Unit 8: Scans, beacons and leaks · Lesson 3 of 6 · 22 min
Finding a beacon
Separate a machine calling home on a timer from people browsing, using the rhythm of its connections.
mission
- You are
- The threat hunter.
- Situation
- Malware usually checks in with its operator on a schedule. beacon.pcap holds half an hour of HTTPS from three laptops.
- Goal
- Find the connections that keep time and measure their interval.
- Hand in
- The beacon's destination, its number of sessions and its interval.
A beacon keeps time
Count sessions per destination
Group TLS sessions by laptop and server name.
tshark -r beacon.pcap -Y 'tls.handshake.type==1' -T fields -e ip.src -e tls.handshake.extensions_server_name | sort | uniq -c | sort -rn
31 10.10.0.57 update-check.example.net
12 10.10.0.23 www.example.com
10 10.10.0.31 intranet.corp.example
you should see 31 sessions to one name in 30 minutes.
tshark- The command-line version of Wireshark. Reads captures and filters packets by protocol fields. Install with sudo apt install tshark, or brew install wireshark on a Mac.
sort- Sorts lines of text. Built into Linux and macOS.
uniq- Collapses repeated neighbouring lines. With -c it counts them. Built into Linux and macOS.
Measure the gaps
Print each session's start time, then let awk print the gap to the previous one, rounded to whole seconds.
tshark -r beacon.pcap -Y 'tls.handshake.extensions_server_name=="update-check.example.net"' -T fields -e frame.time_relative | awk 'NR>1 {printf "%.0f\n", $1-prev} {prev=$1}' | sort -n | uniq -c
1 57
4 58
7 59
7 60
7 61
4 62
you should see Every gap is between 57 and 62 seconds: a 60 second timer with a little jitter.
awk- Splits each line into fields and prints or counts the ones you ask for. Built into Linux and macOS.
Compare with a person
Run the same measurement for the browsing laptop.
tshark -r beacon.pcap -Y 'tls.handshake.extensions_server_name=="www.example.com"' -T fields -e frame.time_relative | awk 'NR>1 {printf "%.0f\n", $1-prev} {prev=$1}' | sort -n | tr '\n' ' '
2 5 13 28 62 74 124 148 152 342 680
you should see Gaps from 2 seconds to 11 minutes. That is a person.
defender tip Real beacons add more jitter and sleep at night. Look at the spread of gaps over hours, and at sessions that continue while nobody is logged in.
tr- Replaces or deletes characters. Built into Linux and macOS.
Program or person
31 sessions in 30 minutes gaps 57 to 62 s same size every time
A schedule.
12 sessions in 30 minutes gaps 2 to 680 s sizes all different
A human.
Pin down both ends
A beacon always runs between the same pair of addresses.
tshark -r beacon.pcap -Y 'tls.handshake.extensions_server_name=="update-check.example.net"' -T fields -e ip.src -e ip.dst | sort -u
10.10.0.57 203.0.113.77
you should see 10.10.0.57 calls 203.0.113.77 every time.
What a defender takes away
- 1Regular gaps and identical sizes are the fingerprint of a beacon.
- 2Measure gaps with frame.time_relative and a few lines of awk.
- 3Beacons are often quiet and tiny. Rhythm finds them when volume does not.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.