Possible FIN7 DGA Command and Control Behavior
This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this command and control technique, while maintaining persistence in their target's network.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2020/07/06"
3integration = ["network_traffic"]
4maturity = "production"
5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
6min_stack_version = "8.3.0"
7updated_date = "2023/11/21"
8
9[rule]
10author = ["Elastic"]
11description = """
12This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this
13command and control technique, while maintaining persistence in their target's network.
14"""
15false_positives = [
16 """
17 This rule could identify benign domains that are formatted similarly to FIN7's command and control algorithm. Alerts
18 should be investigated by an analyst to assess the validity of the individual observations.
19 """,
20]
21from = "now-9m"
22index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"]
23language = "lucene"
24license = "Elastic License v2"
25name = "Possible FIN7 DGA Command and Control Behavior"
26note = """## Triage and analysis
27
28In the event this rule identifies benign domains in your environment, the `destination.domain` field in the rule can be modified to include those domains. Example: `...AND NOT destination.domain:(zoom.us OR benign.domain1 OR benign.domain2)`."""
29references = [
30 "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html",
31]
32risk_score = 73
33rule_id = "4a4e23cf-78a2-449c-bac3-701924c269d3"
34severity = "high"
35tags = ["Use Case: Threat Detection", "Tactic: Command and Control", "Domain: Endpoint"]
36timestamp_override = "event.ingested"
37type = "query"
38
39query = '''
40(event.dataset: (network_traffic.tls OR network_traffic.http) OR
41 (event.category: (network OR network_traffic) AND type: (tls OR http) AND network.transport: tcp)) AND
42destination.domain:/[a-zA-Z]{4,5}\.(pw|us|club|info|site|top)/ AND NOT destination.domain:zoom.us
43'''
44
45
46[[rule.threat]]
47framework = "MITRE ATT&CK"
48[[rule.threat.technique]]
49id = "T1071"
50name = "Application Layer Protocol"
51reference = "https://attack.mitre.org/techniques/T1071/"
52
53[[rule.threat.technique]]
54id = "T1568"
55name = "Dynamic Resolution"
56reference = "https://attack.mitre.org/techniques/T1568/"
57[[rule.threat.technique.subtechnique]]
58id = "T1568.002"
59name = "Domain Generation Algorithms"
60reference = "https://attack.mitre.org/techniques/T1568/002/"
61
62
63
64[rule.threat.tactic]
65id = "TA0011"
66name = "Command and Control"
67reference = "https://attack.mitre.org/tactics/TA0011/"
Triage and analysis
In the event this rule identifies benign domains in your environment, the destination.domain
field in the rule can be modified to include those domains. Example: ...AND NOT destination.domain:(zoom.us OR benign.domain1 OR benign.domain2)
.
References
Related rules
- Deprecated - Potential DNS Tunneling via Iodine
- Potential Non-Standard Port SSH connection
- Cobalt Strike Command and Control Beacon
- Halfbaked Command and Control Beacon
- Accepted Default Telnet Port Connection