Detect Protocol or Service Impersonation in Splunk
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By mimicking legitimate protocols or web services, adversaries make their C2 traffic blend in with normal network traffic. Techniques include FakeTLS (malformed TLS handshakes that mimic real TLS but use different encryption), custom HTTP header manipulation, URI endpoint spoofing, SSL certificate impersonation, and mimicking well-known services like Gmail or Google Drive. Real-world examples include Lazarus Group's FakeTLS, Cobalt Strike malleable C2 profiles, SUNBURST's OIP protocol masquerading, and Mustang Panda's PUBLOAD/StarProxy tools.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1001 Data Obfuscation
- Sub-technique
- T1001.003 Protocol or Service Impersonation
- Canonical reference
- https://attack.mitre.org/techniques/T1001/003/
SPL Detection Query
index=* (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3)
NOT (Image IN ("*\\chrome.exe", "*\\firefox.exe", "*\\msedge.exe", "*\\iexplore.exe", "*\\teams.exe", "*\\slack.exe", "*\\zoom.exe", "*\\outlook.exe", "*\\onedrive.exe"))
NOT (DestinationIp IN ("10.*", "172.16.*", "172.17.*", "172.18.*", "172.19.*", "172.20.*", "172.21.*", "172.22.*", "172.23.*", "172.24.*", "172.25.*", "172.26.*", "172.27.*", "172.28.*", "172.29.*", "172.30.*", "172.31.*", "192.168.*", "127.*"))
| eval SuspiciousProcess=if(match(Image, "(svchost\.exe|lsass\.exe|rundll32\.exe|regsvr32\.exe|mshta\.exe|wscript\.exe|cscript\.exe|msbuild\.exe|installutil\.exe|regasm\.exe|regsvcs\.exe|certutil\.exe|bitsadmin\.exe)"), 1, 0)
| eval FakeTLSPort=if(DestinationPort IN ("443", "8443", "4443", "8080", "8888") AND SuspiciousProcess=1, 1, 0)
| eval NonStandardPort=if(NOT DestinationPort IN ("80", "443", "8080", "8443", "25", "465", "587", "53", "123", "636", "389", "3389", "22"), 1, 0)
| eval SmallFixedPayload=if(isnotnull(RequestSizeBytes) AND RequestSizeBytes > 100 AND RequestSizeBytes < 2048, 1, 0)
| stats count as ConnectionCount,
dc(DestinationIp) as UniqueRemoteIPs,
values(DestinationPort) as Ports,
sum(eval(if(isnotnull(RequestSizeBytes), RequestSizeBytes, 0))) as TotalBytesSent,
earliest(_time) as FirstSeen,
latest(_time) as LastSeen,
max(FakeTLSPort) as FakeTLSPortFlag,
max(SuspiciousProcess) as SuspiciousProcessFlag,
max(NonStandardPort) as NonStandardPortFlag
by host, Image, DestinationIp
| where ConnectionCount >= 3
| eval DurationMinutes=round((LastSeen - FirstSeen) / 60, 1)
| eval AvgIntervalSeconds=if(ConnectionCount > 1, round((LastSeen - FirstSeen) / (ConnectionCount - 1), 1), null())
| eval SuspicionScore=FakeTLSPortFlag + SuspiciousProcessFlag + NonStandardPortFlag
| eval BeaconingLikely=if(AvgIntervalSeconds > 30 AND AvgIntervalSeconds < 3600 AND ConnectionCount >= 5, 1, 0)
| eval SuspicionScore=SuspicionScore + BeaconingLikely
| where SuspicionScore >= 1
| eval SuspicionDetail=case(
FakeTLSPortFlag=1 AND SuspiciousProcessFlag=1, "FakeTLS-suspicious-process",
SuspiciousProcessFlag=1 AND BeaconingLikely=1, "suspicious-process-beaconing",
BeaconingLikely=1, "regular-beaconing-pattern",
FakeTLSPortFlag=1, "TLS-port-non-browser",
true(), "anomalous-outbound"
)
| table FirstSeen, host, Image, DestinationIp, Ports, ConnectionCount, UniqueRemoteIPs, TotalBytesSent, AvgIntervalSeconds, DurationMinutes, SuspicionScore, SuspicionDetail
| sort - SuspicionScore, - ConnectionCountDetects protocol impersonation C2 patterns using Sysmon Event ID 3 (Network Connection) logs. Identifies suspicious processes making connections to TLS ports (FakeTLS indicators), non-browser processes connecting to known service ports, statistical beaconing patterns based on connection frequency, and non-standard port usage. Assigns a suspicion score to help analysts prioritize. Covers patterns associated with Cobalt Strike malleable C2, Lazarus Group FakeTLS, Mustang Panda PUBLOAD, and similar threats.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate monitoring agents (Datadog, SolarWinds, Nagios) that beacon regularly to their management servers
- Application performance monitoring tools making regular HTTP health checks from svchost-hosted services
- Custom internal applications using non-standard TLS ports for internal API communications
- Software update mechanisms making regular check-in connections (Java, Adobe, corporate patching agents)
Other platforms for T1001.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1FakeTLS Simulation: Raw TCP Connection on TLS Port
Expected signal: Sysmon Event ID 3: Network Connection with Image=powershell.exe, DestinationPort=4443, DestinationIp=127.0.0.1. Sysmon Event ID 1: Process Create with powershell.exe and TcpClient in CommandLine. The connection attempt will appear in network logs regardless of whether a listener exists.
- Test 2HTTP Header Manipulation: Cobalt Strike-Style Malleable C2 Simulation
Expected signal: Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:8080. Sysmon Event ID 1: Process Create showing powershell.exe with WebRequest in CommandLine. If proxy logs are available, the manipulated HTTP headers (fake User-Agent, encoded cookie) would be visible. PowerShell ScriptBlock Event ID 4104 captures the full script including the fake headers.
- Test 3DNS-Based Protocol Impersonation: DNS Tunneling Simulation
Expected signal: Sysmon Event ID 22: DNS Query events for each subdomain query (aGVsbG8.c2test.invalid, aG9zdG5hbWU.c2test.invalid, etc.) with Image=powershell.exe. Sysmon Event ID 1: Process Create for powershell.exe. Windows DNS Client event log may also capture the failed DNS resolutions. All queries will return NXDOMAIN.
- Test 4SUNBURST-Style Protocol Mimicry: Fake OIP Traffic Pattern
Expected signal: Sysmon Event ID 3: Three Network Connection events from powershell.exe to 127.0.0.1:8080 with distinct URIs. Sysmon Event ID 1: Process Create for powershell.exe. PowerShell ScriptBlock Event ID 4104: Full script content including OIP-mimicking User-Agent and custom X-Solarwinds-Request header. If a web proxy is in the traffic path, it would log the fake Orion User-Agent from a non-Orion process.
References (13)
- https://attack.mitre.org/techniques/T1001/003/
- https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/
- https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf
- https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
- https://www.mandiant.com/resources/cutting-edge-part-2
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133a
- https://www.novetta.com/2016/02/blockbuster/
- https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
- https://lab52.io/blog/mustang-panda-is-actively-targeting-europe-with-plugx-variants/
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://github.com/activecm/rita
- https://zeek.org/
- https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-hunting-schema-tables
Unlock Pro Content
Get the full detection package for T1001.003 including response playbook, investigation guide, and atomic red team tests.