Situational Awareness: Nefarious Activity Observed over the Memorial Day Long Weekend from a Rogue Nation

Situational Awareness is “the understanding of an environment and its elements, and how it changes concerning time and other factors. Situational Awareness is important for effective decision-making in many environments” [Wikipedia]. In the case of an IT infrastructure of an organization, the goal of Situational Awareness with Ennetix xVisor is to provide information on:

• What are the entities on the network? 
• What behaviors does each entity exhibit (suggesting entity type)?
• Are any of these behaviors a concern
• Have any entities recently changed their behaviors?  (see Situational Awareness: “You Know What You Know”).

If you are responsible for an enterprise network, or even a single Internet-facing computer, your systems are constantly being scanned, probed, and potentially used in attacks against other systems. This is the background noise of the Internet. Detecting whether you are under attack should not be your focus—you are under attack. What you need to determine is (1) whether your systems have been compromised and (2) whether the nature of the attacks has changed. If a compromise occurs, you know the steps to take. However, if the nature of the attacks significantly changes, you must remain vigilant, as attackers may have discovered new methods, and these shifts in tactics could disrupt normal operations. To address this issue, you must understand the baseline behavior of your network, its components, and even the attackers. The process of establishing these baselines and detecting deviations is called User and Entity Behavior Analytics (UEBA). 

Nefarious cybersecurity activity was discovered by Ennetix xVisor at one of our clients in the Midwestern US (hereafter referred to as ORG). This attack occurred over the Memorial Day long weekend, starting at 12:00 am (local time) on Saturday, and lasting about 72 hours! The attack got through ORG’s Firewall (a product from a well-known firewall vendor). The activity originated from a rogue nation, and the summary of the attack is below:

• Date range: May 26, 12 am, to May 28, 11 pm
• Internal SSH scanning (10.81.51.6)
• DDoS using ORG’s resources to attack others
• Badly-behaving DNS client (xxx.xxx.226.210)
• Three anomalous DNS query spikes received
• Multiple anomalous DNS query spikes made

Note that SSH scanning and DDoS leveraging DNS are common attack methods. However, establishing baselines for behaviors is very important and seems to be ignored by many organizations. Details on various situational awareness follow.