New Connection Initiated To Potential Dead Drop Resolver Domain

  1title: New Connection Initiated To Potential Dead Drop Resolver Domain
  2id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
  3related:
  4    - id: d7b09985-95a3-44be-8450-b6eadf49833e
  5      type: obsolete
  6status: test
  7description: |
  8    Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks.
  9    In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.    
 10references:
 11    - https://web.archive.org/web/20220830134315/https://content.fireeye.com/apt-41/rpt-apt41/
 12    - https://securelist.com/the-tetrade-brazilian-banking-malware/97779/
 13    - https://blog.bushidotoken.net/2021/04/dead-drop-resolvers-espionage-inspired.html
 14    - https://github.com/kleiton0x00/RedditC2
 15    - https://twitter.com/kleiton0x7e/status/1600567316810551296
 16    - https://www.linkedin.com/posts/kleiton-kurti_github-kleiton0x00redditc2-abusing-reddit-activity-7009939662462984192-5DbI/?originalSubdomain=al
 17author: Sorina Ionescu, X__Junior (Nextron Systems)
 18date: 2022-08-17
 19modified: 2024-10-21
 20tags:
 21    - attack.command-and-control
 22    - attack.t1102
 23    - attack.t1102.001
 24logsource:
 25    category: network_connection
 26    product: windows
 27detection:
 28    selection:
 29        Initiated: 'true'
 30        DestinationHostname|endswith:
 31            - '.t.me'
 32            - '4shared.com'
 33            - 'abuse.ch'
 34            - 'anonfiles.com'
 35            - 'cdn.discordapp.com'
 36            - 'cloudflare.com'
 37            - 'ddns.net'
 38            - 'discord.com'
 39            - 'docs.google.com'
 40            - 'drive.google.com'
 41            - 'dropbox.com'
 42            - 'dropmefiles.com'
 43            - 'facebook.com'
 44            - 'feeds.rapidfeeds.com'
 45            - 'fotolog.com'
 46            - 'ghostbin.co/'
 47            - 'githubusercontent.com'
 48            - 'gofile.io'
 49            - 'hastebin.com'
 50            - 'imgur.com'
 51            - 'livejournal.com'
 52            - 'mediafire.com'
 53            - 'mega.co.nz'
 54            - 'mega.nz'
 55            - 'onedrive.com'
 56            - 'pages.dev'
 57            - 'paste.ee'
 58            - 'pastebin.com'
 59            - 'pastebin.pl'
 60            - 'pastetext.net'
 61            - 'pixeldrain.com'
 62            - 'privatlab.com'
 63            - 'privatlab.net'
 64            - 'reddit.com'
 65            - 'send.exploit.in'
 66            - 'sendspace.com'
 67            - 'steamcommunity.com'
 68            - 'storage.googleapis.com'
 69            - 'technet.microsoft.com'
 70            - 'temp.sh'
 71            - 'transfer.sh'
 72            - 'trycloudflare.com'
 73            - 'twitter.com'
 74            - 'ufile.io'
 75            - 'vimeo.com'
 76            - 'w3spaces.com'
 77            - 'wetransfer.com'
 78            - 'workers.dev'
 79            - 'youtube.com'
 80    # Note: Add/Remove browsers/applications that you don't use or those that have custom install locations
 81    # Note: To avoid complex conditions the filters for some apps are generic by name only. A custom tuning is recommended for best results
 82    filter_main_chrome:
 83        Image:
 84            - 'C:\Program Files\Google\Chrome\Application\chrome.exe'
 85            - 'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe'
 86    filter_main_chrome_appdata:
 87        Image|startswith: 'C:\Users\'
 88        Image|endswith: '\AppData\Local\Google\Chrome\Application\chrome.exe'
 89    filter_main_firefox:
 90        Image:
 91            - 'C:\Program Files\Mozilla Firefox\firefox.exe'
 92            - 'C:\Program Files (x86)\Mozilla Firefox\firefox.exe'
 93    filter_main_firefox_appdata:
 94        Image|startswith: 'C:\Users\'
 95        Image|endswith: '\AppData\Local\Mozilla Firefox\firefox.exe'
 96    filter_main_ie:
 97        Image:
 98            - 'C:\Program Files (x86)\Internet Explorer\iexplore.exe'
 99            - 'C:\Program Files\Internet Explorer\iexplore.exe'
100    filter_main_edge_1:
101        - Image|startswith: 'C:\Program Files (x86)\Microsoft\EdgeWebView\Application\'
102        - Image|endswith: '\WindowsApps\MicrosoftEdge.exe'
103        - Image:
104              - 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe'
105              - 'C:\Program Files\Microsoft\Edge\Application\msedge.exe'
106    filter_main_edge_2:
107        Image|startswith:
108            - 'C:\Program Files (x86)\Microsoft\EdgeCore\'
109            - 'C:\Program Files\Microsoft\EdgeCore\'
110        Image|endswith:
111            - '\msedge.exe'
112            - '\msedgewebview2.exe'
113    filter_main_safari:
114        Image|contains:
115            - 'C:\Program Files (x86)\Safari\'
116            - 'C:\Program Files\Safari\'
117        Image|endswith: '\safari.exe'
118    filter_main_defender:
119        Image|contains:
120            - 'C:\Program Files\Windows Defender Advanced Threat Protection\'
121            - 'C:\Program Files\Windows Defender\'
122            - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
123        Image|endswith:
124            - '\MsMpEng.exe' # Microsoft Defender executable
125            - '\MsSense.exe' # Windows Defender Advanced Threat Protection Service Executable
126    filter_main_prtg:
127        # Paessler's PRTG Network Monitor
128        Image|endswith:
129            - 'C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe'
130            - 'C:\Program Files\PRTG Network Monitor\PRTG Probe.exe'
131    filter_main_brave:
132        Image|startswith: 'C:\Program Files\BraveSoftware\'
133        Image|endswith: '\brave.exe'
134    filter_main_maxthon:
135        Image|contains: '\AppData\Local\Maxthon\'
136        Image|endswith: '\maxthon.exe'
137    filter_main_opera:
138        Image|contains: '\AppData\Local\Programs\Opera\'
139        Image|endswith: '\opera.exe'
140    filter_main_seamonkey:
141        Image|startswith:
142            - 'C:\Program Files\SeaMonkey\'
143            - 'C:\Program Files (x86)\SeaMonkey\'
144        Image|endswith: '\seamonkey.exe'
145    filter_main_vivaldi:
146        Image|contains: '\AppData\Local\Vivaldi\'
147        Image|endswith: '\vivaldi.exe'
148    filter_main_whale:
149        Image|startswith:
150            - 'C:\Program Files\Naver\Naver Whale\'
151            - 'C:\Program Files (x86)\Naver\Naver Whale\'
152        Image|endswith: '\whale.exe'
153    # Note: The TOR browser shouldn't be something you allow in your corporate network.
