How to Hunt Advanced Attackers on a Budget

TL;DR

Detect command-and-control traffic by analyzing connection timing, data sizes, and interval dispersion instead of relying only on payload inspection or signatures. The free, open-source RITA tool processes IPFIX, NetFlow, or Bro and Zeek logs to identify beaconing patterns, including pseudorandom jitter, while preserving visibility when traffic is encrypted.

Transcript

Now, it is my pleasure to welcome up John Strand. John is the owner of Black Hills Information Society, as well as Advanced Countermeasures. He's done some super cool stuff on hunting advanced attackers, and I'm not gonna tell you any more because he can do a much better job. So give him a warm welcome, ladies and gentlemen, Mr. John Strand. Thank ... Read More

Key Insights

• Command-and-control detection is increasingly difficult because malware can hide communications through encryption, encoding, steganography, social media, HTTP, DNS, QUIC, and SCTP. These channels make reliable signatures difficult to create and leave organizations with an important visibility gap.
• Successful security controls do not guarantee that an advanced attacker will be stopped. The insurance company discussed had implemented appropriate security tools and practices, yet the penetration-testing team still gained access, demonstrating the need for detection capabilities after an initial compromise.
• Beaconing intervals can function like a heartbeat for malware communications. Repeated connections may occur at consistent intervals or follow recognizable timing patterns, giving defenders a behavioral signal that remains observable even when the transmitted content cannot be inspected.
• Data sizes can reveal recurring communication behavior independently of connection timing. Clustering consistent transfer sizes provides another way to identify malware beaconing, including cases where attackers deliberately vary communication intervals to make simple timing analysis less effective.
• Jitter produces measurable dispersion around a configured interval. A communication profile using a 10-second interval with two seconds of variation may distribute connections evenly below and above that interval because computer-generated randomization is pseudorandom rather than genuinely random.
• RITA is a free, open-source tool for analyzing connection behavior. It receives traffic records from IPFIX, NetFlow, or Bro and Zeek logs, then evaluates intervals, data sizes, and timing dispersion to identify possible command-and-control activity leaving an organization.
• Zeek is preferred for connection analysis because it is fast and consistent. Its practical restrictions are the network card, CPU, and hard-drive capacity provided to it, while its large user base also makes relevant operational skills easier to find.
• Consistent timestamp semantics are essential for mathematical traffic analysis. Different devices may record a connection at its beginning, end, or somewhere between, and one observed device changed its behavior around noon, creating serious problems for interval calculations.

Questions & Answers

Q: How can organizations detect malware beaconing without inspecting payloads?

Organizations can analyze connection metadata rather than payload contents. Useful indicators include the interval between connections, recurring data sizes, and the dispersion of timing variations. These behavioral patterns can expose a malware heartbeat even when communications are encrypted. RITA performs this analysis using traffic records collected from IPFIX, NetFlow, or Bro and Zeek logs.

Q: What communication patterns can reveal command-and-control traffic?

Command-and-control traffic may reveal itself through consistent connection intervals, repeated data sizes, or recognizable distributions of timing changes. A basic beacon can communicate at a steady rhythm, while a more evasive beacon may add jitter. Even then, its pseudorandom timing can form measurable clusters around a central interval that defenders can analyze.

Q: Why are traditional signatures insufficient for advanced attacker detection?

Traditional signatures become less dependable when attackers conceal command-and-control traffic through multiple layers of encryption, encoding, or steganography. Attackers can also communicate through HTTP, social media, DNS, QUIC, or SCTP. With so many hiding places and communication methods, defenders may be unable to create a recognizable signature for every malicious connection.

Q: What is RITA and what does it analyze?

RITA stands for Real Intelligence Threat Analytics. It is a free, open-source tool created to identify suspicious connection behavior associated with malware. RITA analyzes traffic leaving an environment and looks for patterns in connection intervals, data sizes, and timing dispersion. It can ingest IPFIX, NetFlow, or Bro and Zeek connection logs.

Q: How does jitter affect malware beacon detection?

Jitter varies the time between malware connections to avoid a perfectly regular beaconing interval. For example, malware may use a 10-second interval with two seconds of variation. Because computer randomization is pseudorandom, the resulting connections may still be distributed evenly below and above the central interval, creating a pattern that dispersion analysis can identify.

Q: Why is Zeek recommended for threat-hunting data collection?

Zeek is recommended because it is fast, produces useful connection logs, and records information consistently. Its practical performance restrictions are the network card, CPU, and hard-drive space assigned to it. Zeek also has thousands of users, so organizations can find IT personnel who already understand the technology and its logging model.

Q: Why does timestamp consistency matter when analyzing network connections?

Timestamp consistency matters because interval analysis depends on accurately measuring the time between connections. Some devices record the beginning of a connection, others record its end, and some place the timestamp somewhere between those points. One observed device even changed its convention around noon, making mathematical frequency and consistency analysis extremely difficult.

Q: How can threat hunting remain useful when network traffic is encrypted?

Threat hunting can focus on information that remains visible outside the encrypted payload. Defenders can examine when connections occur, how regularly they repeat, how large their transfers are, and how timing variations are distributed. This approach avoids the privacy and human-resources problems associated with inspecting content while still providing evidence of possible command-and-control behavior.

Summary & Key Takeaways

• Traditional signatures struggle when malware hides command-and-control activity through encryption, encoding, steganography, social media, DNS, QUIC, SCTP, or HTTP beaconing. Because skilled penetration testers use these techniques successfully, organizations need detection methods that examine observable communication behavior instead of depending entirely on recognizable payload content or previously documented attack signatures.

• Beaconing can be identified through mathematical patterns in connection metadata. Regular malware may communicate at consistent intervals and with consistent data sizes. Malware using jitter can vary its timing, but pseudorandom variation may still create measurable dispersion around a central interval, allowing defenders to detect structured behavior without inspecting encrypted payloads.

• RITA, short for Real Intelligence Threat Analytics, is a free, open-source tool created to analyze traffic leaving an environment. It can ingest IPFIX, NetFlow, or Bro and Zeek logs. Zeek is preferred because it is fast, widely used, consistently records connection information, and provides useful visibility for mathematical analysis.