Hunting Beacons: Bartosz Jerzman

Hunting beacons
Bartosz Jerzman
agenda
Part I: HTTP beacon detection

Part II: HTTPS beacon detection
Part III: Let’s hunt them early – C2 scanning
whoami
• Sysadmin and network defender for the Polish Navy

• Incident responder
• Pentester
• Cyber threat intelligence analyst & adversary hunter
• @secman_pl
PART I
Beaconing over HTTP
What is beaconing?
• Malware does not keep long connection to C2
• Malware connects to C2 periodically
• Beaconing can occur regularly at constant intervals
• Or it can occur at pseudorandom moments of time
Time for x33fcon 2019 most popular meme
Signature matching for beaconing?
PAYLOAD
Cobalt Strike beacon traffic simulating Slack communication

Would your SOC escalate on this?
Would your SOC escalate on this?
IDS detected that HTTP response body is not gzipped as it has

been declared in the response headers.
Set of hipothesis:
#1: analysis of intervals of connections
#2: same URI for different Host names
#3: same or none Referrer to many URIs
#4: different URIs but length is constant

Dataset:
• Data from Cyber Defence Excercise: „Locked Shields”
• PCAP -> processed by BRO-IDS/ZEEK -> http.log
• Example of data from http.log
• Alternative data sources: flows, webproxy logs
user_age Req_body Resp_body
srcIP srcPort dstIP dstPort method host uri cookie
nt _length _length
Mozilla/
5.0 Trackr=e
10.18.7.3 50474 39.88.160[.]18 80 POST test.com /test.php (Window 0 303 DMzZm
s NT 6.1; Nvbg==
WOW64)
Hipothesis #1: analysis of connections intervals
Assumption: Connection intervals from malware to C2 server are

distributed around some average value.
WHY?
Beaconing malware often has configuration options for setting:
- sleep time
- jitter (variations from central value)
https://www.investopedia.com
Beacon A: Cobalt Strike payload with configuration{ 60 s sleep, 20% jitter }

Beacon B: Cobalt Strike payload with manual sleep commands from operator
Variation
Beacon #1 #2 #3 #4 #5 #6 AVG STDDEV
Coefficient
A 48s 51s 62s 69s 55s 60s 57,5s +/- 7,75 s 13,4 %
B 1s 2s 100s 14s 70s 27s 35,7s +/- 40,5 s 113,5 %

Beacon A: Cobalt Strike payload with configuration{ 60 s sleep, 20% jitter }

𝑺𝑻𝑫𝑫𝑬𝑽
Var. Coeff. = *100%
Beacon B: Cobalt Strike payload𝑨𝑽𝑮
with manual sleep commands from operator
Variation
Beacon #1 #2 #3 #4 #5 #6 AVG STDDEV
Coefficient
A 48s 51s 62s 69s 55s 60s 57,5s +/- 7,75 s 13,4 %
B 1s 2s 100s 14s 70s 27s 35,7s +/- 40,5 s 113,5 %

Query inspired by: https://www.splunk.com/blog/2018/03/20/hunting-your-dns-dragons.html

Aggregate connections
By srcIP,dstIP,User-Agent

Variation Coeff < 100 %

At least 10 connections
AvgBeaconTime > 1s

C2 server 78.187.72[.]190
AvgBeaconTime 7s
StdDev +/- 3
= very interactive session
C2 server 222.186.31[.]162
BeaconTime: 28min
+/- 7 min
Longterm operation for
maintaining access
Hipothesis #2: same URI for different Host names
Hipothesis is based on the assumption that:
Adversary is using backdoor that has several C2 backup
domains included in the configuration.
https://www.cobaltstrike.com/help-http-beacon
Datasource is HTTP log

from Zeek (request and
response data)
Several false positive URIs

are excluded
Logic: How many different

hosts were requested
with same URI?
Detection threshold: 3
different hosts
5 unique C2 domains
discovered for 2 similar
yet different URI
requests
Hipothesis #3: Same or none Referrer to many URIs
Hipothesis #3: Same or none Referrer to many URIs
Counting Referrers on
single destination
Threshold >3 AND < 10
URIs related to 1st

stage malware from C2
Hipothesis #4: different URIs but length is constant
Exclusion of servcies due to false positives
Another C2 domain
discovered with
3 different URIs of same
length
Jack Crook (still waiting for you, Jack, at x33fcon) has a
great set for hipothesis inspirations:
https://twitter.com/jackcr/status/1029457184164335617
PART II
Beaconing over HTTPS
{ FakeTLS example from LAZARUS APT }
FakeTLS – how does it work?
FAKE TLS HANDSHAKE
C2 COMMS
192.168.56.19
114.215.107[.]218
The Funny Part of
FakeTLS – how does it work? mimicking TLS to
popular sites e.g.
wetransfer.com
FAKE TLS HANDSHAKE
C2 COMMS
192.168.56.19
114.215.107[.]218
C2 sends back real
FakeTLS – how does it work? (often expired)
certificate
FAKE TLS HANDSHAKE
C2 COMMS
192.168.56.19
114.215.107[.]218
FakeTLS – how does it work?
FAKE TLS HANDSHAKE
C2 COMMS
192.168.56.19
114.215.107[.]218
Non-TLS encryption with
symmetric, shared RC4
key
FakeTLS – does it beacon?
C2 COMMS (encrypted messages sizes in Bytes)

