Adversaries may use peer-to-peer networks to exfiltrate data or establish command and control channels without relying on traditional infrastructure. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential covert communication channels and mitigate advanced persistent threat activities.
YARA Rule
rule network_p2p_win {
meta:
author = "x0r"
description = "Communications over P2P network"
version = "0.1"
strings:
$c1 = "PeerCollabExportContact"
$c2 = "PeerCollabGetApplicationRegistrationInfo"
$c3 = "PeerCollabGetEndpointName"
$c4 = "PeerCollabGetEventData"
$c5 = "PeerCollabGetInvitationResponse"
$c6 = "PeerCollabGetPresenceInfo"
$c7 = "PeerCollabGetSigninOptions"
$c8 = "PeerCollabInviteContact"
$c9 = "PeerCollabInviteEndpoint"
$c10 = "PeerCollabParseContact"
$c11 = "PeerCollabQueryContactData"
$c12 = "PeerCollabRefreshEndpointData"
$c13 = "PeerCollabRegisterApplication"
$c14 = "PeerCollabRegisterEvent"
$c15 = "PeerCollabSetEndpointName"
$c16 = "PeerCollabSetObject"
$c17 = "PeerCollabSetPresenceInfo"
$c18 = "PeerCollabSignout"
$c19 = "PeerCollabUnregisterApplication"
$c20 = "PeerCollabUpdateContact"
condition:
5 of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 20 string patterns in its detection logic.
Scenario: Legitimate peer-to-peer file sharing using BitTorrent for software updates
Filter/Exclusion: Exclude traffic involving known BitTorrent clients (e.g., utorrent, qBittorrent) and associated tracker domains (e.g., tracker.example.com)
Scenario: Internal team collaboration using a secure P2P-based file sync tool like Resilio Sync
Filter/Exclusion: Exclude traffic from the Resilio Sync client (resilio-sync) and internal sync domains (e.g., sync.internal.company.com)
Scenario: Scheduled system backups using a P2P-based backup solution (e.g., Syncthing)
Filter/Exclusion: Exclude traffic from Syncthing (syncthing) and internal peer discovery domains (e.g., discovery.syncthing.net)
Scenario: Admin task to transfer large files between servers using a P2P-like protocol (e.g., IPFS for internal use)
Filter/Exclusion: Exclude traffic from IPFS nodes (ipfs) and internal IPFS gateways (e.g., gateway.internal.company.com)
Scenario: User-initiated file sharing between workstations using a P2P tool like FileZilla in a trusted internal network
Filter/Exclusion: Exclude traffic from FileZilla (filezilla) and internal IP ranges (e.g., 192.168.0.0/16)