Executive Summary
Killnet is a hacktivist group based in Russia that has been active since at least 2015. The group is known for launching DDoS attacks on a diverse range of industries, including state and local governments, telecommunications, and defense.
Killnet has been linked to several high profile attacks, including distributed denial-of-service (DDoS) attacks against U.S. airports and Elon Musk's Starlink satellite broadband service.
The motivations behind these attacks vary, but recently, they have primarily targeted those who are the most vocal supporters of Ukraine and its political agenda.
The aim of this threat hunt is to create a virtual attack environment that simulates Killnet's tactics, techniques, and procedures (TTPs). Subsequently, detections and threat hunt queries will be written to proactively identify the emulated TTPs while compensating for the limitations of traditional IOC historical searches.
The results of the threat hunt will include high-level dashboards, code, and network artifacts generated from the attack range, which will be used to explain how a hypothesis was formed. The outcomes will also contain the pseudo and translated query logic in a format that can be utilized by tools such as Suricata, Snort, Splunk, and Zeek. The query output will then be employed to confirm the initial hypothesis generated.
Network Artifacts
To emulate the attack, cc.py was utilized to generate continuous HEAD requests against an Apache server, refer to Appendix A for further details. Once the attack was launched, the captured log traffic was examined, as shown in Figure 1 and Figure 2. Upon reviewing the HEAD HTTP traffic, it was discovered that the digits between the ranges of 11-12 appeared after "HEAD /?" consistently. This pattern will serve as the basis for our first hypothesis, as outlined in the next section.
Figure 1 –Wireshark - Dynamically Generated 11-12 Digits
Figure 2 –Wireshark - Forged Referrer & Anonymized IPs
Figure 3 also contains the Apache logs that were generated on the server as the attack script kept trying to access different files in the ‘/var/www/html/’ directory. The script reiterates in a brute force type style, until CPU resources are rendered exhausted by sheer traffic volume.
Figure 3 – Splunk – Apache Server Error Logs – Failed File Access Attempts
Detection Guidance
Perl compatible regular expressions can be used to leverage the context derived from the packet capture during threat analysis, as shown in Figure 1. This allows us to write Suricata/Snort rules that will match observed patterns in headers. Detections tend to scale more than hunt queries and can be applied strategically on a per sensor basis. Specifically, the following rule will match any instance when an HTTP HEAD request containing 11-12 digits has been captured by a network sensor on a forward looking basis. This serves as our first hypothesis to identify the usage of DDoS HEAD floods:
alert tcp any any -> any any (msg:"Killnet cc.py DDoS HTTP HEAD Flood"; content:"HEAD"; depth:4; content:" /?"; distance:0; content:" HTTP/1.1|0d0a|Host: "; distance:0; fast_pattern; content:"."; distance:1; within:3; content:"."; distance:1; within:3; content:"."; distance:1; within:3; content:"|0d0a|Referer: https://"; distance:0; content:"|0d0a|Accept-Language: "; distance:0; content:"|0d0a|Accept-Charset: "; distance:0; content:"|0d0a|Connection: Keep-Alive|0d0a0d0a|"; distance:0; pcre:"/^HEAD\x20\/\?[0-9]{11,12}\x20HTTP/"; sid:10000001;)
Hypothesis #1
The following is a Splunk hunt query that utilizes the Zeek/Bro dataset to identify "High connections from common source over a short amount of time". The query breaks the time column (shown in Figure 2) into 1-second chunks. Once an appropriate threshold has been established, the "where count > 10" statement can be adjusted accordingly to search retroactively within the last 7 days from when the activity was first observed. This query serves as our second hypothesis to identify the usage of DDoS HEAD floods:
index=zeek sourcetype=zeek_conn
| eval datetime=strftime(ts,"%Y-%m-%d %H:%M:%S")
| bucket span=1s datetime
| stats count by datetime, id.orig_h
| where count > 10
| rename datetime as "Date & Time" id.orig_h as "Attacker IP"
Hypothesis #2
Appendix A. – Adversary Emulation
Cc.py is a Python tool publicly available on the internet that can be used for Layer 7 DDoS attacks. The tool, created by a student in 2020, uses various dynamic characteristics to launch DDoS attacks against web assets. The script automates the process of using open proxy servers to relay attacks while maintaining anonymity, which can render traditional IP-based blocking techniques ineffective.
Figure 4 depicts a Python function called "head" that performs an HTTP HEAD request to a target server. The function takes two arguments: "event" and "proxy type". These arguments control the flow of the request and specify the type of open proxy to leverage. Additionally, the code concatenates the variables where the forged/randomized headers will be used.
Figure 4 - cc.py
To generate a dynamic list of compromised open proxies that will be used to relay attacks on behalf of the attacker, the following command is utilized:
python3 cc.py –down –f proxy.txt –v 5
Once the list is generated, the following command is used to launch an attack against a server running Apache web server within the attack range. The command specifies the use of the "head" module and sets the duration of the attack to 30 seconds. The "head" module floods the target server with continuous HTTP HEAD requests until it is knocked offline.
python3 cc.py –url http://<insert url> -f proxy.txt –m head –v 4 –s 30
Appendix B. – IOCs
At OTX pulse was created listing over the 12K+ indicators from this research.
References
