Attribution Intelligence

5 automated security scanners

Active C2 Infrastructure Fingerprinting

Purpose: The Active C2 Infrastructure Fingerprinting Scanner is designed to detect and analyze potential Command and Control (C2) servers used by malicious actors. It identifies command server identification, control channel fingerprinting, and infrastructure pattern recognition to help in the detection of malicious activities.

What It Detects:

Command Server Identification: The scanner detects patterns indicative of command servers such as “command\s*(?:and|&)\s*control|c2|c&c”. It also identifies domain names associated with known C2 infrastructure.
Control Channel Fingerprinting: Analyzes network traffic and service signatures to identify control channels, looking for specific protocols and ports commonly used by C2 servers (e.g., TCP/443, UDP/53).
Infrastructure Pattern Recognition: Recognizes patterns in infrastructure configurations that match known malicious infrastructures, identifying exposed services and vulnerabilities using the Shodan API.
Domain/IP Reputation Analysis: Evaluates the reputation of domains and IPs associated with the target domain using VirusTotal API, checking for known exploited vulnerabilities listed in CISA KEV.
IP Reputation Evaluation: Uses AbuseIPDB to assess the reputation of IP addresses linked to the target domain, identifying malicious activities or abuse history related to these IPs.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)

Business Impact: This scanner is crucial for organizations aiming to enhance their security posture by detecting potential C2 servers used in malicious activities. It helps in identifying vulnerabilities and controlling channels that could be exploited by adversaries, thereby mitigating risks associated with data breaches and cyber threats.

Risk Levels:

Critical: The risk level is critical when the scanner identifies patterns of command servers or control channels that are directly linked to known malicious infrastructures without any mitigation measures in place.
High: A high risk level is indicated when the scanner detects vulnerabilities or exposed services that could be exploited by adversaries, potentially leading to significant data breaches or system compromises.
Medium: Medium risk levels apply when the scanner identifies potential C2 servers or infrastructure patterns that require immediate attention and mitigation strategies to prevent future malicious activities.
Low: Informational findings at a low risk level are typically non-critical observations that do not pose an immediate threat but should still be monitored for trends or changes in behavior indicative of potential security incidents.
Info: This category includes all other findings that are considered informational and generally do not affect the criticality of the identified issues.

Example Findings:

The scanner identifies a domain with HTTP titles containing “command\s*(?:and|&)\s*control|c2|c&c”, indicating potential C2 infrastructure usage.
A detected vulnerability in an exposed service on the target domain suggests a critical risk, as it could be exploited by malicious actors to gain unauthorized access or execute further attacks.

Attack Pattern Correlation

Purpose: The Attack Pattern Correlation Scanner is designed to detect tactic, technique, and procedure (TTP) matching, methodology similarity, and operational procedure consistency by analyzing threat intelligence feeds. It aims to identify potential attack patterns associated with a given domain, providing valuable insights for security assessments and incident response.

What This Scanner Detects:

Threat Indicator Matching:
- Identifies known vulnerabilities using CVE identifiers.
- Detects malware, ransomware, or trojan signatures.
- Recognizes command and control (C2) server references.
- Flags phishing and credential harvesting attempts.
Exposure Indicator Detection:
- Looks for indicators of data exposure, leaks, or breaches.
- Checks for mentions of unauthorized access.
- Identifies data dumps or sensitive information disclosures.
Vulnerability Correlation:
- Cross-references the domain with the Shodan API to find exposed services and vulnerabilities.
- Uses VirusTotal API to assess the reputation of the domain/IP.
- Compares findings against CISA KEV for known exploited vulnerabilities.
- Evaluates IP reputation using AbuseIPDB.
- Looks up vulnerabilities in the NVD/CVE database.
Methodology Similarity:
- Analyzes patterns of attack methods used by similar threat actors.
- Identifies operational procedures that match known attack vectors.
- Correlates detected TTPs with historical attack data.
Operational Procedure Consistency:
- Ensures consistency in the use of specific attack techniques over time.
- Detects repeated patterns of behavior indicative of persistent threats.
- Validates the presence of consistent operational procedures across different attacks.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)

Business Impact: This scanner is crucial for organizations looking to proactively identify and respond to potential cyber threats, ensuring that their security posture remains robust against sophisticated adversaries. By detecting TTPs and methodological similarities, it helps in understanding the threat landscape more effectively and taking preventive measures accordingly.

