Threat Hunting - Moving from the ad hoc to the formal
•
6 j'aime•1,063 vues
In order to effectively defend your organization, you must think about the offensive strategy as well. But before we get ahead of ourselves let’s talk briefly about the building blocks of a good offense. First is an architecture that is built around a security policy that is aligned with the business risk. Risk must be understood and a cookie cutter approach must be avoided here because again every organization is different and so are their risks.
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à Threat Hunting - Moving from the ad hoc to the formal
Similaire à Threat Hunting - Moving from the ad hoc to the formal (20)
Plus de Priyanka Aash
Plus de Priyanka Aash (20)
Dernier
Dernier (20)
Threat Hunting - Moving from the ad hoc to the formal
- 1. Incident Response and Threat Hunting Sachin Deodhar SpiderLabs Incident Response & Readiness at Trustwave
- 2. ©2017 Trustwave Holdings, Inc. Cybercrime Motivations Why this problem is NOT going away • Trustwave Global Security Report research shows 1,425% Return on Investment • Estimated ROI for a one-month ransomware campaign • Based on Trustwave SpiderLabs research into underground markets • One example: $5,900 investment = $84,100 profit
- 3. ©2017 Trustwave Holdings, Inc. Video – The Cybercrime Underground How it really works
- 4. ©2017 Trustwave Holdings, Inc. BEST DEFENSE IS A GOOD OFFENSE Build on a solid foundation, but don’t rest on it. • This is a maturing model that requires progression from an investment of capital and resources. • Organizations need to maximize data collection from the beginning in order for Active Defense and Intelligence to be most effective. ARCHITECTURE PASSIVE DEFENSE ACTIVE DEFENSE INTELLIGENCE OFFENSE Security Policy, Systems Design, Network architecture, system maintenance address vulnerabilities. Examples: • Application • Database • Layering • Hardening • AD/DNS Added to design to provide defense or insight against threats without consistent human interaction. Examples: • IDS • Firewall • Endpoint Activities related to active monitoring for threats, responding to them, and providing that to the internal environment. Examples • SIEM • 24x7 SOC • IR • Pen Testing Collecting data, exploiting it into information, comparing competing intel, and producing actionable intelligence. Examples • Threat Hunting • Identity Hunting Legal countermeasures and self-defense actions against an adversary. Examples • C&C • Engaging Law Enforcement
- 5. ©2017 Trustwave Holdings, Inc. THREAT DETECTION CONTINUUM Where are you….and where are your adversaries?
- 6. ©2017 Trustwave Holdings, Inc. THE THREAT HUNT CHALLENGE Hunting 101 Evasion techniques still have patterns. Adversaries will continue to change their patterns and Threat hunting must do the same: 1) Adapt to changes in behaviors and learn how the adversaries work. An advanced adversary will target a system, upload code, create a C2 channel, and survive a reboot. Although the specific methods of doing this are always changing, the general behavior patterns are the same. 2) Watch all behaviors of the adversary, including known good, known bad and unknown or unclassified behaviors. Looking for anomalies that deviate from normal behavior can help detect unknown or previously unseen hostile activity. 3) Contain and control the damage by identifying attackers lateral movements and remove systems This is less about spotting malware and more about identifying hostile behavior and containing that behavior fast. Threat hunting is the intersection of cyber threat intelligence, analyst expertise, and artificial intelligence.
