Detect Protocol or Service Impersonation in CrowdStrike LogScale
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By mimicking legitimate protocols or web services, adversaries make their C2 traffic blend in with normal network traffic. Techniques include FakeTLS (malformed TLS handshakes that mimic real TLS but use different encryption), custom HTTP header manipulation, URI endpoint spoofing, SSL certificate impersonation, and mimicking well-known services like Gmail or Google Drive. Real-world examples include Lazarus Group's FakeTLS, Cobalt Strike malleable C2 profiles, SUNBURST's OIP protocol masquerading, and Mustang Panda's PUBLOAD/StarProxy tools.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1001 Data Obfuscation
- Sub-technique
- T1001.003 Protocol or Service Impersonation
- Canonical reference
- https://attack.mitre.org/techniques/T1001/003/
LogScale Detection Query
// T1001.003 - Protocol or Service Impersonation Detection
// Detect suspicious processes making repeated outbound connections to TLS/HTTP ports
// Part 1: FakeTLS - suspicious process connecting to TLS ports
#event_simpleName=NetworkConnectIP4
| RemotePort in [443, 8443, 4443, 8080, 8888]
| RemoteAddressIP4 != /^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|127\.)/
| ImageFileName =~ /(?i)(svchost\.exe|lsass\.exe|rundll32\.exe|regsvr32\.exe|mshta\.exe|wscript\.exe|cscript\.exe|msbuild\.exe|installutil\.exe|regasm\.exe|regsvcs\.exe|certutil\.exe|bitsadmin\.exe)/
| ImageFileName !=~ /(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|teams\.exe|slack\.exe|zoom\.exe|outlook\.exe|onedrive\.exe)/
| groupBy([ComputerName, ImageFileName, RemoteAddressIP4, RemotePort], function=[
count(aid, as=ConnectionCount),
min(@timestamp, as=FirstSeen),
max(@timestamp, as=LastSeen),
collect(CommandLine, limit=5, as=CommandLines)
])
| where ConnectionCount >= 3
| eval DurationMinutes = round((LastSeen - FirstSeen) / 60000, 1)
| eval AvgIntervalSeconds = if(ConnectionCount > 1, round((LastSeen - FirstSeen) / 1000 / (ConnectionCount - 1), 1), null())
| eval BeaconingLikely = if(AvgIntervalSeconds > 30 AND AvgIntervalSeconds < 3600 AND ConnectionCount >= 5, "yes", "no")
| eval SuspicionDetail = "FakeTLS-suspicious-process"
| fields FirstSeen, ComputerName, ImageFileName, RemoteAddressIP4, RemotePort, ConnectionCount, AvgIntervalSeconds, DurationMinutes, BeaconingLikely, SuspicionDetail, CommandLines
| sort(ConnectionCount, order=desc)
// Part 2: Beaconing pattern detection - any non-browser process with regular intervals
// Run separately or union with Part 1
// #event_simpleName=NetworkConnectIP4
// | RemoteAddressIP4 != /^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|127\.)/
// | ImageFileName !=~ /(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|teams\.exe|slack\.exe|zoom\.exe|outlook\.exe|onedrive\.exe|MsMpEng\.exe)/
// | groupBy([ComputerName, ImageFileName, RemoteAddressIP4, RemotePort], function=[
// count(aid, as=ConnectionCount),
// min(@timestamp, as=FirstSeen),
// max(@timestamp, as=LastSeen)
// ])
// | where ConnectionCount >= 5 AND ConnectionCount <= 200
// | eval AvgIntervalSeconds = round((LastSeen - FirstSeen) / 1000 / (ConnectionCount - 1), 1)
// | where AvgIntervalSeconds > 30 AND AvgIntervalSeconds < 3600
// | eval SuspicionDetail = "regular-beaconing-pattern"
// | sort(ConnectionCount, order=desc)CrowdStrike LogScale (Falcon) detection for protocol or service impersonation using NetworkConnectIP4 events from the Falcon sensor. Detects two behavioral patterns: suspicious LOLBin processes connecting to TLS/HTTP ports (FakeTLS pattern) and regular beaconing intervals from non-browser processes. Groups by host, process, and destination to surface repeated outbound connections indicating C2 masquerading as legitimate protocols.
Data Sources
Required Tables
False Positives & Tuning
- Security operations tools like vulnerability scanners or asset discovery agents that run as system processes and probe external infrastructure over HTTPS will match on the suspicious process list — whitelist by device tag or host group in the CrowdStrike console
- Windows-native backup and sync utilities that leverage rundll32.exe or regsvr32.exe to host backup agent DLLs will make periodic HTTPS connections to cloud storage endpoints matching the beaconing threshold — validate against backup software deployment records
- Penetration testing or red team infrastructure on dedicated test systems will intentionally produce this activity — exclude test asset host groups from production alerting policies in Falcon
Other platforms for T1001.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1FakeTLS Simulation: Raw TCP Connection on TLS Port
Expected signal: Sysmon Event ID 3: Network Connection with Image=powershell.exe, DestinationPort=4443, DestinationIp=127.0.0.1. Sysmon Event ID 1: Process Create with powershell.exe and TcpClient in CommandLine. The connection attempt will appear in network logs regardless of whether a listener exists.
- Test 2HTTP Header Manipulation: Cobalt Strike-Style Malleable C2 Simulation
Expected signal: Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:8080. Sysmon Event ID 1: Process Create showing powershell.exe with WebRequest in CommandLine. If proxy logs are available, the manipulated HTTP headers (fake User-Agent, encoded cookie) would be visible. PowerShell ScriptBlock Event ID 4104 captures the full script including the fake headers.
- Test 3DNS-Based Protocol Impersonation: DNS Tunneling Simulation
Expected signal: Sysmon Event ID 22: DNS Query events for each subdomain query (aGVsbG8.c2test.invalid, aG9zdG5hbWU.c2test.invalid, etc.) with Image=powershell.exe. Sysmon Event ID 1: Process Create for powershell.exe. Windows DNS Client event log may also capture the failed DNS resolutions. All queries will return NXDOMAIN.
- Test 4SUNBURST-Style Protocol Mimicry: Fake OIP Traffic Pattern
Expected signal: Sysmon Event ID 3: Three Network Connection events from powershell.exe to 127.0.0.1:8080 with distinct URIs. Sysmon Event ID 1: Process Create for powershell.exe. PowerShell ScriptBlock Event ID 4104: Full script content including OIP-mimicking User-Agent and custom X-Solarwinds-Request header. If a web proxy is in the traffic path, it would log the fake Orion User-Agent from a non-Orion process.
References (13)
- https://attack.mitre.org/techniques/T1001/003/
- https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/
- https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf
- https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
- https://www.mandiant.com/resources/cutting-edge-part-2
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133a
- https://www.novetta.com/2016/02/blockbuster/
- https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
- https://lab52.io/blog/mustang-panda-is-actively-targeting-europe-with-plugx-variants/
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://github.com/activecm/rita
- https://zeek.org/
- https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-hunting-schema-tables
Unlock Pro Content
Get the full detection package for T1001.003 including response playbook, investigation guide, and atomic red team tests.