Well,
we've reached our final demonstration. In this demo, we're going to look at how
malware can use TLS for secure communications. We'll discuss how to view TLS
information in Arkime, as well as explore the use of JA3 hashes to help us to
detect additional command and control nodes.
It's important to understand how to observe and analyze encrypted traffic. Due
to the encryption, many of the information that we'd really like to be able to
see is now not visible since it's encrypted.
However, that doesn't mean, as defenders, we aren't without our options.
So that's what we're going to focus on in this demonstration, so
let's get started. Now for our last traffic analysis exercise,
we're going to actually look at a pcap that we started this whole
course off with, but instead of just focusing on the payload drop
that is these executable,
we're going to focus on some of that post infection traffic,
particularly traffic that uses TLS encryption.
So let's start with the Connections tab.
We haven't used this one yet.
The Connection tab allows you to see graphs between nodes.
So here we can see very prominently that we have one node
that's doing most of our talking.
This happens to be our internal host. Now, we certainly
could look at all of the different hosts that it has
connected to and how it's connected.
You have IP address information, as well as ports.
Sometimes things will stand out,
but I certainly don't think everyone is going to have all
of the good and bad IPs memorized so let's filter this
content a little bit further.
I've decided that I want to focus on just the HTTP protocol, as
you can see with my filter, and we'll limit the bytes in the
session to greater than 500,000.
Let's take a step back,
identify where that trojan was dropped, and then expand our timeline from there.
This certainly looks like it's the case,
but we don't know for sure until we move over to the Sessions tab.
Hopefully, this looks familiar.
You can see our trojan, our executable that is masquerading as a PDF.
However,
that's all we see right now because we have our filters
providing us with a fairly narrow view.
Well,
let's look at another way in which we can adjust our
timeframe. If you look at the graph above,
you'll see a spike, a bar that represents that session traffic.
We can now just simply drag and drop, select an area,
and use that in order to help us narrow our timeline.
You'll notice that as we drag the box around the area that we want to inspect,
our timeline narrows, it gets smaller.
We can continue to do this, and for this example,
were interested in that post infection traffic.
So let's just highlight a timeline that comes after the
session, after when that pdf was dropped,
I'm going to continue to narrow this until we get to a point where we're about
30 minutes after the payload has entered the environment.
Now that we focused in,
let's back some of our filters off. In particular, let's get
rid of the bytes filter. You can see in doing this, we have
now generated more sessions.
Instead of having one, we have five.
As we investigate those sessions, though,
they appear to be legitimate traffic from the host,
which is going to blend in with the malicious traffic.
We have request the digicert, Windows update,
Microsoft, and all of these are really things we don't care about. What
if the sample is using TLS? So let's make a couple of modifications.
We'll change the protocol from HTTP to TLS,
and we'll add a filter so that we keep our IP source to
the host that we're investigating.
Okay, we have some good results here.
We have certainly some TLS traffic.
We have seven sessions that we can now investigate.
Much like the previous, some of this traffic is going to be legitimate.
For example, these requests to oracle.com.
The second session, though,
stands out as an anomaly mainly because the destination port
is a nonstandard port used for TLS traffic.
The standard port is 443, but in this case we see 4443. We can expand that
session and get information about the TLS certificate and the handshake
that took place as that session was established.
Let's first take a look at the cert information,
and you'll see there is some concerning information here,
such as the subject common value, as well as the Subject Org.
The other area that I want to point out is under the TLS section,
we have JA3 and JA3s values.
These are hashes that are calculated based off the
information provided in the initial TLS handshake.
How this is done is beyond the scope of what I want to cover, but this
is an open source technology that was introduced by Salesforce and they
have great documentation on their GitHub.
What we care about right now is that we can use the JA3 hash in order to
identify this certificate and its use with potentially other hosts.
If we go back to our Sessions view and eliminate all of
the filters, except this JA3 hash,
it does identify another session, in this case,
not to a destination port of 4443, but to 9443. So now we've
discovered another important IOC. Great work.
Well, unfortunately, we've come to the end of this course.
We have one module left in which I'll wrap things up and
provide some additional recommendations.