Possible FIN7 DGA Command and Control Behavior

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Possible FIN7 DGA Command and Control Behavior

This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this command and control technique, while maintaining persistence in their target’s network.

Rule type: esql

Rule indices: None

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Tags:

Use Case: Threat Detection
Tactic: Command and Control
Domain: Endpoint
Rule Type: ESQL
Data Source: PAN-OS
Resources: Investigation Guide

Version: 113

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

In the event this rule identifies benign domains in your environment, the destination.domain exclusion in the rule can be modified to include those domains. Example: ... | where destination.domain not in ("zoom.us", "benign.domain1", "benign.domain2").

Rule query

edit

from packetbeat-*, filebeat-*, logs-network_traffic.*, logs-panw.panos* metadata _id, _version, _index
| where (
    data_stream.dataset in ("network_traffic.tls", "network_traffic.http") or
    (
      data_stream.dataset == "panw.panos" and
      network.application in ("ssl", "web-browsing") and network.transport == "tcp"
    ) or
    (event.category in ("network", "network_traffic") and network.protocol in ("tls", "http") and network.transport == "tcp")
  )
| where destination.domain RLIKE "[a-zA-Z]{4,5}\\.(pw|us|club|info|site|top)"
| where destination.domain != "zoom.us"
| keep @timestamp, destination.domain, source.ip, destination.ip, network.protocol, network.transport, data_stream.dataset, _id, _version, _index

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Command and Control
- ID: TA0011
- Reference URL: https://attack.mitre.org/tactics/TA0011/
Technique:
- Name: Application Layer Protocol
- ID: T1071
- Reference URL: https://attack.mitre.org/techniques/T1071/
Sub-technique:
- Name: Web Protocols
- ID: T1071.001
- Reference URL: https://attack.mitre.org/techniques/T1071/001/
Technique:
- Name: Dynamic Resolution
- ID: T1568
- Reference URL: https://attack.mitre.org/techniques/T1568/
Sub-technique:
- Name: Domain Generation Algorithms
- ID: T1568.002
- Reference URL: https://attack.mitre.org/techniques/T1568/002/

« Port Forwarding Rule Addition Possible Okta DoS Attack »