Threat Hunting Exercise: Analyzing Firewall Egress Rule Abuse for Data Exfiltration Dataset

This hunt examines a simulated firewall dataset (fw_egress_abuse_exfil_2022-04-09T130000.json) capturing T1048.003: Exfiltration Over Unencrypted Non-C2 Protocol and T1567: Exfiltration Over Web Service, where an adversary abuses an overly-permissive "any-any" egress rule (originally created for a legacy application) to push a large volume of data to an unsanctioned external FTP server.

Step 1: Hypothesis Formation

Hypothesis: An internal host generates a sustained, high-volume outbound transfer (multiple GB) over FTP (TCP/21 control, high ephemeral data ports) or a permissive legacy rule, to an external destination that has never previously received traffic from the internal subnet, occurring outside business hours. Indicators:

• Firewall logs: single large outbound flow (or a burst of many flows) via a rule matched to a broad/legacy object (e.g., ANY-ANY-LEGACY-APP) rather than a purpose-specific rule.
• Byte count outbound >> byte count inbound (asymmetric, upload-heavy) - inconsistent with typical download-heavy user traffic.
• Destination IP/subnet has zero historical hits in the prior 90 days of firewall logs from this source subnet.
• Activity timestamp falls outside the source host's normal working-hours traffic baseline.

Null Hypothesis: The transfer is a legitimate, scheduled batch job (e.g., nightly vendor file transfer, backup replication) that happens to use the legacy rule. Invalidate by checking change-management/CMDB records for a documented, approved job matching this source/destination/schedule.

Rationale: Legacy firewall rules accumulate over years and are rarely re-reviewed; this hunt validates whether stale, overly-broad rules are being actively exploited as an exfiltration path, and produces evidence to justify rule cleanup.

Step 2: Data Sources and Scope

• Sources: Perimeter firewall traffic logs (rule-name field included); NetFlow/IPFIX for byte-volume corroboration; Change Management/CMDB (for legitimacy cross-check).
• Scope: ~2022-04-09T13:00:00-15:30:00 UTC (outside documented 08:00-18:00 local business hours for the source segment); Host: SRV-FILE-08 (10.30.5.12); Destination: 91.214.63.19:21.
• SIEM Queries (Splunk/ELK):
• Rule-matched volume: index=firewall rule_name="ANY-ANY-LEGACY-APP" | stats sum(bytes_out) as total_out by src_ip, dest_ip | sort -total_out
• Novel destination check: index=firewall src_ip="10.30.5.12" earliest=-90d | stats values(dest_ip) as historical_dests
• Off-hours filter: index=firewall src_ip="10.30.5.12" | eval hour=strftime(_time,"%H") | where hour<8 OR hour>18

Step 3: Key Findings

Parsed events (8 shown) confirm 6.4 GB transferred to a previously-unseen external FTP host via the legacy any-any rule, entirely outside business hours.

Validation:

• Timeline: Three large sequential transfers to a brand-new destination, immediately following FTP session establishment, closed cleanly - consistent with a scripted bulk-exfiltration job, not exploratory or interactive use.
• False Positives: CMDB cross-check found no approved job; the legacy rule's documented original purpose does not match this destination - ruled out as legitimate.
• Correlation: Single source host, single external destination, single rule - a narrow, high-confidence indicator set; recommend checking SRV-FILE-08 for a compromised service account or scheduled task as the delivery mechanism.

Step 4: Recommendations & Next Steps

• Immediate Response: Block 91.214.63.19 at the perimeter; disable/rotate the service account associated with SRV-FILE-08's outbound job; review SRV-FILE-08 for scheduled tasks, cron-equivalents, or unauthorized scripts created around 2022-04-09 13:00 UTC; scope the Finance share for what was actually accessed/read prior to transfer.
• Detection: Sigma-style rule: title: Legacy Firewall Rule Large-Volume Novel-Destination Transfer → selection: rule_name IN (legacy_rule_list) AND bytes_out > 500MB AND dest_ip NOT IN (dest_ip_90day_history) - alert and require manual review before allow.
• Pro Tip: Treat firewall rule review as an ongoing hunting input, not just an annual audit task - cross-reference every "any-any" or overly broad legacy rule against 90-day destination novelty on a recurring schedule; stale rules are one of the most common quiet exfiltration paths in mature networks.

Hypothesis confirmed - a stale, overly-permissive legacy firewall rule was actively exploited to exfiltrate 6.4 GB of data to a previously unseen external FTP server outside business hours!