Threat actors are lazy. They reuse the same server configurations, even when they host different campaigns. Instead of hunting for content (which changes), we can hunt for the server’s unique technical “fingerprint.”
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
The Example: A phishing domain harborfrieght[.]shop was identified. The Technique: We can extract the server’s unique technical signatures. Even if the actor hosts a completely different lure (like a “jeans ad” found in the wild), the underlying server setup is often identical.
The key indicators to pivot on are:
HHV (HTTP Hash): f2bbb45599ecd7349b164c98a8
JARM (TLS Fingerprint): 27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6
The Goal: Run a query to find all domains hosted on infrastructure with these exact HHV and JARM fingerprints. This technique cuts through the noise of different domain names and content, tying disparate campaigns to a single actor.
The Result: This precise, multi-layered search successfully identifies high-fidelity phishing sites, such as the convincing clone gmaii.email, while completely ignoring legitimate Google infrastructure.
Try this example yourself using our free Community Edition:
The post Powerful Pivots: Hunting with Infrastructure Fingerprints appeared first on Silent Push.
Article Link: Powerful Pivots: Hunting with Infrastructure Fingerprints - Silent Push