Threat Hunting with a Chorus of Strings | Jonathan Ham

### Overview At Wild West Hackin' Fest in Deadwood, speaker Jonathan Ham explores low-fidelity network threat hunting under extreme operational constraints. Presenting a scenario where legacy packet captures (collected via WinPcap/WinDump) cannot be parsed by modern libpcap-based tools, Wireshark, or TCPDump, Ham sets out to prove that meaningful threat detection can still be achieved using nothing but the basic Unix utility `strings` against raw binary packet capture files.

### Key Topics The talk centers on detecting three distinct cyber attack scenarios using only `strings` without protocol reconstruction or packet disassembly: - **Watering Hole Attack & Portable Executable (PE) Identification:** Spotting cleartext HTTP traffic, file download artifacts, and dynamically linked libraries (DLLs) indicative of an executable transfer. - **ICMP-Based Data Exfiltration:** Recognizing non-standard, obfuscated, and base64-encoded payloads transmitted within ICMP Echo Request packets. - **DNS C2 Tunneling (iodine):** Hunting IP-over-DNS tunneling through character length profiling, 8-bit ASCII analysis, and identifying abnormal query names.

### Technical Details - **Scenario 1: Watering Hole & PE Detection:** Ham runs `strings -n 12` (filtering for sequences of at least 12 printable ASCII characters) and pipes output to `less`, using regex matching for HTTP `GET` and `Host` headers. The investigation reveals requests to `lab.jhamcorp.com`, retrieving assets and ultimately `notepad.exe`. Grepping for `.dll` strings confirms the payload is a Portable Executable. Inspection of sequential strings reveals server responses with `Content-Type: application/x-msdos-program` and file size metadata. Ham highlights an anti-malware evasion trick where the standard compiler string `This program cannot be run in DOS mode` was altered using a hex editor to evade basic string-matching heuristic detections while keeping the executable functional.

- **Scenario 2: ICMP Data Exfiltration:** Outbound ICMP is often permitted enterprise-wide despite regular users having no business need to ping external resources. Ham demonstrates how data exfiltration tools (such as `hping3`) chunk stolen files into small payloads (e.g., 200 bytes) to avoid triggering legacy Snort rules for oversized ICMP payloads (rules frequently disabled due to MTU path discovery false positives). Even when an attacker compresses (gzip) and base64-encodes the data before transmission, running `strings -n 12` on the packet capture immediately exposes unnatural, repetitive, non-standard text blocks in the ICMP payload space, confirming anomalous activity.

- **Scenario 3: DNS Tunneling via iodine:** The `iodine` tool tunnels arbitrary IP traffic over DNS by gzipping packets and encoding them (using base32, base64, or base128) into DNS query names, typically utilizing NULL, TXT, or private resource records. Normal network traffic rarely exhibits long printable domain names (typically under 30 characters). Ham analyzes internal vs. external tunnel captures using `strings` with 7-bit ASCII and 8-bit encoding (`-e S`). While standard traffic contained zero strings longer than 60 characters, the base128-encoded DNS tunnel traffic yielded thousands of strings exceeding 20, 40, 80, 100, and even 200 characters in length. Recurring domain patterns (`giveyouup.jhamcorp.com`) allowed the discovery of the C2 tunnel endpoint.

### Takeaways While relying solely on `strings` hides transport-layer metadata, source/destination IPs, ports, and protocols, it is sufficient to prove anomalous network behavior and validate hypotheses of malicious activity. Ham emphasizes that any system compromise will fundamentally alter its network and host behavior. When standard tools fail, primitive utilities can provide sufficient indicators to direct deeper file system and host-based forensic investigations. Ham also notes benchmarking findings that `ngrep` parses packets an order of magnitude faster than piping raw `strings` to `grep`.