New Kind of Network (NKN) Detection
NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>
Sigma rule (View on GitHub)
1title: New Kind of Network (NKN) Detection
2id: fa7703d6-0ee8-4949-889c-48c84bc15b6f
3status: test
4description: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>
5references:
6 - https://github.com/nknorg/nkn-sdk-go
7 - https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/
8 - https://github.com/Maka8ka/NGLite
9author: Michael Portera (@mportatoes)
10date: 2022-04-21
11tags:
12 - attack.command-and-control
13logsource:
14 product: zeek
15 service: dns
16detection:
17 selection:
18 query|contains|all:
19 - 'seed'
20 - '.nkn.org'
21 condition: selection
22fields:
23 - id.orig_h
24 - id.resp_h
25 - answers
26falsepositives:
27 - Unknown
28level: low
References
-
Go implementation of NKN client and wallet. Contribute to nknorg/nkn-sdk-go development by creating an account on GitHub.
Read More -
A malicious campaign against ManageEngine ADSelfService Plus used Godzilla webshells, the NGLite backdoor and KdcSponge, a credential stealer.
Read More -
A major platform RAT Tool based by Blockchain/P2P.Now support Windows/Linux/MacOS - Maka8ka/NGLite
Read More
Related rules
- ADSI-Cache File Creation By Uncommon Tool
- APT User Agent
- APT40 Dropbox Tool User Agent
- Activity from Anonymous IP Addresses
- Activity from Infrequent Country