cyber.hendryadrian.com
Detection & Defense · hunt.io

AttackCapture Code Search Helps Threat Hunters Find C2 Profiles, Reverse Shells and Exploit Code

· Original article ↗

Summary

Hunt.io demonstrates AttackCapture Code Search queries for finding Cobalt Strike profiles, EagleSpy artifacts, Covenant implants, reverse shells, and exploit code in open directories.

Key points

  • Code Search scans files in AttackCapture collections for indicators such as exploit code, reverse shells, malware, and C2 configurations.
  • Example queries target distinctive Cobalt Strike Malleable C2 profiles, including profiles associated with geacon_plus.
  • A full-text EagleSpy query can find HTML files containing the malware’s distinctive identifier and exposed panels.
  • Other examples search for Covenant Grunt implants and Python or Bash reverse shells in open directories.
  • Queries target RegreSSHion exploit code associated with CVE-2024-6387 and Cacti command-injection exploit code associated with CVE-2024-29895.
  • The article presents the tool as a way for defenders to identify attacker techniques and inform threat hunting and preparation.

Article Details

Defense Focus
Use Code Search in AttackCapture to find and analyze exploit code, reverse shells, C2 profiles, and exposed implants in indexed files and open directories.
Detection Methods
  • Search for distinctive strings and combinations of code tokens associated with Cobalt Strike Malleable C2 profiles, including URI, HTTP header, and certificate-field patterns.
  • Search for the @EagleSpy identifier in HTML files to locate EagleSpy-related panels or code.
  • Search for Grunt.GruntStager to find exposed Covenant implants.
  • Combine socket, subprocess, shell-path, and interactive-shell strings to identify Python reverse-shell code; search for sh -i together with /dev/tcp to identify Bash reverse shells.
  • Search for the filename 7etsuo-regreSSHion.c and for /cacti/cmd_realtime.php to locate exploit code associated with the cited vulnerabilities.
  • Use unique TLS certificate fields to help identify geacon_plus infrastructure during network scans.
Data Sources
  • Files and code snippets indexed from open directories
  • HTML files
  • Cobalt Strike Malleable C2 profile configuration strings
  • TLS certificate fields
  • Network-scan results
Rule Types
  • AttackCapture Code Search queries using keywords, AND/OR operators, and parentheses
Platforms
  • AttackCapture
Defensive Actions
  • Use Code Search to locate and review suspicious exploit code, reverse shells, C2 configurations, and exposed implants.
  • Use unique TLS certificate fields to identify geacon_plus-related infrastructure during network scans.
  • Review discovered exploit code and assess exposure to the associated vulnerabilities.

MITRE ATT&CK

T1059.004 · Unix ShellThe article describes Bash reverse shells using an interactive shell and /dev/tcp.T1059.006 · PythonThe article describes Python reverse shells that use socket connections and subprocesses to launch an interactive shell.

CVE

CVE-2024-29895Figure 10: Searching for directories using a specific version of the regreSSHion exploit code (Try it: Hunt)CVE-2024-29895CVE-2024-6387CVE-2024-6387

People

Michael KoczwaraPosted about using AttackCapture to uncover Cobalt Strike servers with unique or custom Malleable C2 profiles.

Malware

EagleSpyFigure 4: Open directories hosting geacon_plus profiles (Try it: Hunt)EagleSpy Malwaregeacon_plusFigure 2: CS 4.9 Malleable Profiles (Try it: Hunt)Figure 3: Snippet of one of the CS 4.9 profilesProfile: geacon_plus

Products

AttackCaptureBrief Description: In late August, Michael Koczwara posted on using AttackCapture to uncover Cobalt Strike servers using unique or custom malleable profiles. He showcased a Malleable C2 profile for Cobalt Strike 4.9,Cacti/cacti/cmd_realtime.phpCobalt StrikeCode Search enables threat hunters to locate and analyze specific attack patterns, such as unique Cobalt Strike configurations--all accessible for preview and download.CovenantCovenant is an open-source, .NET-based C2 framework commonly used in red team operations for managing post-exploitation activities. Its primary implant, a "Grunt," executes commands on compromised systems, enabling

Tools

Nucleion the server. In Figure 11 below, we see a few Python variations of the exploit and instances of the Nuclei scanner, likely used to check server exposure to the vulnerability.

Related Articles