Threat Hunting SSH Keys - Bash Script Feature Pivoting

Tom Hegel
Cloud Security Researcher – Lacework Labs

 

Malicious actors often add SSH keys to victim hosts for persistence (T1098.004), in this blog we will show you how to hunt with that knowledge. The process of identifying malicious activity through threat intelligence pivoting is standard practice for any CTI analyst. For readers unfamiliar with the process, pivoting is the process of identifying similar or associated elements of data – such as network and host-based activity. For example, pivoting can be done through network characteristics such as unique C2 server configurations. Additionally, the process of pivoting can be applied to other areas, such as malware samples designed in similar ways or containing similar functionality. The process of pivoting has been written about extensively, and I recommend readers review the paper “Formulating a Robust Pivoting Methodology”. Ultimately, we want to pivot to discover new activity based on a relationship of many types.

Pivot Quality

When it comes to pivoting, it’s important to avoid common mistakes. For example, an analyst could incorrectly associate a collection of domains through a bad pivot on a shared historical DNS record to a parked IP address. On the other hand, a malware sample could be related to others based on code reuse or functionality. A common opportunistic threat which we observe related to Linux and Cloud services are botnets of illicit cryptocurrency miners (T1496). A large majority of these ongoing attacks originate from the delivery and execution of scripts. Now, the scripts happen to reuse code from others on a large scale. For example, we’ve previously mentioned malicious scripts which uninstall monitoring agents for Tencent Host Security (YunJing) and the Threat Detection Service (Aegis) from Alibaba Cloud.

Lacework has observed this function being reused across various cloud targeting threats, such as the H2miner botnet, TeamTNT, and Rocke Group (G0106). In fact, it’s almost a challenge to find similar scripts that do not contain this general function. In more capable and targeted adversary groups, the use of the Royal Road, or “8.t” toolkit is an example of a potential pivot expanding your collection outside of your interests. Royal Road is a shared RTF weaponizer that has been observed in use across multiple seemingly unrelated APT groups such as Goblin Panda, APT40, and ICEFOG (China) and then later with SideWinder (India), later to be in use by various crimeware operators. If you were to pivot on the use of Royal Road alone, many incorrect conclusions could be made, which is a reason why attribution should be taken with caution. Nonetheless, it is important to challenge what is truly unique to your investigation interest and what could be shared widely among different actors.

Royal Road Use Timeline, Source: Analyzing Digital Quartermasters in Asia – Anomali

Malicious SSH Keys

Let’s take a look at private SSH keys – a common, often unique, string we can observe in great quantities when searching for malware. A recent example of a malicious script that is easy to come across are Linux OS Raspberry Pi bots.

The script originally came to light in 2017 with the objective of installing an illicit miner. Today we continue to observe a new flood of the current-day version with the addition of many new features, including adding it to an IRC botnet, such as sample 65b4e03c1300eebf6823bb6834461960. At one point in the script, the actor’s SSH key is added into authorized_keys for retaining access if the IRC bot is remediated by the victim.

SSH Key Addition Command

In this case, our working theory is the samples containing the same key are likely associated with the same operator and/or campaign. An SSH key is an interesting pivot because it is not only based on the uniqueness of a specific sample, it is also a unique identifier the attacker would have to manage as well. This means a pivot to all samples containing this key could be isolated to the same access manager/operator or a different actor reusing the code by accident (less likely). Of course, we must consider if any automated “builder” could include this at creation.

Yara Rules

So how do we pivot on this simple string? One can make use of their own sample telemetry or database if possible. The use of VirusTotal here can grant us access to samples as well. A very basic Yara could be: