John Wunder
66 lines
4.7 KiB
JSON
66 lines
4.7 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--06600dff-13ba-40fa-b58e-55e6aa5337a4",
|
|
"spec_version": "2.0",
|
|
"objects": [
|
|
{
|
|
"type": "attack-pattern",
|
|
"id": "attack-pattern--4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"created": "2017-05-31T21:30:35.334Z",
|
|
"modified": "2018-01-17T12:56:55.080Z",
|
|
"name": "Standard Cryptographic Protocol",
|
|
"description": "Adversaries use command and control over an encrypted channel using a known encryption protocol like HTTPS or SSL/TLS. The use of strong encryption makes it difficult for defenders to detect signatures within adversary command and control traffic.\n\nSome adversaries may use other encryption protocols and algorithms with symmetric keys, such as RC4, that rely on encryption keys encoded into malware configuration files and not public key cryptography. Such keys may be obtained through malware reverse engineering.\n\nDetection: SSL/TLS inspection is one way of detecting command and control traffic within some encrypted communication channels. (Citation: SANS Decrypting SSL) SSL/TLS inspection does come with certain risks that should be considered before implementing to avoid potential security issues such as incomplete certificate validation. (Citation: SEI SSL Inspection Risks)\n\nIf malware uses encryption with symmetric keys, it may be possible to obtain the algorithm and key from samples and use them to decode network traffic to detect malware communications signatures. (Citation: Fidelis DarkComet)\n\nIn general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)\n\nPlatforms: Linux, macOS, Windows\n\nData Sources: Packet capture, Netflow/Enclave netflow, Malware reverse engineering, Process use of network, Process monitoring, SSL/TLS inspection\n\nRequires Network: Yes",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "command-and-control"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "mitre-attack",
|
|
"url": "https://attack.mitre.org/wiki/Technique/T1032",
|
|
"external_id": "T1032"
|
|
},
|
|
{
|
|
"source_name": "University of Birmingham C2",
|
|
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.",
|
|
"url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
|
|
},
|
|
{
|
|
"source_name": "SANS Decrypting SSL",
|
|
"description": "Butler, M. (2013, November). Finding Hidden Threats by Decrypting SSL. Retrieved April 5, 2016.",
|
|
"url": "http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840"
|
|
},
|
|
{
|
|
"source_name": "SEI SSL Inspection Risks",
|
|
"description": "Dormann, W. (2015, March 13). The Risks of SSL Inspection. Retrieved April 5, 2016.",
|
|
"url": "https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html"
|
|
},
|
|
{
|
|
"source_name": "Fidelis DarkComet",
|
|
"description": "Fidelis Cybersecurity. (2015, August 4). Looking at the Sky for a DarkComet. Retrieved April 5, 2016.",
|
|
"url": "https://www.fidelissecurity.com/sites/default/files/FTA%201018%20looking%20at%20the%20sky%20for%20a%20dark%20comet.pdf"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"x_mitre_data_sources": [
|
|
"Packet capture",
|
|
"Netflow/Enclave netflow",
|
|
"Malware reverse engineering",
|
|
"Process use of network",
|
|
"Process monitoring",
|
|
"SSL/TLS inspection"
|
|
],
|
|
"x_mitre_network_requirements": true,
|
|
"x_mitre_platforms": [
|
|
"Linux",
|
|
"macOS",
|
|
"Windows"
|
|
]
|
|
}
|
|
]
|
|
} |