SlideShare une entreprise Scribd logo

The Internal Signs of Compromise

•Télécharger en tant que PPTX, PDF•
•
FireEye, Inc.
FireEye, Inc.

This document discusses Mandiant's incident response methodology and technology. It covers their evolution of incident response approaches over time from disk forensics to memory forensics to live response. Mandiant's current approach involves hunting across endpoints and networks using indicators of compromise to identify compromised systems. They deploy network and host sensors to gain visibility and conduct deep analysis using tools like Mandiant Incident Response and Network Traffic Analysis Platform. The document also outlines Mandiant's incident response services and how they help organizations understand risk, identify compromises, and prepare for future incidents.

Technologie
1  sur  43
1© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. Know before others…Do you know the internal signs of a compromise? Methodology, Technology, and Services Stuart Davis, Mandiant Director
2© Mandiant, a FireEye Company. All rights reserved. Agenda  Background: Threat landscape  Methodology : Evolution of Incident Response  Technology : How MANDIANT finds Evil  Services : What MANDIANT can provide
3© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. 3 THREAT LANDSCAPE Evolution of Incident Response
4© Mandiant, a FireEye Company. All rights reserved. 4 It’s a “who,” not a “what” There is a human at a keyboard Highly tailored and customized attacks Targeted specifically at you They are professional, organized and well funded Escalate sophistication of tactics as needed Relentlessly focused on their objective If you kick them out they will return They have specific objectives Their goal is long-term occupation Persistence tools and tactics ensure ongoing access EVOLVING THREAT LANDSCAPE
5© Mandiant, a FireEye Company. All rights reserved. Gain Initial Access Into Target Strengthen Position within Target Steal Valid User Credentials Identify Target Data Package and Steal Target Data Establish Foothold Escalate Privileges Internal Recon Complete Mission Initial Compromise Move Laterally Maintain Presence ANATOMY OF A TARGETED ATTACK 6
6© Mandiant, a FireEye Company. All rights reserved. 6 TIME FROM INITIAL COMPROMISE TO DISCOVERY 416 243 229 205 2011 2012 2013 2014 Source: Mandiant M-Trends 2015 The longest time we detected attackers had been present in the victim’s environment was 2,982 days (over 8 years). Median number of days that threat groups were present on a victim’s network before detection
7© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. METHODOLOGY Evolution of Incident Response
8© Mandiant, a FireEye Company. All rights reserved. History of DFIR (Digital Forensic and Incident Response) Disk Forensics1995 Memory Forensics2005 • Live Response • Network Forensics 2010
9© Mandiant, a FireEye Company. All rights reserved. 1st Generation (1995-) : Disk Forensics  What to analyze - File System: Full Disk / Eventlogs / Prefetch / Registry Hives / Brower History / Scheduled Task / etc.  How to analyze - Shutdown system, Un-mount disk - Connect to Write blocker > Make disk image - Analyze with tools  Tools to use - The Sleuth Kit & Autopsy (Open Source) - Guidance EnCase - AccessData FTK - X-Ways
10© Mandiant, a FireEye Company. All rights reserved. 1st Generation (1995-) : Disk Forensics (cont.)  Pros - Data recover (Carving) - Law Enforcement  Cons - Business impact : Shutdown System - Difficult to collect : Disk Encryption, RAID, NAS, Cloud - Dead artifacts : No Live Data in the memory - Scale : Disk by disk  Cost-effectiveness - 1 disk for 1 week - JPY 1,500,000 / disk - Up to 100 hosts (100 weeks = 2 years?)
11© Mandiant, a FireEye Company. All rights reserved. 2nd Generation (2005-) : Memory Forensics  What to analyze - Memory : Process / Driver / Handles / Network Connection / etc.  How to analyze - Mount external USB or Network Drive - Dump Physical Memory - Analyze with tools  Tools - Volatility (Open Source) - Mandiant Redline (Free)
12© Mandiant, a FireEye Company. All rights reserved. 2nd Generation (2005-) : Memory Forensics (cont.)  Pros - No business impact - Live Data Acquisition  Cons - Limited Raw Disk Access - Scale : Host by host  Cost-effectiveness - 1 memory dump for half week - $8K USD / host (Forensics specialist needed) - Up to 100 hosts (50 weeks = 1 years?)
13© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Live Response  What to analyze - File System, Memory Forensics by remote  How to analyze - Server, Agent base - Execute a job in the Host by Agent and feed back the result to Server - Analyze the result with central tools  Tools - GRR (Open Source) - Guidance EnCase Enterprise - ManTech Active Defense
14© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Live Response (cont.)  Pros - No business impact - Enterprise Scale - Speed  Cons - No proactive detection - Lack of intelligence - Need extensive knowledge  Cost-effectiveness - Per Host License
15© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Network Forensics  What to analyze - Full packet / Session data / Protocol logs / Statistics  How to analyze - Packet Capture - Protocol Parsing - Analyze the result with central tools  Network Forensic Tools - Security Onion (Open Source) - BlueCoat Solera Networks - RSA Security Analytics (NetWitness)
16© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Network Forensics (cont.)  Pros - No business impact - Network Visibility  Cons - No visibility for encrypted traffic - No proactive detection - Lack of intelligence - Need extensive knowledge  Cost-effectiveness - Depends on traffic and storage
17© Mandiant, a FireEye Company. All rights reserved. Traditional Incident Response Process Identify System Collect Data Analyze Data Report
18© Mandiant, a FireEye Company. All rights reserved. Breadcrumb Trail  Incidents rarely have a simple, linear trail of evidence - Multiple “patient zero” hosts - Multiple pivot points for lateral movement - Forensic artifacts disappear over time - Noise from commodity malware
19© Mandiant, a FireEye Company. All rights reserved. CONFIDENTIAL Phishing Campaigns Compromised Hosts Accessed Hosts Hosts with Non- Targeted Malware Scoping Incidents