Risk Levels:

Critical: Findings that directly impact critical systems or pose a high risk of data loss or unauthorized access.
- Conditions: Direct threats to critical infrastructure, significant exposure to known vulnerabilities, or highly sophisticated and persistent threats identified through methodological similarity analysis.
High: Findings that significantly increase the risk of data breaches or system compromise but do not directly impact critical functions.
- Conditions: Exposure to multiple high-risk vulnerabilities, unauthorized access attempts involving sensitive information, or significant operational deviations from typical threat patterns.
Medium: Findings indicating potential vulnerabilities that could be exploited with some effort and may lead to moderate risk if left unaddressed.
- Conditions: Discovery of multiple medium-risk vulnerabilities, repeated exposure indicators across different attack vectors, or indications of ongoing unauthorized access attempts.
Low: Findings suggesting minimal impact on security posture but still indicative of potential risks that could be mitigated through standard procedures.
- Conditions: Minor exposure to low-risk vulnerabilities, isolated instances of credential harvesting, or minor deviations from typical threat behavior.
Info: Findings providing informational insights into the domain’s online presence and activity without significant risk.
- Conditions: Routine network configurations, benign usage patterns observed in non-critical systems, or minimal exposure to known threats.

Example Findings:

The scanner identifies a CVE-2021-44228 vulnerability in Apache Log4j, indicating a critical risk as this vulnerability has been exploited by multiple threat actors and can lead to remote code execution.
A domain frequently interacts with known phishing domains, suggesting potential involvement in credential harvesting activities that could compromise user credentials.

Targeting Pattern Recognition

Purpose: The Targeting Pattern Recognition Scanner is designed to uncover consistent victim selection, industry focus patterns, and geographic targeting preferences by analyzing threat intelligence feeds. It aims to identify recurring attack vectors and target characteristics through the detection of specific malware, ransomware, trojans, phishing, credential harvesting, and other related threats.

What It Detects:

Victim Selection Consistency: Identifies repeated targeting of specific organizations or industries using patterns such as malware, ransomware, trojan, and phishing/credential harvesting.
Industry Focus Patterns: Recognizes patterns in attacks on particular sectors like finance, healthcare, and others.
Geographic Targeting Preferences: Detects geographic regions that are frequently targeted based on specific indicators of targeting preferences.
Known Exploited Vulnerabilities: Identifies the use of known vulnerabilities listed in CISA’s Known Exploited Vulnerabilities (KEV) database.
Exposed Services and Vulnerabilities: Detects exposed services and vulnerabilities using the Shodan API, which can indicate potential data breaches or unauthorized access points.

Inputs Required:

domain (string): The primary domain to analyze, such as acme.com, providing a base for detecting patterns across various aspects of cyber threats.

Business Impact: This scanner is crucial for organizations and cybersecurity teams aiming to protect their assets from targeted attacks. By identifying consistent victim selection, industry focus, and geographic targeting preferences, it helps in developing more effective defense strategies against recurring attack vectors and enhancing overall security posture.

Risk Levels:

Critical: Conditions that lead to critical risk include persistent and sophisticated repeated targeting of specific sectors or regions, which can indicate a highly organized and determined threat actor.
High: High-risk conditions involve significant exposure to known vulnerabilities affecting critical infrastructure services, signaling potential catastrophic consequences if not mitigated promptly.
Medium: Medium-risk findings pertain to less severe but still significant threats such as specific industry focus patterns or moderately exposed service vulnerabilities that could be exploited with moderate effort and impact.
Low: Low-risk conditions include the occasional use of known exploits in a non-critical environment, generally requiring minimal attention unless they escalate in severity or frequency.
Info: Informational findings are those that provide general insights into threat landscape without posing immediate risk but can be indicative of evolving threats for awareness and monitoring purposes.

Example Findings:

“Our industry focus makes us a prime target for cyber attacks, indicating a pattern consistent with previous incidents.”
“Geographic targeting of our region has increased recently, suggesting heightened interest or ease of access in this area.”

