RSA Application Rules

Detects web traffic from an internal IP address to the following URL:
ss-rat.blogspot.com

Detects a set of pay-site hosts for Cerber ransomware that correlate to embedded configuration files for the malware’s set up of bitcoin wallets for each victim. This rule matches when alias.host (packet) or fqdn (web logs) begins with one of the identified pay-sites.

For more details about this threat, reference these RSA Link blog posts from RSA Research:

• The Evolution of Cerber
• The Evolution of Cerber... v4.1.x

Dependencies:

• Packets: HTTP_lua parser
• Logs: At least one web log event source, September 2016 or later release. If you are running a Log Collector version prior to 10.6.2, you must have the Envision Config File from Live for the FQDN meta key configuration.

Meta Keys:

• Risk Warning = cerber ransomware
• Indicators of Compromise = cerber ransomware

Detects malicious traffic between a command and control server and custom, downloader cmstar variants. Either the HTTP_lua or HTTP native parser is required.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting Cmstar Variants Using Security Analytics

Detects malicious inbound and outbound traffic between backdoor / malware Daserf variants and a command and control server domain over HTTP. The HTTP_lua parser is required.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting Daserf Variants Using Security Analytics

Dyzap has the ability to steal user names and passwords of email, banking and social media accounts. Once the malware infects a victim machine, it starts sending data to its command and control server via an HTTP POST request. This rule detects a variant seen spreading through phishing email messages.

The HTTP_lua and traffic_flow parsers are required.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting a Dyzap variant using RSA NetWitness

Detects attempted get request for /etc/shadow

Detects files transported over unknown protocols.

Filters executable updates for Google tools.

Filters executables involved with Java updates.

Filters executables associated with McAfee updates.

Filters Symantec update executables.

Filters executable downloads from Windows Update.

Rules looks for file transfers via IRC.

Detects malicious outbound traffic between a KeyBase Keylogger infected host and a command and control server. Either the HTTP_lua or HTTP native parser, and the traffic_flow Lua parser, are required.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting KeyBase Keylogger Variants Using Security Analytics

Detects Outbound session (encrypted or non-encrypted) where the data size is greater than 5MB.

DEPENDENCIES

Lua Parser: Traffic Flow Lua

Feeds:

• Hunting
• Investigation

GENERATED META KEYS

• boc = large outbound data transfer
• inv.category = assurance
• inv.context = compliance, corporate

Detects malicious outbound traffic due to installation of Mirage malware. The HTTP_lua parser is a required dependency.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting Mirage Variants Using Security Analytics

Detects web servers running nginx which is often used for malicious purposes.

Detects an internal network session download of NTDSXTRACT.

NTDSXTRACT is a tool framework for extracting data from the active directory database file NTDS.DIT.

Requires a network parser that supports population of meta keys 'action' and 'filename'. HTTP, FTP, IRC and NFS are examples of such parsers.

Detects UDP/123 traffic with a 234-byte payload. This is indicative of an NTP request generated by a monlist command.

Detects UDP/123 traffic with a 60-byte payload. This is indicative of the NTP request size initiated by the ntpdos.py attack script.

Detects UDP/123 traffic with a 50-byte payload. This is indicative of a potential NTP DDoS attack tool.

Detects outbound MS Outlook PFFs (Personal Folder Files). It does not differentiate between type of PFF (e.g.: .pst, .ost, .pab).

Detects and generates meta after a session with a high percentage of payload transmitted outbound reaches 500 megabytes.

VERSIONS SUPPORTED

• 10.5 and higher

CONFIGURATION

By default, the Decoder’s capture buffer size is 32MB. If you have modified this setting, then you may need to tune the condition for session.split within the rule. Once a session exceeds the capture buffer size, it is split into a separate session. Meta is generated on each split session called, session.split, which is incremented by a count of 1 with each new session. The default setting for the Decoder capture buffer size may be found through the RSA NetWitness Platform UI > Administration > Services > Explore > decoder > config > capture.buffer.size.

