166 lines
5.0 KiB
Markdown
166 lines
5.0 KiB
Markdown
FRPC Connection attempt
|
|
|
|
```
|
|
`indextime` sourcetype=zeek* (id.orig_p IN (6000,7000) AND id.resp_p=*) OR (id.resp_p IN (6000,7000) AND id.orig_p=*)
|
|
| eval hash_sha256= lower(hash_sha256),
|
|
hunting_trigger="Detects FRPC communication using designated ports.",
|
|
mitre_category="Command and Control",
|
|
mitre_technique="Application Layer Protocol",
|
|
mitre_technique_id="T0000",
|
|
mitre_subtechnique="",
|
|
mitre_subtechnique_id="",
|
|
apt="Volt Typhoon",
|
|
mitre_link="",
|
|
creator="Cpl Iverson",
|
|
last_tested="2025-04-15",
|
|
upload_date="2025-04-15",
|
|
last_modify_date="2025-04-15",
|
|
mitre_version="v16.1",
|
|
priority="high"
|
|
| `process_create_whitelist`
|
|
| eval indextime = _indextime
|
|
| convert ctime(indextime)
|
|
| table _time indextime id.orig_p id.orig_h id.resp_p id.resp_h mitre_category mitre_technique mitre_technique_id hunting_trigger mitre_subtechnique mitre_subtechnique_id apt mitre_link creator last_tested upload_date last_modify_date mitre_version priority
|
|
| collect `jarvis_index`
|
|
```
|
|
|
|
```
|
|
title: Detect Connection Between Port 7000 and Port 6000
|
|
id: c1234567-89ab-cdef-0123-456789abcdef
|
|
description: Detects network connections from port 7000 to port 6000
|
|
author: Matthew Iverson
|
|
logsource:
|
|
product: network
|
|
service: firewall
|
|
detection:
|
|
selection:
|
|
src_port: 7000
|
|
dest_port: 6000
|
|
condition: selection
|
|
fields:
|
|
- src_ip
|
|
- dest_ip
|
|
- src_port
|
|
- dest_port
|
|
level: medium
|
|
```
|
|
|
|
ICMPDoor
|
|
|
|
```
|
|
`indextime` sourcetype=zeek*
|
|
| where icmp_type=0 OR icmp_type=8
|
|
| eval hash_sha256= lower(hash_sha256),
|
|
hunting_trigger="Detects FRPC communication using designated ports.",
|
|
mitre_category="Command and Control",
|
|
mitre_technique="Application Layer Protocol",
|
|
mitre_technique_id="T0000",
|
|
mitre_subtechnique="",
|
|
mitre_subtechnique_id="",
|
|
apt="Volt Typhoon",
|
|
mitre_link="https://attack.mitre.org/techniques/T1071/",
|
|
creator="Cpl Iverson",
|
|
last_tested="",
|
|
upload_date="2025-04-15",
|
|
last_modify_date="2025-04-15",
|
|
mitre_version="v16.1",
|
|
priority="high"
|
|
| `process_create_whitelist`
|
|
| eval indextime = _indextime
|
|
| convert ctime(indextime)
|
|
| table _time indextime event_description src_ip dest_ip icmp_type icmp_code mitre_category mitre_technique mitre_technique_id hunting_trigger mitre_subtechnique mitre_subtechnique_id apt mitre_link creator last_tested upload_date last_modify_date mitre_version priority
|
|
| collect `jarvis_index`
|
|
```
|
|
|
|
```
|
|
title: Detect ICMP Traffic Related to ICMPDoor Backdoor
|
|
id: 1234abcd-5678-efgh-9101-11213141ijkl
|
|
description: Detects use of ICMP packets for backdoor communication
|
|
author: YourName
|
|
logsource:
|
|
product: network
|
|
service: firewall
|
|
detection:
|
|
selection:
|
|
protocol: icmp
|
|
dest_ip: <COMPROMISED_SERVER_IP>
|
|
icmp_type:
|
|
- 0
|
|
- 8
|
|
condition: selection
|
|
fields:
|
|
- src_ip
|
|
- dest_ip
|
|
- icmp_type
|
|
- icmp_code
|
|
level: high
|
|
```
|
|
|
|
IPsec from outside
|
|
|
|
```
|
|
`indextime` sourcetype=syslog
|
|
| where NOT cidrmatch("10.0.0.0/8", src_ip) AND NOT cidrmatch("192.168.0.0/16", src_ip) AND NOT cidrmatch("172.16.0.0/12", src_ip)
|
|
| where cidrmatch("137.0.0.0/16", src_ip) OR src_port=500 OR dest_port=500
|
|
| stats count by src_ip, dest_ip, src_port, dest_port
|
|
| sort - count
|
|
| eval hash_sha256=if(isnull(hash_sha256), "N/A", lower(hash_sha256)),
|
|
hunting_trigger="Detects suspicious connections to non-private IPs or port 500 usage.",
|
|
mitre_category="Discovery",
|
|
mitre_technique="Network Service Scanning",
|
|
mitre_technique_id="T1046",
|
|
mitre_subtechnique="",
|
|
mitre_subtechnique_id="",
|
|
apt="Volt Typhoon",
|
|
mitre_link="https://attack.mitre.org/techniques/T1046/",
|
|
creator="Sgt Iverson",
|
|
last_tested="",
|
|
upload_date="2025-04-15",
|
|
last_modify_date="2025-04-15",
|
|
mitre_version="v16",
|
|
priority="high"
|
|
| eval indextime = _indextime
|
|
| convert ctime(indextime)
|
|
| table _time, indextime, event_description, hash_sha256, src_ip, dest_ip, src_port, dest_port, http_header, mitre_category, mitre_technique, mitre_technique_id, hunting_trigger, mitre_subtechnique, mitre_subtechnique_id, apt, mitre_link, creator, last_tested, upload_date, last_modify_date, mitre_version, priority
|
|
| collect `jarvis_index`
|
|
```
|
|
|
|
```
|
|
title: Detect Suspicious Connections to Non-Private IPs or Port 500 Usage
|
|
id: b4a8cfa4-7a21-4f8a-9383-1234abcd5678
|
|
description: Detects connections from non-private IPs or IPs in the 137.0.0.0/16 range, with usage of port 500, including data enrichment fields.
|
|
author: Sgt Iverson
|
|
logsource:
|
|
product: network
|
|
service: syslog
|
|
detection:
|
|
selection:
|
|
src_ip:
|
|
- "!10.0.0.0/8"
|
|
- "!192.168.0.0/16"
|
|
- "!172.16.0.0/12"
|
|
- "137.0.0.0/16"
|
|
src_port: 500
|
|
dest_port: 500
|
|
condition: selection
|
|
fields:
|
|
- src_ip
|
|
- dest_ip
|
|
- src_port
|
|
- dest_port
|
|
- hash_sha256
|
|
- http_header
|
|
enrichment:
|
|
hunting_trigger: "Detects suspicious connections to non-private IPs or port 500 usage."
|
|
mitre_category: "Discovery"
|
|
mitre_technique: "Network Service Scanning"
|
|
mitre_technique_id: "T1046"
|
|
apt: "Volt Typhoon"
|
|
mitre_link: "https://attack.mitre.org/techniques/T1046/"
|
|
creator: "Sgt Iverson"
|
|
upload_date: "2025-04-15"
|
|
last_modify_date: "2025-04-15"
|
|
mitre_version: "v16"
|
|
priority: "high"
|
|
level: high
|
|
``` |