Phishing Alert Incident Response
Linux commands used in this demo.
- ngrep
- file
Because employees are the most vulnerable targets for an organization, giving attackers the ability to compromise their targets by preying on human weakness like emotions. For this reason, adversaries plan their assaults intelligently by using phishing attacks.
In this demo, we will tackle about how to respond to a phishing incident.
Scenario: You are tasked to examine the network log of an endpoint that may have fallen victim to a phishing attack.
To do this, execute these Linux’s “ngrep” script: ngrep -l <pcap_file> -q -Wbyline “^GET|POST^”
By executing this command, we now see an exchange of traffic from these IP addresses using non-standard and insecure ports.
“10.8.19.101:49738 <-> 185.244.41.29:80“
Next, we can perform threat intelligence by using the details extracted from above command.
Now, we can see the IP “185.244.41.29” was flagged by 4/94 AV Vendor as malicious.
To do this, execute these Linux’s “ngrep” script: ngrep -l <pcap_file> -q -Wbyline “HTTP” | more
Key Points to Know Here:
- GET /ooiwy.pdf
- File with .pdf extension will have magic bytes “%PDF” instead we see MZ (Portable Executable)
- Hard coded User Agent: Ghost
Now, we know that we are up to something.
If you are more comfortable performing investigation in a graphical interface, we can use a tool like Wireshark.
Note: If you are not yet familiar with this tool, please visit this Wireshark Tutorial. Click Me!
To do this, first open Wireshark and filter using: ip.src == 185.244.41.29
#tip: Another approach is go to Statistics > Protocol Hierarchy > HTTP
Then, follow the HTTP Stream.
In our case, we can see similar “MZ DOS” result from running ngrep.
If you can recall from the previous steps, we see a .pdf file with MZ DOS (PE Executable).
Now, our task is to dump that object to disk.
To do this, first go to File > Export Object as HTTP > Save
The “oowiy.pdf” that the user downloaded is dumped to disk.
We can now perform profiling of this object. To do this, we can run the “file” command.
Now, we can see oowiy.pdf:PE32 Executable, it means this is not a legitimate .PDF file.
Next, for the sake of this demo we submit the sample to VirusTotal[.]com for heuristic scanning.
In our case, we can see that 44/66 AV flagged this as malicious and some AV vendors detect is as Ryuk malware.
During a phishing incident, an analyst must be able to investigate an endpoint’s network traffic. Timing is crucial during this incident and being able to respond quickly and in a systematic way can be beneficial for the analyst and the organization.
In real world scenario, email attachments may contain sensitive information and sending the file to online scanner tool is not recommended for it will expose this information to other researchers or even adversaries.
