Skip to content

Detect and respond to Cobalt Strike beacons using ETW.

Notifications You must be signed in to change notification settings

3lp4tr0n/BeaconHunter

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

75 Commits
 
 
 
 
 
 

Repository files navigation

BeaconHunter

Behavior based monitoring and hunting tool built in C# leveraging ETW tracing. Blue teamers can use this tool to detect and respond to potential Cobalt Strike beacons. Red teamers can use this tool to research ETW bypasses and discover new processes that behave like beacons.

Author: Andrew Oliveau (@AndrewOliveau)

image

TL;DR

Beacon implants injected in a benign process live in a thread with a Wait:DelayExecution state (probably related to Cobalt Strike's sleep). Find all processes that contain a thread in a Wait:DelayExecution state. Then, leverage ETW tracing to specifically monitor suspicious thread activity:

  • HTTP/HTTPS callbacks
  • DNS queries
  • File system (cd,ls,upload,rm)
  • Process termination (kill)
  • Shell commands (run,execute)

Score suspicious behavior. Log, display, and take action against them.

Building / Installation

Pre-compiled

Release

or git clone and go to Release folder.

.NET Framework version

4.5

Nuggets:

Tools -> NuGet Package Manager -> Package Manager Console

  • Install-Package ConsoleTables -Version 2.4.2
  • Install-Package Microsoft.Diagnostics.Tracing.TraceEvent -Version 2.0.64
  • Install-Package System.Runtime.InteropServices.RuntimeInformation -Version 4.3.0

Running BeaconHunter

  • Open PowerShell or CMD as an Administrator
  • .\BeaconHunter.exe

MONITOR

Network Beacon Score
  • Score is determined by calculating the time difference between beacon callbacks (delta), then calculating the 1st derivative of delta, and then feeding the answer to an inverse function 100/x where x is the 1st derivative of delta. (Note: There is probably a better way, but it works)

image

IP and PORT Stats

image

DNS Queries

  • Helpful to detect DNS beacons.

image

Directory Change

image

New Uploaded Files

image

Shell Commands

  • Detects PPID spoofing

image

ACTION

Suspend Thread ID - Manual

image

Suspend Thread ID - Automated

  • Set a score threshold. If Network Beacon Scores goes above threshold, BeaconHunter will automatically suspend the thread.

image

References

About

Detect and respond to Cobalt Strike beacons using ETW.

Resources

Stars

Watchers

Forks

Packages

No packages published

Languages