Introducing Hunt Advanced Search
January 30, 2024
Have you ever run multiple searches seeking to identify malicious infrastructure only to be left frustrated and with more questions than when you started?
Today, we are happy to introduce the Advanced Search feature for Hunt.
Designed with an easy-to-use language to specifically query the data Hunt scans, researchers and threat hunters alike can discover hidden gems in open directories, track well-known frameworks used for initial access, or search for one-of-a-kind TLS certificates; Advanced Search is key to unlocking the secrets of the internet.
Let’s Get Started: Query Syntax & Examples
Advanced Search focuses on three categories when searching data: Malware, Certificates, and Opendir files. Each category has a data schema and example values, allowing users to immediately experience the tool's power.
The below figure depicts what users see when navigating to the Advanced Search page.
Figure 1: Advanced Search Page
For reference, let’s cover a few of the more common queries along with a screenshot from each category threat hunters are likely to use throughout an investigation:
Searching for newly identified Quasar RAT infrastructure
Figure 2: Snippet of query results for Quasar infrastructure
Notice that, like any other modern query language, we can combine queries for a more comprehensive result.
Using the “AND” operator in addition to “seen_last,” we can filter our results to only those scanned in the last 7 days.
TLS certificate subject common name default Cobalt Strike
Figure 3: Snippet of query results for default Cobalt Strike certificate common name
Presence of Fast Reverse Proxy configuration files on open directories
Figure 4: Snipped of query results for FRP config files
Enough of the example queries; let’s dig into some real-world examples and put Advanced Search to the test!
JA4X & Sliver
This first example will combine the power of John Althouse’s JA4+ suite, specifically JA4X ( https://github.com/FoxIO-LLC/ja4 ), with Hunt’s ability to search across subject and issuer information from TLS certificates.
Figure 5: Snippet of query results for Sliver certificates.
The query in the screenshot above searches for certificates matching the JA4X hash but does not use the default subject or issuer common names hardcoded into the Sliver framework.
Cobalt Strike Redirector
RedWarden (https://github.com/mgeeky/RedWarden), is an open-source Cobalt Strike C2 reverse proxy meant to throw researchers off the scent of adversary infrastructure.
Let’s find some recent instances of RedWarden hosted on DigitalOcean.
Figure 6: Snippet of query results for RedWarden on Digital Ocean infrastructure
OpenDirs & CVE’s
Past Hunt blog articles have focused on just how important open directories can be to threat hunting and incident response.
In addition to the large number of executables, log and configuration files and whatever else is exposed, many open directories also host exploit code for common vulnerabilities and exposures (CVE), past and present.
See the below screenshot for exploit code identified by Hunt in open directories across the past 7 days.
Figure 7: Snippet of query results for opendir exploit code
We’ve only scratched the surface of what is capable when using Advanced Search. In just a line or two, researchers, threat hunters, and the curious can identify malicious infrastructure first seen a couple minutes ago, or track the steps of an adversaries infrastructure from a few months ago.
If you haven’t already, apply for a Hunt account, and if you find something interesting share your query with the community.