ArcSight & RSA ECAT Integration - By We-Ankor & Or Cohen

1. Or Cohen – We Ankor 2014
or@we-can.co.il

2. Saturday, May 17, 2014 slide 2
• Many daily alerts, even after advanced aggregation and correlation.
• Investigating a server/workstation is not always possible due to lack
of physical access, tools, time or knowledge.
• Just starting an investigation may take hours or even days – long
after the initial alert was triggered.
• Relevant evidence are hard to collect and analyze.

3. • Start an investigation for every single alert within seconds.
• Get to every host in the network regardless of physical location.
• Collect and analyze relevant evidence.
• Get actionable and refined data from the investigated host ASAP.
Saturday, May 17, 2014 slide 3

4. • Automatically deploy (and remove) ECAT agents across the network.
• Automatically scan hosts with multiple scan configurations.
• Automatically collect scan results from ECAT with full analysis data.
• Automatically react to the presence of a suspicious module.
Saturday, May 17, 2014 slide 4

5. Saturday, May 17, 2014 slide 5
Now what?

6. Saturday, May 17, 2014 slide 6
Install ECAT Agent OnWS87771

7. Saturday, May 17, 2014 slide 6

8. Saturday, May 17, 2014 slide 6

9. Saturday, May 17, 2014 slide 6
Module Name: 6re1fyeg1109.exe
Module Path: C:$Recycle.BinS-1-5-21-1844237615-1604221776-
725345543-151746re1fyeg1109.exe
MD5: A87480D346E943491EE107CDB90D2860
Host Name: WS8771
Host IP: 10.2.34.123
Bytes In: 3211
Bytes Out: 7651819
Target IP: 27.1.34.79
Target Host: superEvil.info
Target Port: 21
OPSWAT Verdict: Clean
YARA Verdict: Infected - super_evil_malware_group
Certificate Status: Not Singed
HASH Lookup: Unknown
S.L: 49
Comment:Found Infected on 19/05/2014 by:
super_evil_malware_group

10. Saturday, May 17, 2014 slide 6
Module Name: 6re1fyeg1109.exe
MD5: A87480D346E943491EE107CDB90D2860

11. Saturday, May 17, 2014 slide 6
Module Name: 6re1fyeg1109.exe
MD5: A87480D346E943491EE107CDB90D2860
WS8291
WS8101
WS2151
iexplore.exe
svchost.exe
tempp.exe

12. Saturday, May 17, 2014 slide 6
WS8291
WS8101
WS2151
Module Name: 6re1fyeg1109.exe
MD5: A87480D346E943491EE107CDB90D2860

13. Saturday, May 17, 2014 slide 6
AVVendor
Module Name: 6re1fyeg1109.exe
MD5: A87480D346E943491EE107CDB90D2860

14. Or Cohen – We Ankor 2014