systems trust, and malware scanners don’t flag automatically.

In the right hands NetSupport is standard IT management software. For an attacker, it’s a foothold as effective as walking into the office and pulling up a chair.

Persistence

Access is perishable and expensive. Machines reboot and sessions drop, so attackers establish persistence mechanisms to ensure their valuable footholds aren’t easily erased.

Our analyst went searching for the attacker’s inevitable lifeline and found it in the Windows Task Scheduler. The attacker had set WMIATRTL.exe to run at startup, with admin privileges.

With the threat fully mapped, our analyst:

• Isolated the endpoint from the network.
• Killed WMIATRTL.exe.
• Stripped out the startup persistence.
• Informed the customer and advised on remediation steps.

Our analyst’s remediation advice was clear: revoke all active sessions, rotate credentials, and re-image the machine from a clean backup. The customer moved fast and confirmed it was done.

A foothold that never became more

For an organization managing healthcare software infrastructure in a sector governed by strict data sensitivity obligations, a threat actor with remote access is the worst kind of nightmare.

With a persistent, privileged foothold the attacker would have had all they needed to map the target’s network, identify high-value systems, stage tools for lateral movement, steal or ransom data, and pivot toward healthcare operations and patient data.

We dismantled the foothold before a remote connection was ever established.

In a high-activity development environment where hundreds of legitimate processes run every day, a renamed executable can go unnoticed for a long time. Catching it takes analysts who see beyond the superficial.

---

Reconstruction

From first signal to full handover