8

It is very common for active malware to "call home" (or beaconing), either to fetch updates and instructions or to send back stolen information..

In an internal network where web access to the Internet must go through a proxy, the traffic that doesn't pass through the proxy and by default is dropped by the gateway firewall could be valuable to detect malware call-home activities.

What are the techniques to detect malware call home/beaconing activities?

  • 2
    Malware can use proxy settings, so they will go with the common traffic. – ThoriumBR Sep 24 '18 at 11:29
  • @ThoriumBR Not always. Malwares can use a proxy to tunnel stolen information or some sort of command it awaiting for to hand on. – slayer Oct 5 '18 at 13:18
4

There are a number of ways to do this, largely depending on the logs available, the exact nature of your network and the strain of malware you're infected with.

Malware can and will use your proxy, it can and will use your nameservers, it can and will run under the context of a normal user.

If you're effectively going in blind, with no indicators of concern, you could use the below to pick out potential malware traffic;

  • Web traffic to a domain no other device is communicating with
  • Web traffic to domains with known risky TLDs (.top, .gq for example)
  • Large amounts of DNS traffic originating from a user endpoint
  • Periodic traffic which calls out with a precise interval
  • Proxy traffic on odd ports
  • Proxy traffic which remains out of hours
  • HTTP traffic with commands within the URI (i.e, a web shell)
  • Unusual user agent strings
  • Proxy traffic which remains out of hours - what does it mean? can you elaborate? – Filipon Sep 24 '18 at 13:40
  • 1
    This depends on your environment but out of normal working hours, so 18:00 - 06:00 perhaps if you're monitoring a typical office. If you're monitoring a home network, you could look at any time when you're not using the device. (i.e, is there traffic occurring when nobody is using the machine?) – Doomgoose Sep 24 '18 at 13:43
1

I really agree with Doomgoose's answer, but i would like to also propose something different. If you have detected the malware you can isolate it and perform some basic dynamic analysis. In this case, I would put the malware in a virtual machine where it could have network access, run the malware, so it can go reach its "home" and analyze the traffic, either through wireshark, or other tools that do this as part of their dynamic analysis routine for malwares. Once its traffic is identified, you can make rules for ids/ips/firewalls/whatever, so you can further detect the spread in a big network and/or block it. Apart from that, you will save a great deal of time analyzing logs which may also contain numerous lines of legitimate traffic between the ones of the malware.

1

DNS Beacons are the most common based on my experience, also watch out for systems communicating within your network using Let's Encrypt Certificates and "looks" like Amazon Web Service, but in reality they are not of course. These are signs of hacker trade craft. You can find more information about this by Googling for "Malleable C2"

1

There are different methods of detecting a malware's attempt to communicate with its command and control server. In my opinion, the best way to perform a dynamic analysis of a malware is to analyse it in an isolated VM running FakeNet.

When a malware is executed, it uses different methods to establish network connectivity. It's goal is to establish comms with its C&C. Some do it either by pinging well known public sites such as Google or even 8.8.8.8.

FakeNet responds to such requests with a fake reply by simulating a network, making the malware believe that it has an internet connection. Logs can be exported in .pcap format and analysed separately. You can read more on FakeNet here

-2

To my knowledge the most prevalent technique is to leverage a DNS sinkhole which analysis any particular type of outgoing requests.

  • 2
    Why a DNS sinkhole? How does a sinkhole help in this use case? How do you use a sinkhole to analyze? I think you need to expand on this answer a lot more, because there is not enough detail in general, and sinkholes are certainly not the "most prevalent" technique to analyse traffic of any sort, unless I am missing something. – schroeder Sep 24 '18 at 12:51
-3

Another technique that you can add to your list is the use of honeypots, in general malware tries to spread over the home network in order to find other victims, honeypots helps to detect this.

  • "spreading" is not a "call home" activity – schroeder Oct 1 '18 at 20:34
  • @camp0 I believe that you have a misunderstand of what a well-known "Malware Call Home" is. The "Home" refers to the whose host that the Malware tries to communicate to follow some command (i.e., C2) or store ripped off information from the infected computer/device – slayer Oct 5 '18 at 12:51
  • @camp0 The use of honeyspot [and honeynet]––since it is utter isolated from the major network––is a good method to obtain the Malware and analyze their behavior. Despite this subject is not being discussed here, though. That's why I gave you a down voted. – slayer Oct 5 '18 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.