- 7. ©2016 Trustwave Holdings, Inc. Incident Preparation, Detection & Response Program
- 8. ©2017 Trustwave Holdings, Inc. Incident Readiness How will you prepare for the attacks? • Breach Assessments • Identity Hunting • Real-time response • Cyber Threat Intel • Forensics • Reverse engineering • Root Cause Analysis • Network Remediation • Application • Networks • Social Engineering • Red Team • Plan • Train • Test • Hunt Incident Readiness Program Penetration Testing Threat Hunting / MDR Incident Response • Incident Readiness is not a collection of products • Incident Readiness is an organized, holistic, and systematic approach designed to rapidly: – Prevent – Identify – Respond – Remediate
- 9. ©2017 Trustwave Holdings, Inc. Incident Readiness Program • An Incident Readiness Program prepares corporations to respond to the inevitable attacks • A Managed IRP provides a 24/7 global expert response, ready to respond on the client’s behalf • Flexible IRP hours allow guaranteed ROI – IR Retainers should be more than an insurance policy • 4 hour remote SLA – 24 hour onsite SLA (If required) • Programs are customized to client requirements • Long-term partnerships allow for improved capabilities and cooperation over time • Dedicated consultants enable intimate corporate knowledge but supported by a global team of experts Preparedness with Guaranteed Coverage
- 10. ©2017 Trustwave Holdings, Inc. IRP – Project Phases Flexible program, catered to the Client’s needs •Current state of readiness and develop roadmap to IR maturityReadiness & Detection Assessment •Map roles & responsibilities for various emergenciesIncident Response Plan •IR, computer forensics, & malware analysis coursesIR Team Development & Training •Instructor led situational group exercisesTable Top Exercises •Clandestine Darknet research for client specific intel (aka. Targeted threat research)Identity Hunting •Live fire exercises to test IR capabilityAttack Simulation / Cyber wargames •Endpoint & Traffic analysis to identify active network threatsProactive Threat Hunting •24/7 team of global experts ready to respond on a moment’s noticeIR Retainer
- 11. ©2017 Trustwave Holdings, Inc. Breach Assessment Threat Hunting • 1 – 3 month engagement to identify any malicious activity on your network • Security best practices support an annual threat hunt to identify unknown attackers inside the network • Mergers & Acquisitions: Connecting to any unknown network requires a Breach Assessment • Threat hunt focuses on endpoints, network log data, and memory analytics – powered by SpiderLabs cyber threat intelligence • Immediate visibility and threat hunting across all global endpoints leveraging threat intel, behavioral analytics, and AI. • Partnered with industry-leading EDR technologies, CounterTack and Carbon Black Answer the essential question: Is your network compromised?
- 12. ©2017 Trustwave Holdings, Inc. Managed Detection and Response Comprehensive endpoint visibility, every action tracked, immediate IR & Remediation Constant visibility & threat hunting for countless endpoints across the globe All system activity tracked, automated AI hunting, real time IR and remediation Immediate threat intel generation and enterprise threat hunting capability
- 13. ©2017 Trustwave Holdings, Inc. Speed Matters • Every second an attacker is on your network, he is looking to move laterally and capture your golden secrets • No retainer in place – Provider selection, contract negotiations, NDA, payment, travel time – Average time to respond 8 days • IRP retainer in place – Expert (SpiderLabs?) responder on-call 24/7 – 4 hour remote / 24 hour onsite global SLA • MDR + Retainer – Constant proactive threat hunting – Immediate remote IR – many steps automated – Analysis occurs concurrent to responder travel time – Response & remediation time is minutes, not days Detection to remediation time essential to impact reduction 0 1 2 3 4 5 6 7 8 9 No Retainer Retainer MDR + Retainer Time to Respond Time to Respond
- 14. ©2016 Trustwave Holdings, Inc. Advanced Breach Detection & Response – Case Study
- 15. Strictly confidential – Do not distribute18 Layered Detection and Response Day In the Life KEY’S TO SUCCESS: 1. The Right People 2. Standard Processes 3. Leveraged Technology Threat Manager Threat Analyst Threat Analyst Threat Analyst Threat Analyst Advanced Analysis / Response Advanced Analysis / Response Tier 3 • Console Monitoring • Take action • 5-7 minutes on average per alert • Deep investigation • Tuning and mitigation • 30 minutes on average per alert • Malware reverser • Data pivot and trend • Industry alert • Threat hunting Tier 1 Tier 2 Network Hunter Endpoint Hunter Malware Hunter Threat Intel
- 16. Strictly confidential – Do not distribute19 SpiderLabs Cyber Threat Intelligence The Real secret Sauce Trustwave Threat Intelligence SL-PT: CREATE • OSX Skype Backdoor (12/16) • Bopup Server Remote Buffer Overflow (11/16) • Linux Kernel Bypass Technique (3/16) SL-RES: ANALYZE • Malware family discoveries: Punkey, Alina, Backoff… • Exploit Kit Tracking: RIG, Neutrino, Angler, etc. • Global Botnet Tracking: Conficker, ZeroAccess, etc SL-IR: INVESTIGATE • Deep dive breach investigations yield libraries of IoC’s • Actor tracking &attribution: Carbanak (2016-17) • Threat briefs and community education SL-TO: ASSIMILATE • External and internal Threat intel assimilation: Cymru, CB, Homeland Security, Virus Total, Emerging Threats, etc • Telco Partnerships • Continual hunting and triage response
