Detect Server in Sumo Logic CSE
Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in Drive-by Compromise, enabling Phishing operations, or facilitating Command and Control. Instead of compromising a third-party server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused. Real-world examples include GALLIUM operating Taiwan-based exclusive servers, Kimsuky purchasing hosting servers with virtual currency and prepaid cards, Sandworm Team leasing servers through resellers to obscure attribution, Earth Lusca acquiring multiple servers with distinct roles per operation, Mustard Tempest hosting second-stage SocGholish payloads on short-lived acquired servers, and CURIUM creating dedicated servers for C2 and exfiltration. Because the adversary action of acquiring the server occurs entirely outside the target environment, detection must focus on identifying the operational use of adversary-controlled server infrastructure: C2 beaconing patterns, connections to known malicious hosting infrastructure, and suspicious DNS resolution to adversary-controlled domains.
MITRE ATT&CK
- Tactic
- Resource Development
- Technique
- T1583 Acquire Infrastructure
- Sub-technique
- T1583.004 Server
- Canonical reference
- https://attack.mitre.org/techniques/T1583/004/
Sumo Detection Query
_index=sec_record_network
| where !(dstDevice_ip matches "10.*"
OR dstDevice_ip matches "172.16.*" OR dstDevice_ip matches "172.17.*"
OR dstDevice_ip matches "172.18.*" OR dstDevice_ip matches "172.19.*"
OR dstDevice_ip matches "172.20.*" OR dstDevice_ip matches "172.21.*"
OR dstDevice_ip matches "172.22.*" OR dstDevice_ip matches "172.23.*"
OR dstDevice_ip matches "172.24.*" OR dstDevice_ip matches "172.25.*"
OR dstDevice_ip matches "172.26.*" OR dstDevice_ip matches "172.27.*"
OR dstDevice_ip matches "172.28.*" OR dstDevice_ip matches "172.29.*"
OR dstDevice_ip matches "172.30.*" OR dstDevice_ip matches "172.31.*"
OR dstDevice_ip matches "192.168.*" OR dstDevice_ip matches "127.*")
| where !(dstDevice_hostname matches "*microsoft.com"
OR dstDevice_hostname matches "*windows.com"
OR dstDevice_hostname matches "*windowsupdate.com"
OR dstDevice_hostname matches "*office.com"
OR dstDevice_hostname matches "*live.com"
OR dstDevice_hostname matches "*azure.com"
OR dstDevice_hostname matches "*microsoftonline.com"
OR dstDevice_hostname matches "*office365.com"
OR dstDevice_hostname matches "*akamai*"
OR dstDevice_hostname matches "*cloudflare.com"
OR dstDevice_hostname matches "*amazonaws.com"
OR dstDevice_hostname matches "*googleapis.com"
OR dstDevice_hostname matches "*digicert.com"
OR dstDevice_hostname matches "*verisign.com")
| where !(application matches "*msedge.exe" OR application matches "*chrome.exe"
OR application matches "*firefox.exe" OR application matches "*iexplore.exe"
OR application matches "*opera.exe" OR application matches "*brave.exe"
OR application matches "*outlook.exe" OR application matches "*teams.exe"
OR application matches "*slack.exe" OR application matches "*zoom.exe"
OR application matches "*onedrive.exe" OR application matches "*msedgewebview2.exe")
| timeslice 1h
| stats count as HourlyConnections, values(dstPort) as Ports
by srcDevice_hostname, application, dstDevice_ip, dstDevice_hostname, _timeslice
| stats
sum(HourlyConnections) as TotalConnections,
count as HoursActive,
avg(HourlyConnections) as AvgPerHour,
stddev(HourlyConnections) as StdDevPerHour,
values(Ports) as Ports,
min(_timeslice) as FirstSeen,
max(_timeslice) as LastSeen
by srcDevice_hostname, application, dstDevice_ip, dstDevice_hostname
| where TotalConnections >= 10 and HoursActive >= 2
| eval ConsistencyRatio = if(AvgPerHour > 0, StdDevPerHour / AvgPerHour, 99)
| eval IsSuspiciousProcess = if(application matches /(?i)(powershell|pwsh|cmd|wscript|cscript|rundll32|regsvr32|mshta|certutil|bitsadmin|curl|wget|msiexec|wmic|msbuild|csc)\.exe/, 1, 0)
| eval IsBeaconPattern = if(ConsistencyRatio < 0.5 and AvgPerHour >= 0.5, 1, 0)
| eval RiskScore = IsSuspiciousProcess + IsBeaconPattern + if(TotalConnections > 50, 1, 0)
| where RiskScore >= 1
| sort by RiskScore desc, TotalConnections desc
