New Connection Initiated To Potential Dead Drop Resolver Domain

Title: New Connection Initiated To Potential Dead Drop Resolver Domain
Status: test
Description:Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks. In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
References:
  -https://web.archive.org/web/20220830134315/https://content.fireeye.com/apt-41/rpt-apt41/
  -https://securelist.com/the-tetrade-brazilian-banking-malware/97779/
  -https://blog.bushidotoken.net/2021/04/dead-drop-resolvers-espionage-inspired.html
  -https://github.com/kleiton0x00/RedditC2
  -https://twitter.com/kleiton0x7e/status/1600567316810551296
  -https://www.linkedin.com/posts/kleiton-kurti_github-kleiton0x00redditc2-abusing-reddit-activity-7009939662462984192-5DbI/?originalSubdomain=al
Author: Sorina Ionescu, X__Junior (Nextron Systems)
Date: 2022-08-17
modified:2026-03-29
Tags:

• -'attack.command-and-control'
• -'attack.t1102'
• -'attack.t1102.001'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    Initiated: 'true'
    DestinationHostname|endswith:
      -'.t.me'
      -'0x0.st'
      -'4shared.com'
      -'abuse.ch'
      -'anonfiles.com'
      -'bashupload.com'
      -'cdn.discordapp.com'
      -'chunk.io'
      -'cloudflare.com'
      -'ddns.net'
      -'discord.com'
      -'docs.google.com'
      -'drive.google.com'
      -'dropbox.com'
      -'dropmefiles.com'
      -'facebook.com'
      -'feeds.rapidfeeds.com'
      -'fotolog.com'
      -'ghostbin.co/'
      -'githubusercontent.com'
      -'gofile.io'
      -'hastebin.com'
      -'imgur.com'
      -'livejournal.com'
      -'mediafire.com'
      -'mega.co.nz'
      -'mega.nz'
      -'onedrive.com'
      -'pages.dev'
      -'paste.ee'
      -'pastebin.com'
      -'pastebin.pl'
      -'pastetext.net'
      -'pixeldrain.com'
      -'privatlab.com'
      -'privatlab.net'
      -'reddit.com'
      -'send.exploit.in'
      -'sendspace.com'
      -'steamcommunity.com'
      -'storage.googleapis.com'
      -'technet.microsoft.com'
      -'temp.sh'
      -'transfer.sh'
      -'trycloudflare.com'
      -'twitter.com'
      -'ufile.io'
      -'vimeo.com'
      -'w3spaces.com'
      -'wetransfer.com'
      -'workers.dev'
      -'x0.at'
      -'youtube.com'

  filter_main_chrome:
    Image:
      -'C:\Program Files\Google\Chrome\Application\chrome.exe'
      -'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe'

  filter_main_chrome_appdata:
    Image|startswith: 'C:\Users\'
    Image|endswith: '\AppData\Local\Google\Chrome\Application\chrome.exe'
  filter_main_firefox:
    Image:
      -'C:\Program Files\Mozilla Firefox\firefox.exe'
      -'C:\Program Files (x86)\Mozilla Firefox\firefox.exe'

  filter_main_firefox_appdata:
    Image|startswith: 'C:\Users\'
    Image|endswith: '\AppData\Local\Mozilla Firefox\firefox.exe'
  filter_main_ie:
    Image:
      -'C:\Program Files (x86)\Internet Explorer\iexplore.exe'
      -'C:\Program Files\Internet Explorer\iexplore.exe'

  filter_main_edge_1:
Image|startswith:'C:\Program Files (x86)\Microsoft\EdgeWebView\Application\' Image|endswith:'\WindowsApps\MicrosoftEdge.exe'     - Image:
      - 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe'
      - 'C:\Program Files\Microsoft\Edge\Application\msedge.exe'
  filter_main_edge_2:
    Image|startswith:
      -'C:\Program Files (x86)\Microsoft\EdgeCore\'
      -'C:\Program Files\Microsoft\EdgeCore\'

    Image|endswith:
      -'\msedge.exe'
      -'\msedgewebview2.exe'

  filter_main_safari:
    Image|contains:
      -'C:\Program Files (x86)\Safari\'
      -'C:\Program Files\Safari\'

    Image|endswith: '\safari.exe'
  filter_main_defender:
    Image|contains:
      -'C:\Program Files\Windows Defender Advanced Threat Protection\'
      -'C:\Program Files\Windows Defender\'
      -'C:\ProgramData\Microsoft\Windows Defender\Platform\'

