RSA Application Rules

Detects web traffic from an internal IP address to the following URL:
ss-rat.blogspot.com

Detects a set of pay-site hosts for Cerber ransomware that correlate to embedded configuration files for the malware’s set up of bitcoin wallets for each victim. This rule matches when alias.host (packet) or fqdn (web logs) begins with one of the identified pay-sites.

For more details about this threat, reference these RSA Link blog posts from RSA Research:

• The Evolution of Cerber
• The Evolution of Cerber... v4.1.x

Dependencies:

• Packets: HTTP_lua parser
• Logs: At least one web log event source, September 2016 or later release. If you are running a Log Collector version prior to 10.6.2, you must have the Envision Config File from Live for the FQDN meta key configuration.

Meta Keys:

• Risk Warning = cerber ransomware
• Indicators of Compromise = cerber ransomware

Detects malicious traffic between a command and control server and custom, downloader cmstar variants. Either the HTTP_lua or HTTP native parser is required.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting Cmstar Variants Using Security Analytics

CryptoShield ransomware is being distributed through sites that have been compromised so that when a visitor goes to the site, they encounter the attack chain. Once the ransomware is executed on the victim's computer, it generates a unique ID for the victim and an encryption key. This rule detects the upload of this key to the command and control server.

DEPENDENCIES:

Lua Parsers:

• HTTP_lua
• Form_Data_lua
• traffic_flow

Feeds:

• NetWitness

Generated Meta Keys:

• ioc = cryptoshield ransomware
• inv.category = threat
• inv.context = malware, crimeware

Detects malicious inbound and outbound traffic between backdoor / malware Daserf variants and a command and control server domain over HTTP. The HTTP_lua parser is required.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting Daserf Variants Using Security Analytics

Dyzap has the ability to steal user names and passwords of email, banking and social media accounts. Once the malware infects a victim machine, it starts sending data to its command and control server via an HTTP POST request. This rule detects a variant seen spreading through phishing email messages.

The HTTP_lua and traffic_flow parsers are required.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting a Dyzap variant using RSA NetWitness

Detects attempted get request for /etc/shadow

Detects files transported over ICMP.

Filters executables associated with Adobe updates.

Filters executables associated with Intel updates.

Filters Macromedia update executables.

Filters Skype update executables.

Filters executables associated with VMware updates.

Detects download of an executable file from a host on a blacklist feed.

Detects malicious outbound traffic between HttpBrowser Malware variants and a command and control server. Either the HTTP_lua or HTTP native parser is a required dependency.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting HttpBrowser Variants Using Security Analytics

Detects an internal network session download of jRAT (Java Remote Administration Tool).

Requires a network parser that supports population of meta keys 'action' and 'filename'. HTTP, FTP, IRC and NFS are examples of such parsers.

Detects an Outbound encrypted session where the data size is greater than 5MB.

Detects malicious outbound traffic between a system infected with Locky Ransomware and command and control server.

This rule has the following dependencies:

• Dependent on the HTTP Lua and Traffic Flow Lua parsers
• Dependent on Web proxy and security event sources such as Cisco WSA and SQUID
• Dependent on the NetWitness feed

Meta Key: alert.id - mapped to analysis meta.

For more details about this threat, reference this RSA Link blog post from RSA Research: Nemucod and Locky.

Detects malicious outbound traffic between a NetTraveler infected host and a command and control server. Either the HTTP_lua or HTTP native parser, and the traffic_flow Lua parser, are required.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting NetTraveler Variants Using Security Analytics

10.4 or higher. Detects web traffic from an internal IP address to the following URL: ge.tt/85SH60t/v/0.

10.4 or higher. Detects UDP/123 traffic with a 234-byte payload over Netflow. This is indicative of an NTP request generated by a monlist command.

10.4 or higher. Detects UDP/123 traffic with a 60-byte payload over NetFlow. This is indicative of the NTP request size initiated by the ntpdos.py attack script.

10.4 or higher. Detects UDP/123 traffic with a 50-byte payload over Netflow. This is indicative of a potential NTP DDoS attack tool.

Alerts when sessions containing payload have only ACK flag set.

Detects and generates meta after a session with a high percentage of payload transmitted outbound reaches 1GB, 2GB and 3GB.

VERSIONS SUPPORTED

• 10.5 and higher

CONFIGURATION

By default, the Decoder’s capture buffer size is 32MB. If you have modified this setting, then you may need to tune the condition for session.split within the rule. Once a session exceeds the capture buffer size, it is split into a separate session. Meta is generated on each split session called, session.split, which is incremented by a count of 1 with each new session. The default setting for the Decoder capture buffer size may be found through the NetWitness Suite UI > Administration > Services > Explore > decoder > config > capture.buffer.size.

DEPENDENCIES

Lua Parsers:

• traffic_flow
• session_analysis

GENERATED META KEYS

• boc = outbound session greater than 1gb

Detects use of common proxy services using a list of domains matched against the alias host meta key.

The following parsers are required:

• HTTP network parser
• TLS_lua parser

Detects remote client file downloads by looking for the file name and extension within the filename meta key.  Use of an HTTP network parser is required.

RIG exploit kit is suspected in the compromise of a vulnerable website due to patterns found within the query string.

This rule has the following dependencies:

• Dependent on the HTTP Lua and Traffic Flow Lua parsers
• Dependent on Web proxy and security event sources such as Cisco WSA and SQUID
• Dependent on the NetWitness feed

This rule generates the following meta keys:

• ioc = rig exploit kit
• inv.category = threat
• inv.context = attack phase, exploit

The SchoolBell rule detects malware associated with ShellCrew's large scale infrastructure harvesting campaign. SchoolBell targets Windows servers running vulnerable versions of Java web containers such as JBoss and Jenkins. The associated SchoolBell rule can be used to detect the malware's callbacks from an infected host.

Both the HTTP_lua and traffic_flow parsers are required.

Detects file sharing application usage for Box, Dropbox, Github and iCloud for potential shadow IT use.

Forensic executable detection with a small session size.

Indicates a forensic executable detection with no corresponding directory information.

Forensic executable detection from the root directory of a host.

Detects when an internal IP address initiates an SSH connection to an external IP address.
An SSH connection is identified by the following:

• service = 22, and
• tcp.dstport = 22

An Internal IP address is a private address space defined by RFC-1918. Any IP address not in the private space is considered external.

Detects a session larger than 1 MB to the following stealth mail services:

• Stealth Email. Alias host www.stealth-email.com
• Hush Mail. With an IP destination of 65.39.178.58 or organization destination of 'Peer 1 Network (USA)'
• Neomailbox. Alias host www.neomailbox.com
• Cryptoheaven. Alias host www.cryptoheaven.com
• S-mail. Alias host www.s-mail.com

Detects the beaconing activity of the TDSS Rootkit botnet.

Detects malicious traffic between backdoor/malware Tendrit variants and a command and control server. Either the HTTP_lua or HTTP native parser is required.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting Tendrit Variants Using Security Analytics

Detects hosts infected with the TSONE Dorkbot.

Detects the existence of "pastebin.com/post.php" in a URL string. Pastebin is a very common site for quickly distributing sensitive data, posting and retrieving malicious and benign code snippets, and is often used to post the output of competing Threat Actor Groups, usually in the form of usernames, passwords, and credit card numbers gained during successful harvesting campaigns as well as focused attacks against servers hosting the data.