Hunting: Recent news and your proxy logs

If you have been reading any of the blog posts or the twitter verse the past few months you might have seen reference to some Adobe Flash and Microsoft 0-days being used and maybe wondering if you have been a victim. Using nuggets of open source  intelligence like info from these posts by ShadowServer and  Sophos you just might have enough  data to search your proxy logs and see if you have experienced any of these attacks. You do have your web traffic going through a proxy don’t you? If you don’t you should start doing it and start collecting the logs. The logs are a treasure trove of information if you want to go hunting.

So let’s go on a hunt.

For this hunt like previous onces I will be using ArcSight Logger because that is what I have access to. I will also be leveraging websense for the proxy logs as well.

Indicators from the ShadowServer and Sophos blogs:


Logger Query:

deviceVendor = “Websense” AND  ( ( ( requestUrlFileName CONTAINS “deploy.html” )  OR  ( requestUrlFileName CONTAINS “deployJava.js” )  OR  ( requestUrlFileName CONTAINS “movie.swf” )  OR  ( requestUrlFileName CONTAINS “BrightBalls.swf” )  OR  ( requestUrlQuery CONTAINS “Elderwood=” )  OR  ( requestUrlQuery CONTAINS “apple=” ) ) )

Now this isn’t the most efficient query because of the CONTAINS operators but there is a trade off when doing searches like this and you just have to be prepared for it. There could also be some false positives as well espically around faq.htm so be prepared to use a  little excel foo. Or you can leave the faq.htm off I will leave that up to you. I did a quick hunt and went back 2 weeks and got the following hits:

Notice the swf file is different but the query was for Elderwood.  If I had just put  BrightBalls.swf?Elderwood as a search parameter I would have missed it. Good thing the bad guys used the same query string.  So do some experimenting you might find slicing and dicing on key terms will get you more data and more places to keep hunting.

Now for me this showed a sign I needed to do more digging and going for some packets to review if you have them and perhaps another search this time adding Geoffrey.swf as a search parameter to see if there is anything additional there.

As always happy hunting!


Using CIF to create content for ArcSight – Part 2

In my previous post Using CIF to create content for ArcSight – Part 1 I quickly went over how to populate an active list with data from CIF. Now we are going to take it a step further and start monitoring for hits on that active list and generate some other content for ArcSight.  This post is quite long so the TL:DR version

Create active list for monitoring, create rule to populate the active list when a domain query matches a domain you are monitoring, create active channel/data monitor to watch for events.


This is a very basic active list/correlation rule example you can do much more but this should be a decent starting point.

Also please note for this example I am using ISC Bind DNS logs so the query field gets mapped to the DeviceCustomString4 field in ArcSight

First let’s create another active list :

In the Navigation Panel go to Active Lists and right click your personal folder and select New Active List

New Active List

Next in the Inspect/Edit Panel modify the Active List to meet your needs but in this example it will have the name “Suspicious Traffic”, it will expire entries in 3 days if an entry is not updated, 10,000 entries will  be allowed. These are all changeable fields after the active list is created.

Now set the fields the Active List will use (These can not be changed after the list has been created). I have entered:
Attacker Address (Key Field), Target Address, Target Port, Domain, Category Outcome, Description, Source

Now let’s create a filter so that we can match the events we are looking for:

New Filter

I gave the filter the name “Discover Malicious Domain Lookup” and started with creating the following conditions

Filter Conditions before Active List

I then add an InActiveList Condition

Add In Active List Condition

Then I added a condition that checks if Device Custom String 4 (The BIND DNS Query field) matches the Domain Name filed in the Malicious Domains Active List

Matches Malicious Domain

The filter should look something like this:

Full Filter

Click apply to create the filter and move on to creating the Correlation Rule:

For this example we will be firing on every hit which can be noisy. You might want to tune for your environment and capabilities but this should be a good starting point.

Start by creating your rule

New Rule

Give it a name then click on the conditions tab. Right click and select matches filter:

Matches Filter Condition

Select the filter we created above:

Selecting your filter

Next we will build some local variable that will help with populating the Suspicious Traffic Watchlist we created. Click the Local Variables Tab.

Click the + button and add a new Local Variable select List from the Categories Window on the Left and the GetActiveListValue in the functions window.

Setting the GetActiveListVaule Function

Give the variable a name I chose getDomainWatchList and map Domain Name to Device Custom String4. Click Ok and create another local variable

Setting the getDomainWatchList Local Variable

Next we create a variable using the String Categories and the Concatenate function:

String Category Concat funftion

The variable name is getWatchlistSource and it’s settings are below.  The first string argument source is from the getDomainWatchList variable we just created above. The second string argument is blank for this rule variable because we are only matching on this one source.

Get WatchList Source

Next create one more variable using the Concatenate function caused getWatchListDescription. The first string argument source is from the getDomainWatchList variable we just created above. This two has a blank string argument for the Concatenate function.

Get Watch List Description Variable

Now that all of our variables are set we need to make sure they are aggregated so they get populated when a rule hits. Click on the aggregation tab and under the Aggregate  only  if these fields are identical and click the Add button. Select the variables getWatchListDescription and getWatchListSource we just created. Click ok and let’s get to working on the actions for the rule.

Aggregation Fields to add

First we need to set a few fields that we will use to populate the event created when the rule fires. Deactivate the On First Event Action and enable the On Every Event Action then right click and Select Add -> Set Event Field .  Let’s use Flex String 1 and Flex String 2 for that purpose and use the variables we created above and click OK.

Set Flex String Event Fileds

We are almost done I promise 🙂
Now we need to add any systems that match the rule to the  Suspicious Traffic Active List we created at the beginning of this post. Right Click the On Every Event Action then right click and Select  Add -> Active List -> Add to Active List below are the mappings for the fields in the Active List.

Add to Active List Action

Now click ok and then go back to the aggregation tab and add the following fields so that your fields match the ones below:

Aggregation Fields

Now we are ready to apply all the conditions for the rule and deploy it as a real time rule. Once it is deployed as a rule you can try and generate some test hits by doing lookups of domains in the active list against the server creating the DNS logs. Just make sure you know the address of your system :). To monitor for events create an Active Channel where the filter is Name = Discover Malicious Domains or whatever name you gave the rule above. If everything works you should soon see events in your active channel.

Active Channel Test Hit

You can then look at the entries for your Suspicious Traffic Active List and you should see entries in there that match the results in the active channel.

Active List Entries

Now you can start to have some fun and create dashboard with data monitors around these type of events below is a screen shot of a sample dashboard. The top half is of an event graph and the bottom is the top bucketized count of malicious domains queried.

Sample Data Monitors

Now the rest of the content creation is up to you but hopefully this gets your juices flowing and you come up with some other great use cases for CIF related data. As always happy hunting!