20© Mandiant, a FireEye Company. All rights reserved. CONFIDENTIAL Phishing Campaigns Compromised Hosts Accessed Hosts ? ? ? Scoping Incidents
21© Mandiant, a FireEye Company. All rights reserved.  Can’t wait for an alarm to go off before investigating  Intelligence driven Hosts & Network Devices Gather Sources of Evidence ? Identify systems of interest, generate new leads Hunting
22© Mandiant, a FireEye Company. All rights reserved. 2 • Red Teaming and Penetration Testing • ICS Security Assessment • Security Program Assessment (SPA) • Response Readiness Assessment (RRA) • Other strategic services • Compromise Assessment (CA) • Incident Response (IR) • Cyber Defense Center Development (CDC) • SOC/CIRT transformation • Incident Response Retainer • Education • Deployment & Integration AM I AT RISK? AM I PREPARED? AM I COMPROMISED? I AM BREACHED! PREPARE FOR FUTURE EVENTS? INCIDENT RESPONSE AND PREPAREDNESS CYCLE
23© Mandiant, a FireEye Company. All rights reserved. AM I PREPARED?AM I AT RISK? AM I COMPROMISED? I AM BREACHED! PREPARE FOR FUTURE EVENTS DIFFERENTIATORS VALUE 2 COMPROMISE ASSESSMENT AM I COMPROMISED? COMPROMISE ASSESSMENT Evaluate your environment for the presence of targeted attacker activity using the same methods and technologies used during our incident investigations OUR APPROACH • Deploy network and host based inspection technology for comprehensiveness, efficiency, and scale • Apply intelligence from prior investigations and our own knowledge of attack group tools, tactics, and procedures to assess your environment • Analyze evidence and anomalous activity to confirm malicious activity • Summarize our findings and provide strategic recommendations based upon our observations during the engagement Understand the health of your network- whether or not you have been breached • Same technology used in all Mandiant investigations for comprehensiveness, efficiency, and scale • Leverage all of our Intel to search for signs of compromise across the environment • Pivot into Incident Response mode if targeted attacker activity is identified
24© Mandiant, a FireEye Company. All rights reserved.
25© Mandiant, a FireEye Company. All rights reserved.
26© Mandiant, a FireEye Company. All rights reserved.
27© Mandiant, a FireEye Company. All rights reserved.
28© Mandiant, a FireEye Company. All rights reserved.
29© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. TECHNOLOGY How MANDIANT finds Evil
30© Mandiant, a FireEye Company. All rights reserved. Investigative Cycle  Indicators Of Compromise (IOC)  Host inspection (MIR)  Network analysis (NTAP)  Log analysis (TAP)  Malware reverse engineering  Threat Intelligence Analysis
31© Mandiant, a FireEye Company. All rights reserved. Indicators Of Compromise (IOCs)  Indicator Of Compromise  Way of describing threat data like - Malware - Attacker Methodology - Evidence of compromise or activity  What Is An Indicator? - MD5: Change Frequently - File Names/Directories: Many Reused - Registry Key Values: Many Reused - Services With Wrong Service dll’s: Outliers - IPs and Domain Names: Change Frequently
32© Mandiant, a FireEye Company. All rights reserved. Network : Attacker Monitoring & Forensics  Network visibility  Internet egress points  Decode traffic generated by known malware  Reconstruct command-and-control activity  Recover data theft  Monitor All protocols (full packet capture)
33© Mandiant, a FireEye Company. All rights reserved. Network : Architecture Mandiant VPN tunnel Internet Perimeter Firewall Switch Web Proxy Internal Network Firewall VPN Users Mandiant Mandiant Network Sensor = Network SPAN/TAP Servers, workstations, laptops INTERNAL NETWORK
34© Mandiant, a FireEye Company. All rights reserved. Endpoint : Hunting & Live Response  Host visibility  Agent / controller model  Deploy to all Windows systems in environment  Identify historical evidence of compromise  Search all hosts for IOCs  Conduct deep-dive analysis on systems of interest
35© Mandiant, a FireEye Company. All rights reserved. Endpoint : Architecture MIR Controller #nMIR Controller #1 VPN Users Mandiant Servers, workstations, laptops INTERNAL NETWORK = Mandiant Agent Mutually authenticated SSL
36© Mandiant, a FireEye Company. All rights reserved. Big data : Finding Needle & Analysis  Network, endpoint, application events visibility  Detect with Mandiant Threat Intelligence  Source from Syslog, Windows Event Log, File, ODBC  Communication Broker in customer environment  Cloud-based; all technology managed
37© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. TOOLS OF THE TRADE A TEAM of analysts enabled by MIR and NTAP
38© Mandiant, a FireEye Company. All rights reserved. End-point Visibility – Sweeping the Environment
39© Mandiant, a FireEye Company. All rights reserved. Find One. IOC matches are verified by analysts by extracting suspect artifacts from end-points and/or verifying network sensors for corroborating evidence.
40© Mandiant, a FireEye Company. All rights reserved. Find One. Then Find Them All. An initial lead converted to an IOC can yield quick results across the entire estate.
41© Mandiant, a FireEye Company. All rights reserved. Regional Threats Indicators of Compromise (IOC) used during a Compromise Assessment are comprised of information from: • Incident Response engagements • Internal research • Publicly available data • Regional teams input IOCs are updated continuously and can be made client specific.
42© Mandiant, a FireEye Company. All rights reserved. Tracking Attackers With Network Sensors Network sensors enable near real-time detection of threats, capture of identified malicious traffic, and tracking of attacker activity.
43© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. TO GAIN MORE INSIGHT WATCH THE WEBINAR HERE

Recommandé

Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligenceseadeloitte
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation centerMuhammad Sahputra
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat IntelligenceNTT Innovation Institute Inc.
 
kill-chain-presentation-v3
kill-chain-presentation-v3kill-chain-presentation-v3
kill-chain-presentation-v3Shawn Croswell
 
Security Awareness Training
Security Awareness TrainingSecurity Awareness Training
Security Awareness TrainingDaniel P Wallace
 
Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]David Sweigert
 
Cyber Resilience
Cyber ResilienceCyber Resilience
Cyber ResilienceIan-Edward Stafrace
 
What is cyber resilience?
What is cyber resilience?What is cyber resilience?
What is cyber resilience?Aaron Clark-Ginsberg
 

Recommandé

Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligenceseadeloitte
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation centerMuhammad Sahputra
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat IntelligenceNTT Innovation Institute Inc.
 
kill-chain-presentation-v3
kill-chain-presentation-v3kill-chain-presentation-v3
kill-chain-presentation-v3Shawn Croswell
 
Security Awareness Training
Security Awareness TrainingSecurity Awareness Training
Security Awareness TrainingDaniel P Wallace
 
Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]David Sweigert
 
Cyber Resilience
Cyber ResilienceCyber Resilience
Cyber ResilienceIan-Edward Stafrace
 
What is cyber resilience?
What is cyber resilience?What is cyber resilience?
What is cyber resilience?Aaron Clark-Ginsberg
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You AreKatie Nickels
 
The Zero Trust Model of Information Security
The Zero Trust Model of Information Security The Zero Trust Model of Information Security
The Zero Trust Model of Information Security Tripwire
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligencemohamed nasri
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat IntelligenceZaiffiEhsan
 
Incident Response
Incident Response Incident Response
Incident Response InnoTech
 
Cyber Security Incident Response
Cyber Security Incident ResponseCyber Security Incident Response
Cyber Security Incident ResponsePECB
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsIain Dickson
 
Cyber Security Governance
Cyber Security GovernanceCyber Security Governance
Cyber Security GovernancePriyanka Aash
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework👀 Joe Gray
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
Secure Design: Threat Modeling
Secure Design: Threat ModelingSecure Design: Threat Modeling
Secure Design: Threat ModelingNarudom Roongsiriwong, CISSP
 
The New Pentest? Rise of the Compromise Assessment
The New Pentest? Rise of the Compromise AssessmentThe New Pentest? Rise of the Compromise Assessment
The New Pentest? Rise of the Compromise AssessmentInfocyte
 
Understanding Cyber Kill Chain and OODA loop
Understanding Cyber Kill Chain and OODA loopUnderstanding Cyber Kill Chain and OODA loop
Understanding Cyber Kill Chain and OODA loopDavid Sweigert
 
The Board and Cyber Security
The Board and Cyber SecurityThe Board and Cyber Security
The Board and Cyber SecurityFireEye, Inc.
 
INCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONINCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONSylvain Martinez
 
Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for BeginnersSKMohamedKasim
 
Security operations center 5 security controls
Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controlsAlienVault
 
Cyber Security Standards Compliance
Cyber Security Standards ComplianceCyber Security Standards Compliance
Cyber Security Standards ComplianceDr. Prashant Vats
 
Threat Intelligence
Threat IntelligenceThreat Intelligence
Threat IntelligenceDeepak Kumar (D3)
 
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansChristopher Korban
 
Crack the Code
Crack the CodeCrack the Code
Crack the CodeInnoTech
 

Contenu connexe

Tendances

Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You AreKatie Nickels
 
The Zero Trust Model of Information Security
The Zero Trust Model of Information Security The Zero Trust Model of Information Security
The Zero Trust Model of Information Security Tripwire
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligencemohamed nasri
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat IntelligenceZaiffiEhsan
 
Incident Response
Incident Response Incident Response
Incident Response InnoTech
 
Cyber Security Incident Response
Cyber Security Incident ResponseCyber Security Incident Response
Cyber Security Incident ResponsePECB
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsIain Dickson
 
Cyber Security Governance
Cyber Security GovernanceCyber Security Governance
Cyber Security GovernancePriyanka Aash
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
The New Pentest? Rise of the Compromise Assessment
The New Pentest? Rise of the Compromise AssessmentThe New Pentest? Rise of the Compromise Assessment
The New Pentest? Rise of the Compromise AssessmentInfocyte
 
Understanding Cyber Kill Chain and OODA loop
Understanding Cyber Kill Chain and OODA loopUnderstanding Cyber Kill Chain and OODA loop
Understanding Cyber Kill Chain and OODA loopDavid Sweigert
 
The Board and Cyber Security
The Board and Cyber SecurityThe Board and Cyber Security
The Board and Cyber SecurityFireEye, Inc.
 
INCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONINCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONSylvain Martinez
 
Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for BeginnersSKMohamedKasim
 
Security operations center 5 security controls
Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controlsAlienVault
 
Cyber Security Standards Compliance
Cyber Security Standards ComplianceCyber Security Standards Compliance
Cyber Security Standards ComplianceDr. Prashant Vats
 

Tendances (20)

Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
 
The Zero Trust Model of Information Security
The Zero Trust Model of Information Security The Zero Trust Model of Information Security
The Zero Trust Model of Information Security
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
Incident Response
Incident Response Incident Response
Incident Response
 
Cyber Security Incident Response
Cyber Security Incident ResponseCyber Security Incident Response
Cyber Security Incident Response
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feeds
 
Cyber Security Governance
Cyber Security GovernanceCyber Security Governance
Cyber Security Governance
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
 
Secure Design: Threat Modeling
Secure Design: Threat ModelingSecure Design: Threat Modeling
Secure Design: Threat Modeling
 
The New Pentest? Rise of the Compromise Assessment
The New Pentest? Rise of the Compromise AssessmentThe New Pentest? Rise of the Compromise Assessment
The New Pentest? Rise of the Compromise Assessment
 
Understanding Cyber Kill Chain and OODA loop
Understanding Cyber Kill Chain and OODA loopUnderstanding Cyber Kill Chain and OODA loop
Understanding Cyber Kill Chain and OODA loop
 
