Hunting network assets

In addition to hunting all scanned files in Google Threat Intelligence, you can also hunt for all scanned URLs, domains and IP addresses. For this now you need to choose between File, URL, Domain or IP when you create a new Livehunt ruleset.

The "vt" module is now expanded with a ".net" attribute that contains all metadata extracted from the URL, its Domain and the IP address where it’s hosted. It also has complementary attributes to easily reference specific IoCs characteristics without having to deal with data's internal representation. Instead of that, self-descriptive enums are provided.

The tables below summarize all “vt” module attributes.
The first table is focused on the main attributes:

• The first column shows the entity type that the YARA rule match against
• The second column shows the main attribute used in the rule
• The third column shows other secondary attributes belonging to different entity types and complementary attributes that can be combined in the same YARA rule
• The last column provides a brief description of the main attribute

The second table shows the complementary attributes, basically enums that can be used in combination with the previous attributes to deploy a functional rule.

⚠️ Please note that vt.net and vt.Net are different attributes. The first one represents network entities while the second one provides an abstraction layer of the internal representation of the network protocols.

Let’s walk through some examples:

Get all detected URLs under a specific domain first select "Create a new rule" and choose to match URL, these will produce URL notifications.

import "vt"

rule detectedPythonPackages {
meta:
  description = "URLs with detections matching files.pythonhosted.org domain"
  author = "google_ti"
  target_entity = "url"
condition:
  vt.net.url.analysis_stats.malicious > 1 and
  vt.net.domain.raw == "files.pythonhosted.org"
}

Notice how is possible to combine vt.net.url and vt.net.domain, it works in a top down fashion:

• URL matching rules will allow vt.net.url, vt.net.domain and vt.net.ip fields
• Domain matching rules will allow vt.net.domain and vt.net.ip fields
• IP matching rules will allow only vt.net.ip fields

In a similar way we can create another URL rule to monitor new URLs from the LilithBot campaign:

import "vt"

rule LilithBot {
meta:
  description = "URLs matching LilithBot C2C"
  author = "google_ti"
  target_entity = "url"
condition:
  vt.net.url.raw matches /\/gate\/.{60}\/registerBot/ or
  vt.net.url.raw matches /\/gate\/.{60}\/getFile\?name=admin_settings_plugin\.json/ or
  vt.net.url.raw matches /\/gate\/.{60}\/uploadFile\?name/
}

The vt.net module contains the following metadata:

URL metadata

IP Metadata

Domain metadata

File ITW field

Analysis stats struct

HTTPs Certificate Subject struct

Network range helper

In order to match complex IP range matches you can use the next javascript function:

function cidrToInt(yara_fn, raw_cidr) {
    cidr = raw_cidr.split('/');
    ip = cidr[0].split('.').reduce(function(ipInt, octet) { return (ipInt<<8) + parseInt(octet, 10)}, 0) >>> 0;
    base = Math.pow(2, 32 - cidr[1])
    start = Math.floor(ip / base) * base;
    end = Math.pow(2, 32 - cidr[1]) + start;
    return (yara_fn + " >= " + start + " and " + yara_fn + " < " + end + " // " + raw_cidr);
}

// Examples:
// Matching with a net rule (URL, Domain, IP):
console.log(cidrToInt("vt.net.ip.ip_as_int", "234.243.166.33/22"));

// Matching with a File rule:
console.log(cidrToInt("vt.metadata.itw.ip.ip_as_int", "234.243.166.33/22"));

Net output: vt.net.ip.ip_as_int >= 3941835776 and vt.net.ip.ip_as_int < 3941836800 // 234.243.166.33/22
File output: vt.metadata.itw.ip.ip_as_int >= 3941835776 and vt.metadata.itw.ip.ip_as_int < 3941836800 // 234.243.166.33/22

Filetypes automatically analysed

There is only some filetypes that are automatically submitted for a file analysis after URL is received:

These filetypes applies to vt.net.url.downloaded_file. attributes, in case you want to scan other filetypes you should write a content rule ("strings") and once the match is done the hash will be visible in Google TI and you will have the possibility to submit it for a file analysis.

FAQ

How do I match certain content or sized response:

In Nethunt the content of the response is treated as a file (HTTP headers, etc are not included), you can use that content/file to make matches like in traditional matching yaras. Some examples:

• Matching some strings:

import "vt"

rule html_content {
meta:
  description = "URLs matching certain strings in content"
  author = "google_ti"
  target_entity = "url"
strings:
  $mystring: "some&html"
condition:
  $mystring and $mystring at 400
}

• Matching empty response:

import "vt"

rule empty_content {
meta:
  description = "URLs matching empty content"
  author = "google_ti"
  target_entity = "url"
condition:
  filesize == 0
}

How do I match URLs in certain ASN number/IP range, etc:

You are able to mix different net modules in a single rule and match over a single net type, for example:

• Notify new URLs whos domain resolve its IP address of a certain ASN in a certain IP range

import "vt"

rule urls_in_asn {
meta:
  description = "New URLs whos domain resolve to certain ASN"
  author = "google_ti"
  target_entity = "url"
condition:
  vt.net.url.new_url and
  vt.net.ip.ip_asn == 74838
}

• Notify new URLs whos domain resolve in a certain IP range (IP range helper):

import "vt"

rule urls_in_iprange {
meta:
  description = "New URLs whos domain resolve to my IP range"
  author = "google_ti"
  target_entity = "url"
condition:
  vt.net.url.new_url and
  vt.net.ip.ip_as_int >= 3941835776 and vt.net.ip.ip_as_int < 3941836800 // 234.243.166.33/22
}

How do I obtain a domain favicon hashes:

You need to search for the domain URL in Google TI, go to https://www.virustotal.com/gui/search, and write your domain url, ie: http://google.com , then go to details tab and at the end you will find a "Favicon" header, there you can see both dhash and raw mad5 hashes.

import "vt"

rule urls_with_dhash {
meta:
  description = "Domains with similar favicons"
  author = "google_ti"
  target_entity = "domain"
condition:
  vt.net.url.favicon.dhash == "f0cc929ab296cc71" or
  vt.net.url.favicon.raw_md5 == "30e26a059b7b858731e172c431d55bb4"
}

How do I obtain domains with self signed certificates:

You can use the "self-signed" tag for that, to be notified you could use for example:

import "vt"

rule selfsigned_certificate_domains {
meta:
  description = "Domains with self signed certificates"
  author = "google_ti"
  target_entity = "domain"
condition:
  for any tag in vt.net.domain.tags: (
    tag == "self-signed"
  )
}

How do I obtain a feed of IP resolutions for a certain domain:

It's currently not possible to combine domain matching attributes in IP rules, to overcome this limitation exists the vt.net.ip.reverse_lookup attribute, it can be used like this:

import "vt"

rule ip_resolutions_for_domain {
meta:
  description = "IP resolutions for a certain domain"
  author = "google_ti"
  target_entity = "ip_address"
condition:
  vt.net.ip.reverse_lookup == "somedomain.com"
}