I have found that there is quite a lot of incredibly useful meta packed into the 'query' meta key over the past several years. The HTTP parser puts arguments and passed variables in there when used in GET's and POST's. While examining some recent PCAP's from the Malware Traffic Analysis site, there are some common elements we can use to identify Trickbot infections. This was not an exhaustive look at Trickbot, but simply a means to identify some common traits as meta values. As Trickbot, or any malware campaign changes, IOC's will need to be updated.
First things first, let's look at the index level for the 'query' meta key. By default, the 'query' meta key is set to 'IndexKeys'. This means that you could perform a search where the key existed in a session, but could not query for the values stored within that key.
There are pro's and con's to setting the index level to 'IndexValues' in your 'index-concentrator-custom.xml' file on your concentrators. Some pro's include being able to search for values in there during an investigation. The con's are that these queries would likely involve 'contains' which taxes the query from a performance perspective. Furthermore, 'query' is a Text formatted meta key and limited to 256 bytes. Therefore, anything that after 256 bytes would be truncated and you may not have the complete query string.
Whether 'query' is set to 'IndexKeys' or 'IndexValues' or even 'IndexNone', we can take advantage of it in App rule creation. In one Trickbot pcap, we can see an HTTP POST to an IP address on a non-standard port.
If we look at the meta created for this session, we can see the 'proclist' and 'sysinfo' as pieces in the 'query' meta.
Combine these with a service type (service = 80) and an action (action = 'post'), we can create an application rule that can help find Trickbot infections in the environment. For good measure, we can add additional meta from analysis.service to help round it out.
| Trickbot application rule |
|---|
| service = 80 && action = 'post' && query = 'name="sysinfo"' && query = 'name="proclist"' && analysis.service = 'windows cli admin commands' |
The flexibility of app rule creation allows for analysts and threat hunters take a handful of indicators (meta) and combine them to make detection easier.
App rules help make detection easier. Once a threat is identified, we can use this method to find the traffic easier moving forward so that we can go find the next new bad thing. If the app rule fires too often on normal traffic, then we can adjust the rule to add or exclude other meta to ensure it is firing correctly.
As always, good luck, and happy hunting.
Chris
