Detect Server in Google Chronicle
Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in Drive-by Compromise, enabling Phishing operations, or facilitating Command and Control. Instead of compromising a third-party server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused. Real-world examples include GALLIUM operating Taiwan-based exclusive servers, Kimsuky purchasing hosting servers with virtual currency and prepaid cards, Sandworm Team leasing servers through resellers to obscure attribution, Earth Lusca acquiring multiple servers with distinct roles per operation, Mustard Tempest hosting second-stage SocGholish payloads on short-lived acquired servers, and CURIUM creating dedicated servers for C2 and exfiltration. Because the adversary action of acquiring the server occurs entirely outside the target environment, detection must focus on identifying the operational use of adversary-controlled server infrastructure: C2 beaconing patterns, connections to known malicious hosting infrastructure, and suspicious DNS resolution to adversary-controlled domains.
MITRE ATT&CK
- Tactic
- Resource Development
- Technique
- T1583 Acquire Infrastructure
- Sub-technique
- T1583.004 Server
- Canonical reference
- https://attack.mitre.org/techniques/T1583/004/
YARA-L Detection Query
rule t1583_004_c2_beaconing_adversary_server {
meta:
author = "Detection Engineering"
description = "Detects C2 beaconing to adversary-controlled server infrastructure - T1583.004"
mitre_attack_tactic = "Resource Development"
mitre_attack_technique = "T1583.004"
severity = "HIGH"
confidence = "MEDIUM"
reference = "https://attack.mitre.org/techniques/T1583/004/"
events:
$e.metadata.event_type = "NETWORK_CONNECTION"
$e.network.direction = "OUTBOUND"
not re.regex($e.target.ip,
`^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|::1$|fe80:)`)
not re.regex($e.target.hostname,
`(?i)(microsoft\.com|windows\.com|windowsupdate\.com|office\.com|live\.com|azure\.com|microsoftonline\.com|office365\.com|akamaiedge\.net|akamaitechnologies\.com|cloudflare\.com|cloudflare-dns\.com|amazonaws\.com|googleapis\.com|apple\.com|icloud\.com|digicert\.com|verisign\.com)$`)
not re.regex($e.principal.process.file.full_path,
`(?i)(msedge\.exe|chrome\.exe|firefox\.exe|iexplore\.exe|opera\.exe|brave\.exe|outlook\.exe|teams\.exe|slack\.exe|zoom\.exe|onedrive\.exe|msedgewebview2\.exe|microsoftedgecp\.exe)$`)
re.regex($e.principal.process.file.full_path,
`(?i)(powershell\.exe|pwsh\.exe|cmd\.exe|wscript\.exe|cscript\.exe|rundll32\.exe|regsvr32\.exe|mshta\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe|msiexec\.exe|odbcconf\.exe|wmic\.exe|msbuild\.exe|csc\.exe)$`)
$host = $e.principal.hostname
$dst_ip = $e.target.ip
$proc = $e.principal.process.file.full_path
match:
$host, $dst_ip, $proc over 24h
condition:
#e >= 10
}Chronicle YARA-L 2.0 rule detecting C2 beaconing patterns to adversary-controlled server infrastructure. Monitors outbound NETWORK_CONNECTION UDM events exclusively from LOLBin and scripting engine processes to public IP space, excluding known CDN and cloud hosting domains. The 24-hour match window requiring a minimum of 10 events per unique host, destination IP, and process triple identifies the repeated-contact pattern characteristic of C2 agents communicating with adversary-operated servers (T1583.004). Restricting to known-suspicious process names reduces volume while maintaining high-fidelity coverage.
Data Sources
Required Tables
False Positives & Tuning
- LOLBin-based administrative tooling such as PowerShell monitoring scripts or certutil used for certificate operations making regular connections to partner or vendor systems that resolve to public IPs not covered by the exclusion regex
- Software distribution tools invoking msiexec or similar LOLBins to download packages from vendor servers that do not use well-known CDN domains
- Developer automation tools such as curl or wget invoked by scheduled tasks to poll external package registries or APIs at regular intervals
Other platforms for T1583.004
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate C2 Beacon Check-in with Regular Interval Callback
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with the above CommandLine. Sysmon Event ID 3: Five Network Connection events to 127.0.0.1:8888 at approximately 30-second intervals from powershell.exe. If targeting a real test server: firewall and proxy logs showing repeated outbound connections from powershell.exe to the test server IP at regular intervals. Windows PowerShell ScriptBlock Log Event ID 4104 capturing the Invoke-WebRequest command.
- Test 2DNS Query Pattern Consistent with Adversary-Controlled Server Domain
Expected signal: Sysmon Event ID 22: DNS Query events for each of the five domains, showing QueryName, QueryStatus (most will return NXDOMAIN or error since these are test domains), and the querying process image path (powershell.exe). Windows DNS Client Operational log (Microsoft-Windows-DNS-Client/Operational Event ID 3008) may additionally capture failed lookup events.
- Test 3Outbound Connection to Non-Standard C2 Ports from LOLBin
Expected signal: Sysmon Event ID 3: Network connection attempt events from powershell.exe to 127.0.0.1 on ports 4444, 8080, and 8443. Note: Sysmon typically logs connection attempts even when the connection is refused (no listener). Sysmon Event ID 1: Process Create for the powershell.exe instance. For testing with a real server running nc -lvp 4444 or similar: successful connection events with DestinationIp and DestinationPort fields populated.
- Test 4Scheduled Task Persistence Simulating C2 Callback Persistence Mechanism
Expected signal: Security Event ID 4698: A scheduled task was created — captures task name (WindowsNetworkHealth), task content, and creating user. Sysmon Event ID 1: Process Create for schtasks.exe with the /Create parameters. When the task executes: Sysmon Event ID 1 for powershell.exe spawned by svchost.exe (Task Scheduler service) with parent command line referencing taskhost/taskhostw, carrying the -NoProfile -WindowStyle Hidden flags. Sysmon Event ID 3: Network connection from task-spawned powershell.exe to 127.0.0.1:8888.
References (10)
- https://attack.mitre.org/techniques/T1583/004/
- https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2
- https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/
- https://threatconnect.com/blog/infrastructure-research-hunting/
- https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/
- https://sysdig.com/blog/googles-vertex-ai-platform-freejacked/
- https://www.microsoft.com/en-us/security/blog/2019/12/12/gallium-targeting-global-telecom/
- https://www.sentinelone.com/labs/socgholish-campaigns-and-initial-access-kit/
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc.html
- https://www.trendmicro.com/en_us/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-an.html
Unlock Pro Content
Get the full detection package for T1583.004 including response playbook, investigation guide, and atomic red team tests.