Suricata

I have a Lua script I've developed to unmask websockets. I can add this to the git repo while a rust parser is being created.

just wanted to bump this request WebSockets is still used by malware, recently case of it is documented here https://isc.sans.edu/forums/diary/Keep+an+Eye+on+WebSockets/28430/

just another bump - APT actor using websockets

https://cert.gov.ua/article/37704
Translated to English -- https://cert-gov-ua.translate.goog/article/37704?_x_tr_sl=uk&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp

I was able to confirm this traffic using WebSockets - can share a pcap privately if needed, but looks like standard websockets use here.

redteam tooling using WebSockets
https://github.com/dobin/antnium

just another example of a RAT using websockets

https://asec.ahnlab.com/en/52899/

Source Code: https://github.com/XZB-1248/Spark/

@Brandon Murphy do you have pcaps for this ?

Also this pcap - thanks to AnyRun - https://app.any.run/tasks/caf8a256-6249-47ec-8de0-80b5d6049874/

Also private pcap shared, thanks Brandon !

What would be the expectation wrt detection?

Minimum I can think of is keywords for:
- message header
- message payload raw
- message payload unmasked

But would there be a requirement to reassemble (unmasked) message payloads into a continues buffer as well?

websocket pcaps found on malware-traffic-analysis.net:

• https://www.malware-traffic-analysis.net/2018/09/04/2018-09-04-Emotet-infection-with-IcedID.pcap.zip
• https://www.malware-traffic-analysis.net/2023/01/03/2023-01-03-Rhadamanthys-Stealer-traffic.pcap.zip

Victor Julien wrote in #note-15:

What would be the expectation wrt detection?

Minimum I can think of is keywords for:
- message header
- message payload raw
- message payload unmasked

message payload unmasked would be key to detection.

would be nice to see logic that handles to_client/to_server in these messages as well.

outside of what you have, i could see the actual key being a buffer (while typically dynamic, actors do stupid things sometimes)

But would there be a requirement to reassemble (unmasked) message payloads into a continues buffer as well?

I'm not sure I understand this question. like a single buffer with the contents of all messages?