SlideShare une entreprise Scribd logo

Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck

•
•
North Texas Chapter of the ISSA
North Texas Chapter of the ISSA

Presentation from the North Texas ISSA July 2015 Lunch and Learn meeting: Advanced Threat Hunting

Présentations et discours publics
1  sur  32
Télécharger pour lire hors ligne
©2014  Bit9.  All  Rights  Reserved     Advanced  Threat  Hun/ng:     Iden%fy  and  Track  Zero-­‐Day  A3acks   Infiltra%ng  Your  Organiza%on           Jus/n  Falck,  Technical  Product  Manager  –  Carbon  Black   Bit9  +  Carbon  Black     July  16th,  2015  
  Background     Threat  Landscape     Advanced  Threats   •  What  are  they?   •  Zero-­‐Days   •  Why  Advanced  Threats  might  not  be  what  you  think  they  are   •  Living  off  the  Land  (“Outsider-­‐Insider”)     Hun/ng   •  What  do  you  hunt?   •  How  do  you  hunt?   •  RelaQonships  MaTer!     Wrap-­‐Up  &  Takeaways   Agenda  
Quick  Background  Check   www.linkedin.com/in/jus/nfalck   jfalck@bit9.com     2007  –  2013:  Central  Intelligence  Agency     2013  –  2015:  Goldman  Sachs     Threat  Management  Center  -­‐  Irving,  TX     2015  –  Present:  Bit9  +  Carbon  Black     Technical  Product  Manager  -­‐  CB  
The  Evolving  Threat  Landscape   Criminal  Enterprises   •  Broad-­‐based  and   targeted  aTacks   •  Financially   moQvated   •  Geang  more   sophisQcated   Hac/vists   •  Targeted  and   destrucQve   aTacks   •  Unpredictable   moQvaQons   •  Generally  less   sophisQcated   Na/on-­‐States   •  Targeted  and     mulQ-­‐stage  aTacks     •  MoQvated  by   informaQon  and  IP   •  Highly   sophisQcated,   limitless  resources  
Proof  of  Effec/veness  
Endless  Stream  of  Data  Breaches   Source:  InformaQon  is  BeauQful,  www.informaQonisbeauQful.net,  January  2015  
DON’T  OVERCOMPLICATE  THE  THREAT   THREAT  MODEL: 1:  OPPORTUNISTIC 2:  NOT
Opportunis=c  threats  sell  our  computers.     Goal:  breadth  of  access.       “Advanced”  threats  sell  our  data.       Goal:    precision  of  access.
Tradi/onal  Defenses  Were  Designed  for  Opp.  AZacks   OPPORTUNISTIC  ADVANCED   Goal  for  aTacker  is  to   compromise  as  few   endpoints  as  possible   Goal  for  aTacker  is  to   compromise  as  many     endpoints  as  possible   Hosts  Compromised   Time   Hosts  Compromised   Time   DETECTION  THRESHOLD   DETECTION  THRESHOLD   Signature   available   Signature   available  (if  ever)  
“Zero-­‐Days”     “Zero-­‐Day”  is  a  term  typically  used  to  refer  to  two  different  scenarios:   •  Zero-­‐Day  Vulnerability:  vulnerability  is  unknown  or  fix/patch  is  not  yet   available   –  “Non-­‐Pub”:  exploit  an  unknown  vulnerability   •  Zero-­‐Day  Malware:  malware  that  is  unknown;  signatures  are  not   available  
So  how  “advanced”   are  the  techniques  and   payloads  being  used?  
“The (Target) malware utilized is ABSOLUTELY UNSOPHISTICATED and UNINTERESTING” -McAfee Business Week, March 13, 2014
But  once  they’re  in…   However  they  get  in,  we  need  to  find  them!   Faster  detec/on  means:   • Shorter  dwell  Qme   • Smaller  scope  for  your  incident  response   • Less  damage  to  your  business     What  do  they  do  once  they’re  in?  
They  oben  “Live  off  the  Land”  (and  blend  in)  
