⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION

We have not been able to test, simulate or build datasets for it, use at your own risk!

Try in Splunk Security Cloud

Description

This search looks for commands that the SNICat tool uses in the TLS SNI field.

  • Type: TTP
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • Last Updated: 2020-10-21
  • Author: Shannon Davis, Splunk
  • ID: 82d06410-134c-11eb-adc1-0242ac120002

ATT&CK

ID Technique Tactic
T1041 Exfiltration Over C2 Channel Exfiltration
`zeek_ssl` 
| rex field=server_name "(?<snicat>(LIST
|LS
|SIZE
|LD
|CB
|CD
|EX
|ALIVE
|EXIT
|WHERE
|finito)-[A-Za-z0-9]{16}\.)" 
| stats count by src_ip dest_ip server_name snicat 
| where count>0 
| table src_ip dest_ip server_name snicat 
| `detect_snicat_sni_exfiltration_filter`

Associated Analytic Story

How To Implement

You must be ingesting Zeek SSL data into Splunk. Zeek data should also be getting ingested in JSON format. We are detecting when any of the predefined SNICat commands are found within the server_name (SNI) field. These commands are LIST, LS, SIZE, LD, CB, EX, ALIVE, EXIT, WHERE, and finito. You can go further once this has been detected, and run other searches to decode the SNI data to prove or disprove if any data exfiltration has taken place.

Required field

  • _time
  • server_name
  • src_ip
  • dest_ip

Kill Chain Phase

  • Actions on Objectives

Known False Positives

Unknown

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1