| fields srcDevice_hostname, application, dstDevice_ip, dstDevice_hostname, TotalConnections, HoursActive, AvgPerHour, ConsistencyRatio, Ports, FirstSeen, LastSeen, IsSuspiciousProcess, IsBeaconPattern, RiskScoreDetects C2 beaconing to adversary-controlled server infrastructure using Sumo Logic Cloud SIEM normalized network records. Applies hourly bucketing to measure connection consistency: a low coefficient of variation (StdDev/Avg below 0.5) across multiple hours with 10 or more total connections indicates machine-driven automated beaconing versus human-driven browsing. Scores findings by process suspicion (LOLBins and scripting engines) and beacon pattern regularity for analyst triage prioritization.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise endpoint agents such as EDR sensors, SIEM forwarders, and IT management tools with consistent polling intervals connecting to cloud infrastructure not covered by the domain exclusion list
- Custom business applications making regular REST API calls to external SaaS services where the destination domain is not a well-known CDN or major cloud provider
- Developer workstations running automation scripts or CI/CD pipelines that repeatedly contact external build or artifact repositories at consistent intervals
Other platforms for T1583.004
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate C2 Beacon Check-in with Regular Interval Callback
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with the above CommandLine. Sysmon Event ID 3: Five Network Connection events to 127.0.0.1:8888 at approximately 30-second intervals from powershell.exe. If targeting a real test server: firewall and proxy logs showing repeated outbound connections from powershell.exe to the test server IP at regular intervals. Windows PowerShell ScriptBlock Log Event ID 4104 capturing the Invoke-WebRequest command.
- Test 2DNS Query Pattern Consistent with Adversary-Controlled Server Domain
Expected signal: Sysmon Event ID 22: DNS Query events for each of the five domains, showing QueryName, QueryStatus (most will return NXDOMAIN or error since these are test domains), and the querying process image path (powershell.exe). Windows DNS Client Operational log (Microsoft-Windows-DNS-Client/Operational Event ID 3008) may additionally capture failed lookup events.
- Test 3Outbound Connection to Non-Standard C2 Ports from LOLBin
Expected signal: Sysmon Event ID 3: Network connection attempt events from powershell.exe to 127.0.0.1 on ports 4444, 8080, and 8443. Note: Sysmon typically logs connection attempts even when the connection is refused (no listener). Sysmon Event ID 1: Process Create for the powershell.exe instance. For testing with a real server running nc -lvp 4444 or similar: successful connection events with DestinationIp and DestinationPort fields populated.
- Test 4Scheduled Task Persistence Simulating C2 Callback Persistence Mechanism
Expected signal: Security Event ID 4698: A scheduled task was created — captures task name (WindowsNetworkHealth), task content, and creating user. Sysmon Event ID 1: Process Create for schtasks.exe with the /Create parameters. When the task executes: Sysmon Event ID 1 for powershell.exe spawned by svchost.exe (Task Scheduler service) with parent command line referencing taskhost/taskhostw, carrying the -NoProfile -WindowStyle Hidden flags. Sysmon Event ID 3: Network connection from task-spawned powershell.exe to 127.0.0.1:8888.
References (10)
- https://attack.mitre.org/techniques/T1583/004/
- https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2
- https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/
- https://threatconnect.com/blog/infrastructure-research-hunting/
- https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/
- https://sysdig.com/blog/googles-vertex-ai-platform-freejacked/
- https://www.microsoft.com/en-us/security/blog/2019/12/12/gallium-targeting-global-telecom/
- https://www.sentinelone.com/labs/socgholish-campaigns-and-initial-access-kit/
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc.html
- https://www.trendmicro.com/en_us/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-an.html
Unlock Pro Content
Get the full detection package for T1583.004 including response playbook, investigation guide, and atomic red team tests.