HTTP POST Request with Encoded Payload

Name:HTTP POST Request with Encoded Payload
id:0590881d-7b81-48dd-9674-1f23f7db5d40
version:1
date:None
author:Raven Tait, Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk
status:production
type:Anomaly
Description:The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex, base64, URL, XML, Unicode, or Octal encoded strings. It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex, URL, XML, Unicode, or Octal escape sequences or sixteen or more consecutive base64 character groups. This activity is significant as adversaries commonly use various encoding schemes to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads.
Data_source:

• -Zeek HTTP

search:`zeek_http`
method="POST"
post_body="*"

NOT orig_mime_type_first_stated IN (
"application/x-www-form-urlencoded",
"application/ocsp-request"
)

NOT user_agent IN (
"MicroMessenger Client",
"Dalvik*",
"AliPayWallet*"
)

| eval dest_port=coalesce(dest_port, 'id.resp_p'),
dest=coalesce(dest, dest_ip, 'id.resp_h'),
src=coalesce(src, src_ip, 'id.orig_h')

| eval encoding=ltrim(if(match(post_body, "(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), "Hexadecimal", ""), " + ")
| eval encoding=ltrim(if(match(post_body, "(?:[A-Za-z0-9+\\/]{4}){16,}={0,2}"), encoding." + Base64", encoding), " + ")
| eval encoding=ltrim(if(match(post_body, "(?:0x[A-Fa-f0-9]{2}){8,}"), encoding." + URL Encoding", encoding), " + ")
| eval encoding=ltrim(if(match(post_body, "(?:\\&\\#x?[A-Za-z0-9]{2,3}\;?){8,}"), encoding." + XML Encoding", encoding), " + ")
| eval encoding=ltrim(if(match(post_body, "(?:\\\\u[A-Fa-f0-9]{4}|\\\\u\{[A-Fa-f0-9]+\}){8,}"), encoding." + Unicode", encoding), " + ")
| eval encoding=ltrim(if(match(post_body, "(?:\\\\\\d{3}){8,}"), encoding." + Octal", encoding), " + ")

| where encoding!=""

| stats count min(_time) as firstTime
max(_time) as lastTime
values(uri) as uri
values(encoding) as encoding
values(post_body) as post_body

by src dest dest_port method status_code

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `http_post_request_with_encoded_payload_filter`

how_to_implement:Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). The "post_body" field must be populated, which requires Zeek to be configured with the HTTP post body extraction policy. Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on.
known_false_positives:Legitimate applications may POST base64-encoded data, particularly APIs that transmit binary content. Review the destination, URI, and post body content to confirm whether the activity is expected.
References:
  -https://attack.mitre.org/techniques/T1071/001/
  -https://attack.mitre.org/techniques/T1132/001/
  -https://docs.zeek.org/en/master/logs/http.html
  -https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md
drilldown_searches:
 name:'View the detection results for - "$src$"'
 search:'%original_detection_search% | search src = "$src$"'
 earliest_offset:'$info_min_time$'
 latest_offset:'$info_max_time$'
 name:'View risk events for the last 7 days for - "$id.orig_h$"'
 search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
 earliest_offset:'7d'
 latest_offset:'0'
analytic_story:['Command And Control', 'Data Exfiltration']

asset_type:Network

mitre_attack_id:['T1071.001', 'T1132.001']

product:['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

category:network

security_domain:network

tags:

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.001/zeek_http_encoded_post/http.log
  sourcetype: zeek:http
  source: http.log
 test_type:'unit'
manual_test:None