Hunt Introduces Advanced Search for Threat Hunting

Summary

Hunt introduces a query language for searching malware, TLS certificates, and open-directory files to help researchers find malicious infrastructure, track frameworks, and locate exposed exploit code.

Key points

Advanced Search lets users query Hunt data across malware, certificates, and open-directory files.
Example queries search for Quasar RAT infrastructure and certificates associated with Cobalt Strike.
Users can combine search conditions, including filtering results by when they were last seen.
The article demonstrates using JA4X certificate fingerprinting to find Sliver certificates without relying on default subject or issuer names.
Searches can identify RedWarden instances and exploit code hosted in open directories.

Article Details

Defense Focus: Use Hunt Advanced Search to discover and track potentially malicious infrastructure through malware, TLS certificate, and open-directory data.
Detection Methods: Search malware records for the name Quasar and filter results by last-seen time.
Search TLS certificate subject and issuer information using JA4X fingerprints.
Search for certificates associated with Sliver without relying on its default hardcoded subject or issuer common names.
Search open directories for Fast Reverse Proxy configuration files and recently modified files.
Search open directories for exploit code associated with CVEs.
Data Sources: Hunt-scanned malware data
TLS certificate subject and issuer information
Open-directory files, including executables, logs, and configuration files
Rule Types: Hunt Advanced Search query syntax
Platforms: Hunt Advanced Search
Defensive Actions: Combine query conditions with AND and time filters to narrow results to recently scanned or modified data.
Use certificate fingerprints alongside subject and issuer searches to identify related infrastructure.
Review open directories for exposed executables, logs, configuration files, and exploit code as part of threat hunting and incident response.