Cloud-Based C2

#!/bin/bash
PCAP="$1"

echo "=== API-like User-Agents to cloud storage (non-browser = suspicious) ==="
# Real user-agent = browser string. API access = python-requests, Go-http-client, curl, etc.
tshark -r "$PCAP" -n \
  -Y "http.user_agent" \
  -T fields \
  -E separator="\t" \
  -e ip.src \
  -e http.host \
  -e http.user_agent \
  | grep -E "(sharepoint|github|slack|dropbox|googleapis|telegram|onedrive)" \
  | grep -iv "mozilla\|chrome\|safari\|firefox" \
  | sort | uniq -c | sort -rn | head -20

echo ""
echo "=== Beaconing intervals to known cloud APIs ==="
tshark -r "$PCAP" -n \
  -Y "tls.handshake.type==1" \
  -T fields \
  -E separator="\t" \
  -e frame.time_epoch \
  -e ip.src \
  -e tls.handshake.extensions_server_name \
  | grep -E "(sharepoint|github\.com|api\.github|slack\.com|googleapis|dropbox)" \
  | awk -F'\t' '
    {
      key=$2"\t"$3
      if (key in last_ts) {
        interval = $1 - last_ts[key]
        counts[key]++
        intervals[key] += interval
        sq_intervals[key] += interval*interval
      }
      last_ts[key] = $1
    }
    END {
      for (k in counts) {
        n = counts[k]
        if (n >= 5) {
          mean = intervals[k]/n
          # CV approximation
          printf "n=%d mean=%.0fs  %s\n", n, mean, k
        }
      }
    }
  ' | sort -t= -k2 -n | head -20

echo ""
echo "=== Telegram bot API access (unusual from enterprise) ==="
tshark -r "$PCAP" -n \
  -Y "tls.handshake.extensions_server_name contains \"telegram\"" \
  -T fields \
  -E separator="\t" \
  -e frame.time_epoch -e ip.src -e tls.handshake.extensions_server_name \
  | head -20

echo ""
echo "=== GitHub API from non-developer machines ==="
tshark -r "$PCAP" -n \
  -Y "http.host == \"api.github.com\" and not http.user_agent contains \"Mozilla\"" \
  -T fields \
  -E separator="\t" \
  -e frame.time_epoch -e ip.src -e http.user_agent -e http.request.uri \
  | head -20