Living  off  the  Land   Living  Off  the  Land:  the  aZacker  uses  built-­‐in  tools  so  there  are  very  few   new  executables.    The  aZacker  typically  needs  to  do  the  following:     •  Execute  code:   –  Crack/Dump/Guess/Obtain  Valid  CredenQals   »  See  this  with  Backoff  POS  Malware   •  Copy  Data:   –  UQlize  tools  like  robocopy,  xcopy,  cmd.exe  to  gather  data   –  UQlize  “known  good”  tools  for  compression  or  use  scripts   •  Exfil  Data:   –  mp.exe,  net.exe,  Visual  Basic  script  to  control  IE  for  POSTing  data   •  Manipulate:   –  Download  something  not  malicious  but  that  will  trip  up  detecQon   –  When  Admin  logs  in,  credenQals,  keystrokes,  etc.,  are  captured  and  used   •  Persist:   –  Compromise  or  Add  more  user  and  system  accounts   –  Login  to  backup  servers,  staging  servers,  less  noQceable  parts  of  your  enterprise   –  Create  scheduled  jobs  that  will  run  and  re-­‐add  accounts,  communicate  out,  etc.  
Living  off  the  Land  (cont’d)     More  Things  to  Consider:   •  PowerShell  is  TOO  Powerful   –  Execute  from  remote  URL   –  Basically  anything  you  would  ever  want  to  write  code  for,  you  can  do  with  powershell,  so  as  an   adversary,  I  can  really  do  some  damage  (powersploit,  etc)   •  Use  Internal  C2  Sites:   –  Use  blog  comments  and/or  wiki  to  give  your  stuff  new  commands  so  there  is  no  outside   communicaQons   •  Use  Well-­‐Known  Social  Networking  and  File-­‐sharing  Sites:   –  TwiTer  (bots)   –  Dropbox   –  Google  Drive   –  Facebook   –  <  Insert  Social  Site  Here  >   •  Find  hardcoded  creden/als,  re-­‐use  same  password  across  an  enterprise,  Single-­‐Sign-­‐ On  design  flaws,  etc.    
In  Other  Words…   THEY  ARE  NOW  INSIDERS!     BETTER  DEFENSE  AGAINST  THIS…       LEADS  TO  BETTER  DEFENSE  AGAINST   TRUE  INSIDERS!  
So,  back  to  Hun/ng…  
Is  Your  Environment  Like  This?  
Or  This?  
What  do  you  Hunt?     Do  you  know  what  you’re  looking  for?    Do  they  have  to  be  advanced?   •  Are  you  running  vulnerable  somware?    Is  it  likely  to  be  compromised?   •  Have  you  hardened  your  systems,  have  you  reduced  surface  area?   •  Do  you  have  shared  passwords,  plain-­‐text  credenQals,  etc?   •  If  you  have  too  much  entropy  or  very  few  standards,  hunQng  will  be  DIFFICULT   •  Then  again,  it  is  rarely  “easy”       What  do  the  bad  guys  need  to  do?   •  Execute   •  Communicate   •  Grab  Data   •  Steal/Add  CredenQals   •  Persist  
Which comes first… Detection or Collection? By  priori=zing  collec=on  over  detec=on  you  can: (1)  HUNT  MORE  EFFECTIVELY!!! (2)  Rapidly  find  root  cause (3)  Quickly  &  confidently  reconstruct  =melines (4)  Accelerate  Discovery  (determine  scope) (5)  Benefit  from  hindsight  (evolve)
Some  Ideas…      §  Are  abnormal  user  accounts  being  used?   §  Do  windows  processes  (lsass,  svchost,  csrss)  have  strange  parents?   §  Are  IE,  Acrobat,  Word,  Notepad,  etc.,  spawning  child  processes?   §  Are  Office  Applica/ons  making  outbound  connec/ons?   §  Is  Java  spawning  command  shells?   §  Is  cmd.exe  running  as  system?   §  Are  user  accounts  being  added  locally?   §  Are  thousands  of  files  being  modified  by  a  single  process?   §  Is  bp  or  robocopy  being  used?   §  Are  processes  execu/ng  that  don’t  have  a  .exe  or  .scr  extension?  
Back  to  the  Basics…      §  Are  you  recording  every  command  line  used  by  net.exe  and  looking   for  abnormali/es?   §  Are  you  watching  when  PowerShell.exe  is  used?   §  Are  you  mapping  user  account  ac/vity  to  hosts  to  look  for   abnormal  logins?   §  Are  you  ….    <INSERT  LOTS  OF  STUFF  “TO  DO”  HERE>  
