SlideShare une entreprise Scribd logo

Security Risk Advisors - BSides Philadelphia 2017 - Threat Hunting: Defining the Process While Circumventing Corporate Obstacles

•Télécharger en tant que PPTX, PDF•
•
D
Douglas Webster

Threat hunting is a hot topic spurred on by the thought that it’s not a matter of IF, but WHEN, your organization will be breached. Mature security organizations are shifting in their approach from solely relying on reactive response and black box security tools to proactive hunting. This shift in approach requires large amounts of network and endpoint data to tie together attacker tools, tactics, and procedures. Security teams often have their hands tied due to limited budgets, politics and their ability to affect change with what information gets logged (just try getting a DNS admin to check a box that says “Debug” in prod). Hypothesis driven data acquisition can be used to overcome environmental challenges, provide a specific goal, and reduce analysis paralysis. This presentation will discuss hypothesis driven threat hunting using free and commercial tools for organizations which face common corporate roadblocks.

Technologie
1  sur  41
Threat Hunting Defining the Process While Circumventing Corporate Obstacles December 2017
Introductions Our success together is driven by the trusted relationships we build. We work closely with our clients to improve their strategy and programs, assess controls and threats, and implement and operate the best solutions based on their unique needs and business environments. Matt Schneck Threat Management Senior Consultant Focus: Endpoint Engineer & Data Analysis GIAC Certified Forensic Examiner (GCFE) Ryan Andress Threat Management Consultant Focus: Incident Response & Data Analysis GIAC Certified Forensic Analyst (GCFA) Kevin Foster Threat Management Senior Consultant Focus: Incident Response & Data Acquisition GIAC Certified Forensic Analyst (GCFA) GIAC Certified Reverse Engineering Malware (GREM)
What is Threat Hunting? Preparation & Communication Threat Hunting Framework Post Hunt Agenda
Objectives  Identify compromised systems and accounts  Improve security monitoring detection rules  Perform forensics at scale Hunt Strategies  Threat Intelligence – Sweep for known bad  Anomaly – Configurations with the least frequency of occurrence  Behavioral – Attacker tools, tactics, and techniques Risks Mitigated  “Pre-existing conditions” – historic compromises  Blind spots – limited security monitoring visibility  Secondary compromises – attackers move off patient 0 Threat Hunting Defined Develop a Hypothesis Gather Data Analyze Data 1.Make Observations Measure Progress
Threat Hunting Overview Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement Preparation Execution Post
Preparation & Communication
Hunt Team Selection Developer • Integrates threat hunting toolsets and processes • Ability to develop custom scripts Incident Responder • Identify system configuration anomalies • Develop new or modify rulesets based on findings Team Lead • Provides oversight and direction for hunters • Communicates with internal & external stakeholders Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Tracking  Who did what when?  What systems?  What user accounts?  When did activities occur?  What data is being accessed? Organization  IR platform toolset  Visibility into team member activity  Project status tracking at every stage  Quantify metrics Activity Tracking & Organization You need to be able to prove: “We weren’t acquiring data at that time, we didn’t take down the power grid.” Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Measurements of Success Success! Hypothesis Topic and System Scoping Establish and Define a Repeatable Threat Hunting Methodology Identify and Reduce Environment Attack Surface Develop Environment Baselines Automation & Rule Generation Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Speak the language of each stakeholder group:  Execs Improving the organizations security posture without capital expenditure  Sys-Admins We won’t break your stuff Threat hunting does not necessarily require:  Deploying an agent  Change management approvals  Angering sys-admins Getting Approval Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