154    # filter_main_tor:
155    #     Image|contains: '\Tor Browser\'
156    filter_main_whaterfox:
157        Image|startswith:
158            - 'C:\Program Files\Waterfox\'
159            - 'C:\Program Files (x86)\Waterfox\'
160        Image|endswith: '\Waterfox.exe'
161    filter_main_midori:
162        Image|contains: '\AppData\Local\Programs\midori-ng\'
163        Image|endswith: '\Midori Next Generation.exe'
164    filter_main_slimbrowser:
165        Image|startswith:
166            - 'C:\Program Files\SlimBrowser\'
167            - 'C:\Program Files (x86)\SlimBrowser\'
168        Image|endswith: '\slimbrowser.exe'
169    filter_main_flock:
170        Image|contains: '\AppData\Local\Flock\'
171        Image|endswith: '\Flock.exe'
172    filter_main_phoebe:
173        Image|contains: '\AppData\Local\Phoebe\'
174        Image|endswith: '\Phoebe.exe'
175    filter_main_falkon:
176        Image|startswith:
177            - 'C:\Program Files\Falkon\'
178            - 'C:\Program Files (x86)\Falkon\'
179        Image|endswith: '\falkon.exe'
180    filter_main_qtweb:
181        Image|startswith:
182            - 'C:\Program Files (x86)\QtWeb\'
183            - 'C:\Program Files\QtWeb\'
184        Image|endswith: '\QtWeb.exe'
185    filter_main_avant:
186        Image|startswith:
187            - 'C:\Program Files (x86)\Avant Browser\'
188            - 'C:\Program Files\Avant Browser\'
189        Image|endswith: '\avant.exe'
190    filter_main_whatsapp:
191        Image|startswith:
192            - 'C:\Program Files (x86)\WindowsApps\'
193            - 'C:\Program Files\WindowsApps\'
194        Image|endswith: '\WhatsApp.exe'
195        DestinationHostname|endswith: 'facebook.com'
196    filter_main_telegram:
197        Image|contains: '\AppData\Roaming\Telegram Desktop\'
198        Image|endswith: '\Telegram.exe'
199        DestinationHostname|endswith: '.t.me'
200    filter_main_onedrive:
201        Image|contains: '\AppData\Local\Microsoft\OneDrive\'
202        Image|endswith: '\OneDrive.exe'
203        DestinationHostname|endswith: 'onedrive.com'
204    filter_main_dropbox:
205        Image|startswith:
206            - 'C:\Program Files (x86)\Dropbox\Client\'
207            - 'C:\Program Files\Dropbox\Client\'
208        Image|endswith:
209            - '\Dropbox.exe'
210            - '\DropboxInstaller.exe'
211        DestinationHostname|endswith: 'dropbox.com'
212    filter_main_mega:
213        Image|endswith:
214            # Note: This is a basic/best effort filter in order to avoid FP with the MEGA installer and executable.
215            #       In practice please apply exact path to avoid basic path bypass techniques.
216            - '\MEGAsync.exe'
217            - '\MEGAsyncSetup32_*RC.exe' # Beta versions
218            - '\MEGAsyncSetup32.exe' # Installers 32bit
219            - '\MEGAsyncSetup64.exe' # Installers 64bit
220            - '\MEGAupdater.exe'
221        DestinationHostname|endswith:
222            - 'mega.co.nz'
223            - 'mega.nz'
224    filter_main_googledrive:
225        Image|contains:
226            - 'C:\Program Files\Google\Drive File Stream\'
227            - 'C:\Program Files (x86)\Google\Drive File Stream\'
228        Image|endswith: 'GoogleDriveFS.exe'
229        DestinationHostname|endswith: 'drive.google.com'
230    filter_main_discord:
231        Image|contains: '\AppData\Local\Discord\'
232        Image|endswith: '\Discord.exe'
233        DestinationHostname|endswith:
234            - 'discord.com'
235            - 'cdn.discordapp.com'
236    filter_main_null:
237        Image: null
238    filter_main_empty:
239        Image: ''
240    # filter_optional_qlik:
241    #     Image|endswith: '\Engine.exe' # Process from qlik.com app
242    condition: selection and not 1 of filter_main_*
243falsepositives:
244    - One might need to exclude other internet browsers found in it's network or other applications like ones mentioned above from Microsoft Defender.
245    - Ninite contacting githubusercontent.com
246level: high