- 17. Strictly confidential – Do not distribute20 Response & Hunting in Action – Case Study Customer: 150+ luxury hotels, Next-Gen Firewalls, Threat Prevention, MDR, IRP, Endpoint protection, strong & layered security Tier 1 Alert - Excessive login attempts lead to Admin Accounts lockout Tier 2 Escalation – Log/ MDR review identify lateral movement and active malware Tier 3 Escalation - Reservation agent socially engineered to open malicious Word document. Attacker escalated privileges, shutdown antivirus, enabled RDP and targeted customer PII and payment card data. Remediation – Backdoors closed & security recommendations implemented MDR Hunting - Attack profile generated. Carbanak attribution, hunt for IoC’s identified dozens of attacker backdoors Enterprise Hunting: Intel fueled threat hunt across MSS enterprise. Multiple attempts identified, all attacks stopped at initial stages. Threat Brief helped external victims identify compromise
- 18. ©2017 Trustwave Holdings, Inc. CARBANAK – TIMELINE OF MAJOR EVENTS A short but impactful history 2013-2015: Great Bank Heist June 2016: Russia Arrests 50 July 2016: Oracle / Micros Attack Q2 2016 - Present: Operation Grand Mars
- 19. ©2016 Trustwave Holdings, Inc. Optional: How Trustwave SpiderLabs identified Russian Cyber Mafia and inspired a major international federal investigation
- 20. ©2017 Trustwave Holdings, Inc. INFILTRATION • Email from Adam Kronz (adamkroz@rbx.email ) • Accompanied by direct phone call to reservation agent • Back-story researched via social media • Used fictitious company URL and website • Microsoft Word attachment contains malicious macros and downloads evil .vbs scripts Beyond Spear-Phishing
- 21. ©2017 Trustwave Holdings, Inc. GOOGLE CLOUD ENABLED MALWARE INTERACTION • Malware configurations, scripts, and attack parameters updated on-the-fly via Google Docs • Extremely difficult to block http traffic to the public cloud • Google and Pastebin cloud receive exfiltration data • Bot status and remote control monitored via Google Dynamic updates with no direct attacker interaction
- 22. ©2017 Trustwave Holdings, Inc. LINKS TO CARBANAK • Retrieves Anunak named config file • IFOBS banking module remain in this malware variation • Known command and control servers: – 148.251.18.75 – 95.215.46.221 – 95.215.46.229 – 95.215.46.234 – 81.17.28.124 Clear connections across attack campaigns
- 23. ©2017 Trustwave Holdings, Inc. LEGITIMATE DIGITAL CERTIFICATES • Binary digital signatures are designed to verify legitimacy of binaries • July 2016 - Carbanak acquired proper certificates for their malware from Comodo • 2 Russian shell companies were used: Forsajt Ynvest & Grand Mars Digital certificates industry in question
- 24. ©2017 Trustwave Holdings, Inc. ATTRIBUTION INVESTIGATION 304 Malicious Carbanak Domains registered to williamdanielson@yahoo.com & 1066569215 or 1066549216 US or Chinese contact numbers cubehost.biz registered under same contact numbers to Artyom Tveritinov of Perm, Russia Cubehost.biz is linked to Russian security firm "InfoKube". Infokube.ru was registered to atveritinov@gmail.com. Artyom Tveritinov is the CEO
- 25. ©2017 Trustwave Holdings, Inc. INFOKUBE STILL OPEN FOR BUSINESS • InfoKube has officially denied all involvement with the Carbanak attacks • CEO Artyom Tveritinov has deleted all social media accounts Probably a good idea to vet your security provider…
- 26. ©2017 Trustwave Holdings, Inc. Operation Grand Mars – Links to Report Link to the Operation Grand Mars report referenced in this presentation: https://www2.trustwave.com/Operation-Grand-Mars.html
- 27. THANK YOU
Notes de l'éditeur
- Type of damage cause be Cyber threats include: Theft of identity, credit cards, intellectual property Spoofing transaction processes such as wire transfers or access credentials Business disruption from DDoS Criminal extortion Destruction (Saudi Aramco, Sony) Influence business decisions (Sony, OPM) Weapons proliferation (Stuxnet, Duqu, Flame) Criminal exploitation (Ashley Madison)
- In order to effectively defend your organization, you must think about the offensive strategy as well. But before we get ahead of ourselves let’s talk briefly about the building blocks of a good offense. First is an architecture that is built around a security policy that is aligned with the business risk. Risk must be understood and a cookie cutter approach must be avoided here because again every organization is different and so are their risks. Layering on that architecture is passive defense, which is where the traditional security products would reside and the key for this stage is minimal human interaction, but clearly without the set it and forget it mentality again reinforced by the security policy. Now we move on to being more proactive and actively defending. Utilizing a SIEM to help with data collection and presentation to a 24x7 monitoring