This structured approach helps users understand the purpose and capabilities of the scanner while providing clear guidance on risk assessment based on detected patterns.

Temporal Attack Consistency

Purpose: The Temporal Attack Consistency Scanner is designed to detect and analyze timing signature recognition, operational tempo patterns, and time zone activity correlation in order to identify potential coordinated attacks or unusual activity that may indicate malicious intent.

What It Detects:

Identifies repeated attack attempts at specific times of day, potentially indicating synchronized attacks across multiple targets within a short timeframe.
Analyzes the frequency and intensity of attack events over time, detecting unusual spikes in activity that deviate from normal operational patterns.
Correlates attack times with known attacker time zones, identifying activities originating from geographically dispersed locations within a short period.
Groups similar events and analyzes their temporal distribution to identify clusters of events that may indicate coordinated attacks.
Compares current activity patterns with historical data to detect deviations from established baselines that could signal new attack vectors or tactics.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com). This is essential for the scanner to target and monitor specific online entities for potential threats.

Business Impact: Monitoring timing patterns, operational tempo, and time zone activity correlation is crucial for maintaining the integrity and security of digital infrastructures against sophisticated cyber attacks. Detecting coordinated or unusual activities early can significantly enhance the ability to respond effectively and minimize potential damage from malicious intent.

Risk Levels:

Critical: Identifies significant deviations in timing patterns that are highly indicative of ongoing or planned coordinated attacks, with immediate attention required to mitigate potential harm.
High: Detects irregular spikes in activity that may suggest targeted or well-planned attacks, requiring thorough investigation and potentially escalating security measures.
Medium: Indicates unusual but less severe deviations in timing patterns, which might require further monitoring or analysis to confirm the presence of malicious intent.
Low: Flags minor deviations that could be indicative of routine operational activity rather than malicious intent, generally requiring minimal action beyond regular monitoring.
Info: Provides informational findings about normal operational patterns and does not indicate any potential threats, serving as a baseline for understanding typical network behavior.

Example Findings:

A significant spike in attack attempts at 3 AM every Tuesday could be indicative of synchronized attacks that require immediate investigation to determine the nature and scope of the threat.
An unusual increase in activity from multiple time zones during evening hours might suggest a persistent and evolving cyber threat requiring continuous monitoring and response strategies.

Malware Variant Attribution

Purpose: The Malware Variant Attribution Scanner is designed to detect and analyze similarities in malware samples based on their coding patterns and techniques. It aims to attribute malware variants to specific threat actors or groups by identifying shared coding elements, function reuse, and development patterns.

What It Detects:

Code Similarity Assessment: Identifies similar code blocks across different malware samples using regex patterns, which can help detect reused functions and libraries indicative of the same developer or group.
Function Reuse Detection: Analyzes function signatures and implementations to find matches between malware variants, utilizing regex to identify common function names and patterns used by specific threat actors.
Development Pattern Recognition: Recognizes coding styles, comments, and other development artifacts that are unique to certain groups, helping detect the presence of known malicious libraries or frameworks in malware samples.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com). This is essential for searching for domain-related malware samples on VirusTotal and analyzing their code snippets for similarity detection.

Business Impact: The ability to attribute malware variants to specific threat actors or groups is crucial for understanding the tactics, techniques, and procedures (TTPs) used by these malicious actors. This attribution helps in developing targeted defense strategies and enhances overall cybersecurity posture against evolving threats.

Risk Levels:

Critical: Malware samples that exhibit highly similar code patterns across different variants, indicating a high level of function reuse or direct threat actor affiliation.
High: Significant similarity in coding elements suggesting potential function reuse or influence from the same developer or group.
Medium: Slight similarities in coding patterns that might indicate some degree of development influence or shared techniques but do not conclusively point to a specific threat actor.
Low: Minimal code similarities that could be attributed to independent development or unrelated threats, with low confidence in attribution.
Info: Informational findings related to the presence of certain benign libraries or coding elements that are not indicative of malicious intent.

Example Findings:

A malware sample showing high similarity across multiple variants, suggesting a direct association with a known threat actor based on shared coding techniques and patterns.
Detection of reused functions in different samples, which could indicate a common development framework used by the same group or individual threat actors.