The above command is telling Suricata to read in (-r) the pacp file, to load the config file (-c), and to give it the path to the rules (-S). We can also look at the results of running Suricata on the packet capture: A bit later, we will look at how Zeek handles this type of port/protocol mismatch. In this example, the traffic is using port 443, however it is very clearly not actually SSL traffic. Many of the newer firewalls with protocol inspection have the ability to detect when traffic is not conforming to the standards of a particular protocol.

The big thing to take from this is that the traffic is on port 443, but it is not full SSL. These are artifacts from another C2 capture we will talk about where we used CobaltStrike. You will see some information relating to, please ignore that for now. Now let’s take a moment and look at C2 server from the view of NetworkMiner. If you look at the Secure Sockets Layer data in Wireshark it will show up as blank. And, we can see that Wireshark thinks the data is SSL based on the port, and the data appears to be encrypted. In the above data capture we can see the communication between the two hosts. We will start with a very basic Wireshark filter to see the communication between these two systems: ip.addr=134.209.211.136 & ip.addr=10.55.101.237 Also, there may be other interesting things in the captures as well. We have provided the pcap file for analysis. Path to the file: ~/Malware of the Day/ReverseHTTP/.pcap) (you will be required to enter your email address to access the file.

They are not the norm.įor this collection, we have the pcap file. Networks that can detect this type of command and control are more often than not the exception. The odd thing about this… is that it works. It just means the C2 will be using a port that is commonly allowed outbound from a network. This does not mean that the tool will be actually mimicking the actual protocol. This can be broken down into ports normally used for HTTPS, DNS and SMTP. Now let’s look at T1043 which is the MITRE technique for an attacker using a commonly used port.

Threat hunting wireshark cheat sheet