How Hunt Uses Predictive Scanning to Find Services on Non-Standard Ports
Summary
Hunt describes using GPS predictive scanning to identify services on non-standard ports, then investigate them for malware. The approach found a short-lived Cobalt Strike cluster on ports 1788 and 1799 and preserved its infrastructure history.
Key points
- GPS predicts which services may be running across all 65,000 ports, helping reduce the need to scan every address-port combination directly.
- Hunt feeds data from its standard collection pipeline into a customized GPS implementation that uses application-, transport- and network-layer features.
- The system identified a short-lived Cobalt Strike cluster with beacon servers on port 1799 and team servers on port 1788.
- Hunt found 44 IP addresses associated with Cobalt Strike; the servers were last observed on September 23 and had disappeared by then.
- Hunt retained server history, including a timeline of observed malware and TLS certificates, to support further threat hunting.
Article Details
- Defense Focus
- Identify services on non-standard ports to uncover malicious infrastructure.
- Detection Methods
- Use predictive scanning to identify services across ports, including obscure ports.
- Interrogate identified services for known malware indicators, such as Cobalt Strike's default HTTP response.
- Review historical server observations and TLS certificates to support infrastructure tracking and threat hunting.
- Data Sources
- Network data from the standard data-collection pipeline
- Application-, transport-, and network-layer features
- Service responses
- Historical server observations
- TLS certificates
- Platforms
- GPS
- Hunt
- Defensive Actions
- Look beyond commonly used ports when identifying services.
- Check services found on non-standard ports for known malware indicators.
- Use historical observations and TLS certificates to investigate infrastructure and pivot to related threat-hunting leads.