[Snort-sigs] Osx.Trojan.Xagent

Y M snort at ...3751...
Mon Feb 27 12:54:01 EST 2017


Hello,


After trying multiple combinations, the below set of rules were the most efficient among all the combinations I had when profiled. Pcap is available.


The rules are divided into two sets. The first is a catch-all regardless of the URL. The second set is tailored according to each URL. In either sets, the rules should catch (I think) both GET and POST requests; the resulting pcap did not contain any POST requests.


First Set:


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Xagent outbound connection"; flow:to_server,established; content:"/?"; fast_pattern:only; http_uri; content:" (unknown version) "; http_header; content:" Darwin/"; within:30; http_header; content:"Accept|3A 20|*/*|0D 0A|"; http_header; content:"Connection|3A 20|keep-alive|0D 0A|"; http_header; pcre:"/\/(search|find|results|open|search|close|watch)\/\x3f[a-zA-Z]{2,8}\x3d/U"; content:!"Referer"; http_header; content:!"Cookie"; http_header; metadata:ruleset community, service http; reference:url,http://contagiodump.blogspot.com/2017/02/russian-apt-apt28-collection-of-samples.html; reference:url,download.bitdefender.com/resources/files/News/CaseStudies/study/143/Bitdefender-Whitepaper-APT-Mac-A4-en-EN-web.pdf; classtype:trojan-activity; sid:1000860; rev:1;)


Or, the second Set:


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Xagent outbound connection"; flow:to_server,established; content:"/search/?"; fast_pattern:only; http_uri; content:" (unknown version) "; http_header; content:" Darwin/"; within:30; http_header; content:"Accept|3A 20|*/*|0D 0A|"; http_header; content:"Connection|3A 20|keep-alive|0D 0A|"; http_header; pcre:"/\/search\/\x3f[a-zA-Z]{2,8}\x3d/U"; content:!"Referer"; http_header; content:!"Cookie"; http_header; metadata:ruleset community, service http; reference:url,http://contagiodump.blogspot.com/2017/02/russian-apt-apt28-collection-of-samples.html; reference:url,download.bitdefender.com/resources/files/News/CaseStudies/study/143/Bitdefender-Whitepaper-APT-Mac-A4-en-EN-web.pdf; classtype:trojan-activity; sid:1000861; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Xagent outbound connection"; flow:to_server,established; content:"/watch/?"; fast_pattern:only; http_uri; content:" (unknown version) "; http_header; content:" Darwin/"; within:30; http_header; content:"Accept|3A 20|*/*|0D 0A|"; http_header; content:"Connection|3A 20|keep-alive|0D 0A|"; http_header; pcre:"/\/watch\/\x3f[a-zA-Z]{2,8}\x3d/U"; content:!"Referer"; http_header; content:!"Cookie"; http_header; metadata:ruleset community, service http; reference:url,http://contagiodump.blogspot.com/2017/02/russian-apt-apt28-collection-of-samples.html; reference:url,download.bitdefender.com/resources/files/News/CaseStudies/study/143/Bitdefender-Whitepaper-APT-Mac-A4-en-EN-web.pdf; classtype:trojan-activity; sid:1000862; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Xagent outbound connection"; flow:to_server,established; content:"/open/?"; fast_pattern:only; http_uri; content:" (unknown version) "; http_header; content:" Darwin/"; within:30; http_header; content:"Accept|3A 20|*/*|0D 0A|"; http_header; content:"Connection|3A 20|keep-alive|0D 0A|"; http_header; pcre:"/\/open\/\x3f[a-zA-Z]{2,8}\x3d/U"; content:!"Referer"; http_header; content:!"Cookie"; http_header; metadata:ruleset community, service http; reference:url,http://contagiodump.blogspot.com/2017/02/russian-apt-apt28-collection-of-samples.html; reference:url,download.bitdefender.com/resources/files/News/CaseStudies/study/143/Bitdefender-Whitepaper-APT-Mac-A4-en-EN-web.pdf; classtype:trojan-activity; sid:1000863; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Xagent outbound connection"; flow:to_server,established; content:"/find/?"; fast_pattern:only; http_uri; content:" (unknown version) "; http_header; content:" Darwin/"; within:30; http_header; content:"Accept|3A 20|*/*|0D 0A|"; http_header; content:"Connection|3A 20|keep-alive|0D 0A|"; http_header; pcre:"/\/find\/\x3f[a-zA-Z]{2,8}\x3d/U"; content:!"Referer"; http_header; content:!"Cookie"; http_header; metadata:ruleset community, service http; reference:url,http://contagiodump.blogspot.com/2017/02/russian-apt-apt28-collection-of-samples.html; reference:url,download.bitdefender.com/resources/files/News/CaseStudies/study/143/Bitdefender-Whitepaper-APT-Mac-A4-en-EN-web.pdf; classtype:trojan-activity; sid:1000864; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Xagent outbound connection"; flow:to_server,established; content:"/results/?"; fast_pattern:only; http_uri; content:" (unknown version) "; http_header; content:" Darwin/"; within:30; http_header; content:"Accept|3A 20|*/*|0D 0A|"; http_header; content:"Connection|3A 20|keep-alive|0D 0A|"; http_header; pcre:"/\/results\/\x3f[a-zA-Z]{2,8}\x3d/U"; content:!"Referer"; http_header; content:!"Cookie"; http_header; metadata:ruleset community, service http; reference:url,http://contagiodump.blogspot.com/2017/02/russian-apt-apt28-collection-of-samples.html; reference:url,download.bitdefender.com/resources/files/News/CaseStudies/study/143/Bitdefender-Whitepaper-APT-Mac-A4-en-EN-web.pdf; classtype:trojan-activity; sid:1000865; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Xagent outbound connection"; flow:to_server,established; content:"/close/?"; fast_pattern:only; http_uri; content:" (unknown version) "; http_header; content:" Darwin/"; within:30; http_header; content:"Accept|3A 20|*/*|0D 0A|"; http_header; content:"Connection|3A 20|keep-alive|0D 0A|"; http_header; pcre:"/\/close\/\x3f[a-zA-Z]{2,8}\x3d/U"; content:!"Referer"; http_header; content:!"Cookie"; http_header; metadata:ruleset community, service http; reference:url,download.bitdefender.com/resources/files/News/CaseStudies/study/143/Bitdefender-Whitepaper-APT-Mac-A4-en-EN-web.pdf; classtype:trojan-activity; sid:1000866; rev:1;)


Thank you.

YM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20170227/e1ea2d5c/attachment.html>


More information about the Snort-sigs mailing list