MITRE ATT&CK Hypothesis Selecting a Hypothesis via ATT&CK: The MITRE ATT&CK Matrix is mapped to attacker tactics and techniques. Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Hypothesis Driven Methodology Four Steps of Hypothesis Testing: 1. Identify a MITRE ATT&CK tactic technique to test  IE: A malicious modification to a path environment variable has been made on an in-scope system 2. Formulate an action plan for to identify in-scope systems and outline data acquisition 3. Execute the action plan and obtain data from in- scope systems 4. Perform automated data analytics and manual analysis to accept or reject the hypothesis Develop a Hypothesis Identify Scope Data Acquisition & Analysis 1.Make Observations Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Threat Hunting Framework
Possible Data Sources Endpoint Logs:  CimSweep  PowerShell Remoting  Windows Event Forwarding  SIEM Collectors  EDR Tools Network Logs:  DNS  Firewall  Bro  Netflow Account Logs:  Active Directory  VPN’s If you’re capturing any of these logs, you can start hunting for malicious activity – you’ve already got the data! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Network Hunting Network Driven Use Cases DNS Logs Firewall Logs VPN Logs Bro/NTA Logs Suspicious Geolocation Login Port Scanning/Recon C2 Channels or Beaconing Data Exfiltration Detection DNS Tunneling Suspicious Download Tracking Most organizations have the network equipment in place currently to perform basic threat hunting. The table below outlines common hunting use cases based off of network device. Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Crawling with CimSweep Pros  Backwards compatible through Windows NT 4.0  Allows for scripted mass collection Cons  Limited in the data that can be collected  Internal firewalls can limit connectivity if using RPC Ports  One-to-one data collection Pre-Req’s  Collection system requires PowerShell 3.0 or greater  Privileged account – Local Admin rights on remote systems Author: Matt Graeber - https://github.com/PowerShellMafia/CimSweep Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Walking with PowerShell Remoting Pros  Provides lots more data than CimSweep  One-to-Many data collection  Lots of interesting work by the community  Able to make full use of Win32 API’s Cons  Requires PowerShell scripting capabilities Pre-Req’s  Requires PS Remoting be enabled Author: Jared Atkinson – https://github.com/Invoke-IR/ACE Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Running with Windows Event Forwarding Pros  Increase visibility to all of your systems  Many-to-One event data collection  Extremely well documented by MS Cons  Requires heavy GPO modifications Pre-Req’s  PowerShell Remoting  A spare server for log collection Source: Jessica Payne – “Monitoring What Matters” Blog Post on technet Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Endpoint Threat Hunting Maturity CimSweep •Runs pretty much everywhere! •Gives you something when you’ve otherwise got nothing •Great way to start demonstrating value PowerShell Remoting • Gives you much more data • Scales for fast collection • Will win you friends with other admins Windows Event Forwarding • Allows for hunting through historic data • By nature – provides continuous data collection • Better enables automated alerting Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Data Analysis & Project Tracking
MISP – Malware Information Sharing Platform What is it?  Threat Intel Aggregator  Hosted IOC Database/Repository App Enrichment  TheHive  Cortex  Threat Intel Providers via API Key VT, Shodan, etc. What is the value / why do it?  Bulk IOC Queries  Threat Actor Tracking  SIEM Agnostic - Various Export Formats Supported Organization Segregation https://blog.thehive-project.org/2017/06/19/thehive-cortex-and-misp-how-they-all-fit-together/ Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
