Carbon Spider

FIN7 is leveraging Halfbaked malware to establish persistence and conduct command and control (C2) operations within compromised networks, using HTTP and TLS protocols with specific URL structures (e.g., `http://[IP_ADDRESS]/cd`) and common ports (53, 80, 8080, 443) for detection evasion and data exfiltration.

FIN7 threat group utilizes a specific Domain Generation Algorithm (DGA) for command and control (C2), characterized by domains with 4-5 alphabetic characters and specific top-level domains such as .pw, .us, .club, .info, .site, or .top, enabling persistence and continued operations within target networks.

Adversaries, notably FIN7, deploy Cobalt Strike beacons on compromised systems to establish command and control (C2) channels, utilizing specific network activity algorithms and domain naming conventions for communication over protocols like HTTP or TLS, posing a critical risk of further compromise and data exfiltration.

A high-severity threat involves the abuse of `curl.exe` on Windows systems to download potentially malicious files from various public file-sharing and content delivery network (CDN) domains, a technique observed in campaigns by threat actors such as FIN7, leading to further system compromise.

This brief documents the detection of Cobalt Strike command and control activity through identifying specific domain naming conventions used by its implant beacons, indicative of network attack and exploitation campaigns.

Detection of command-line tools such as `ipconfig.exe` and `systeminfo.exe` being executed from non-standard parent processes can indicate system discovery activity by threat actors like FIN7 using injected processes.

This rule detects command and control activity associated with the FIN7 threat group, which is known to use domain generation algorithms (DGA) to maintain persistence in their target's network by identifying network traffic using TLS or HTTP protocols to domains with a specific pattern.