Thread by @Kostastsale

Many security teams scrutinize inbound connections, but they tend to overlook traffic leaving the network. Here are a couple of things I consider when #Threat_hunting for ExMatter or similar tools: 🧵👇

1⃣Create your baseline:
It is difficult to find anomalous activity if...

https://twitter.com/1ZRR4H/status/1655014346307559428

...you don't know what normal looks like.
🔹Gather historical network data of outbound connections. The longer the baseline, the better the results.

....⤵️

2⃣Initial Analysis
🔹Query for outbound connections towards protocols that are used for transferring files and data over a network, e.g. SSH, FTP, TELNET, SFTP etc.
🔹Filter out expected traffic with the help of your baseline.
🔹Checkout the most & least frequent conn occurrence

❓Questions to Consider While Analyzing Suspicious Connections❓

🔹Is that server part of our business daily operations?
🔹What was the date and time of the initial connection (conn attempt)?
🔹How long did the session last?
🔹What was the bytes sent/received ratio?

....⤵️

🔹Is the traffic encrypted or decrypted?(depends on the protocol) Can I see the content?(If you can get PCAPs, you're awesome😅)

If the low-hanging fruit from the initial analysis didn't provide any wins, we gotta try harder.

3⃣Trying Harder Analysis

....⤵️

🔹Let's go back to the baseline data. After figuring out the metrics you want to include in your analysis, sort the data based on that. Such metrics could be:

- Top Destinations
- Top Sources
- Average Session Duration
- Average Data Sent/Received

Choosing what data you....⤵️

...want to concentrate should match the intent of your threat hunt. (Are you looking for data exfil or reverse proxy using SSH?)

🔹Establish the average for each metric and assign
a threshold for each, focusing on the outbound connections that exceed this threshold.

🔹You can now start looking into spikes based on the average number of your chosen metrics and their assigned max threshold.
🔹At this point, creating visualizations can help you quickly identify suspicious activities and generate investigation leads....

...You can use your favourite tool to create an overlay chart based on your baseline and your collected data.

The above was an insight into what goes through my head when I hunt for suspicious outbound traffic. It is not complete, just rough notes.....⤵️

...I might follow up with a blog when I find the time 😊 There are many threat-hunting avenues one could take with outbound connections as your main data point.

I made this thread to give you an idea of what you can do to combat tools such as ExMatter. I hope this was helpful!