Interception and policy application for malicious communications
Disclosed herein are system, method, and computer program product embodiments for adapting to malware activity on a compromised computer system. An embodiment operates by detecting an adversary operating malware on a compromised system. A stream of network communications associated with adversary is intercepted. The stream of network communications includes a command and control channel of the adversary. The stream of network communications is accessed. An emulation of the command and control channel is provided. An analysis of the accessed stream of traffic is executed. A plurality of response mechanisms is provided. The plurality of response mechanisms is based in part on the analysis of the stream of network communications and a custom policy language tailored for the malware.
1. A computer implemented method for intercepting network communications, comprising:
intercepting, by a computing device, a stream of network communications from an adversary attempting to perform a targeted attack on a client device;
decoding, by the computing device, the stream of network communications including a command and control channel of the adversary;
reverse-engineering a protocol of the command control channel of the adversary based on the decoding;
utilizing the reverse-engineering protocol to produce an emulated command and control server and an emulated command and control channel of the adversary, wherein the emulated command and control server serves as a routing device between the adversary and the client device;
controlling the decoded stream of network communications by routing the decoded stream of network communications through the emulated command and control server and over the emulated command and control channel to the client device, wherein
the controlling is based on an enforcement of a plurality of response mechanisms that are dependent on the reverse-engineering protocol and a policy language tailored for activities of the adversary;
initiating a response mechanism from the plurality of response mechanisms; and
seeking to influence the activities of the adversary based on the initiated response mechanism, wherein the adversary is unaware of the controlling and the controlling includes manipulating the stream of network communications.
2. The method of claim 1 , the reverse-engineering further comprising:
intercepting the stream of network communications using a black-holing technique; and
monitoring the reverse-engineered protocol to determine behavioral characteristics of the malware, command and control channel, and actions of the adversary.
3. The method of claim 2 , further comprising:
logging portions of the decoded stream of network communications for real-time and post-mortem analysis; and
logging the behavioral characteristics of the malware, the command and control channel, and the adversary.
4. The method of claim 1 , wherein the seeking to influence includes controlling activities of the adversary.
5. The method of claim 1 wherein the intercepting occurs at a network boundary of a compromised system.
6. The method of claim 1 , further comprising:
identifying the adversary using at least one of a signature-based detection technique or a heuristic-based detection technique.
7. The method of claim 1 , wherein the intercepting of the stream of traffic is performed using at least one of a domain name server (DNS) or Internet Protocol (IP) black-holing technique.
8. A system, comprising:
a memory; and
at least one processor coupled to the memory and configured to:
intercept a stream of network communications from an adversary attempting to perform a targeted attack on a client device;
decode the stream of network communications including a command and control channel of the adversary;
reverse-engineer a protocol of the command control channel of the adversary based on the decoded stream of network communications;
utilize the reverse-engineered protocol to produce an emulated command and control server and an emulate command and control channel of the adversary, wherein the emulated command and control server serves as a routing device between the adversary and the client device;
control the decoded stream of network communications by routing the decoded stream of network communications through the emulated command and control server and over the emulated command and control channel to the client device, wherein the controlling is based on an enforcement of a plurality of response mechanisms that are dependent on the reverse-engineered protocol and a policy language tailored for activities of the adversary;
initiate a response mechanism from the plurality of response mechanisms; and
seek to influence the activities of the adversary based on the initiated response mechanism, wherein the adversary is unaware of the controlling and the controlling includes manipulating the stream of network communications.
9. The system of claim 8 , wherein to reverse-engineer the protocol, the at least one processor further configured to:
intercept the stream of network communications using a black-holing technique; and
monitor the reverse-engineered protocol to determine behavioral characteristics of the malware, command and control channel, and actions of the adversary.
10. The system of claim 9 , the at least one processor further configured to:
log portions of the decoded stream of network communications for real-time and post-mortem analysis; and
log the behavioral characteristics of the malware, the command and control channel, and the adversary.
11. The system of claim 8 , wherein to seek to influence the at least one processor is configured to control activities of the adversary.
12. The system of claim 8 , wherein the at least one processor is located at a network boundary of the compromised system.
13. The system of claim 8 , the at least one processor further configured to:
identify the adversary using at least one of a signature-based detection technique or a heuristic-based detection technique.
14. The system of claim 8 , the at least one processor further configured to intercept the stream of network communications using at least one of a domain name server (DNS) technique or a black-holing technique.
15. A non-transitory tangible computer-readable device having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform operations comprising:
intercepting a stream of network communications from an adversary attempting to perform a targeted attack on a client device;
decoding the stream of network communications including a command and control channel of adversary;
reverse-engineering a protocol of the command control channel of the adversary based on the;
utilizing the reverse-engineering protocol to produce an emulated command and control server and an emulated command and control channel of the adversary, wherein the emulated command and control server serves as a routing device between the adversary and the client device;
controlling the decoded stream of network communications by routing the decoded stream of network communications through the emulated command and control server and over the emulated command and control channel to the client device, wherein the controlling is based on an enforcement of a plurality of response mechanisms that are dependent on the reverse-engineering protocol and a policy language tailored for activities of the adversary;
initiating a response mechanism from the plurality of response mechanisms; and
seeking to influence the activities of the adversary based on the initiated response mechanism, wherein the adversary is unaware of the controlling and the controlling includes manipulating the stream of network communications.
16. The non-transitory computer-readable device of claim 15 , the operations further comprising:
intercepting the stream of network communications using a black-holing technique; and
monitoring the reverse-engineered protocol to determine behavioral characteristics of the malware, command and control channel, and actions of the adversary.
17. The non-transitory computer-readable device of claim 16 , the operations further comprising:
logging portions of the decoded stream of network communications for real-time and post-mortem analysis; and
logging the behavioral characteristics of the malware, the command and control channel, and the adversary.
18. The non-transitory computer-readable device of claim 15 , wherein the seeking to influence includes controlling activities of the adversary.
19. The non-transitory computer-readable device of claim 15 , the operations further comprising:
identifying the adversary using at least one of a signature-based detection technique or a heuristic-based detection technique.
20. The non-transitory computer-readable device of claim 15 , wherein the intercepting of the stream of traffic is performed using at least one of a domain name server (DNS) technique or a black-holing technique.