Netwitness Investigator Parsers

Ever wondered how Netwitness Investigator differentiate the traffic and produce alerts? Let's take a look into those parsers. Key point to remember: it is session based and not packet based. Priority to packet collection and reassembly before anything else.

1. FlexParse
 » FlexParse exposes the network session parsing and metadata model
    - Configure how to identify applications and extract data

• XML parser definitions
• Register search tokens
• Perform logic operations 
• Register metadata for the NetWitness system

» Why?
   - Instantly customize and expand processing and modeling behavior
   - Processing flexibility for networks with:

• Heavy application profiles
• Proprietary protocols 
• And threats that don’t fall into common intrusion detection methods 

» What's possible…
   - Expand baseline parsers, fast flux identification, social networking profiling, mainframe exploitation, SCADA, file object identification, complex threat identification, …Etc.

2. SCADA MODBUS Parser
» Why?
   - Need insight into SCADA over IP to correlate with other network activity –critical infrastructure                   monitoring
» Demonstrate
   - Create new Service type for MODBUS
   - Simple text based protocol has numeric tokens that map to actions:

• “Read Coil Status”
• “Read Input Status”
• “Read Hold Registers” 
• “Read Input Registers” 
• “Force Single Coil”
• “Force Multiple Coils”
• Etc……

3. Malicious PDF Parser

» Why?

    - One of the most pervasive exploitation techniques used currently

    - Very effective exploitation technique that can be difficult to detect

» Demonstrate

   - Combined existence of PDF tokens, including javascript that classifies potentially malicious objects

   - Use “flags” to keep “state” between several different <match> statements

» A deeper insight to Parser Logic

» Find the following token:

   - HTTP/1.1 200 OK

» If above is found, then find token:

   - Content-Type: application/pdf

» If above is found, then find token:

   - %PDF-1.

» If above is found, then alert if the following is found:

   - /S/JavaScript

4. JRE 0day Analysis

Hunting for Anomalous Traffic

» Profile HTTP for java-archives (potential deployment toolkit)

» Rule: service = HTTP(80) && content = ‘application/java-archive’

Internal host being referred to what?

» Use IP from anomalous traffic analysis

- Rule: ip.src = 156.145.x.x && referrer contains ‘nytimes.com’,’foxnews.com’,etc..’

» Redirection to 95.211.14.21

- Netherlands Hosting Provider

- 95.211.14.21/measure/ad.php

- Inspect php

» Rule to profile & find ad.php querystring:

- service = HTTP(80) && (query contains 'pl=' && query contains 'ce=' && query contains 'hb=' && query contains 'av=' && query contains 'jv=’)

Ad.php behavior

» How many times have I seen this “.gif”?

Compromised Hosts

» Rule: service = HTTP(80) && filename=‘p.gif’ && content = ‘application/octet-stream’

» 3 Sessions

» 3 Unique hosts

Deeper Analysis

» p.gif (exe) appears corrupt

- Does that mean no one was infected?

» Let’s have a look at the .jar

» .jar modifies the first two bytes of the binary to subvert “MZ” token signatures

» FlexParse profile the malware

And there you go: you have parsers ready for show.