DEPENDENCIES

Lua Parsers:

• traffic_flow
• session_analysis

GENERATED META KEYS

• boc = outbound session greater than 500mb

Detects proxy client file downloads by looking for the file name and extension within the filename meta key.  Use of an HTTP network parser is required.

Detects an RDP session over a non-standard port.

Detects use of common remote client download sites. It uses a list of domains matched against the alias host meta key. Use of an HTTP network parser is required.

Detects web traffic involving UDP/67 or 68 that is not a legitimate DHCP server.

Note: Users must add legitimate DHCP servers to the RogueDHCPServerDetected feed. For details, see Create Feed for Rogue DHCP Server Rule.

Detects document uploads to the site ScribD.

Detects some voice and chat applications' (e.g. Vonage, VOIPStudio, tinychat, and Yahoo Messenger) usage for potential shadow IT use.

Indicates a forensic executable detection with a file extension that is not .exe.

Indicates a forensic executable detection with a small session size and no corresponding alias.host information.

Detects malicious traffic between Spaeshill downloader/malware and a command and control server. Either the HTTP_lua or HTTP native parser is a required dependency.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting Spaeshill Using Security Analytics

Detects a user sign-up or sign-in event for the following stealth mail services:

• Stealth Email. Referer of either www.spytech-web.com/stealth-email-buy.shtml or stealth-email.com
• Hush Mail. Any traffic with an IP destination of 65.39.178.58 or organization destination of 'Peer 1 Network (USA)'
• Neomailbox. Any traffic to alias host www.neomailbox.com
• Cryptoheaven. Any traffic to alias host www.cryptoheaven.com
• S-mail. Any traffic to alias host mail.s-mail.com

Detects malicious outbound traffic between a Taidoor infected host and a command and control server. Either the HTTP_lua or HTTP native parser, and the traffic_flow Lua parser, are required.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting Taidoor Variants using Security Analytics

Detects the beaconing activity of the TDSS Rootkit botnet.

Detects an encrypted network session, as well as log sessions to an external (non RFC-1918) IP destination that shows at least one indicator of using the Tor protocol for anonymous data access. The possible indicators of Tor are: Communication over a common Tor destination port of 9001, 9030, 9101, 9003, 9050, 9051 or communication with a known Tor tunnel node.

DEPENDENCIES

Packets:

• Lua Parsers:

  • traffic_flow
  • TLS_lua

• Feeds:

  • Tor Exit Nodes
  • Investigation

Logs:

• Lua Parsers: traffic_flow

• Feeds:

  • Tor Exit Nodes
  • Investigation
• Log Parser: at least one parser with device.class='Firewall' or device.type='rsaflow'

GENERATED META KEYS

• analysis.session= tunneling outbound tor
• inv.category = assurance
• inv.context = compliance, corporate, organizational hazard, risk

Detects malicious outbound traffic due to installation of Trojan BLT variants. Either the HTTP_lua or HTTP native parser is required.

For more details about this threat, reference this RSA Link blog post from RSA Research: Detecting Trojan BLT Variants Using Security Analytics

Detects a domain controller or directory server engaged in port activity that is outside the expected ports.

For Active Directory port requirements, see the following Microsoft Windows Server article: https://technet.microsoft.com/en-us/...(v=ws.10).aspx

Note: This rule must be modified to include the IP address of the local Domain Controller or Directory Server.

Detects the existence of "rghost.net" in a URL string.

Rghost is a very common site for quickly distributing sensitive data and posting and retrieving malicious ( as well as benign) code snippets.

It is often used to post the output of competing Threat Actor Groups, usually in the form of usernames, passwords, and credit card numbers gained during successful harvesting campaigns, as well as focused attacks against servers hosting the data.

Additionally, it is a large online repository for searchable malware executables.