How Defenders Can Identify Malicious Command-and-Control Infrastructure
Summary
Hunt.io explains how defenders can identify malicious C2 servers using internet scanning and indicators such as TLS certificates, HTTP responses, protocol behavior, and code-derived patterns.
Key points
- Hunt says it tracks 110 infrastructure families, 85 of which are active daily.
- Researchers identify suspicious servers through sources such as reports, IOC databases, and internet scanning.
- Useful infrastructure indicators include TLS certificates, HTTP headers, HTML strings, SSH keys, domain patterns, JARM and JA4x hashes, and TCP banners.
- A Gh0st RAT scanning example shows that a simple random-data probe can identify servers responding with the expected packet flag.
- For ShadowPad, researchers combine certificate details with HTTP responses and other context rather than relying on one indicator.
- Octopus C2 can be identified by matching distinctive page text from its source code with HTTP response data.
Article Details
- Defense Focus
- Identify and track malicious command-and-control infrastructure before it can be used to deploy malware.
- Detection Methods
- Correlate TLS/SSL certificate fields with HTTP response headers and HTML content to identify suspicious servers.
- Use certificate characteristics, HTTP headers, HTML strings, SSH keys, domain naming conventions, JARM and JA4x hashes, and TCP banners to identify infrastructure patterns.
- Probe suspected Gh0st RAT servers with random data and check for the expected response packet flag.
- Review C2 source code for network behavior and operator-facing HTML, then use those details to form detection queries.
- Corroborate suspected infrastructure with hosting provider, location, historical or recent reporting, and third-party detections.
- Data Sources
- Internet scanning results
- TLS/SSL certificates
- HTTP response headers and content
- HTML source and C2 project source code
- IOC databases, including Hunt's IOC Hunter and ThreatFox
- Historical and recent reporting
- Third-party detections
- Rule Types
- Search query correlating certificate fields with HTTP response content or headers
- Search query matching HTTP response headers and HTML title/header strings while excluding variable Server and Date headers
- Platforms
- Hunt Advanced Search
- Defensive Actions
- Correlate multiple indicators rather than relying on a single indicator before identifying or adding C2 servers to a feed.
- Use validated infrastructure detections to track or block malicious servers.
- When conducting internet scans, understand applicable laws and limit scans to specific IP ranges.
People
Malware
EmotetShadowPad, Quasar RAT, HeadLace, Emotet, and SIGNBT (to name a few) often grab headlines and captivate readers, leading to a long day of scouring logs and network traffic for blue teamers.Gh0st RATGh0st RAT (Remote Administration Tool) emerged into the public domain in 2008 and has continued its eerie presence with unrelenting momentum. With numerous variants and a recognizable network protocol, attackers haven'tHEADLACEShadowPad, Quasar RAT, HeadLace, Emotet, and SIGNBT (to name a few) often grab headlines and captivate readers, leading to a long day of scouring logs and network traffic for blue teamers.Quasar RATShadowPad, Quasar RAT, HeadLace, Emotet, and SIGNBT (to name a few) often grab headlines and captivate readers, leading to a long day of scouring logs and network traffic for blue teamers.ShadowPadShadowPad, Quasar RAT, HeadLace, Emotet, and SIGNBT (to name a few) often grab headlines and captivate readers, leading to a long day of scouring logs and network traffic for blue teamers.SIGNBTShadowPad, Quasar RAT, HeadLace, Emotet, and SIGNBT (to name a few) often grab headlines and captivate readers, leading to a long day of scouring logs and network traffic for blue teamers.