Detection: Multiple Archive Files Http Post Traffic

Date: 2024-05-16 ID: 4477f3ea-a28f-11eb-b762-acde48001122 Author: Teoderick Contreras, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects the high-frequency exfiltration of archive files via HTTP POST requests. It leverages HTTP stream logs to identify specific archive file headers within the request body. This activity is significant as it often indicates data exfiltration by APTs or trojan spyware after data collection. If confirmed malicious, this behavior could lead to the unauthorized transfer of sensitive data to an attacker’s command and control server, potentially resulting in severe data breaches and loss of confidential information.

Search

1`stream_http` http_method=POST 
2|eval archive_hdr1=substr(form_data,1,2) 
3| eval archive_hdr2 = substr(form_data,1,4) 
4|stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count by src_ip dest_ip http_method http_user_agent uri_path url bytes_in bytes_out archive_hdr1 archive_hdr2 
5|where count >20 AND (archive_hdr1 = "7z" OR archive_hdr1 = "PK" OR archive_hdr2="Rar!") 
6| `security_content_ctime(firstTime)` 
7| `security_content_ctime(lastTime)` 
8| `multiple_archive_files_http_post_traffic_filter`

Data Source

Name	Platform	Sourcetype	Source	Supported App
Splunk Stream HTTP	Splunk	`'stream:http'`	`'stream:http'`	N/A

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
multiple_archive_files_http_post_traffic_filter	`search *`

multiple_archive_files_http_post_traffic_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1048.003	Exfiltration Over Unencrypted Non-C2 Protocol	Exfiltration
T1048	Exfiltration Over Alternative Protocol	Exfiltration

KillChainPhase.ACTIONS_ON_OBJECTIVES

NistCategory.DE_CM

Cis18Value.CIS_13

APT32

APT33

FIN6

FIN8

Lazarus Group

OilRig

Thrip

Wizard Spider

TeamTNT

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Enabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Notable	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Risk Based Alerting	True

This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled in stream http configuration.

Known False Positives

Normal archive transfer via HTTP protocol may trip this detection.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message	Risk Score	Impact	Confidence
A http post $http_method$ sending packet with possible archive bytes header in uri path $uri_path$	25	50	50

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`stream`	`stream:http`
Integration	✅ Passing	Dataset	`stream`	`stream:http`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 3