ELK – Elasticsearch, Logstash & Kibana Data Manipulation via Visualization  Custom views via visualizations  Advanced filtering in visualizations White List / Blacklist File Paths  Least Frequency of Occurrence (LFO) Process Stacking Rapid Query Results  Flexible Query Options String Queries  FilePath: (“appdata” OR “temp”) Levenshtein/Fuzzy Queries Logstash Plugin Filters  Unify your data fields across different tools & scripts ImagePath, path, Path = ExecutablePath Parse out file extension Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Data Enrichment on Ingestion Logstash can make rest queries on event ingestion  SANS FTW Domain Stats  Is it in the Alexa top 1 million?  When was it created “Freq” Server  Test the “Englishness” of a domain  Virus Total Queries Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Data Enrichment Example Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Data Enrichment Example Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
TheHive & Cortex Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
TheHive & Cortex Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
TheHive & Cortex Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
TheHive & Cortex Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
TheHive & Cortex Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
TheHive & Cortex Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! TheHive & Cortex Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Data Analysis / Analytics Data Reduction  Targeted Threat Hunt Topics Persistence  Registry Keys Least Frequency Of Occurrence (LFO)  Stack all the things! Uniform environment should be homogenous  Know Normal…Find Evil! Suspiciously name files One character .exe, Pseudorandom Letters/Numbers  Legit filenames operating in illegitimate file paths  Thanks SANS! https://www.s ans. o rg/s ecurity - res ources /pos te rs /df ir -f ind-e vil/35/do wnlo ad Threat Intel Correlation https://www.sans.org/security-resources/posters/dfir/windows-forensics-evidence-of-75 Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Data Analysis / Analytics Data Reduction  Targeted Threat Hunt Topics Persistence  Registry Keys Least Frequency Of Occurrence (LFO)  Stack all the things! Uniform environment should be homogenous  Know Normal…Find Evil! Suspiciously name files One character .exe, Pseudorandom Letters/Numbers  Legit filenames operating in illegitimate file paths  Thanks SANS! https://www.s ans. o rg/s ecurity - res ources /pos te rs /df ir -f ind-e vil/35/do wnlo ad Threat Intel Correlation Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Data Analysis / Analytics Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Observation / Result Tracking Metrics and Tasks and Observables Oh My!  Hosted & concurrent users! See ya later Excel!!  Tagging: Hash, ip, domain, etc. Allows metric tracking for reporting  Accountability! Team member status updates / live streams Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Observation / Result Tracking Metrics and Tasks and Observables Oh My!  Hosted & concurrent users! See ya later Excel!!  Tagging: Hash, ip, domain, etc. Allows metric tracking for reporting  Accountability! Team member status updates / live streams Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Observation / Result Tracking Metrics and Tasks and Observables Oh My!  Hosted & concurrent users! See ya later Excel!!  Tagging: Hash, ip, domain, etc. Allows metric tracking for reporting  Accountability! Team member status updates / live streams Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Measurements of Success Success! Hypothesis Topic and System Scoping Establish and Define a Repeatable Threat Hunting Methodology Identify and Reduce Environment Attack Surface Develop Environment Baselines Automation & Rule Generation Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
Citations 1. Threat Hunting Definition: https://sqrrl.com/solutions/cyber-threat-hunting/ 2. MISP 1. http://www.misp-project.org/ 3. TheHive 1. http://thehive-project.org/ 4. TheHive How it fits together images: https://blog.thehive- project.org/2017/06/19/thehive-cortex-and-misp-how-they-all-fit-together/ 5. SANS Graphics 1. https://www.sans.org/security-resources/posters/dfir-find- evil/35/download 2. https://www.sans.org/security-resources/posters/dfir/windows- forensics-evidence-of-75

Recommandé

Security Risk Advisors - BSides PGH 2018 - Red Team SIEM
Security Risk Advisors - BSides PGH 2018 - Red Team SIEMSecurity Risk Advisors - BSides PGH 2018 - Red Team SIEM
Security Risk Advisors - BSides PGH 2018 - Red Team SIEM
Douglas Webster
 
Security Risk Advisors - BSides Philadelphia 2017 - MFA: It's 2017 and You're...
Security Risk Advisors - BSides Philadelphia 2017 - MFA: It's 2017 and You're...Security Risk Advisors - BSides Philadelphia 2017 - MFA: It's 2017 and You're...
Security Risk Advisors - BSides Philadelphia 2017 - MFA: It's 2017 and You're...
Douglas Webster
 
Security Risk Advisors - BSides NOLA 2017 - Your New Red Team Hardware Surviv...
Security Risk Advisors - BSides NOLA 2017 - Your New Red Team Hardware Surviv...Security Risk Advisors - BSides NOLA 2017 - Your New Red Team Hardware Surviv...
Security Risk Advisors - BSides NOLA 2017 - Your New Red Team Hardware Surviv...
Douglas Webster
 
2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot
Marius Sescu
 
Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPT
Expeed Software
 
Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
Pixeldarts
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
ThinkNow
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
marketingartwork
 

Recommandé

Security Risk Advisors - BSides PGH 2018 - Red Team SIEM
Security Risk Advisors - BSides PGH 2018 - Red Team SIEMSecurity Risk Advisors - BSides PGH 2018 - Red Team SIEM
Security Risk Advisors - BSides PGH 2018 - Red Team SIEM
Douglas Webster
 
Security Risk Advisors - BSides Philadelphia 2017 - MFA: It's 2017 and You're...
Security Risk Advisors - BSides Philadelphia 2017 - MFA: It's 2017 and You're...Security Risk Advisors - BSides Philadelphia 2017 - MFA: It's 2017 and You're...
Security Risk Advisors - BSides Philadelphia 2017 - MFA: It's 2017 and You're...
Douglas Webster
 
Security Risk Advisors - BSides NOLA 2017 - Your New Red Team Hardware Surviv...
Security Risk Advisors - BSides NOLA 2017 - Your New Red Team Hardware Surviv...Security Risk Advisors - BSides NOLA 2017 - Your New Red Team Hardware Surviv...
Security Risk Advisors - BSides NOLA 2017 - Your New Red Team Hardware Surviv...
Douglas Webster
 
2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot
Marius Sescu
 
Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPT
Expeed Software
 
Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
Pixeldarts
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
ThinkNow
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
marketingartwork
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
jfdjdjcjdnsjd
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
Principled Technologies
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
Delhi Call girls
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Igalia
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
naman860154
 
Evaluating the top large language models.pdf
Evaluating the top large language models.pdfEvaluating the top large language models.pdf
Evaluating the top large language models.pdf
ChristopherTHyatt
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
apidays
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
Product Anonymous
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
Anna Loughnan Colquhoun
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
Enterprise Knowledge
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
Michael W. Hawkins
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
Rafal Los
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
wesley chun
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
Safe Software
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
The Digital Insurer
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
hans926745
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
ThousandEyes
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Drew Madelung
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
lior mazor
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
Skeleton Technologies
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
Neil Kimberley
 

Contenu connexe

Dernier

Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
Principled Technologies
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
Delhi Call girls
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Igalia
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
Enterprise Knowledge
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
Safe Software
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Drew Madelung
 

Dernier (20)

presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
 
Evaluating the top large language models.pdf
Evaluating the top large language models.pdfEvaluating the top large language models.pdf
Evaluating the top large language models.pdf
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 

En vedette

Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
Kurio // The Social Media Age(ncy)
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
Search Engine Journal
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
SpeakerHub
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Applitools
 

En vedette (20)

Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity - Best PracticesTime Management & Productivity - Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work
 
ChatGPT webinar slides
ChatGPT webinar slidesChatGPT webinar slides
ChatGPT webinar slides
 
More than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike RoutesMore than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike Routes
 
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
Ride the Storm: Navigating Through Unstable Periods / Katerina Rudko (Belka G...
 

Security Risk Advisors - BSides Philadelphia 2017 - Threat Hunting: Defining the Process While Circumventing Corporate Obstacles

  • 1. Threat Hunting Defining the Process While Circumventing Corporate Obstacles December 2017
  • 2. Introductions Our success together is driven by the trusted relationships we build. We work closely with our clients to improve their strategy and programs, assess controls and threats, and implement and operate the best solutions based on their unique needs and business environments. Matt Schneck Threat Management Senior Consultant Focus: Endpoint Engineer & Data Analysis GIAC Certified Forensic Examiner (GCFE) Ryan Andress Threat Management Consultant Focus: Incident Response & Data Analysis GIAC Certified Forensic Analyst (GCFA) Kevin Foster Threat Management Senior Consultant Focus: Incident Response & Data Acquisition GIAC Certified Forensic Analyst (GCFA) GIAC Certified Reverse Engineering Malware (GREM)
  • 3. What is Threat Hunting? Preparation & Communication Threat Hunting Framework Post Hunt Agenda
  • 4. Objectives  Identify compromised systems and accounts  Improve security monitoring detection rules  Perform forensics at scale Hunt Strategies  Threat Intelligence – Sweep for known bad  Anomaly – Configurations with the least frequency of occurrence  Behavioral – Attacker tools, tactics, and techniques Risks Mitigated  “Pre-existing conditions” – historic compromises  Blind spots – limited security monitoring visibility  Secondary compromises – attackers move off patient 0 Threat Hunting Defined Develop a Hypothesis Gather Data Analyze Data 1.Make Observations Measure Progress
  • 5. Threat Hunting Overview Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement Preparation Execution Post
  • 7. Hunt Team Selection Developer • Integrates threat hunting toolsets and processes • Ability to develop custom scripts Incident Responder • Identify system configuration anomalies • Develop new or modify rulesets based on findings Team Lead • Provides oversight and direction for hunters • Communicates with internal & external stakeholders Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 8. Tracking  Who did what when?  What systems?  What user accounts?  When did activities occur?  What data is being accessed? Organization  IR platform toolset  Visibility into team member activity  Project status tracking at every stage  Quantify metrics Activity Tracking & Organization You need to be able to prove: “We weren’t acquiring data at that time, we didn’t take down the power grid.” Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 9. Measurements of Success Success! Hypothesis Topic and System Scoping Establish and Define a Repeatable Threat Hunting Methodology Identify and Reduce Environment Attack Surface Develop Environment Baselines Automation & Rule Generation Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 10. Speak the language of each stakeholder group:  Execs Improving the organizations security posture without capital expenditure  Sys-Admins We won’t break your stuff Threat hunting does not necessarily require:  Deploying an agent  Change management approvals  Angering sys-admins Getting Approval Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 11. MITRE ATT&CK Hypothesis Selecting a Hypothesis via ATT&CK: The MITRE ATT&CK Matrix is mapped to attacker tactics and techniques. Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 12. Hypothesis Driven Methodology Four Steps of Hypothesis Testing: 1. Identify a MITRE ATT&CK tactic technique to test  IE: A malicious modification to a path environment variable has been made on an in-scope system 2. Formulate an action plan for to identify in-scope systems and outline data acquisition 3. Execute the action plan and obtain data from in- scope systems 4. Perform automated data analytics and manual analysis to accept or reject the hypothesis Develop a Hypothesis Identify Scope Data Acquisition & Analysis 1.Make Observations Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 14. Possible Data Sources Endpoint Logs:  CimSweep  PowerShell Remoting  Windows Event Forwarding  SIEM Collectors  EDR Tools Network Logs:  DNS  Firewall  Bro  Netflow Account Logs:  Active Directory  VPN’s If you’re capturing any of these logs, you can start hunting for malicious activity – you’ve already got the data! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 15. Network Hunting Network Driven Use Cases DNS Logs Firewall Logs VPN Logs Bro/NTA Logs Suspicious Geolocation Login Port Scanning/Recon C2 Channels or Beaconing Data Exfiltration Detection DNS Tunneling Suspicious Download Tracking Most organizations have the network equipment in place currently to perform basic threat hunting. The table below outlines common hunting use cases based off of network device. Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 16. Crawling with CimSweep Pros  Backwards compatible through Windows NT 4.0  Allows for scripted mass collection Cons  Limited in the data that can be collected  Internal firewalls can limit connectivity if using RPC Ports  One-to-one data collection Pre-Req’s  Collection system requires PowerShell 3.0 or greater  Privileged account – Local Admin rights on remote systems Author: Matt Graeber - https://github.com/PowerShellMafia/CimSweep Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 17. Walking with PowerShell Remoting Pros  Provides lots more data than CimSweep  One-to-Many data collection  Lots of interesting work by the community  Able to make full use of Win32 API’s Cons  Requires PowerShell scripting capabilities Pre-Req’s  Requires PS Remoting be enabled Author: Jared Atkinson – https://github.com/Invoke-IR/ACE Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 18. Running with Windows Event Forwarding Pros  Increase visibility to all of your systems  Many-to-One event data collection  Extremely well documented by MS Cons  Requires heavy GPO modifications Pre-Req’s  PowerShell Remoting  A spare server for log collection Source: Jessica Payne – “Monitoring What Matters” Blog Post on technet Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 19. Endpoint Threat Hunting Maturity CimSweep •Runs pretty much everywhere! •Gives you something when you’ve otherwise got nothing •Great way to start demonstrating value PowerShell Remoting • Gives you much more data • Scales for fast collection • Will win you friends with other admins Windows Event Forwarding • Allows for hunting through historic data • By nature – provides continuous data collection • Better enables automated alerting Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 20. Data Analysis & Project Tracking
