Investigation réseau — SOC

# Beaconing via transaction — connexions régulières vers même dest
index=network earliest=-24h dest_ip="{{EXTERNAL_IP}}"
| transaction src_ip dest_ip maxpause=10m
| eval interval=duration/eventcount
| where eventcount > 20 AND interval < 300
| stats stdev(interval) as jitter, avg(interval) as avg_interval, count
  by src_ip, dest_ip, dest_port
| where jitter < 10
| sort jitter

# Beaconing timechart — régularité des connexions
index=network src_ip="{{SUSPICIOUS_IP}}" dest_ip="{{EXTERNAL_IP}}" earliest=-6h
| timechart span=5m count as connections
| stats stdev(connections) as regularity_score
# Faible stdev → connexions très régulières → probable beacon

# Top destinations suspectes par régularité
index=network earliest=-24h action=allowed
  NOT (dest_ip IN ("{{CDN_RANGES}}"))
  dest_ip!="10.*" dest_ip!="172.16.*" dest_ip!="192.168.*"
| bucket _time span=1h
| stats count by src_ip, dest_ip, dest_port, _time
| stats stdev(count) as regularity, avg(count) as avg_hourly, dc(_time) as hours_active
  by src_ip, dest_ip, dest_port
| where hours_active > 12 AND regularity < 2
| sort regularity

# DNS — Volume élevé vers même domaine parent (tunneling)
index=dns earliest=-2h query_type IN ("A", "TXT", "NULL", "CNAME")
| rex field=query "(?:[^.]+\.)+(?P<parent_domain>[^.]+\.[^.]+)$"
| stats
    count as total_queries,
    dc(query) as unique_subdomains,
    avg(eval(len(query))) as avg_query_len
  by src_ip, parent_domain
| where unique_subdomains > 50 OR avg_query_len > 50
| sort -unique_subdomains

# DNS — Entropie des sous-domaines (ioc_entropy lookup ou calcul)
index=dns earliest=-1h
| rex field=query "^(?P<subdomain>[^.]+)\."
| eval entropy=0
| eval chars=split(subdomain, "")
| eval entropy=mvsum(eval(-log(1/mvcount(chars))/log(2)))
# Approximation — utiliser un lookup pré-calculé en prod
| where len(subdomain) > 30
| table _time, src_ip, query, subdomain, len(subdomain)

# DNS — Requêtes TXT suspectes (souvent utilisées pour C2)
index=dns query_type=TXT earliest=-24h
  NOT (query IN ("*.spf*", "*.dkim*", "*.dmarc*"))
| stats count by src_ip, query, query_type
| sort -count

# Elastic — DNS tunneling indicators
dns.question.type: ("TXT" or "NULL") 
  and not dns.question.name: ("_dmarc.*" or "_domainkey.*")
# Long subdomains
dns.question.name.length > 50

# Patterns réseau Cobalt Strike
 Malleable C2 profiles  modifier les headers HTTP pour se fondre dans le trafic
 Default beacon  POST /submit.php toutes les 
 Headers suspects  X-Malware-ID, X-Session-ID dans requtes POST
 Certificats TLS auto-signés avec CN "Major Cobalt Strike User"
 JA3 fingerprint connu   CS default
 JARM fingerprint  
# Splunk — Cobalt Strike beacon default
indexproxy url"*/submit.php" methodPOST content_length < 200 earliest-6h
| stats count by src_ip dest_domain content_length
| where count > 10

# Patterns Meterpreter
 Handshake TLS suivi de trafic HTTP/HTTPS vers IP publique non CDN
 User-Agent vide ou gnrique sur reverse HTTPS
 Stage download  GET /AAAA payload 4 bytes puis rponse > 
 Port par dfaut  4444 reverse_tcp 4433 reverse_https

# HTTP/HTTPS vers IPs directes (pas de domaine) — indicateur fort C2
index=proxy earliest=-24h
  NOT (dest_domain IN ("{{KNOWN_IP_SERVICES}}"))
  dest_ip!="10.*" dest_ip!="192.168.*" dest_ip!="172.16.*"
| rex field=url "^https?://(?P<raw_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| where isnotnull(raw_ip)
| stats count by src_ip, raw_ip, dest_port, method
| sort -count

# Connexions longues suspectes (possible C2 idle connection)
zeek-cut idorig_h idresp_h idresp_p proto duration orig_bytes resp_bytes 
  < connlog | awk '$5 > 3600 && $6 < 10000' | sort -k5 -rn | head -20
# Connexions vers IPs inconnues sur port 443 (TLS C2)
zeek-cut idorig_h idresp_h idresp_p conn_state < connlog 
  | awk '$3 == 443 && $1 !~ /^10\./ && $1 !~ /^192\.168\./' 
  | sort | uniq -c | sort -rn

# Domaines à haute entropie dans dns.log
zeek-cut query qtype_name < dnslog 
  | awk 'length($1) > 50' | sort | uniq -c | sort -rn | head -20
# Requêtes TXT non-SPF/DKIM
zeek-cut query qtype_name answers < dnslog 
  | awk '$2 == "TXT" && $1 !~ /(spf|dkim|dmarc)/' | head -30

# Alertes C2 dans eve.json
jq selectevent_type"alert" | 
  timestamp timestamp
  src src_ip
  dest dest_ip
  alert alertsignature
  category alertcategory
 /var/log/suricata/eve.json | grep -i "C2\|beacon\|rat\|trojan"
# Stats par catégorie d'alerte
jq -r 'select(.event_type=="alert") | .alert.category' 
  /var/log/suricata/eve.json | sort | uniq -c | sort -rn

# Détection de protocoles sur mauvais ports
index=network earliest=-24h
| eval protocol_mismatch=case(
    dest_port=443 AND protocol="http", "HTTP_on_HTTPS_port",
    dest_port=80 AND protocol="https", "HTTPS_on_HTTP_port",
    dest_port=53 AND protocol!="dns", "non-DNS_on_DNS_port",
    dest_port!=22 AND protocol="ssh", "SSH_non_standard_port",
    true(), null()
  )
| where isnotnull(protocol_mismatch)
| stats count by src_ip, dest_ip, dest_port, protocol, protocol_mismatch

# Extraire JA3 fingerprints depuis PCAP avec zeek
zeek -r capturepcap policy/protocols/ssl/ja3.zeek
cat ssllog | zeek-cut ja3 ja3s server_name | sort | uniq -c | sort -rn
# Vérifier JA3 contre base connue (JA3er, TLS-Fingerprint.io)
curl "https://ja3er.com/json/{{JA3_HASH}}"

# Splunk — JA3 malveillants connus (nécessite lookup ja3_blacklist.csv)
index=ssl earliest=-24h
| lookup ja3_blacklist.csv ja3_hash OUTPUT malware_family, confidence
| where isnotnull(malware_family)
| table _time, src_ip, dest_ip, server_name, ja3_hash, malware_family, confidence