Varonis Threat Labs developed the Jitter-Trap technique to detect stealthy post-exploitation beacons by analyzing patterns of randomness in network traffic, a common evasion method used by advanced threat actors. This method leverages behavioral signatures and network anomalies to distinguish malicious beacon activity from benign traffic, improving detection during the post-exploitation phase. #JitterTrap #CobaltStrike #Sliver
Keypoints
- Jitter-Trap detects beacon communications by analyzing randomness patterns in sleep and jitter parameters that control beacon polling intervals.
- Post-exploitation frameworks like Cobalt Strike, Sliver, Mythic, and others use modular architectures, customizable C2 communication, and evasion techniques to maintain stealthy access.
- Beacon frameworks use sleep and jitter values to randomize communication intervals, typically forming uniform distributions detectable through statistical tests like Kolmogorov-Smirnov and chi-square.
- Benign web traffic rarely shows uniform random distributions in polling intervals or a high ratio of distinct URLs per request, unlike malicious beacon traffic.
- Data jitter also causes uniform distribution in download sizes, further aiding detection of anomalous beacon communication.
- Randomized URL paths and segments in beacon communications create high distinct URL ratios uncommon in normal traffic, serving as a detection feature.
- Combining behavioral and network-based detection methods enhances discovery of post-exploitation beacons despite their evasion capabilities.
MITRE Techniques
- [T1071] Application Layer Protocol – Beacons communicate using protocols like HTTP/S, DNS, and SMB for command and control (“C2 communication – Beacons communicate with their operators using various protocols”).
- [T1055] Process Injection – Advanced evasion techniques include updated methods for process injection (“updated methods for process injection, running unmanaged PowerShell”).
- [T1110] Brute Force – Credential dumping and privilege escalation support is mentioned as part of lateral movement (“multiple persistence techniques, privilege escalation, and credential dumping to help operators maintain long-term access”).
- [T1027] Obfuscated Files or Information – Frameworks employ obfuscation and encryption to evade detection (“Advanced frameworks include obfuscation, encryption, and traffic shaping”).
- [T1078] Valid Accounts – Use of legitimate accounts for access and lateral movement is implied by maintaining access within compromised environments (“maintain access, execute commands, move laterally, and exfiltrate data”).
Indicators of Compromise
- [File Hashes] Examples of Cobalt Strike beacon samples with low detection rates and various communication profiles – specific hashes not listed but referenced as targets for detection.
- [Network Traffic Patterns] Uniform distribution of timediff values between HTTP requests and download sizes indicating presence of sleep and data jitter.
- [URLs] High ratio of distinct URLs per request during beacon sessions – examples include randomized concatenated words in PoshC2 and randomized URL path segments in Sliver.
Read more: https://www.varonis.com/blog/jitter-trap