Introducing CENTS reporting module

[zoomequipd]

Support for automated Suricata rules based on extracted configurations with the initial implementation supporting Remcos, SquirrelWaffle, and TrickBot.

This feature will be presented in depth during SURICON

Jack Mott, Brandon Murphy, and Konstantin Klinger

Malware is increasingly using encryption and TLS for command-and-control network traffic. This increased adoption has resulted in difficulty when creating typical network intrusion detection signatures. However, it is often possible to extract the configuration of a malware sample including DGA seeds, C2 domains/ports, crypto keys, version number, etc. These details can be used to determine what post-exploitation or post-infection network communication can be expected from the malware in later stages of malware execution.

This presentation will demonstrate how to leverage existing extracted configuration parameters from Cape Sandbox to generate Suricata signatures. While this is easy on a per sample basis, any solution should be scalable and enable automatic signature creation for the most common malware families. Our proposed solution, CENTS – Configuration Extraction to Network Traffic Signatures, will demonstrate one method of achieving automated coverage for the most common malware families which use encryption and TLS.

Feel free to squash as needed.

[doomedraven]

nice stuff thank you a lot

[kevoreilly]

Awesome