Systems and methods for attributing potentially malicious email campaigns to known threat groups

Patent metadata

Field	Value
Publication number	US-9548988-B1
Application number	US-201414461810-A
Country	US
Kind code	B1
Filing date	Aug 18, 2014
Priority date	Aug 18, 2014
Publication date	Jan 17, 2017
Grant date	Jan 17, 2017

Abstract

The disclosed computer-implemented method for attributing potentially malicious email campaigns to known threat groups may include (1) identifying a potentially malicious email campaign targeting at least one organization, (2) detecting, within the potentially malicious email campaign, an incriminating feature that has been linked to a known threat group, (3) determining, based at least in part on detecting the incriminating feature linked to the known threat group, that the known threat group is likely responsible for the potentially malicious email campaign, and then in response to determining that the known threat group is likely responsible for the potentially malicious email campaign, (4) attributing the potentially malicious email campaign to the known threat group. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for attributing potentially malicious email campaigns to known threat groups, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying a potentially malicious email campaign targeting at least one organization;
detecting an attachment within at least one email included in the potentially malicious email campaign;
executing the attachment detected within the email included in the potentially malicious email campaign;
determining that, upon execution, the attachment causes a remote download of malicious code;
executing at least a portion of the malicious code whose remote download was caused by the attachment;
observing, while executing the portion of the malicious code, at least one dynamic characteristic of the malicious code, wherein the dynamic characteristic of the malicious code comprises contacting a Command and Control (C&C) domain during execution of the malicious code;
determining that the C&C domain has been linked to a known threat group;
determining, based at least in part on the C&C domain being linked to the known threat group, that the known threat group is likely responsible for the potentially malicious email campaign;
in response to determining that the known threat group is likely responsible for the potentially malicious email campaign, attributing the potentially malicious email campaign to the known threat group.

2. The method of claim 1 , wherein determining that the attachment causes the remote download of malicious code comprises:
identifying a data cluster that specifies a plurality of features linked to the known threat group;
identifying the C&C domain within the data cluster.

3. The method of claim 2 , further comprising, prior to identifying the C&C domain within the data cluster:
identifying an open-source intelligence resource indicating that the C&C domain is allegedly connected to the known threat group;
linking, based at least in part on the open-source intelligence resource, the C&C domain to the known threat group by adding the C&C domain to the data cluster.

4. The method of claim 1 , wherein identifying the potentially malicious email campaign targeting the organization comprises identifying a plurality of emails addressed to the targeted organization.

5. The method of claim 1 , wherein determining that the C&C domain has been linked to the known threat group comprises:
identifying at least one static characteristic of the C&C domain;
determining that the static characteristic of the C&C domain is linked to the known threat group.

6. The method of claim 1 , wherein determining that the C&C domain has been linked to the known threat group comprises:
identifying at least one additional dynamic characteristic of the C&C domain;
determining that the additional dynamic characteristic of the C&C domain is linked to the known threat group.

7. The method of claim 6 , wherein identifying the dynamic characteristic of the C&C domain comprises:
executing at least a portion of the malicious code downloaded from the C&C domain;
observing, while executing the portion of the malicious code, the additional dynamic characteristic of the malicious code.

8. The method of claim 7 , wherein the additional dynamic characteristic of the malicious code comprises downloading an additional file via the Internet.

9. The method of claim 1 , wherein the attachment comprises at least one of:
a file;
a Uniform Resource Locator (URL) to a malicious website.

10. The method of claim 1 , further comprising notifying the targeted organization that the known threat group is likely responsible for the potentially malicious email campaign.

11. A system for attributing potentially malicious email campaigns to known threat groups, the system comprising:
an identification module, stored in memory, that:
identifies a potentially malicious email campaign targeting at least one organization;
detects an attachment within at least one email included in the potentially malicious email campaign;

an automation module, stored in memory, that executes the attachment detected within the email included in the potentially malicious email campaign;
a determination module, stored in memory, that determines that, upon execution, the attachment causes a remote download of malicious code;
wherein:
the automation module executes at least a portion of the malicious code whose remote download was caused by the attachment;
the identification module observes, while executing the portion of the malicious code, at least one dynamic characteristic of the malicious code, wherein the dynamic characteristic of the malicious code comprises contacting a Command and Control (C&C) domain during execution of the malicious code;
the determination module:
determines that the C&C domain has been linked to a known threat group;
determines, based at least in part on the C&C domain being linked to the known threat group, that the known threat group is likely responsible for the potentially malicious email campaign;

an attribution module, stored in memory, that attributes the potentially malicious email campaign to the known threat group in response to the determination that the known threat group is likely responsible for the potentially malicious email campaign;
at least one physical processor that executes the identification module, the automation module, the determination module, and the attribution module.

12. The system of claim 11 , wherein the identification module:
identifies a data cluster that specifies a plurality of features linked to the known threat group;
identifies the C&C domain within the data cluster.

13. The system of claim 12 , wherein:
the identification module identifies an open-source intelligence resource indicating that the C&C domain is allegedly connected to the known threat group;
the attribution module links, based at least in part on the open-source intelligence resource, the C&C domain to the known threat group by adding the C&C domain to the data cluster.

14. The system of claim 11 , wherein the identification module identifies a plurality of emails addressed to the targeted organization.

15. The system of claim 11 , wherein:
the identification module identifies at least one static characteristic of the C&C domain;
the determination module determines that the static characteristic of the C&C domain is linked to the known threat group.

16. The system of claim 11 , wherein:
the identification module identifies at least one additional dynamic characteristic of the C&C domain;
the determination module determines that the additional dynamic characteristic of the C&C domain is linked to the known threat group.

17. The system of claim 16 , further comprising an automation module that executes at least a portion of the malicious code downloaded from the C&C domain;
wherein the identification module observes, during execution of the portion of the malicious code, the additional dynamic characteristic of the malicious code.

18. The system of claim 17 , wherein the additional dynamic characteristic of the malicious code comprises downloading an additional file via the Internet.

19. The system of claim 11 , wherein the attachment comprises at least one of:
a file;
a Uniform Resource Locator (URL) to a malicious website.

20. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, wh

Assignees

• Symantec Corp

Inventors

• Roundy Kevin Alejandro
• Thonnard Olivier

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L67/01

  Protocols · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title