The Board and Cyber Security
The Board and Cyber SecurityThe Board and Cyber Security
The Board and Cyber Security
 
INCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONINCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATION
 
Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for Beginners
 
Security operations center 5 security controls
Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controls
 
Cyber Security Standards Compliance
Cyber Security Standards ComplianceCyber Security Standards Compliance
Cyber Security Standards Compliance
 
Threat Intelligence
Threat IntelligenceThreat Intelligence
Threat Intelligence
 

Similaire à The Internal Signs of Compromise

Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansChristopher Korban
 
Crack the Code
Crack the CodeCrack the Code
Crack the CodeInnoTech
 
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoBSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoKatie Nickels
 
ICS Network Security Monitoring (NSM)
ICS Network Security Monitoring (NSM)ICS Network Security Monitoring (NSM)
ICS Network Security Monitoring (NSM)Digital Bond
 
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec
 
Big Data Analytics to Enhance Security
Big Data Analytics to Enhance SecurityBig Data Analytics to Enhance Security
Big Data Analytics to Enhance SecurityData Science Thailand
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™Katie Nickels
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels
 
The Cyber Security Landscape: An OurCrowd Briefing for Investors
The Cyber Security Landscape: An OurCrowd Briefing for InvestorsThe Cyber Security Landscape: An OurCrowd Briefing for Investors
The Cyber Security Landscape: An OurCrowd Briefing for InvestorsOurCrowd
 
WHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & HandlingWHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & HandlingAPNIC
 
[CLASS 2014] Palestra Técnica - Fabio Rosa
[CLASS 2014] Palestra Técnica - Fabio Rosa[CLASS 2014] Palestra Técnica - Fabio Rosa
[CLASS 2014] Palestra Técnica - Fabio RosaTI Safe
 
Security Breakout Session
Security Breakout Session Security Breakout Session
Security Breakout Session Splunk
 
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...MohamedOmerMusa
 
Good Guys vs Bad Guys: Using Big Data to Counteract Advanced Threats
Good Guys vs Bad Guys: Using Big Data to Counteract Advanced ThreatsGood Guys vs Bad Guys: Using Big Data to Counteract Advanced Threats
Good Guys vs Bad Guys: Using Big Data to Counteract Advanced ThreatsZivaro Inc
 
PaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPrime Infoserv
 
Računalna forenzika i automatizirani odgovor na mrežne incidente
Računalna forenzika i automatizirani odgovor na mrežne incidenteRačunalna forenzika i automatizirani odgovor na mrežne incidente
Računalna forenzika i automatizirani odgovor na mrežne incidenteDamir Delija
 
Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...
Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...
Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...Symantec
 
Cyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APTCyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APTSimone Onofri
 

Similaire à The Internal Signs of Compromise (20)

Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
 
Crack the Code
Crack the CodeCrack the Code
Crack the Code
 
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoBSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
 
ICS Network Security Monitoring (NSM)
ICS Network Security Monitoring (NSM)ICS Network Security Monitoring (NSM)
ICS Network Security Monitoring (NSM)
 
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
 
Big Data Analytics to Enhance Security
Big Data Analytics to Enhance SecurityBig Data Analytics to Enhance Security
Big Data Analytics to Enhance Security
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
 
The Cyber Security Landscape: An OurCrowd Briefing for Investors
The Cyber Security Landscape: An OurCrowd Briefing for InvestorsThe Cyber Security Landscape: An OurCrowd Briefing for Investors
The Cyber Security Landscape: An OurCrowd Briefing for Investors
 
WHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & HandlingWHOIS Database for Incident Response & Handling
WHOIS Database for Incident Response & Handling
 
[CLASS 2014] Palestra Técnica - Fabio Rosa
[CLASS 2014] Palestra Técnica - Fabio Rosa[CLASS 2014] Palestra Técnica - Fabio Rosa
[CLASS 2014] Palestra Técnica - Fabio Rosa
 
Security Breakout Session
Security Breakout Session Security Breakout Session
Security Breakout Session
 
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...
Trial Course - CertMaster Learn and CertMaster Labs for Security+ (Exam SY0-6...
 
Good Guys vs Bad Guys: Using Big Data to Counteract Advanced Threats
Good Guys vs Bad Guys: Using Big Data to Counteract Advanced ThreatsGood Guys vs Bad Guys: Using Big Data to Counteract Advanced Threats
Good Guys vs Bad Guys: Using Big Data to Counteract Advanced Threats
 
Red Team P1.pdf
Red Team P1.pdfRed Team P1.pdf
Red Team P1.pdf
 
PaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPaloAlto Enterprise Security Solution
PaloAlto Enterprise Security Solution
 
Računalna forenzika i automatizirani odgovor na mrežne incidente
Računalna forenzika i automatizirani odgovor na mrežne incidenteRačunalna forenzika i automatizirani odgovor na mrežne incidente
Računalna forenzika i automatizirani odgovor na mrežne incidente
 
Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...
Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...
Symantec Webinar | Redefining Endpoint Security- How to Better Secure the End...
 
Hacking3e ppt ch06
Hacking3e ppt ch06Hacking3e ppt ch06
Hacking3e ppt ch06
 
Cyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APTCyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APT
 

Plus de FireEye, Inc.

Asia Pacific & The Security Gap: Don't Stand Still
Asia Pacific & The Security Gap: Don't Stand StillAsia Pacific & The Security Gap: Don't Stand Still
Asia Pacific & The Security Gap: Don't Stand StillFireEye, Inc.
 
EMEA & The Security Gap: Don't Stand Still
EMEA & The Security Gap: Don't Stand StillEMEA & The Security Gap: Don't Stand Still
EMEA & The Security Gap: Don't Stand StillFireEye, Inc.
 
[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...
[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...
[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...FireEye, Inc.
 
M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点FireEye, Inc.
 