“Response  is  the  closest   thing  we  have  in  IT  to   dogfigh/ng”   -­‐  Bruce  Schneier,  Blackhat  2014  Keynote    
Time is the dominant parameter. The pilot who goes through the OODA cycle in the shortest time prevails because his opponent is caught responding to situations that have already changed. Col John Boyd 1966  Observe    Orient    Decide    Act  
Modern       IR  view   Ac/onable  Endpoint  Visibility   Tradi/onal   IR  view   Events  +  Intelligence     With  no  insight  into  known  bad,  how  can  they  pick   the  needles  out  of  their  data  collecQon  haystack?     Events  +  Intelligence  +  Prevalence       Without  understanding  prevalence,  how  can  they   prioriQze  detecQon  events  to  accelerate  threat   discovery?   Events  +  Intelligence  +  Prevalence  +  Rela/onships     Without  maintaining  the  recorded  relaQonships,  how   do  they  quickly  scope  any  impacted  endpoints  and   lateral  movement?   Events     Most  organizaQons  only  have  a  staQc  view  of  their   business  and  the  data  they  manage  to  collect   What’s  more  ac/onable?   ?  svchost.exe  ran   svchost.exe  was  spawned  by   unsigned  binary  under  abnormal   user  account  and  made  a   network  connecQon  
The  very  nature  of  threat  hun%ng   requires  the  human  element   In  IT,  we  hire  staff  to     support  technology   In  security  opera%ons,     we  buy  technology  to   support  staff   Invest  in  tools  that  enable  humans  to  make  quick  decisions  
1   2   3   Hun/ng  Tips   Collect  the  RIGHT  Data   Neslow  data  and  firewall  logs  can  help,  but  if  you  aren’t  seeing   what  is  execuQng  and  what  is  changing  on  your  systems,  you  will   not  have  as  much  hunQng  success.     You  need  to  hunt  where  the  adversaries  live!   Incorporate  Reputa/on  and  Classifica/on  Informa/on   When  you’re  hunQng,  you  should  not  have  to  spend  Qme  manually  checking  the     reputaQon  of  a  binary  or  website,  as  that  greatly  slows  down  your  ability  to     conQnue  to  the  hunt.    Being  able  to  quickly  say  things  are  known  good,  known     Bad  is  key,  as  is  the  ability  to  say  if  it  is  part  of  a  parQcular  campaign  or  aTack.   Analyze  RELATIONSHIPS   RelaQonships  are  key  to  being  able  to  detect  abnormal  behavior.     Sure,  the  adversary  lives  off  the  land,  but  they’re  sQll  going  to  do   unusual  things  with  the  exisQng  tools  available  to  them.     4   Automate  as  much  as  possible!   When  you  know  what  is  normal,  you  should  be  able  to  be  alerted  when  acQvity  occurs  outside   of  what  is  normal.    And  you  should  be  able  to  automate  this.    You  should  also  automate   reputaQon  and  classificaQon  informaQon  retrieval,  and  automate  discovery.    
TAKE-­‐AWAYS              
Take-­‐Aways    Think  about  how  you  might  hunt  advanced  threats    Can  internal  tools  be  used  against  you?    Do  you  have  proper  context?    Can  you  tell  the  FBI  whether  or  not  you’ve  seen  the  IOCs   they  just  sent  you?    Compare  current  behavior  vs.  older  methods  vs.  “next-­‐ gen”    Enable  your  humans  to  do  some  hunQng    Are  you  focused  on  root  cause?  
Thank  You!               jfalck@bit9.com     www.linkedin.com/in/jus/nfalck  