  • 21. MISP – Malware Information Sharing Platform What is it?  Threat Intel Aggregator  Hosted IOC Database/Repository App Enrichment  TheHive  Cortex  Threat Intel Providers via API Key VT, Shodan, etc. What is the value / why do it?  Bulk IOC Queries  Threat Actor Tracking  SIEM Agnostic - Various Export Formats Supported Organization Segregation https://blog.thehive-project.org/2017/06/19/thehive-cortex-and-misp-how-they-all-fit-together/ Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 22. ELK – Elasticsearch, Logstash & Kibana Data Manipulation via Visualization  Custom views via visualizations  Advanced filtering in visualizations White List / Blacklist File Paths  Least Frequency of Occurrence (LFO) Process Stacking Rapid Query Results  Flexible Query Options String Queries  FilePath: (“appdata” OR “temp”) Levenshtein/Fuzzy Queries Logstash Plugin Filters  Unify your data fields across different tools & scripts ImagePath, path, Path = ExecutablePath Parse out file extension Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 23. Data Enrichment on Ingestion Logstash can make rest queries on event ingestion  SANS FTW Domain Stats  Is it in the Alexa top 1 million?  When was it created “Freq” Server  Test the “Englishness” of a domain  Virus Total Queries Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 24. Data Enrichment Example Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 25. Data Enrichment Example Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 26. TheHive & Cortex Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 27. TheHive & Cortex Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 28. TheHive & Cortex Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 29. TheHive & Cortex Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 30. TheHive & Cortex Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 31. TheHive & Cortex Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 32. Threat Hunt Process Tracking  Live stream of team member activity  Project tasks assigned for visibility & accountability Observation Tracking  Custom tracking of observables Statistics based on Type, IOC, & Tags!  Filter observables data Data Analysis & Automation  Cortex Analyzers Data Reduction via threat intel correlation  Delegate your work to the machines! TheHive & Cortex Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 33. Data Analysis / Analytics Data Reduction  Targeted Threat Hunt Topics Persistence  Registry Keys Least Frequency Of Occurrence (LFO)  Stack all the things! Uniform environment should be homogenous  Know Normal…Find Evil! Suspiciously name files One character .exe, Pseudorandom Letters/Numbers  Legit filenames operating in illegitimate file paths  Thanks SANS! https://www.s ans. o rg/s ecurity - res ources /pos te rs /df ir -f ind-e vil/35/do wnlo ad Threat Intel Correlation https://www.sans.org/security-resources/posters/dfir/windows-forensics-evidence-of-75 Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 34. Data Analysis / Analytics Data Reduction  Targeted Threat Hunt Topics Persistence  Registry Keys Least Frequency Of Occurrence (LFO)  Stack all the things! Uniform environment should be homogenous  Know Normal…Find Evil! Suspiciously name files One character .exe, Pseudorandom Letters/Numbers  Legit filenames operating in illegitimate file paths  Thanks SANS! https://www.s ans. o rg/s ecurity - res ources /pos te rs /df ir -f ind-e vil/35/do wnlo ad Threat Intel Correlation Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 35. Data Analysis / Analytics Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 36. Observation / Result Tracking Metrics and Tasks and Observables Oh My!  Hosted & concurrent users! See ya later Excel!!  Tagging: Hash, ip, domain, etc. Allows metric tracking for reporting  Accountability! Team member status updates / live streams Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 37. Observation / Result Tracking Metrics and Tasks and Observables Oh My!  Hosted & concurrent users! See ya later Excel!!  Tagging: Hash, ip, domain, etc. Allows metric tracking for reporting  Accountability! Team member status updates / live streams Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 38. Observation / Result Tracking Metrics and Tasks and Observables Oh My!  Hosted & concurrent users! See ya later Excel!!  Tagging: Hash, ip, domain, etc. Allows metric tracking for reporting  Accountability! Team member status updates / live streams Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 39. Measurements of Success Success! Hypothesis Topic and System Scoping Establish and Define a Repeatable Threat Hunting Methodology Identify and Reduce Environment Attack Surface Develop Environment Baselines Automation & Rule Generation Identify Team Members Socialize with Stakeholders Hypothesis & Scope Data Acquisition Data Analysis Observation Documentation Ruleset Improvement
  • 40.
  • 41. Citations 1. Threat Hunting Definition: https://sqrrl.com/solutions/cyber-threat-hunting/ 2. MISP 1. http://www.misp-project.org/ 3. TheHive 1. http://thehive-project.org/ 4. TheHive How it fits together images: https://blog.thehive- project.org/2017/06/19/thehive-cortex-and-misp-how-they-all-fit-together/ 5. SANS Graphics 1. https://www.sans.org/security-resources/posters/dfir-find- evil/35/download 2. https://www.sans.org/security-resources/posters/dfir/windows- forensics-evidence-of-75

