The Setting

While attempting to build detection for DeepRats as revealed by @benkow_, I managed to have (what I think) is a pretty good idea about using xbits. I’ll admit its a bit basic but I think sometimes the best ideas are deceivingly simple.

The Idea

1.) observe potentially malicious behavior, set an xbit 2.) observe another potentially malicious behavior, set another xbit 3.) build detection consisting of a good fast_pattern match and xbits checks

Full working example here. The pattern in brief:

Rule 1 — IP check (set xbit on ip_src): Match TLS SNI to known IP-lookup domains. When a host resolves its own external IP, set ET.ipcheck on that source.

Rule 2 — Dropper site (set xbit on ip_src): Match TLS SNI to known abused storage/dropper domains. Set ET.dropsite on that source.

Rule 3 — Tor + correlation (check both xbits on ip_dst): Match characteristic Tor certificate patterns, then gate on ET.ipcheck and ET.dropsite being set on the destination. Note track ip_dst because this fires on the Tor response — the host that previously did the IP check is now the destination of an inbound Tor connection.

The key is the xbit direction flip: the first two rules track outbound behavior on the source; the final rule confirms that behavior by looking for it on the destination in the response direction.

The final sig could probably also be a great HUNTING sig. Other HUNTING sig ideas:

  • Tor -> coinmining
  • IP Check -> HTTP POST
  • IP Check -> HTTP to frequently abused TLD

tweet me your ideas!