Recommandé

Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Danny Akacki
 
SOC2016 - The Investigation Labyrinth
SOC2016 - The Investigation LabyrinthSOC2016 - The Investigation Labyrinth
SOC2016 - The Investigation Labyrinth
chrissanders88
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
GIBIN JOHN
 
Building a Successful Threat Hunting Program
Building a Successful Threat Hunting ProgramBuilding a Successful Threat Hunting Program
Building a Successful Threat Hunting Program
Carl C. Manion
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
Ben Boyd
 
Abstract Tools for Effective Threat Hunting
Abstract Tools for Effective Threat HuntingAbstract Tools for Effective Threat Hunting
Abstract Tools for Effective Threat Hunting
chrissanders88
 
Threat hunting and achieving security maturity
Threat hunting and achieving security maturityThreat hunting and achieving security maturity
Threat hunting and achieving security maturity
DNIF
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On Lab
Teymur Kheirkhabarov
 

Recommandé

Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Danny Akacki
 
SOC2016 - The Investigation Labyrinth
SOC2016 - The Investigation LabyrinthSOC2016 - The Investigation Labyrinth
SOC2016 - The Investigation Labyrinth
chrissanders88
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
GIBIN JOHN
 
Building a Successful Threat Hunting Program
Building a Successful Threat Hunting ProgramBuilding a Successful Threat Hunting Program
Building a Successful Threat Hunting Program
Carl C. Manion
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
Ben Boyd
 
Abstract Tools for Effective Threat Hunting
Abstract Tools for Effective Threat HuntingAbstract Tools for Effective Threat Hunting
Abstract Tools for Effective Threat Hunting
chrissanders88
 
Threat hunting and achieving security maturity
Threat hunting and achieving security maturityThreat hunting and achieving security maturity
Threat hunting and achieving security maturity
DNIF
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On Lab
Teymur Kheirkhabarov
 
TTPs for Threat hunting In Oil Refineries
TTPs for Threat hunting In Oil RefineriesTTPs for Threat hunting In Oil Refineries
TTPs for Threat hunting In Oil Refineries
Dragos, Inc.
 
Avoiding the Pitfalls of Hunting - BSides Charm 2016
Avoiding the Pitfalls of Hunting - BSides Charm 2016Avoiding the Pitfalls of Hunting - BSides Charm 2016
Avoiding the Pitfalls of Hunting - BSides Charm 2016
Tony Cook
 
Threat Hunting Workshop
Threat Hunting WorkshopThreat Hunting Workshop
Threat Hunting Workshop
Splunk
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
Spyglass Security
 
Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightCyber Threat Hunting with Phirelight
Cyber Threat Hunting with Phirelight
Hostway|HOSTING
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE - ATT&CKcon
 
Threat hunting on the wire
Threat hunting on the wireThreat hunting on the wire
Threat hunting on the wire
InfoSec Addicts
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)
ENOInstitute
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
Dhruv Majumdar
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
Splunk
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
Splunk
 
What is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityWhat is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda Security
Panda Security
 
Threat Hunting Report
Threat Hunting Report Threat Hunting Report
Threat Hunting Report
Morane Decriem
 
Threat Hunting with Data Science
Threat Hunting with Data ScienceThreat Hunting with Data Science
Threat Hunting with Data Science
Austin Taylor
 
How to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your NetworkHow to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your Network
Sqrrl
 
Enabling effective hunt teaming and incident response
Enabling effective hunt teaming and incident responseEnabling effective hunt teaming and incident response
Enabling effective hunt teaming and incident response
jeffmcjunkin
 
Hunting on the Cheap
Hunting on the CheapHunting on the Cheap
Hunting on the Cheap
EndgameInc
 
Threat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceThreat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement Matrice
Vishal Kumar
 
Threat Hunting 101: Intro to Threat Detection and Incident Response
Threat Hunting 101: Intro to Threat Detection and Incident ResponseThreat Hunting 101: Intro to Threat Detection and Incident Response
Threat Hunting 101: Intro to Threat Detection and Incident Response
Infocyte
 
Workshop threat-hunting
Workshop threat-huntingWorkshop threat-hunting
Workshop threat-hunting
Tripwire
 
I hunt sys admins 2.0
I hunt sys admins 2.0I hunt sys admins 2.0
I hunt sys admins 2.0
Will Schroeder
 

Contenu connexe

Tendances

Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
Spyglass Security
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
Splunk
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)
ENOInstitute
 
Threat Hunting with Data Science
Threat Hunting with Data ScienceThreat Hunting with Data Science
Threat Hunting with Data Science
Austin Taylor
 
Hunting on the Cheap
Hunting on the CheapHunting on the Cheap
Hunting on the Cheap
EndgameInc
 

Tendances (20)

TTPs for Threat hunting In Oil Refineries
TTPs for Threat hunting In Oil RefineriesTTPs for Threat hunting In Oil Refineries
TTPs for Threat hunting In Oil Refineries
 
Avoiding the Pitfalls of Hunting - BSides Charm 2016
Avoiding the Pitfalls of Hunting - BSides Charm 2016Avoiding the Pitfalls of Hunting - BSides Charm 2016
Avoiding the Pitfalls of Hunting - BSides Charm 2016
 
