Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
It is very common for active malware to "call home" (or beaconing), either to fetch updates and instructions or to send back stolen information..
In an internal network where web access to the Internet must go through a proxy, the traffic that doesn't pass through the proxy and by default is dropped by the gateway firewall could be valuable to detect malware call-home activities.
What are the techniques to detect malware call home/beaconing activities?
There are a number of ways to do this, largely depending on the logs available, the exact nature of your network and the strain of malware you're infected with.
Malware can and will use your proxy, it can and will use your nameservers, it can and will run under the context of a normal user.
If you're effectively going in blind, with no indicators of concern, you could use the below to pick out potential malware traffic;
What are the techniques to detect malware call home/beaconing activities?
As we discussed in the comments sir, following are the broad known ways to hide malware network communications followed by ways to detect them. I have generalized some info because I am no expert in malware analysis. Hopefully below information serves help.
0> Direct IP connections, typically for malware that doesn’t make use of DNS.
Technique to detect:
1>Domain Generation Algorithm (DGA)
Malware with domain generation capabilities can periodically modifying C&C address details and using unknown addresses. It defeated/can defeat the Web Security Gateway (SWG), Terminal Detection Response (EDR) and Sandbox.
OR
1> Domain Name System (DNS) to resolve a C&C server address.
detection technique that may help:-
2>Host fraud
Forging header information can confuse the true destination of the data, so it can bypass defensive measures against known C&C server addresses. It defeated/can defeat the Web Security Gateway (SWG), IPS / IDS and Sandbox.
detection technique that may help:- take following important general measures to strictly limit these malware:
Only multi-layer protective measures can achieve complete safety coverage combination of endpoint defense (such as antivirus software and network layer protection measures such as firewalls and Web security gateways) .
Focus on zero-day malware: need of malware defense mechanism that can clearly identify and detect zero-day malware.
Perform traffic analysis: the infection may come from user endpoints, attackers usually extend it to network resources. Thus consider focusing not only on a certain area or resource type, but also network in its entirety
Leveraging big data: collect massive amounts of information accumulated over time to detect malware activities worldwide and correlate seemingly unrelated activities to track the development & evolution of malware.
3> web traffic:-Corporate environments often require that users’ web traffic goes through a filtering proxy. The web proxy logs are also helpful for detecting and analyzing C&Cs.
detection technique:-
4>Mail:-Not all C&C communication has to be web-based; it can also happen via email.
detection technique:-
5>internet relay chat (IRC) or peer to peer (P2P):-Firewall logs can shed light on other forms of C&C communication via internet relay chat (IRC) or peer to peer (P2P) exchange.
detection technique:-
6> network steganography (a crucial tool):
(interesting irrelevant info, feel free to skip if not interested)
The secret is injected into network traffic. For example, the data can be cloaked by manipulating the content of unused flags within headers or by modulating the inter-packet time (IPT) of network flow datagrams. In the latter case, asender can encode bits of information in previously agreed-upon IPT values. Similar to the LSB modification of image’s pixels example, overly aggressive deviations would make it possible to differentiate the hiding process from normal jitter events. Therefore, hidden channels are typically characterized by a low bandwidth, often ranging from a few to a few hundreds bits per second. Today, many other methods enable covert communications among desktops or digital devices, including generating inaudible sounds or utilizing a smartphone’s sensors to receive a sequence that activates a threat
technique to detect:-
credits and respect:
https://reverseengineering.stackexchange.com/questions/22063/difficulty-obtaining-malware-traffic
https://securityintelligence.com/how-to-leverage-log-services-to-analyze-cc-traffic/
https://arxiv.org/pdf/1504.04867.pdf
One Chinese site I converted text to English from, respect for the info but unfortunately I can not mention it because it was hosted on http(not https so skeptical about recommending such site to visit.)
Hopefully this information serves help. Please feel free to edit this answer to add information or credits I missed to mention.
In the case the malware uses a DGA (Domain Generation Algorithm) to contact the C&C server, analyzing the DNS queries can be useful.
Detecting 'homecalls' can be done by a clustering the meta-data of the DNS queries or doing statistical analysis on the queried host-name itself.
Detecting whether a queried domains is legit of malicious can also be done with a machine learning classifiers. There are good open source classifiers like FANCI or Endgame out there. FANCI is a random forest classifier, whereas Endgame is a Deep-Learning classifier. Both have their ups and downs. The machine learning algorithms could be trained to fit your personal needs by retraining them on your own data. The downside of this, is that you need to have lots of clean and malicious data available, which is often not the case.
The results of the machine learning classifiers seem promising. However they can also be circumvented using adversarial examples.
Note that this is not a complete answer, just one possible proposition to solve the problem.
I really agree with Doomgoose's answer, but i would like to also propose something different. If you have detected the malware you can isolate it and perform some basic dynamic analysis. In this case, I would put the malware in a virtual machine where it could have network access, run the malware, so it can go reach its "home" and analyze the traffic, either through wireshark, or other tools that do this as part of their dynamic analysis routine for malwares. Once its traffic is identified, you can make rules for ids/ips/firewalls/whatever, so you can further detect the spread in a big network and/or block it. Apart from that, you will save a great deal of time analyzing logs which may also contain numerous lines of legitimate traffic between the ones of the malware.
DNS Beacons are the most common based on my experience, also watch out for systems communicating within your network using Let's Encrypt Certificates and "looks" like Amazon Web Service, but in reality they are not of course. These are signs of hacker trade craft. You can find more information about this by Googling for "Malleable C2"
There are different methods of detecting a malware's attempt to communicate with its command and control server. In my opinion, the best way to perform a dynamic analysis of a malware is to analyse it in an isolated VM running FakeNet.
When a malware is executed, it uses different methods to establish network connectivity. It's goal is to establish comms with its C&C. Some do it either by pinging well known public sites such as Google or even 8.8.8.8.
FakeNet responds to such requests with a fake reply by simulating a network, making the malware believe that it has an internet connection. Logs can be exported in .pcap format and analysed separately. You can read more on FakeNet here
To my knowledge the most prevalent technique is to leverage a DNS sinkhole which analysis any particular type of outgoing requests.
Another technique that you can add to your list is the use of honeypots, in general malware tries to spread over the home network in order to find other victims, honeypots helps to detect this.
