Chasing AMMYY at Splunk .conf

The Encrypted Visibility Engine (EVE) in Firewall Threat Defense (FTD) has demonstrated the capability to distinguish between closely related malware strains, such as AMMYY and its derivative, Flawed AMMYY, using granular session fingerprinting. Detections for Flawed AMMYY often appear in pairs—one HTTP and one HTTPS—sharing identical timestamps from a single IP address. EVE applies different Confidence Scores based on the protocol; it assigns a higher score to the HTTP connection because it can observe full session details, even though its visibility into encrypted HTTPS traffic is important.
When examining these events via Splunk logs, the difference in visibility becomes clear: the HTTP session reveals not only the destination IP and URL but also a tangible download attempt for an executable file (.exe). This granular detail elevates EVE's confidence score significantly compared to the HTTPS connection alone. Network packet capture analysis confirms that this dual behavior suggests an endpoint initiates an HTTP request, receives a 301 redirect (which fails in the initial HTTP exchange), and then pivots to the HTTPS connection for the actual data transfer.

EVE detections track consistent malware related detections including Upatre, Xpiro, and Quasar from conferences.
A new detection in the Splunk .conf network was Flawed AMMYY.
AMMYY is a remote access tool often used in scams.
Flawed AMMYY is a RAT derived from leaked AMMYY source code and is utilized as malware.
EVE utilizes granular session fingerprinting to differentiate between similar applications like AMMYY and Flawed AMMYY.
EVE detections for Flawed AMMYY appeared in pairs with identical timestamps originating from a single IP address.
One connection type observed was HTTP, featuring a visible download attempt of an .exe file.
The other corresponding connection was HTTPS.
EVE assigns a higher Confidence Score to the HTTP session because it observes full session details.
TLS decryption would yield visibility equivalent to EVE's observation on decrypted HTTPS sessions.
Analysis of packet capture showed an endpoint attempting a GET request for an .exe, followed by a 301 redirect from the server.

The underlying paradigm driving this narrative is the relentless push toward increasing observability within increasingly encrypted digital environments. The core assumption being challenged is that encryption equals opacity; instead, the presentation suggests that rich metadata gleaned at lower levels of protocol interaction (like HTTP session data or TLS handshake analysis) provides a robust mechanism to infer malicious activity even when application payloads are obscured by HTTPS. This positions threat detection less as a decryption battle and more as an advanced pattern-matching exercise applied across protocol boundaries.
The strength of the argument rests on demonstrating how partial visibility—the ability to see redirects, initiation requests, and protocol switching—can elevate forensic certainty from moderate (e.g., 82% confidence on HTTPS) to near-certainty (99% on HTTP). However, this model inherently relies on endpoint activity being perfectly synchronized or exhibiting predictable dual behavior for the detection to fire cohesively. The cost borne by defenders is a reliance on complex correlation across network artifacts (EVE/Splunk) and deeper forensic evidence (packet capture), suggesting that simple perimeter defenses are functionally insufficient against modern threats.
This narrative positions security vendors as sophisticated interpreters of protocol leakage, turning "blind spots" into defined attack vectors with specific confidence scores. The benefit accrues to those who possess the advanced analytical tooling capable of this granular cross-protocol assessment. If threat actors evolve to mask their redirect or download sequencing across multiple disparate protocols simultaneously, will EVE's current model remain effective? Furthermore, what is the operational overhead for an organization to maintain the infrastructure necessary to generate and correlate these high-fidelity events?
Patterns detected: none
A bad actor employing influence tactics would likely present this efficacy claim without grounding it in a generalized threat landscape, instead tying the vendor’s capability directly to overcoming current market weaknesses (i.e., "traditional security fails against encrypted traffic"). The article does not match this; instead, it focuses on specific technical proof points derived from proprietary testing environments.