Threat Hunting Workshop
Threat Hunting WorkshopThreat Hunting Workshop
Threat Hunting Workshop
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
 
Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightCyber Threat Hunting with Phirelight
Cyber Threat Hunting with Phirelight
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
 
Threat hunting on the wire
Threat hunting on the wireThreat hunting on the wire
Threat hunting on the wire
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
 
What is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityWhat is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda Security
 
Threat Hunting Report
Threat Hunting Report Threat Hunting Report
Threat Hunting Report
 
Threat Hunting with Data Science
Threat Hunting with Data ScienceThreat Hunting with Data Science
Threat Hunting with Data Science
 
How to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your NetworkHow to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your Network
 
Enabling effective hunt teaming and incident response
Enabling effective hunt teaming and incident responseEnabling effective hunt teaming and incident response
Enabling effective hunt teaming and incident response
 
Hunting on the Cheap
Hunting on the CheapHunting on the Cheap
Hunting on the Cheap
 
Threat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceThreat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement Matrice
 
Threat Hunting 101: Intro to Threat Detection and Incident Response
Threat Hunting 101: Intro to Threat Detection and Incident ResponseThreat Hunting 101: Intro to Threat Detection and Incident Response
Threat Hunting 101: Intro to Threat Detection and Incident Response
 

En vedette

SANS @Night There's Gold in Them Thar Package Management Databases
SANS @Night There's Gold in Them Thar Package Management DatabasesSANS @Night There's Gold in Them Thar Package Management Databases
SANS @Night There's Gold in Them Thar Package Management Databases
Phil Hagen
 
WMI - A FRONT DOOR FOR MALWARES
WMI - A FRONT DOOR FOR MALWARESWMI - A FRONT DOOR FOR MALWARES
WMI - A FRONT DOOR FOR MALWARES
Santhosh Kumar
 
BSides Augusta 2015 - Building a Better Analyst Using Cognitive Psychology
BSides Augusta 2015 - Building a Better Analyst Using Cognitive PsychologyBSides Augusta 2015 - Building a Better Analyst Using Cognitive Psychology
BSides Augusta 2015 - Building a Better Analyst Using Cognitive Psychology
chrissanders88
 
Blue team reboot - HackFest
Blue team reboot - HackFest Blue team reboot - HackFest
Blue team reboot - HackFest
Haydn Johnson
 

En vedette (20)

Workshop threat-hunting
Workshop threat-huntingWorkshop threat-hunting
Workshop threat-hunting
 
I hunt sys admins 2.0
I hunt sys admins 2.0I hunt sys admins 2.0
I hunt sys admins 2.0
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - GerritzBSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
 
SANS @Night There's Gold in Them Thar Package Management Databases
SANS @Night There's Gold in Them Thar Package Management DatabasesSANS @Night There's Gold in Them Thar Package Management Databases
SANS @Night There's Gold in Them Thar Package Management Databases
 
WMI - A FRONT DOOR FOR MALWARES
WMI - A FRONT DOOR FOR MALWARESWMI - A FRONT DOOR FOR MALWARES
WMI - A FRONT DOOR FOR MALWARES
 
A Threat Hunter Himself
A Threat Hunter HimselfA Threat Hunter Himself
A Threat Hunter Himself
 
Practical Cyber Defense
Practical Cyber DefensePractical Cyber Defense
Practical Cyber Defense
 
Windows スクリプトセミナー WMI編 VBScript&WMI
Windows スクリプトセミナー WMI編 VBScript&WMIWindows スクリプトセミナー WMI編 VBScript&WMI
Windows スクリプトセミナー WMI編 VBScript&WMI
 
The Diamond Model for Intrusion Analysis - Threat Intelligence
The Diamond Model for Intrusion Analysis - Threat IntelligenceThe Diamond Model for Intrusion Analysis - Threat Intelligence
The Diamond Model for Intrusion Analysis - Threat Intelligence
 
44CON London 2015: NTFS Analysis with PowerForensics
44CON London 2015: NTFS Analysis with PowerForensics44CON London 2015: NTFS Analysis with PowerForensics
44CON London 2015: NTFS Analysis with PowerForensics
 
