Unit 8: Scans, beacons and leaks · Lesson 3 of 6 · 22 min
Finding a beacon
Separate a machine calling home on a timer from people browsing, using the rhythm of its connections.
mission
- You are
- The threat hunter.
- Situation
- Malware usually checks in with its operator on a schedule. beacon.pcap holds half an hour of HTTPS from three laptops.
- Goal
- Find the connections that keep time and measure their interval.
- Hand in
- The beacon's destination, its number of sessions and its interval.
A beacon keeps time
Count sessions per destination
Group TLS sessions by laptop and server name.
tshark -r beacon.pcap -Y 'tls.handshake.type==1' -T fields -e ip.src -e tls.handshake.extensions_server_name | sort | uniq -c | sort -rn
31 10.10.0.57 update-check.example.net
12 10.10.0.23 www.example.com
10 10.10.0.31 intranet.corp.example
you should see 31 sessions to one name in 30 minutes.
Measure the gaps
Print each session's start time, then let awk print the gap to the previous one, rounded to whole seconds.
tshark -r beacon.pcap -Y 'tls.handshake.extensions_server_name=="update-check.example.net"' -T fields -e frame.time_relative | awk 'NR>1 {printf "%.0f\n", $1-prev} {prev=$1}' | sort -n | uniq -c
1 57
4 58
7 59
7 60
7 61
4 62
you should see Every gap is between 57 and 62 seconds: a 60 second timer with a little jitter.
Compare with a person
Run the same measurement for the browsing laptop.
tshark -r beacon.pcap -Y 'tls.handshake.extensions_server_name=="www.example.com"' -T fields -e frame.time_relative | awk 'NR>1 {printf "%.0f\n", $1-prev} {prev=$1}' | sort -n | tr '\n' ' '
2 5 13 28 62 74 124 148 152 342 680
you should see Gaps from 2 seconds to 11 minutes. That is a person.
defender tip Real beacons add more jitter and sleep at night. Look at the spread of gaps over hours, and at sessions that continue while nobody is logged in.
Program or person
31 sessions in 30 minutes gaps 57 to 62 s same size every time
A schedule.
12 sessions in 30 minutes gaps 2 to 680 s sizes all different
A human.
Pin down both ends
A beacon always runs between the same pair of addresses.
tshark -r beacon.pcap -Y 'tls.handshake.extensions_server_name=="update-check.example.net"' -T fields -e ip.src -e ip.dst | sort -u
10.10.0.57 203.0.113.77
you should see 10.10.0.57 calls 203.0.113.77 every time.
What a defender takes away
- 1Regular gaps and identical sizes are the fingerprint of a beacon.
- 2Measure gaps with frame.time_relative and a few lines of awk.
- 3Beacons are often quiet and tiny. Rhythm finds them when volume does not.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.