# Network Protocol Indicators of Malicious Activity

Organized reference of suspicious network behaviors by protocol, for use during
malware traffic analysis.

## DNS

### Suspicious Indicators

| Indicator | Description | Severity |
|-----------|-------------|----------|
| High NXDOMAIN ratio | >30% of queries returning NXDOMAIN | High - DGA activity |
| Long subdomains | Subdomain labels >30 characters | High - DNS tunneling |
| High query volume to single domain | >100 queries/minute to one domain | High - Tunneling or DGA |
| TXT record queries with encoded data | Base64/hex in TXT queries | High - DNS tunneling |
| Random-looking domain names | High entropy domain labels | Medium - DGA |
| Queries to suspicious TLDs | .tk, .ml, .ga, .cf, .xyz | Medium |
| Direct IP DNS requests | DNS queries bypassing local resolver | Medium |
| DNS over non-standard ports | DNS traffic on ports other than 53 | High |
| Multiple A records rapidly changing | Same domain resolving to many IPs | Medium - Fast flux |
| NULL/ANY record queries | Unusual record types | Low-Medium |

### Common DNS Tunneling Tools

- **iodine**: Uses NULL records, domains end with tunnel domain
- **dnscat2**: Uses TXT/CNAME records, hex-encoded subdomains
- **dns2tcp**: Uses TXT records, base64-encoded data
- **Cobalt Strike DNS**: Configurable, often uses A records with encoded subdomains

---

## HTTP

### Suspicious Indicators

| Indicator | Description | Severity |
|-----------|-------------|----------|
| POST to raw IP | HTTP POST requests to IP addresses (no domain) | High |
| Encoded URL parameters | Base64/hex in query strings or POST body | Medium-High |
| Non-browser User-Agent | UA strings not matching known browsers | Medium |
| Empty or missing User-Agent | No UA header in requests | Medium |
| Regular interval requests | Periodic HTTP calls (beaconing) | High |
| Unusual HTTP methods | PUT, DELETE, PATCH to unexpected endpoints | Medium |
| Large POST requests | POST body >1MB without file upload context | High - Exfiltration |
| HTTP on non-standard ports | HTTP traffic on ports other than 80/8080 | Medium |
| Cookie-based data transfer | Large or encoded cookies for C2 data | Medium-High |
| Abnormal header order | Non-standard HTTP header ordering | Low-Medium |

### Common Malware HTTP Patterns

```
# Cobalt Strike default
GET /search?q=<encoded> HTTP/1.1
POST /submit.php HTTP/1.1

# Metasploit Meterpreter
GET /INITM HTTP/1.1
POST /INITM HTTP/1.1

# Generic C2 check-in
GET /gate.php?id=<bot_id>&cmd=check HTTP/1.1
POST /panel/gate.php HTTP/1.1

# Exfiltration via GET parameters
GET /api/update?data=<base64_encoded_stolen_data> HTTP/1.1
```

---

## HTTPS/TLS

### Suspicious Indicators

| Indicator | Description | Severity |
|-----------|-------------|----------|
| Self-signed certificates | Certificate not issued by trusted CA | Medium-High |
| Short certificate validity | Valid for <30 days | Medium |
| Mismatched CN/SAN | Certificate subject does not match requested domain | Medium |
| Known malicious JA3 hash | Client TLS fingerprint matches malware | High |
| TLS on non-standard ports | Encrypted traffic on unusual ports | Medium |
| Unusual cipher suites | Weak or uncommon cipher selections | Low-Medium |
| Certificate with no organization | Empty Org field in certificate | Medium |
| Let's Encrypt cert on suspicious domain | Free cert + DGA/suspicious domain | Medium |
| Expired certificate accepted | Client accepts expired TLS cert | Medium |
| TLS 1.0/1.1 usage | Outdated TLS versions | Low |

---

## SMTP/Email

### Suspicious Indicators

| Indicator | Description | Severity |
|-----------|-------------|----------|
| SMTP from non-mail process | Unexpected process sending email | High |
| Direct SMTP (bypassing relay) | Connection to port 25 on external MX | Medium-High |
| Large attachment encoding | Base64-encoded executable attachments | High |
| Mismatched EHLO/HELO | HELO hostname does not match source | Medium |
| Bulk email sending | High volume outbound SMTP | Medium - Spam bot |
| SMTP on non-standard ports | Email on ports other than 25/465/587 | Medium |

---

## IRC

### Suspicious Indicators

| Indicator | Description | Severity |
|-----------|-------------|----------|
| Any IRC traffic | IRC increasingly uncommon in legitimate use | Medium |
| IRC to non-standard ports | IRC on ports other than 6667/6697 | High |
| JOIN to suspicious channels | Channel names with hex/random strings | High |
| PRIVMSG with encoded data | Base64/hex data in messages | High |
| Mass JOIN commands | Joining many channels rapidly | Medium - Botnet |
| IRC over TLS/SSL | Encrypted IRC to unknown servers | Medium |

---

## SMB/CIFS

### Suspicious Indicators

| Indicator | Description | Severity |
|-----------|-------------|----------|
| SMB to external IPs | Port 445 traffic leaving network | Critical |
| EternalBlue signatures | MS17-010 exploit traffic patterns | Critical |
| Admin share access | Access to C$, ADMIN$, IPC$ | High |
| PsExec patterns | Named pipe creation for remote execution | High |
| Large file transfers over SMB | Unusual data volume | Medium-High |
| SMB relay traffic | NTLM authentication relay patterns | High |

---

## Custom/Unknown Protocols

### Suspicious Indicators

| Indicator | Description | Severity |
|-----------|-------------|----------|
| High-entropy payload | Encrypted/compressed custom protocol data | Medium-High |
| Regular beacon intervals | Periodic connections on unusual ports | High |
| Consistent packet sizes | Fixed-size messages (structured C2 protocol) | Medium |
| XOR-encoded traffic | Patterns suggesting single-byte XOR | High |
| Raw TCP with binary data | Non-text protocol on unusual port | Medium |
| Heartbeat packets | Small periodic keep-alive messages | Medium |

### Identification Techniques

1. **Entropy analysis**: High entropy suggests encryption/compression
2. **Magic bytes**: Check first bytes for known protocol signatures
3. **Packet size distribution**: Fixed sizes suggest structured protocol
4. **Timing analysis**: Regular intervals suggest automated communication
5. **Port analysis**: Well-known port misuse (e.g., HTTP on port 443 without TLS)

---

## ICMP

### Suspicious Indicators

| Indicator | Description | Severity |
|-----------|-------------|----------|
| ICMP tunneling | Data in ICMP echo payload beyond normal ping | High |
| Large ICMP packets | ICMP packets >100 bytes payload | Medium-High |
| High ICMP volume | Excessive ping traffic to single destination | Medium |
| ICMP type anomalies | Unusual ICMP types (e.g., type 0 with data) | Medium |

---

## General Network Indicators

| Indicator | Description | Severity |
|-----------|-------------|----------|
| Traffic at unusual hours | Network activity outside business hours | Medium |
| Geographic anomalies | Connections to unexpected countries | Medium |
| Port scanning patterns | Sequential or common port probing | High |
| Multiple failed connections | Repeated connection attempts to many hosts | Medium |
| Protocol tunneling | One protocol encapsulated in another | High |
| Tor/proxy usage | Connections to known Tor entry/exit nodes | Medium-High |