BSides Augusta 2015 - Building a Better Analyst Using Cognitive Psychology
BSides Augusta 2015 - Building a Better Analyst Using Cognitive PsychologyBSides Augusta 2015 - Building a Better Analyst Using Cognitive Psychology
BSides Augusta 2015 - Building a Better Analyst Using Cognitive Psychology
 
Hunting on the cheap
Hunting on the cheapHunting on the cheap
Hunting on the cheap
 
Deeplook into apt and how to detect and defend v1.0
Deeplook into apt and how to detect and defend v1.0Deeplook into apt and how to detect and defend v1.0
Deeplook into apt and how to detect and defend v1.0
 
Logs, Logs, Logs - What you need to know to catch a thief
Logs, Logs, Logs - What you need to know to catch a thiefLogs, Logs, Logs - What you need to know to catch a thief
Logs, Logs, Logs - What you need to know to catch a thief
 
CrowdCasts Monthly: Going Beyond the Indicator
CrowdCasts Monthly: Going Beyond the IndicatorCrowdCasts Monthly: Going Beyond the Indicator
CrowdCasts Monthly: Going Beyond the Indicator
 
Proper logging can catch breaches like retail PoS
Proper logging can catch breaches like retail PoSProper logging can catch breaches like retail PoS
Proper logging can catch breaches like retail PoS
 
Logging for Hackers v1.0
Logging for Hackers v1.0Logging for Hackers v1.0
Logging for Hackers v1.0
 
Blue team reboot - HackFest
Blue team reboot - HackFest Blue team reboot - HackFest
Blue team reboot - HackFest
 
BSidesDC - **** it, Do It Live (PowerShell Digital Forensics)
BSidesDC - **** it, Do It Live (PowerShell Digital Forensics)BSidesDC - **** it, Do It Live (PowerShell Digital Forensics)
BSidesDC - **** it, Do It Live (PowerShell Digital Forensics)
 

Similaire à Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck

Anomaly Detection and You
Anomaly Detection and YouAnomaly Detection and You
Anomaly Detection and You
Mary Kelly Rich
 
How an Attacker "Audits" Your Software Systems
How an Attacker "Audits" Your Software SystemsHow an Attacker "Audits" Your Software Systems
How an Attacker "Audits" Your Software Systems
Security Innovation
 
Networking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin Dunn
Networking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin DunnNetworking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin Dunn
Networking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin Dunn
North Texas Chapter of the ISSA
 
WTF is Penetration Testing v.2
WTF is Penetration Testing v.2WTF is Penetration Testing v.2
WTF is Penetration Testing v.2
Scott Sutherland
 
FUEL_USERS_GROUP
FUEL_USERS_GROUPFUEL_USERS_GROUP
FUEL_USERS_GROUP
Will Pearce
 

Similaire à Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck (20)

Threat Hunting, Detection, and Incident Response in the Cloud
Threat Hunting, Detection, and Incident Response in the CloudThreat Hunting, Detection, and Incident Response in the Cloud
Threat Hunting, Detection, and Incident Response in the Cloud
 
Intro to INFOSEC
Intro to INFOSECIntro to INFOSEC
Intro to INFOSEC
 
Needlesand haystacks i360-dublin
Needlesand haystacks i360-dublinNeedlesand haystacks i360-dublin
Needlesand haystacks i360-dublin
 
Anomaly Detection and You
Anomaly Detection and YouAnomaly Detection and You
Anomaly Detection and You
 
Information Security: Advanced SIEM Techniques
Information Security: Advanced SIEM TechniquesInformation Security: Advanced SIEM Techniques
Information Security: Advanced SIEM Techniques
 
Pentesting Tips: Beyond Automated Testing
Pentesting Tips: Beyond Automated TestingPentesting Tips: Beyond Automated Testing
Pentesting Tips: Beyond Automated Testing
 
DEF CON 23 - BRENT - white hacking web apps wp
DEF CON 23 - BRENT - white hacking web apps wpDEF CON 23 - BRENT - white hacking web apps wp
DEF CON 23 - BRENT - white hacking web apps wp
 
Keynote at the Cyber Security Summit Prague 2015
Keynote at the Cyber Security Summit Prague 2015Keynote at the Cyber Security Summit Prague 2015
Keynote at the Cyber Security Summit Prague 2015
 
