Reasons for Monitoring Network Communication on the Client
Many attacker actions require network communication:
- Scanning of internet-exposed elements of the infrastructure of a company
- lateral movement through a breached environment
- exfiltration of sensitive and valuable data back to attacker-controlled infrastructure
Ideally, a company implemented monitoring on a network level, allowing visibility into current and past communication between internal systems as well as with external systems. This allows detection and investigation of possible attacker actions.
When a comprehensive network view is missing, one can try to compensate with monitoring on each host for its network communication (host-based network monitoring). This will not cover all network communication, only those connections involving the systems included in the host-based view.
Still, when a large portion of the internal systems is covered, identification of malicious activity is possible. In an incident where Velociraptor is used for investigation, it can be utilized for such host-based monitoring.
Building Blocks
Velociraptor includes several client monitoring artifacts which can serve as a reference for implementations. Initial inspiration was taken from Windows.Events.ProcessCreation and Windows.Events.TrackProcessesBasic. These Velociraptor artifacts show different ways of tracking changes on the system.
To identify network communication, Velociraptor has artifacts for Windows, Linux and MacOS. From the Windows and MacOS variants, one is lead to the Velociraptor internal plugin netstat. This plugin is not bound to any operating system. However, these Velociraptor artifacts and the Velociraptor plugin only provide a snapshot of the network communication at the time of execution.
Velociraptor includes the internal plugin diff which allows for periodic execution of a non-event query (meaning a query returning one time results) and highlights changes in the output of the query based on a custom comparison.
Putting Blocks Together
The client monitoring artifact we developed can be found at:
https://docs.velociraptor.app/exchange/artifacts/pages/generic.events.tracknetworkconnections/
The artifact utilizes the netstat plugin to get information about the network communication. This is wrapped with the diff plugin, so that the network communication is periodically polled and checked for changes. Changes are identified based on following elements: process id, layer 3 protocol, layer 4 protocol, local address used, local port used, remote address used, remote port used. We believe that those elements sufficiently uniquely identify a network communication (edge cases may apply, e. g. when a process repeatedly opens a connection to the same remote endpoint reusing the local port). Changes are by default checked every two seconds. Short lived connections might fall through that crack. This is a limitation of the diff plugin, as the interval between checks can be made no shorter than one second.
After some testing, we found that the information given by the netstat plugin should be enriched with information about the process that initiated the network communication. Depending on which process initiated a network communication, the judgement on it being benign or suspicious changes. We utilized the Velociraptor internal function process_tracker_get to retrieve process information based on the PID associated with a network connection.
The client monitoring artifact emits events for both added network connections as well as removed network connections.
No Artifact Works Alone
The client monitoring artifact is sufficient to track network communication on the level of IP addresses and ports. But it only informs the Velociraptor server about the network communication. The server also needs a kind of companion server monitoring artifact which reacts to the events from the clients.
We developed a second Velociraptor artifact which watches for events from the earlier artifact and sends a notification on added network connections using a webhook. To combat spam and also focus the alerting on specific IOCs, we added filtering for specific clients (based on their Fqdn), remote IP addresses, remote ports as well as initiating process.
The server monitoring artifact can be found at:
https://docs.velociraptor.app/exchange/artifacts/pages/server.alerts.tracknetworkconnections/
If desired, the server monitoring artifact could also trigger other actions instead of or additional to the webhook message. These might include starting evidence collection on the client that emitted the event, killing the process responsible for the network communication or moving the client into quarantine.