[Infographic] Healthcare Cyber Security: Threat Prognosis
[Infographic] Healthcare Cyber Security: Threat Prognosis[Infographic] Healthcare Cyber Security: Threat Prognosis
[Infographic] Healthcare Cyber Security: Threat PrognosisFireEye, Inc.
 
[Infographic] Email: The First Security Gap Targeted by Attackers
[Infographic] Email: The First Security Gap Targeted by Attackers[Infographic] Email: The First Security Gap Targeted by Attackers
[Infographic] Email: The First Security Gap Targeted by AttackersFireEye, Inc.
 
M-Trends 2015: 최일선에서 본 관점
M-Trends 2015: 최일선에서 본 관점 M-Trends 2015: 최일선에서 본 관점
M-Trends 2015: 최일선에서 본 관점 FireEye, Inc.
 
M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点FireEye, Inc.
 
M-Trends 2015 : Les nouvelles du front
M-Trends 2015 : Les nouvelles du frontM-Trends 2015 : Les nouvelles du front
M-Trends 2015 : Les nouvelles du frontFireEye, Inc.
 
5 Reasons Cyber Attackers Target Small and Medium Businesses
5 Reasons Cyber Attackers Target Small and Medium Businesses 5 Reasons Cyber Attackers Target Small and Medium Businesses
5 Reasons Cyber Attackers Target Small and Medium Businesses FireEye, Inc.
 
Connected Cares: The Open Road For Hackers
Connected Cares: The Open Road For HackersConnected Cares: The Open Road For Hackers
Connected Cares: The Open Road For HackersFireEye, Inc.
 
M-Trends® 2013: Attack the Security Gap
M-Trends® 2013: Attack the Security GapM-Trends® 2013: Attack the Security Gap
M-Trends® 2013: Attack the Security GapFireEye, Inc.
 
M-Trends® 2012: An Evolving Threat
M-Trends® 2012: An Evolving Threat M-Trends® 2012: An Evolving Threat
M-Trends® 2012: An Evolving Threat FireEye, Inc.
 
M-Trends® 2011: When Prevention Fails
M-Trends® 2011: When Prevention Fails M-Trends® 2011: When Prevention Fails
M-Trends® 2011: When Prevention Fails FireEye, Inc.
 
M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent ThreatFireEye, Inc.
 
SANS 2013 Report: Digital Forensics and Incident Response Survey
SANS 2013 Report: Digital Forensics and Incident Response Survey SANS 2013 Report: Digital Forensics and Incident Response Survey
SANS 2013 Report: Digital Forensics and Incident Response Survey FireEye, Inc.
 
SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...
SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...
SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...FireEye, Inc.
 
2013 Incident Response Survey
2013 Incident Response Survey2013 Incident Response Survey
2013 Incident Response SurveyFireEye, Inc.
 
FireEye Cyber Defense Summit 2016 Now What - Before & After The Breach
FireEye Cyber Defense Summit 2016 Now What - Before & After The BreachFireEye Cyber Defense Summit 2016 Now What - Before & After The Breach
FireEye Cyber Defense Summit 2016 Now What - Before & After The BreachFireEye, Inc.
 
Proatively Engaged: Questions Executives Should Ask Their Security Teams
Proatively Engaged: Questions Executives Should Ask Their Security TeamsProatively Engaged: Questions Executives Should Ask Their Security Teams
Proatively Engaged: Questions Executives Should Ask Their Security TeamsFireEye, Inc.
 

Plus de FireEye, Inc. (20)

Asia Pacific & The Security Gap: Don't Stand Still
Asia Pacific & The Security Gap: Don't Stand StillAsia Pacific & The Security Gap: Don't Stand Still
Asia Pacific & The Security Gap: Don't Stand Still
 
EMEA & The Security Gap: Don't Stand Still
EMEA & The Security Gap: Don't Stand StillEMEA & The Security Gap: Don't Stand Still
EMEA & The Security Gap: Don't Stand Still
 
[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...
[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...
[Industry Intelligence Brief] Cyber Threats to the Legal and Professional Ser...
 
M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点
 
[Infographic] Healthcare Cyber Security: Threat Prognosis
[Infographic] Healthcare Cyber Security: Threat Prognosis[Infographic] Healthcare Cyber Security: Threat Prognosis
[Infographic] Healthcare Cyber Security: Threat Prognosis
 
[Infographic] Email: The First Security Gap Targeted by Attackers
[Infographic] Email: The First Security Gap Targeted by Attackers[Infographic] Email: The First Security Gap Targeted by Attackers
[Infographic] Email: The First Security Gap Targeted by Attackers
 
M-Trends 2015: 최일선에서 본 관점
M-Trends 2015: 최일선에서 본 관점 M-Trends 2015: 최일선에서 본 관점
M-Trends 2015: 최일선에서 본 관점
 
M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点M-Trends 2015 セキュリティ最前線からの視点
M-Trends 2015 セキュリティ最前線からの視点
 
M-Trends 2015 : Les nouvelles du front
M-Trends 2015 : Les nouvelles du frontM-Trends 2015 : Les nouvelles du front
M-Trends 2015 : Les nouvelles du front
 
5 Reasons Cyber Attackers Target Small and Medium Businesses
5 Reasons Cyber Attackers Target Small and Medium Businesses 5 Reasons Cyber Attackers Target Small and Medium Businesses
5 Reasons Cyber Attackers Target Small and Medium Businesses
 
Connected Cares: The Open Road For Hackers
Connected Cares: The Open Road For HackersConnected Cares: The Open Road For Hackers
Connected Cares: The Open Road For Hackers
 
M-Trends® 2013: Attack the Security Gap
M-Trends® 2013: Attack the Security GapM-Trends® 2013: Attack the Security Gap
M-Trends® 2013: Attack the Security Gap
 
M-Trends® 2012: An Evolving Threat
M-Trends® 2012: An Evolving Threat M-Trends® 2012: An Evolving Threat
M-Trends® 2012: An Evolving Threat
 
M-Trends® 2011: When Prevention Fails
M-Trends® 2011: When Prevention Fails M-Trends® 2011: When Prevention Fails
M-Trends® 2011: When Prevention Fails
 
M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat
 
SANS 2013 Report: Digital Forensics and Incident Response Survey
SANS 2013 Report: Digital Forensics and Incident Response Survey SANS 2013 Report: Digital Forensics and Incident Response Survey
SANS 2013 Report: Digital Forensics and Incident Response Survey
 
SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...
SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...
SANS 2013 Report on Critical Security Controls Survey: Moving From Awareness ...
 