FakeTLS – does it beacon? Maximum
message size of
808 Bytes
C2 COMMS
FakeTLS – interesting part shortly after handshake
The beginning of
REAL comms has
fixed size
messages
C2 COMMS
FakeTLS – is it really hardcoded?
24 B
# Message 2 construction in code

push 0x17 # Encrypted Data Header in SSL message
push 1 # TLS 1.0
lea edx, [esp + 0x34]
push 0x18 # 24 bytes - Encrypted Message Length
FakeTLS detection using SSL profiling
8B
24 B
8B
8B
4B
backdoor FakeTLS C2
Analysing the sizes of first 5 messages of Encrypted Application Data

(after TLS handshake) can help you detect traffic to unknown C2
infrastructure that uses FakeTLS
FakeTLS – what’s wrong with those msg sizes?
8B
24 B
8B
8B
4B
backdoor FakeTLS C2
In TLS algorithms every message is hashed (e.g. md5) for integrity check
length(md5(msg)) = 16B
8B < 16B ;)
FakeTLS – where to hunt unknown C2
infrastructure?
Reactive: Proactive:
- own network traffic - pcaps from sandboxes e.g.
detection Hybrid-Analysis
- Can your network traffic
analyser process TLS data
after the handshake?
PART III
Let’s hunt them early – C2 scanning
NBA in 1990s – „Offense starts with defense”
http://b-rise.com
Quick intro to wide topic
https://attack.mitre.org/
Finding defaults: #1 Cobalt Strike console port
Management console port for Teamserver is by default: 50050/tcp

Finding defaults: #2 Cobalt Strike idle DNS answer
DNS answer for ANY request is: 0.0.0.0

Finding defaults: #3 Cobalt Strike 404 answer
CS (NanoHTTPD) answers with: HTTP/1.1 404 Not Found

Content-Type: text/plain
Date: Mon, 30 Feb 2019
13:37:00 GMT
Content-Length: 0
Finding defaults: #4 Cobalt Strike „space”
CS responds with additional space after 200 OK

Hunting for NanoHTTPD servers.
Corrected in Cobalt Strike v. 3.13
Conclusion
• Adversary tools and procedures very often have patterns

• Threat analyst job is to uncover human traces and
adversaries weaknesses
• Burn the defaults, burn what is known (opensource,
commercial C2)

Hunting Beacons: Bartosz Jerzman

Uploaded by

Copyright:

Available Formats

Hunting Beacons: Bartosz Jerzman

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Hunting Beacons: Bartosz Jerzman

Uploaded by

Copyright:

Available Formats

Hunting beacons

Part I: HTTP beacon detection

• Sysadmin and network defender for the Polish Navy

Cobalt Strike beacon traffic simulating Slack communication

IDS detected that HTTP response body is not gzipped as it has

#2: same URI for different Host names

#3: same or none Referrer to many URIs

#4: different URIs but length is constant

Assumption: Connection intervals from malware to C2 server are

Beacon A: Cobalt Strike payload with configuration{ 60 s sleep, 20% jitter }

B 1s 2s 100s 14s 70s 27s 35,7s +/- 40,5 s 113,5 %

Beacon A: Cobalt Strike payload with configuration{ 60 s sleep, 20% jitter }

B 1s 2s 100s 14s 70s 27s 35,7s +/- 40,5 s 113,5 %

Query inspired by: https://www.splunk.com/blog/2018/03/20/hunting-your-dns-dragons.html

Query inspired by: https://www.splunk.com/blog/2018/03/20/hunting-your-dns-dragons.html

Variation Coeff < 100 %

Query inspired by: https://www.splunk.com/blog/2018/03/20/hunting-your-dns-dragons.html

Datasource is HTTP log

Several false positive URIs

Logic: How many different

URIs related to 1st

Exclusion of servcies due to false positives

FAKE TLS HANDSHAKE

FAKE TLS HANDSHAKE

FAKE TLS HANDSHAKE

FAKE TLS HANDSHAKE

C2 COMMS (encrypted messages sizes in Bytes)

# Message 2 construction in code

Analysing the sizes of first 5 messages of Encrypted Application Data

Management console port for Teamserver is by default: 50050/tcp

DNS answer for ANY request is: 0.0.0.0

CS (NanoHTTPD) answers with: HTTP/1.1 404 Not Found

CS responds with additional space after 200 OK

• Adversary tools and procedures very often have patterns

You might also like