Camera Management Software - Trusted Binary Spawning Shell

Georg Lauenstein@gsec

•updated yesterday•0•0•5

Detects a camera management software binary (e.g. iVMS-4200, SmartPSS, NVR/DVR viewers, vendor CMS/VMS clients) spawning cmd.exe, powershell.exe or pwsh.exe. In this campaign the compromised vendor update channel abused the trusted, signed vendor executable to proxy execution of follow-on payloads and shell commands, inheriting the vendor signature to evade application allowlisting and static detection.