2013 Incident Response Survey
2013 Incident Response Survey2013 Incident Response Survey
2013 Incident Response Survey
 
FireEye Cyber Defense Summit 2016 Now What - Before & After The Breach
FireEye Cyber Defense Summit 2016 Now What - Before & After The BreachFireEye Cyber Defense Summit 2016 Now What - Before & After The Breach
FireEye Cyber Defense Summit 2016 Now What - Before & After The Breach
 
Proatively Engaged: Questions Executives Should Ask Their Security Teams
Proatively Engaged: Questions Executives Should Ask Their Security TeamsProatively Engaged: Questions Executives Should Ask Their Security Teams
Proatively Engaged: Questions Executives Should Ask Their Security Teams
 

Dernier

DBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDropbox
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodJuan lago vázquez
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businesspanagenda
 
MS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsMS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsNanddeep Nachan
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...apidays
 
A Beginners Guide to Building a RAG App Using Open Source Milvus
A Beginners Guide to Building a RAG App Using Open Source MilvusA Beginners Guide to Building a RAG App Using Open Source Milvus
A Beginners Guide to Building a RAG App Using Open Source MilvusZilliz
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024The Digital Insurer
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMESafe Software
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesrafiqahmad00786416
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...apidays
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWERMadyBayot
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyKhushali Kathiriya
 
Ransomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdfRansomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdfOverkill Security
 
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Zilliz
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)wesley chun
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?Igalia
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century educationjfdjdjcjdnsjd
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoffsammart93
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024The Digital Insurer
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays
 

Dernier (20)

DBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor Presentation
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
 
MS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsMS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectors
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
A Beginners Guide to Building a RAG App Using Open Source Milvus
A Beginners Guide to Building a RAG App Using Open Source MilvusA Beginners Guide to Building a RAG App Using Open Source Milvus
A Beginners Guide to Building a RAG App Using Open Source Milvus
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMECloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Ransomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdfRansomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdf
 