Incident Response Fails
Incident Response FailsIncident Response Fails
Incident Response Fails
 
Purple Teaming - The Collaborative Future of Penetration Testing
Purple Teaming - The Collaborative Future of Penetration TestingPurple Teaming - The Collaborative Future of Penetration Testing
Purple Teaming - The Collaborative Future of Penetration Testing
 
How an Attacker "Audits" Your Software Systems
How an Attacker "Audits" Your Software SystemsHow an Attacker "Audits" Your Software Systems
How an Attacker "Audits" Your Software Systems
 
Networking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin Dunn
Networking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin DunnNetworking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin Dunn
Networking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin Dunn
 
SplunkLive! Amsterdam 2015 - Analytics based security breakout
SplunkLive! Amsterdam 2015 - Analytics based security breakoutSplunkLive! Amsterdam 2015 - Analytics based security breakout
SplunkLive! Amsterdam 2015 - Analytics based security breakout
 
WTF is Penetration Testing v.2
WTF is Penetration Testing v.2WTF is Penetration Testing v.2
WTF is Penetration Testing v.2
 
FUEL_USERS_GROUP
FUEL_USERS_GROUPFUEL_USERS_GROUP
FUEL_USERS_GROUP
 
SplunkLive! Stockholm 2015 breakout - Analytics based security
SplunkLive! Stockholm 2015 breakout - Analytics based securitySplunkLive! Stockholm 2015 breakout - Analytics based security
SplunkLive! Stockholm 2015 breakout - Analytics based security
 
SplunkLive! Customer Presentation – athenahealth
SplunkLive! Customer Presentation – athenahealthSplunkLive! Customer Presentation – athenahealth
SplunkLive! Customer Presentation – athenahealth
 
SplunkLive! Customer Presentation – athenahealth
SplunkLive! Customer Presentation – athenahealthSplunkLive! Customer Presentation – athenahealth
SplunkLive! Customer Presentation – athenahealth
 
2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion Detection2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion Detection
 
Presentation infra and_datacentrre_dialogue_v2
Presentation infra and_datacentrre_dialogue_v2Presentation infra and_datacentrre_dialogue_v2
Presentation infra and_datacentrre_dialogue_v2
 

Plus de North Texas Chapter of the ISSA

Ntxissacsc5 yellow 6-abusing protocols for dynamic addressing in space-jacenr...
Ntxissacsc5 yellow 6-abusing protocols for dynamic addressing in space-jacenr...Ntxissacsc5 yellow 6-abusing protocols for dynamic addressing in space-jacenr...
Ntxissacsc5 yellow 6-abusing protocols for dynamic addressing in space-jacenr...
North Texas Chapter of the ISSA
 

Plus de North Texas Chapter of the ISSA (20)

Purple seven-ntxissacsc5 walcutt
Purple seven-ntxissacsc5 walcuttPurple seven-ntxissacsc5 walcutt
Purple seven-ntxissacsc5 walcutt
 
Ntxissacsc5 yellow 7 protecting the cloud with cep
Ntxissacsc5 yellow 7 protecting the cloud with cepNtxissacsc5 yellow 7 protecting the cloud with cep
Ntxissacsc5 yellow 7 protecting the cloud with cep
 
Ntxissacsc5 gold 4 beyond detection and prevension remediation
Ntxissacsc5 gold 4 beyond detection and prevension remediationNtxissacsc5 gold 4 beyond detection and prevension remediation
Ntxissacsc5 gold 4 beyond detection and prevension remediation
 
Ntxissacsc5 gold 1 mimecast e mail resiliency
Ntxissacsc5 gold 1 mimecast e mail resiliencyNtxissacsc5 gold 1 mimecast e mail resiliency
Ntxissacsc5 gold 1 mimecast e mail resiliency
 
Ntxissacsc5 yellow 6-abusing protocols for dynamic addressing in space-jacenr...
Ntxissacsc5 yellow 6-abusing protocols for dynamic addressing in space-jacenr...Ntxissacsc5 yellow 6-abusing protocols for dynamic addressing in space-jacenr...
Ntxissacsc5 yellow 6-abusing protocols for dynamic addressing in space-jacenr...
 
