#bothunter

[thehighaspeccouncil]

As the bots continue to spread in our tag, we have hired another promising BotHunter.

Please welcome Michael.

He's more the silent type.

He likes pumpkins. 🎃

And he only takes one day off a year...

[thehighaspeccouncil]

We are the High Aspec Council.

We are currently residing on an abandoned oil rig in the North Sea. Or in a sleeping volcano on an island in the Pacific. Or in a secret high-tech fortress hidden in the ice of Antarctica. Or anywhere else.

For centuries we were working from the shadows to asexualise the world.

The bot invasion of the asexual tag has forced us to take direct action.

We hunt bots. We slay bots. We kill bots. We shoot, stab, crush and massacre bots.

And we do like to blow them up.

Anyway, you may contact us and ask anything you like. Although you might not like the answers (insert sinister laugh here).

So, you who have read this, go forth and be ace, have fun and kill bots.

[metaflows]

More file extraction testing. Here we're looking at the highest ranked bothunter event for the last week, which is classified as "/snort-trojan-activity/Egg Download/: 1.7002773:E3-Egg Download ET TROJAN FSG Packed Binary via HTTP Inbound". The reputation result from SRI is expected, and the direct integration to virustotal is working well. 

Still not entirely sure why ntop is calling the windows client honeypot "ubuntu", probably some kind of netbois naming confusion.

[metaflows]

Yesterdays BotHunter Events page. 30 excellent examples of infected systems and their profile data. Unfortunately the IP rep links aren't publicly accessible right now.. but hopefully that will get fixed soon. 

[metaflows]

The staff here at MetaFlows has been given charge of setting up a google group for BotHunter users. This group is for helping people make the best of BotHunter. We use it in lots of deployments around the world and could not exist without it. We have a lot to contribute to the community of BotHunter users and hope you will share your ideas.

Feel free to join and share your experiences, ask questions, or brainstorm with us. 

[metaflows]

Up to date list of current known malicious systems that have been identified by BotHunter users, Including forensic confidence data (number of users reporting, number of infection reports associated)

[metaflows]

The Malware Lifecycle

BotHunter is capable of declaring a host infected when either of three dialog sequence combinations are observed:

Condition 1: Evidence of a local host infection, and evidence of outward malware coordination or attack propagation, or  Condition 2: At least two distinct signs of outward bot coordination, attack propagation, or attacker preparation sequences are observed. Condition 3:  Evidence that a local host has attempted to establish communication with a confirmed malware control host or drop site.

Learn more about BotHunter:

BotHunter.net

MetaFlows BotHunter Local Correlation

[metaflows]

Event categories for classifying the stages and types of malware communications. You can learn more at the BotHunter website http://www.bothunter.net/releasenotes.html 

http://www.metaflows.com/technology/bothunter/