Introducing Hunt Advanced Search

Have you ever run multiple searches seeking to identify malicious infrastructure only to be left frustrated and with more questions than when you started?

Today, we are happy to introduce the Advanced Search feature for Hunt.

Designed with an easy-to-use language to specifically query the data Hunt scans, researchers and threat hunters alike can discover hidden gems in open directories, track well-known frameworks used for initial access, or search for one-of-a-kind TLS certificates; Advanced Search is key to unlocking the secrets of the internet.

Let's Get Started: Query Syntax & Examples

Advanced Search focuses on three categories when searching data: Malware, Certificates, and Opendir files. Each category has a data schema and example values, allowing users to immediately experience the tool's power.

The below figure depicts what users see when navigating to the Advanced Search page.

For reference, let's cover a few of the more common queries along with a screenshot from each category threat hunters are likely to use throughout an investigation:

Searching for newly identified Quasar RAT infrastructure

• Query: malware_name:"Quasar"

Notice that, like any other modern query language, we can combine queries for a more comprehensive result.

Using the "AND" operator in addition to "seen_last," we can filter our results to only those scanned in the last 7 days.

TLS certificate subject common name default Cobalt Strike

• subject.common_name:"

Presence of Fast Reverse Proxy configuration files on open directories

• file_key://frpc.ini$/ AND modified:>now-30d

Enough of the example queries; let's dig into some real-world examples and put Advanced Search to the test!

JA4X & Sliver

This first example will combine the power of John Althouse's JA4+ fingerprinting suite, specifically JA4X ( https://github.com/FoxIO-LLC/ja4 ), with Hunt's ability to search across subject and issuer information from TLS certificates.

The query in the screenshot above searches for certificates matching the JA4X hash but does not use the default subject or issuer common names hardcoded into the Sliver framework.

Cobalt Strike Redirector

RedWarden (https://github.com/mgeeky/RedWarden), is an open-source Cobalt Strike C2 reverse proxy meant to throw researchers off the scent of adversary infrastructure.

Let's find some recent instances of RedWarden hosted on DigitalOcean.

OpenDirs & CVE's

Past Hunt blog articles have focused on just how important open directories can be to cyber threat hunting and incident response.

In addition to the large number of executables, log and configuration files and whatever else is exposed, many open directories also host exploit code for common vulnerabilities and exposures (CVE), past and present.

See the below screenshot for exploit code identified by Hunt in open directories across the past 7 days.

Conclusion

We've only scratched the surface of what is capable when using Advanced Search. In just a line or two, researchers, threat hunters, and the curious can identify malicious infrastructure first seen a couple minutes ago, or track the steps of an adversaries infrastructure from a few months ago.

If you haven't already, apply for a Hunt account, and if you find something interesting share your query with the community.