team that is augmented with a incident response team to identify the areas of compromise, which include reverse engineering malware to identify how passive defenses and architecture did not detect the malware. Building off an active defense we must infuse everything with intelligence and begin to go on missions to find the threats that have circumvented all control’s and defenses thus far. These are the unkown or undetected threats, not simply the “missed” threats as many times perceived. There are two facets to hunting, identify the threat against your organization and identify threats in your organization. Both aspects must be covered. I’ll leave you with a good non-technical example of this, as a Atlanta Falcon fan and Atlantanian many of you probably witness the greatest comeback story from Tom Brady and the Patriots…...as amazing as that story is, the bigger question that all analysts were answering on Monday morning was, “How did the Falcon’s loose with that big of a lead?” Besides some amazing math and analysts that did calcuations to determine the probabilty of it happening it could be summarized best with “The Falcons forgot to play offense when they were up by 25pts.” So the question you should ask is, “Did you forget to play offense and have faith only in your defense?”
- So what types of services should a organization look at to be more offense. To understand this I want to walk through the threat continuum which highlights that when greater visibility is achieved so is greater analytics and investigation. What I see is typically companies start with compliance focused tools and services. There is low visibilty and investigation capabilities here, but it meets most regulatory requirements and shows their organizational maturity in security. As organizations mature they begin to invest in threat monitoring which would be part of the active defense category. This is the area of table steaks for threat detection, I would even consider this to be the minimum area to begin in a enterprise threat detection program. The area all organizations should be investing in or have a roadmap too is the green area and is focused on high visibility, analytics, and investigation. This is where Intelligence and Offense can increase your organizations threat detection and most importantly protection by leveraging security orchestration. Breaking down a few specifics in the green, we see there being two areas of threat hunting which would include a endpoint approach as well as a network based approach. It’s a 80-20 mix between the two of them. Also part of the hunting category is identity hunting which is comprised of actively looking for your adversaries via social media, forums, and the darkweb specifically. You must be actively seeking information that would allow you to better protect your organization. This is how you get proactive and don’t wait till they try to deploy that specially crafted compromise.
- The key challenges to threat hunting is that our adversaries are constantly changing their behavior, however there are patterns that we can be aware of and look for. We know that a attacker is going to target systems, upload code, create a command and control channel, and ensure they can survive a reboot. This is a consistent behavior we can include in our hunts. We then must look for anomalies that deviate from normal behavior, that is where tools like UEBA can be highly effective which can help detect unknown or previously unseen hostile activity and last we must look for lateral movements. And when we find infected systems, we remove them immediately. I included a summary checklist that we use when conducting hunts for our clients. Key here is that this is less about spotting malware and more about identifying hostile behavior and containing that behavior as quickly as possible.
- I’ve talked about active defense, offense, and now hunting, So the question that must be addressed is, how do we successfully hunt? First let’s break hunting down in two categories, automated and manual. So how do we get from manual to automated, because manual is expensive as well as time consuming. Manual hunting requires a high level of skills, which we know we are at a shortage in the market. Manual also isn’t scalable across all threats, many which are imminent. We want to automate the collection and presentation of the data to the greatest extent possible for the hunt. So looking at the Hunting Maturity Model, we first begin with basic automated alerting, which again comes from that compliance focused mentality and basic active defense. Then we incorporate threat intel indicators into our searches that move into data analyst procedures for the hunters that were previously created. Next if we identify a new threat that wasn’t previously covered we create new data analysis procedures. Once these 4 steps are complete we move onto automation, where we automate the majority of the successful data analysis and our hunters can focus in on the results. To recap, the key objectives to a successful hunt are focused goals, limiting the searches, constantly improving based on feedback, automating, and of course measuring your success.