Detect Server in CrowdStrike LogScale
Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in Drive-by Compromise, enabling Phishing operations, or facilitating Command and Control. Instead of compromising a third-party server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused. Real-world examples include GALLIUM operating Taiwan-based exclusive servers, Kimsuky purchasing hosting servers with virtual currency and prepaid cards, Sandworm Team leasing servers through resellers to obscure attribution, Earth Lusca acquiring multiple servers with distinct roles per operation, Mustard Tempest hosting second-stage SocGholish payloads on short-lived acquired servers, and CURIUM creating dedicated servers for C2 and exfiltration. Because the adversary action of acquiring the server occurs entirely outside the target environment, detection must focus on identifying the operational use of adversary-controlled server infrastructure: C2 beaconing patterns, connections to known malicious hosting infrastructure, and suspicious DNS resolution to adversary-controlled domains.
MITRE ATT&CK
- Tactic
- Resource Development
- Technique
- T1583 Acquire Infrastructure
- Sub-technique
- T1583.004 Server
- Canonical reference
- https://attack.mitre.org/techniques/T1583/004/
LogScale Detection Query
#event_simpleName=NetworkConnectIP4
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8"])
| !regex("(?i)(msedge|chrome|firefox|iexplore|opera|brave|outlook|msteams|slack|zoom|onedrive|msedgewebview2)\\.exe", field=ImageFileName)
| IsSuspiciousProcess := if(regex("(?i)(powershell|pwsh|cmd|wscript|cscript|rundll32|regsvr32|mshta|certutil|bitsadmin|curl|wget|msiexec|wmic|msbuild|csc)\\.exe", ImageFileName), 1, 0)
| HourBucket := formatTime("%Y-%m-%d %H:00:00", field=@timestamp, timezone="UTC")
| groupBy([ComputerName, ImageFileName, RemoteAddressIP4, RemotePort, IsSuspiciousProcess, HourBucket],
function=count(as=HourlyConnections))
| groupBy([ComputerName, ImageFileName, RemoteAddressIP4, RemotePort, IsSuspiciousProcess],
function=[
sum(HourlyConnections, as=TotalConnections),
count(as=HoursActive),
avg(HourlyConnections, as=AvgPerHour),
stddev(HourlyConnections, as=StdDevConnections),
min(HourBucket, as=FirstSeen),
max(HourBucket, as=LastSeen)
])
| TotalConnections >= 10
| HoursActive >= 2
| ConsistencyRatio := StdDevConnections / AvgPerHour
| IsBeaconPattern := if(ConsistencyRatio < 0.5 and AvgPerHour >= 0.5, 1, 0)
| RiskScore := IsSuspiciousProcess + IsBeaconPattern + if(TotalConnections > 50, 1, 0)
| RiskScore >= 1
| sort(RiskScore, order=desc, limit=1000)
| select([ComputerName, ImageFileName, RemoteAddressIP4, RemotePort,
TotalConnections, HoursActive, AvgPerHour, ConsistencyRatio,
IsSuspiciousProcess, IsBeaconPattern, RiskScore, FirstSeen, LastSeen])CrowdStrike LogScale detection for C2 beaconing to adversary-controlled server infrastructure using Falcon NetworkConnectIP4 telemetry. Applies a two-pass hourly aggregation pipeline to compute connection consistency metrics: a coefficient of variation (StdDev divided by Avg) below 0.5 across two or more active hours with ten or more total connections is the statistical signature of automated beaconing versus human-driven activity. Findings are scored by LOLBin or scripting process presence and beacon regularity to prioritize analyst triage.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon sensor itself or other EDR agents making regular telemetry callbacks to Falcon cloud infrastructure that falls outside the CIDR exclusion ranges
- PowerShell-based administrative automation such as DSC configurations or custom runbooks polling external management APIs on regular intervals from server hosts
- Automated build or deployment pipelines invoking curl or msiexec to retrieve artifacts from external repositories at consistent scheduled intervals
Other platforms for T1583.004
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate C2 Beacon Check-in with Regular Interval Callback
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with the above CommandLine. Sysmon Event ID 3: Five Network Connection events to 127.0.0.1:8888 at approximately 30-second intervals from powershell.exe. If targeting a real test server: firewall and proxy logs showing repeated outbound connections from powershell.exe to the test server IP at regular intervals. Windows PowerShell ScriptBlock Log Event ID 4104 capturing the Invoke-WebRequest command.
- Test 2DNS Query Pattern Consistent with Adversary-Controlled Server Domain
Expected signal: Sysmon Event ID 22: DNS Query events for each of the five domains, showing QueryName, QueryStatus (most will return NXDOMAIN or error since these are test domains), and the querying process image path (powershell.exe). Windows DNS Client Operational log (Microsoft-Windows-DNS-Client/Operational Event ID 3008) may additionally capture failed lookup events.
- Test 3Outbound Connection to Non-Standard C2 Ports from LOLBin
Expected signal: Sysmon Event ID 3: Network connection attempt events from powershell.exe to 127.0.0.1 on ports 4444, 8080, and 8443. Note: Sysmon typically logs connection attempts even when the connection is refused (no listener). Sysmon Event ID 1: Process Create for the powershell.exe instance. For testing with a real server running nc -lvp 4444 or similar: successful connection events with DestinationIp and DestinationPort fields populated.
- Test 4Scheduled Task Persistence Simulating C2 Callback Persistence Mechanism
Expected signal: Security Event ID 4698: A scheduled task was created — captures task name (WindowsNetworkHealth), task content, and creating user. Sysmon Event ID 1: Process Create for schtasks.exe with the /Create parameters. When the task executes: Sysmon Event ID 1 for powershell.exe spawned by svchost.exe (Task Scheduler service) with parent command line referencing taskhost/taskhostw, carrying the -NoProfile -WindowStyle Hidden flags. Sysmon Event ID 3: Network connection from task-spawned powershell.exe to 127.0.0.1:8888.
References (10)
- https://attack.mitre.org/techniques/T1583/004/
- https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2
- https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/
- https://threatconnect.com/blog/infrastructure-research-hunting/
- https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/
- https://sysdig.com/blog/googles-vertex-ai-platform-freejacked/
- https://www.microsoft.com/en-us/security/blog/2019/12/12/gallium-targeting-global-telecom/
- https://www.sentinelone.com/labs/socgholish-campaigns-and-initial-access-kit/
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc.html
- https://www.trendmicro.com/en_us/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-an.html
Unlock Pro Content
Get the full detection package for T1583.004 including response playbook, investigation guide, and atomic red team tests.