Hello and welcome to
another application of the minor
attack framework discussion
today we're going to be looking at
custom command and control
protocols.
So today's objectives are
as follows.
We're going to be looking at
describing for you custom command
and control protocol as it's laid
out in the Mannatech framework.
We're going to squeeze a piece
of malware or common command and
control tool in the middle.
We'll talk mitigation technique and
detection technique as well.
So let's go ahead and jump right
in.
Custom command and control protocol
as laid out in modern threat, actors
may communicate using custom
C to command and control protocols
instead of using the existing
standard application layer protocol.
This can include using raw sockets
on top of fundamental protocols
provided by TCP, IP
or another standard network
stack.
Now an example of this is Naiad,
which is a Trojan
used by Alderwood to open the
back door. Uncompromised hosts
campaigns with Naiad may be traced
back as early as 2010.
Naiad Drop's files
that make registry changes align its
different components to launch
automatically.
Port for three is used
to create a back door where
instructions can be issued to launch
attacks and upload collected files.
So that is just one of many examples
of some custom command and control
software that is being used out
there right now.
Mitigation techniques for command
and control traffic can include
things like filtering network
traffic to look for odd protocols.
So things that are out of the norm
nips or network intrusion prevention
can be used to stop common attacks
and look for indicators of
compromise, which will this system
will automatically block some of
those attempts and then
use of network segmentation to slow
attackers down or to keep
critical systems separate from other
network systems in this type of
limitation, again, just makes it
that much harder for an actor to
move through the network and
not be detected.
Detection techniques can include
things like reviewing ICMP
messages and other protocols, again,
looking for abnormal
data sets. Again, packets that are
abnormally sized or perfectly
spaced out and chopped up
into maybe similar sizes
across a period of time.
But you would have to, again, have a
good baseline there and understand
how your network communications
are looking on a day to day basis
to be able to do a comparison and
potentially find this anomalous
traffic.
Now let's do a quick check on
learning.
Command and control protocols allow
end users to remotely control their
systems.
All right, well, if you need
additional time, please pass the
video in this instance,
command and control protocols
allow threat actors
to remotely control and
use our systems.
So in this case, this is
a false statement.
Command and control protocols are
not commonly used by users to
control their systems.
So let's go ahead and jump in to our
summary for today's discussion.
We described custom command and
control protocol as far as how it
looks in the moderate tech
framework.
We squeezed in a tool named Naiad
and just looked at its capability
at a very high level.
We looked at mitigation techniques
such as network intrusion prevention
to stop some of these attack
attempts.
And we looked at detection
techniques such as reviewing
uncommon ICMP
traffic or ways
in which that traffic could be
manipulated. Again,
keeping in mind that you have to
have a general awareness of your
network and the types of traffic
it produces to really make
this beneficial.
So with that, I want to thank you
for your time today, and I look
forward to seeing you again
soon.