Techniques
Sample rules
HTTP POST Request with Encoded Payload
- source: splunk
- technicques:
Description
The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex, base64, URL, XML, Unicode, or Octal encoded strings. It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex, URL, XML, Unicode, or Octal escape sequences or sixteen or more consecutive base64 character groups. This activity is significant as adversaries commonly use various encoding schemes to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads.
Detection logic
`zeek_http`
method="POST"
post_body="*"
NOT orig_mime_type_first_stated IN (
"application/x-www-form-urlencoded",
"application/ocsp-request"
)
NOT user_agent IN (
"MicroMessenger Client",
"Dalvik*",
"AliPayWallet*"
)
| eval dest_port=coalesce(dest_port, 'id.resp_p'),
dest=coalesce(dest, dest_ip, 'id.resp_h'),
src=coalesce(src, src_ip, 'id.orig_h')
| eval encoding=ltrim(if(match(post_body, "(?:\\\\x[0-9a-fA-F]{2}){8,}
|(?:%[0-9a-fA-F]{2}){8,}"), "Hexadecimal", ""), " + ")
| eval encoding=ltrim(if(match(post_body, "(?:[A-Za-z0-9+\\/]{4}){16,}={0,2}"), encoding." + Base64", encoding), " + ")
| eval encoding=ltrim(if(match(post_body, "(?:0x[A-Fa-f0-9]{2}){8,}"), encoding." + URL Encoding", encoding), " + ")
| eval encoding=ltrim(if(match(post_body, "(?:\\&\\#x?[A-Za-z0-9]{2,3}\;?){8,}"), encoding." + XML Encoding", encoding), " + ")
| eval encoding=ltrim(if(match(post_body, "(?:\\\\u[A-Fa-f0-9]{4}
|\\\\u\{[A-Fa-f0-9]+\}){8,}"), encoding." + Unicode", encoding), " + ")
| eval encoding=ltrim(if(match(post_body, "(?:\\\\\\d{3}){8,}"), encoding." + Octal", encoding), " + ")
| where encoding!=""
| stats count min(_time) as firstTime
max(_time) as lastTime
values(uri) as uri
values(encoding) as encoding
values(post_body) as post_body
by src dest dest_port method status_code
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `http_post_request_with_encoded_payload_filter`