Hunting Unpacked: Unleashing External Threat Intelligence in Network Hunting

Key Takeaways

• Internal hunting is an invaluable exercise for INFOSEC teams and, by extension, the business or agency.
• Impactful methodologies rely on experienced professionals who are able to identify patterns and anomalies in large data sets comprised of network and/or host-based telemetry.
• Using the external web to alert on new or existing adversary TTPs is a smart technique for identifying criteria for new or improved hunting plays.
• New hunting methodologies need to be tested and refined. Plays vary by efficacy, and each play should be tracked for quality over time, and phased out when appropriate.

Do you hunt? Rather, do you frequently hunt in the internal network?

Operating under the premise that a previously undetected attacker is in the internal network is a savvy defense strategy that should comprise a large and evolving chapter in every business’s information security (INFOSEC) playbook.

Playbook plays should include well-documented hunting methodologies that can be performed by team veterans and rookies alike. The key is talented and motivated professionals who share two traits: curiosity and creativity; because hunting is an art. Sure, there’s room for machine-learning algorithms (science) to assist in the hunt, but the tools still require a human brain.

One of the best sources for hunting strategies is external analysis and intelligence. New hunting methodologies need to be tested and refined. Plays vary by efficacy, and each play should be tracked for quality over time, and phased out when appropriate. But like most daunting tasks, committing and starting is the primary hurdle.

Logical methodologies include pattern and anomaly recognition in single and combined data sets such as employee activity times across time zones, analyzing the long tail of workstation-generated user agent strings, new registry keys, or memory processes across network devices.

The following is an exposition of a basic internal hunting methodology that was originally derived from a lead identified on the external web. It’s one basic example of a hunting play that can be implemented based on external threat intelligence and adversary TTP identification.

Crafting a Methodology

What is the most common low-level adversary tactic, technique, or procedure (TTP) for surreptitiously installing malicious code on a victim system while evading antivirus detection? Packing or compressing the executable or script.

Packing or compression software is used by legitimate companies who need to make their legitimate portable binaries more efficient for transmission and storage. Unfortunately, threat actors also use packers to obfuscate their malware and evade antivirus software. So packers are a useful TTP category, but suboptimal for hunting in the enterprise due to a high noise to signal ratio in host and/or network telemetry (log and event meta data), unless the signature development list is constrained to a small subset of packers unlikely to be used by legitimate software manufacturers (see a sample crypter list below).

Packer defensive signatures may not be directly applicable for higher-level TTP hunting, but there may be derivative value in malware sample information identified by packer type and observed over time outside of the company network.

To that end, we created Recorded Future entities for a long list of known packers (or “crypters” as they are known in the Underground Economy).

On April 29, 2016 Recorded Future produced a new entity (more information on Recorded Future’s natural language processing technology) alert for “RLPack.”

The malware sample in question — Trojan-Banker.Win32.Banker.exe — creates three mutexes, one of which is fairly unique: “Wapp.” Team Cymru’s malware intelligence platform returns 940 malware samples using the same mutex. Metadata for one of the samples appears below and is packed with RLPack V1.18 Basic Edition:

—
This sample is a Trojan (tagged by multiple antivirus engines as a “Banker Trojan”) that performs a HTTP POST method to hxxp://xhoxts.byethost13[.]com/envia.php (located at 199.59.243.120:80 — Bodis, LLC in New York).
Metadata for additional related malware sample examples (by mutex) appear below:

A sample of additional packers used in related malware samples includes Thinstall Embedded 2.501 -> Jitit, PKLITE32 v1.1, Themida/WinLicense V1.8.0.2 + -> Oreans Technologies, eXPressor v1.5x -> CGSoftLabs (h), and UPX.

Creating the Play

The only runtime analysis commonality across the above four samples is the mutex string “Wapp” and the file type .exe destined for Windows machines. Otherwise these Trojan samples are different sizes, use different packers, and communicate with different internet controllers.

Yet there’s an opportunity to create a play specifically for hunting this crimeware in the enterprise, and it revolves around the HTTP POST path. While the domains and associated server addresses change across samples, the URI structure is relatively uniform.

In this case envia.php and infect.php are ideal candidates for a hunting methodology. Enviar is a Spanish transitive verb meaning “to send” and a Google search for inurl:”/envia.php” returns relatively few results. Thus it’s unlikely that internal enterprise employees would normally be initiating HTTP traffic to web pages ending in envia.php. Similarly, there are few Google results for inurl:”infect.php” also making it a good candidate for inclusion in a hunting play for this Banking Trojan family.

In order to test the play, a SIEM (security incident and event management) is a useful facilitator, specifically Splunk or ELK (ElasticSearch, Logstash, and Kibana). The SIEM should be storing web proxy logs and available for queries. A regular expression search (a generic Splunk query involving BlueCoat web proxy logs: sourcetype=”bluecoat:proxysg:access:syslog” uri_path=infect.php) for the previously discussed PHP pages may reveal negative results. Positive results could indicate a previously undetected compromise.

Regardless of initial search results, the SIEM query should be automated for regular review and evaluated for long-term value. The playbook should eventually contain internal hunting plays for specific malware families that are identified as high-value priorities to the business due to specific functionality or attribution.

Open source Yara rules are provided by Endgame for alerting on specific packers.

Conclusion

Hunting is an invaluable exercise for INFOSEC teams and, by extension, the business or agency.

Impactful methodologies rely on experienced professionals who are able to identify patterns and anomalies in large data sets comprised of network and/or host-based telemetry.

Using the web to alert on new or existing adversary TTPs is a smart technique for identifying criteria for new or improved hunting plays. In this case we identify a new malware sample via the web due to a match on a packer/crypter entity which leads to additional samples via malware intelligence. The additional samples contain metadata that is useful for malicious traffic profiling.

The identified pattern is subsequently ported to a SIEM query for ongoing alerting and the play is documented and tracked for long-term efficacy and value communication to the business.