Notes de l'éditeur

  1. Interest in threat hunting has grown significantly across all verticals we work with. Asked by clients to execute, develop, or assist with threat hunting in the following verticals Healthcare Financial Technology Pharmaceutical Critical Factors for Threat Hunting: Project Focus Data availability Dedicated Team Members* Varying Skillsets
  2. Hypothesis Topic and System Scoping: Select a Campaign Topic that is feasible based on the visibility and assessible data for in-scope systems Establish and Define a Repeatable Threat Hunting Methodology: Define a process which can be scaled in scope, perform additional hunt campaigns, and reperform within other security toolsets which will enable a more mature & proactive security stance Identify and Reduce Environment Attack Surface: Identify, track, and update abnormal system configurations with owners to increase environmental hygiene and secure potential persistence mechanisms attackers utilize Develop Environment Baselines: Develop a historical baseline of expected results in order for anomalies to be uncovered during periodic patrolling. Automation Automation to detect, alert, and act on anomalies that were previously identified or TTPs that were covered by a previous hunt. Automation can take place via various toolsets like a SIEM, EDR, Firewall, etc.
  3. This follows the scientific method for hypothesis testing
  4. Hypothesis Topic and System Scoping: Select a Campaign Topic that is feasible based on the visibility and assessible data for in-scope systems Establish and Define a Repeatable Threat Hunting Methodology: Define a process which can be scaled in scope, perform additional hunt campaigns, and reperform within other security toolsets which will enable a more mature & proactive security stance Identify and Reduce Environment Attack Surface: Identify, track, and update abnormal system configurations with owners to increase environmental hygiene and secure potential persistence mechanisms attackers utilize Develop Environment Baselines: Develop a historical baseline of expected results in order for anomalies to be uncovered during periodic patrolling. Automation Automation to detect, alert, and act on anomalies that were previously identified or TTPs that were covered by a previous hunt. Automation can take place via various toolsets like a SIEM, EDR, Firewall, etc.