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 

The Internal Signs of Compromise

  • 1. 1© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. Know before others…Do you know the internal signs of a compromise? Methodology, Technology, and Services Stuart Davis, Mandiant Director
  • 2. 2© Mandiant, a FireEye Company. All rights reserved. Agenda  Background: Threat landscape  Methodology : Evolution of Incident Response  Technology : How MANDIANT finds Evil  Services : What MANDIANT can provide
  • 3. 3© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. 3 THREAT LANDSCAPE Evolution of Incident Response
  • 4. 4© Mandiant, a FireEye Company. All rights reserved. 4 It’s a “who,” not a “what” There is a human at a keyboard Highly tailored and customized attacks Targeted specifically at you They are professional, organized and well funded Escalate sophistication of tactics as needed Relentlessly focused on their objective If you kick them out they will return They have specific objectives Their goal is long-term occupation Persistence tools and tactics ensure ongoing access EVOLVING THREAT LANDSCAPE
  • 5. 5© Mandiant, a FireEye Company. All rights reserved. Gain Initial Access Into Target Strengthen Position within Target Steal Valid User Credentials Identify Target Data Package and Steal Target Data Establish Foothold Escalate Privileges Internal Recon Complete Mission Initial Compromise Move Laterally Maintain Presence ANATOMY OF A TARGETED ATTACK 6
  • 6. 6© Mandiant, a FireEye Company. All rights reserved. 6 TIME FROM INITIAL COMPROMISE TO DISCOVERY 416 243 229 205 2011 2012 2013 2014 Source: Mandiant M-Trends 2015 The longest time we detected attackers had been present in the victim’s environment was 2,982 days (over 8 years). Median number of days that threat groups were present on a victim’s network before detection
  • 7. 7© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. METHODOLOGY Evolution of Incident Response
  • 8. 8© Mandiant, a FireEye Company. All rights reserved. History of DFIR (Digital Forensic and Incident Response) Disk Forensics1995 Memory Forensics2005 • Live Response • Network Forensics 2010
  • 9. 9© Mandiant, a FireEye Company. All rights reserved. 1st Generation (1995-) : Disk Forensics  What to analyze - File System: Full Disk / Eventlogs / Prefetch / Registry Hives / Brower History / Scheduled Task / etc.  How to analyze - Shutdown system, Un-mount disk - Connect to Write blocker > Make disk image - Analyze with tools  Tools to use - The Sleuth Kit & Autopsy (Open Source) - Guidance EnCase - AccessData FTK - X-Ways
  • 10. 10© Mandiant, a FireEye Company. All rights reserved. 1st Generation (1995-) : Disk Forensics (cont.)  Pros - Data recover (Carving) - Law Enforcement  Cons - Business impact : Shutdown System - Difficult to collect : Disk Encryption, RAID, NAS, Cloud - Dead artifacts : No Live Data in the memory - Scale : Disk by disk  Cost-effectiveness - 1 disk for 1 week - JPY 1,500,000 / disk - Up to 100 hosts (100 weeks = 2 years?)
  • 11. 11© Mandiant, a FireEye Company. All rights reserved. 2nd Generation (2005-) : Memory Forensics  What to analyze - Memory : Process / Driver / Handles / Network Connection / etc.  How to analyze - Mount external USB or Network Drive - Dump Physical Memory - Analyze with tools  Tools - Volatility (Open Source) - Mandiant Redline (Free)
  • 12. 12© Mandiant, a FireEye Company. All rights reserved. 2nd Generation (2005-) : Memory Forensics (cont.)  Pros - No business impact - Live Data Acquisition  Cons - Limited Raw Disk Access - Scale : Host by host  Cost-effectiveness - 1 memory dump for half week - $8K USD / host (Forensics specialist needed) - Up to 100 hosts (50 weeks = 1 years?)
  • 13. 13© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Live Response  What to analyze - File System, Memory Forensics by remote  How to analyze - Server, Agent base - Execute a job in the Host by Agent and feed back the result to Server - Analyze the result with central tools  Tools - GRR (Open Source) - Guidance EnCase Enterprise - ManTech Active Defense
  • 14. 14© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Live Response (cont.)  Pros - No business impact - Enterprise Scale - Speed  Cons - No proactive detection - Lack of intelligence - Need extensive knowledge  Cost-effectiveness - Per Host License
  • 15. 15© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Network Forensics  What to analyze - Full packet / Session data / Protocol logs / Statistics  How to analyze - Packet Capture - Protocol Parsing - Analyze the result with central tools  Network Forensic Tools - Security Onion (Open Source) - BlueCoat Solera Networks - RSA Security Analytics (NetWitness)
  • 16. 16© Mandiant, a FireEye Company. All rights reserved. 3rd Generation (2010-) : Network Forensics (cont.)  Pros - No business impact - Network Visibility  Cons - No visibility for encrypted traffic - No proactive detection - Lack of intelligence - Need extensive knowledge  Cost-effectiveness - Depends on traffic and storage
  • 17. 17© Mandiant, a FireEye Company. All rights reserved. Traditional Incident Response Process Identify System Collect Data Analyze Data Report
  • 18. 18© Mandiant, a FireEye Company. All rights reserved. Breadcrumb Trail  Incidents rarely have a simple, linear trail of evidence - Multiple “patient zero” hosts - Multiple pivot points for lateral movement - Forensic artifacts disappear over time - Noise from commodity malware
  • 19. 19© Mandiant, a FireEye Company. All rights reserved. CONFIDENTIAL Phishing Campaigns Compromised Hosts Accessed Hosts Hosts with Non- Targeted Malware Scoping Incidents
  • 20. 20© Mandiant, a FireEye Company. All rights reserved. CONFIDENTIAL Phishing Campaigns Compromised Hosts Accessed Hosts ? ? ? Scoping Incidents
  • 21. 21© Mandiant, a FireEye Company. All rights reserved.  Can’t wait for an alarm to go off before investigating  Intelligence driven Hosts & Network Devices Gather Sources of Evidence ? Identify systems of interest, generate new leads Hunting
  • 22. 22© Mandiant, a FireEye Company. All rights reserved. 2 • Red Teaming and Penetration Testing • ICS Security Assessment • Security Program Assessment (SPA) • Response Readiness Assessment (RRA) • Other strategic services • Compromise Assessment (CA) • Incident Response (IR) • Cyber Defense Center Development (CDC) • SOC/CIRT transformation • Incident Response Retainer • Education • Deployment & Integration AM I AT RISK? AM I PREPARED? AM I COMPROMISED? I AM BREACHED! PREPARE FOR FUTURE EVENTS? INCIDENT RESPONSE AND PREPAREDNESS CYCLE
  • 23. 23© Mandiant, a FireEye Company. All rights reserved. AM I PREPARED?AM I AT RISK? AM I COMPROMISED? I AM BREACHED! PREPARE FOR FUTURE EVENTS DIFFERENTIATORS VALUE 2 COMPROMISE ASSESSMENT AM I COMPROMISED? COMPROMISE ASSESSMENT Evaluate your environment for the presence of targeted attacker activity using the same methods and technologies used during our incident investigations OUR APPROACH • Deploy network and host based inspection technology for comprehensiveness, efficiency, and scale • Apply intelligence from prior investigations and our own knowledge of attack group tools, tactics, and procedures to assess your environment • Analyze evidence and anomalous activity to confirm malicious activity • Summarize our findings and provide strategic recommendations based upon our observations during the engagement Understand the health of your network- whether or not you have been breached • Same technology used in all Mandiant investigations for comprehensiveness, efficiency, and scale • Leverage all of our Intel to search for signs of compromise across the environment • Pivot into Incident Response mode if targeted attacker activity is identified
  • 24. 24© Mandiant, a FireEye Company. All rights reserved.
  • 25. 25© Mandiant, a FireEye Company. All rights reserved.
  • 26. 26© Mandiant, a FireEye Company. All rights reserved.
  • 27. 27© Mandiant, a FireEye Company. All rights reserved.
  • 28. 28© Mandiant, a FireEye Company. All rights reserved.
  • 29. 29© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. TECHNOLOGY How MANDIANT finds Evil
  • 30. 30© Mandiant, a FireEye Company. All rights reserved. Investigative Cycle  Indicators Of Compromise (IOC)  Host inspection (MIR)  Network analysis (NTAP)  Log analysis (TAP)  Malware reverse engineering  Threat Intelligence Analysis
  • 31. 31© Mandiant, a FireEye Company. All rights reserved. Indicators Of Compromise (IOCs)  Indicator Of Compromise  Way of describing threat data like - Malware - Attacker Methodology - Evidence of compromise or activity  What Is An Indicator? - MD5: Change Frequently - File Names/Directories: Many Reused - Registry Key Values: Many Reused - Services With Wrong Service dll’s: Outliers - IPs and Domain Names: Change Frequently
  • 32. 32© Mandiant, a FireEye Company. All rights reserved. Network : Attacker Monitoring & Forensics  Network visibility  Internet egress points  Decode traffic generated by known malware  Reconstruct command-and-control activity  Recover data theft  Monitor All protocols (full packet capture)
  • 33. 33© Mandiant, a FireEye Company. All rights reserved. Network : Architecture Mandiant VPN tunnel Internet Perimeter Firewall Switch Web Proxy Internal Network Firewall VPN Users Mandiant Mandiant Network Sensor = Network SPAN/TAP Servers, workstations, laptops INTERNAL NETWORK
  • 34. 34© Mandiant, a FireEye Company. All rights reserved. Endpoint : Hunting & Live Response  Host visibility  Agent / controller model  Deploy to all Windows systems in environment  Identify historical evidence of compromise  Search all hosts for IOCs  Conduct deep-dive analysis on systems of interest
  • 35. 35© Mandiant, a FireEye Company. All rights reserved. Endpoint : Architecture MIR Controller #nMIR Controller #1 VPN Users Mandiant Servers, workstations, laptops INTERNAL NETWORK = Mandiant Agent Mutually authenticated SSL
  • 36. 36© Mandiant, a FireEye Company. All rights reserved. Big data : Finding Needle & Analysis  Network, endpoint, application events visibility  Detect with Mandiant Threat Intelligence  Source from Syslog, Windows Event Log, File, ODBC  Communication Broker in customer environment  Cloud-based; all technology managed
  • 37. 37© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. TOOLS OF THE TRADE A TEAM of analysts enabled by MIR and NTAP
  • 38. 38© Mandiant, a FireEye Company. All rights reserved. End-point Visibility – Sweeping the Environment
  • 39. 39© Mandiant, a FireEye Company. All rights reserved. Find One. IOC matches are verified by analysts by extracting suspect artifacts from end-points and/or verifying network sensors for corroborating evidence.
  • 40. 40© Mandiant, a FireEye Company. All rights reserved. Find One. Then Find Them All. An initial lead converted to an IOC can yield quick results across the entire estate.
  • 41. 41© Mandiant, a FireEye Company. All rights reserved. Regional Threats Indicators of Compromise (IOC) used during a Compromise Assessment are comprised of information from: • Incident Response engagements • Internal research • Publicly available data • Regional teams input IOCs are updated continuously and can be made client specific.
  • 42. 42© Mandiant, a FireEye Company. All rights reserved. Tracking Attackers With Network Sensors Network sensors enable near real-time detection of threats, capture of identified malicious traffic, and tracking of attacker activity.
  • 43. 43© Mandiant, a FireEye Company. All rights reserved.© Mandiant, a FireEye Company. All rights reserved. TO GAIN MORE INSIGHT WATCH THE WEBINAR HERE