    Image|endswith:
      -'\MsMpEng.exe'
      -'\MsSense.exe'

  filter_main_prtg:
    Image|endswith:
      -'C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe'
      -'C:\Program Files\PRTG Network Monitor\PRTG Probe.exe'

  filter_main_brave:
    Image|startswith: 'C:\Program Files\BraveSoftware\'
    Image|endswith: '\brave.exe'
  filter_main_maxthon:
    Image|contains: '\AppData\Local\Maxthon\'
    Image|endswith: '\maxthon.exe'
  filter_main_opera:
    Image|contains: '\AppData\Local\Programs\Opera\'
    Image|endswith: '\opera.exe'
  filter_main_seamonkey:
    Image|startswith:
      -'C:\Program Files\SeaMonkey\'
      -'C:\Program Files (x86)\SeaMonkey\'

    Image|endswith: '\seamonkey.exe'
  filter_main_vivaldi:
    Image|contains: '\AppData\Local\Vivaldi\'
    Image|endswith: '\vivaldi.exe'
  filter_main_whale:
    Image|startswith:
      -'C:\Program Files\Naver\Naver Whale\'
      -'C:\Program Files (x86)\Naver\Naver Whale\'

    Image|endswith: '\whale.exe'
  filter_main_whaterfox:
    Image|startswith:
      -'C:\Program Files\Waterfox\'
      -'C:\Program Files (x86)\Waterfox\'

    Image|endswith: '\Waterfox.exe'
  filter_main_midori:
    Image|contains: '\AppData\Local\Programs\midori-ng\'
    Image|endswith: '\Midori Next Generation.exe'
  filter_main_slimbrowser:
    Image|startswith:
      -'C:\Program Files\SlimBrowser\'
      -'C:\Program Files (x86)\SlimBrowser\'

    Image|endswith: '\slimbrowser.exe'
  filter_main_flock:
    Image|contains: '\AppData\Local\Flock\'
    Image|endswith: '\Flock.exe'
  filter_main_phoebe:
    Image|contains: '\AppData\Local\Phoebe\'
    Image|endswith: '\Phoebe.exe'
  filter_main_falkon:
    Image|startswith:
      -'C:\Program Files\Falkon\'
      -'C:\Program Files (x86)\Falkon\'

    Image|endswith: '\falkon.exe'
  filter_main_qtweb:
    Image|startswith:
      -'C:\Program Files (x86)\QtWeb\'
      -'C:\Program Files\QtWeb\'

    Image|endswith: '\QtWeb.exe'
  filter_main_avant:
    Image|startswith:
      -'C:\Program Files (x86)\Avant Browser\'
      -'C:\Program Files\Avant Browser\'

    Image|endswith: '\avant.exe'
  filter_main_whatsapp:
    Image|startswith:
      -'C:\Program Files (x86)\WindowsApps\'
      -'C:\Program Files\WindowsApps\'

    Image|endswith: '\WhatsApp.exe'
    DestinationHostname|endswith: 'facebook.com'
  filter_main_telegram:
    Image|contains: '\AppData\Roaming\Telegram Desktop\'
    Image|endswith: '\Telegram.exe'
    DestinationHostname|endswith: '.t.me'
  filter_main_onedrive:
    Image|contains: '\AppData\Local\Microsoft\OneDrive\'
    Image|endswith: '\OneDrive.exe'
    DestinationHostname|endswith: 'onedrive.com'
  filter_main_dropbox:
    Image|startswith:
      -'C:\Program Files (x86)\Dropbox\Client\'
      -'C:\Program Files\Dropbox\Client\'

    Image|endswith:
      -'\Dropbox.exe'
      -'\DropboxInstaller.exe'

    DestinationHostname|endswith: 'dropbox.com'
  filter_main_mega:
    Image|endswith:
      -'\MEGAsync.exe'
      -'\MEGAsyncSetup32_*RC.exe'
      -'\MEGAsyncSetup32.exe'
      -'\MEGAsyncSetup64.exe'
      -'\MEGAupdater.exe'

    DestinationHostname|endswith:
      -'mega.co.nz'
      -'mega.nz'

  filter_main_googledrive:
    Image|contains:
      -'C:\Program Files\Google\Drive File Stream\'
      -'C:\Program Files (x86)\Google\Drive File Stream\'

    Image|endswith: 'GoogleDriveFS.exe'
    DestinationHostname|endswith: 'drive.google.com'
  filter_main_discord:
    Image|contains: '\AppData\Local\Discord\'
    Image|endswith: '\Discord.exe'
    DestinationHostname|endswith:
      -'discord.com'
      -'cdn.discordapp.com'

  filter_main_null:
    Image: 'None'
  filter_main_empty:
    Image: ''
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -One might need to exclude other internet browsers found in it's network or other applications like ones mentioned above from Microsoft Defender.
  -Ninite contacting githubusercontent.com
Level: high