Notes de l'éditeur

  1. Key Points: There are 7 major phases to a targeted attack. 1. The initial compromise typically begins with a victim clicking on a link or attachment in a spear phishing e-mail. 2. After the initial compromise the attacker creates back doors and establishes a foothold in the environment. 3. Very quickly the attacker steals valid credentials. At this point they blend in and it’s difficult to tell them apart from legitimate users. 4. Now the attacker begins to survey the network to identify the data they are trying to steal. 5. As they perform reconnaissance, they move laterally to other parts of the network in search of their target data. 6. As they move laterally they deploy additional backdoors and persistence mechanisms 7. Once they have identified their target data they package it up and steal it. I mentioned before that the attackers’ objectives are long-term occupation. The typical organization Mandiant responded to in the last year had been compromised an average of 229 days.
  2. In 1984 the FBI launched a Computer Analysis and Response In 1987 FTK founded in 1997 Guidance founded In 1998 EnCase launched In 2004, Michael Ford introduced memory forensics into security investigations with an article in SysAdmin Magazine. In 2005, DFRWS issued a Memory Analysis Forensics Challenge.
  3. Talk about scoping, DO NOT TALK ABOUT SYSTEMS WITH TOOLS, BACKDOORS, ACCESSED ETC NOT BEING THE SAME.
  4. Talk about scoping, DO NOT TALK ABOUT SYSTEMS WITH TOOLS, BACKDOORS, ACCESSED ETC NOT BEING THE SAME.
  5. May not find everything Will find more
  6. This slide represents the incident response and preparedness cycle. It captures our core mission and summarizes everything Mandiant consulting does by mapping it against the different phases and stages our clients go through. It highlights the completeness of our portfolio while showing how everything we do ties back to our core capabilities around IR. It highlights how organization continuously need to ask them selves questions such as Am I prepared? Am I compromised as the threat landscape continues to evolve. Given this rapidly evolving threat landscape, organizations require a trusted party to assist with the different stages of the IR and preparedness cycle. We provide organizations peace of mind in helping them protect their most critical assets, reducing cost in case of an incident and reducing risk of a future incident. We provide them with a deep understanding of attacker behavior, exceptional visibility in the rapidly evolving threat landscape and the technology to respond and defend with speed, scale, and efficiency.
  7. Answers the question – “am I compromised?” Grants companies access to Mandiant’s premier investigative consultants and FireEye’s technology and intelligence. Organizations should ideally have a compromise assessment performed on their environment yearly. Some companies choose to have compromise assessments performed on all companies they acquire or merge with prior to connecting the environments. Other companies choose to have a compromise assessment performed because a breach in their business sector (i.e. government, retail, financial, healthcare, mining, etc) made headlines. Companies naturally want to be proactive in detecting and remediating issues in their environment – compromise assessments help them be proactive. A compromise assessment can be though of as a light incident investigation – the tools, intelligence, and many of the tactics are the same. We deploy the same tools and technology as we normally would deploy but we deploy in an environment that which we have no prior knowledge of if they are actually compromise. We then start searching the environment for host and network indicators of compromise: the re-use of custom malware, C2 protocols, stolen certificates, persistence mechanisms, evidence of lateral movement or credential misuse, etc. In the event malicious activity is discovered we smoothly transition into a full Incident Response. Key Deliverables Executive and technical outbrief presentations, activity reports for both network and endpoint, and a summary of the findings. Peace of mind for the board, executive team, and internal security or audit team.
  8. Iterative analysis Each piece feeds into all of the others