Ntxissacsc5 yellow 2-evidence driven infosec compliance strategy-garrettp1
Ntxissacsc5 yellow 2-evidence driven infosec compliance strategy-garrettp1Ntxissacsc5 yellow 2-evidence driven infosec compliance strategy-garrettp1
Ntxissacsc5 yellow 2-evidence driven infosec compliance strategy-garrettp1
 
Ntxissacsc5 yellow 1-beginnerslinux bill-petersen
Ntxissacsc5 yellow 1-beginnerslinux bill-petersenNtxissacsc5 yellow 1-beginnerslinux bill-petersen
Ntxissacsc5 yellow 1-beginnerslinux bill-petersen
 
Ntxissacsc5 red 6-diy-pentest-lab dustin-dykes
Ntxissacsc5 red 6-diy-pentest-lab dustin-dykesNtxissacsc5 red 6-diy-pentest-lab dustin-dykes
Ntxissacsc5 red 6-diy-pentest-lab dustin-dykes
 
Ntxissacsc5 red 1 &amp; 2 basic hacking tools ncc group
Ntxissacsc5 red 1 &amp; 2 basic hacking tools ncc groupNtxissacsc5 red 1 &amp; 2 basic hacking tools ncc group
Ntxissacsc5 red 1 &amp; 2 basic hacking tools ncc group
 
Ntxissacsc5 purple 5-insider threat-_andy_thompson
Ntxissacsc5 purple 5-insider threat-_andy_thompsonNtxissacsc5 purple 5-insider threat-_andy_thompson
Ntxissacsc5 purple 5-insider threat-_andy_thompson
 
Ntxissacsc5 purple 4-threat detection using machine learning-markszewczul
Ntxissacsc5 purple 4-threat detection using machine learning-markszewczulNtxissacsc5 purple 4-threat detection using machine learning-markszewczul
Ntxissacsc5 purple 4-threat detection using machine learning-markszewczul
 
Ntxissacsc5 purple 3-cyber insurance essentials-shawn_tuma.pptx
Ntxissacsc5 purple 3-cyber insurance essentials-shawn_tuma.pptxNtxissacsc5 purple 3-cyber insurance essentials-shawn_tuma.pptx
Ntxissacsc5 purple 3-cyber insurance essentials-shawn_tuma.pptx
 
Ntxissacsc5 purple 1-eu-gdpr_patrick_florer
Ntxissacsc5 purple 1-eu-gdpr_patrick_florerNtxissacsc5 purple 1-eu-gdpr_patrick_florer
Ntxissacsc5 purple 1-eu-gdpr_patrick_florer
 
Ntxissacsc5 gold 1--mimecast email resiliency- erez-haimowicz
Ntxissacsc5 gold 1--mimecast email resiliency- erez-haimowiczNtxissacsc5 gold 1--mimecast email resiliency- erez-haimowicz
Ntxissacsc5 gold 1--mimecast email resiliency- erez-haimowicz
 
Ntxissacsc5 blue 7-zerotrust more effective approach to security-ed higgins
Ntxissacsc5 blue 7-zerotrust more effective approach to security-ed higginsNtxissacsc5 blue 7-zerotrust more effective approach to security-ed higgins
Ntxissacsc5 blue 7-zerotrust more effective approach to security-ed higgins
 
Ntxissacsc5 blue 6-securityawareness-laurianna_callaghan
Ntxissacsc5 blue 6-securityawareness-laurianna_callaghanNtxissacsc5 blue 6-securityawareness-laurianna_callaghan
Ntxissacsc5 blue 6-securityawareness-laurianna_callaghan
 
Ntxissacsc5 blue 5-holistic approach to cybersecurity-abu_sadeq
Ntxissacsc5 blue 5-holistic approach to cybersecurity-abu_sadeqNtxissacsc5 blue 5-holistic approach to cybersecurity-abu_sadeq
Ntxissacsc5 blue 5-holistic approach to cybersecurity-abu_sadeq
 
Ntxissacsc5 blue 3-shifting from incident to continuous response bill white
Ntxissacsc5 blue 3-shifting from incident to continuous response bill whiteNtxissacsc5 blue 3-shifting from incident to continuous response bill white
Ntxissacsc5 blue 3-shifting from incident to continuous response bill white
 
Ntxissacsc5 blue 4-the-attack_life_cycle_erich_mueller
Ntxissacsc5 blue 4-the-attack_life_cycle_erich_muellerNtxissacsc5 blue 4-the-attack_life_cycle_erich_mueller
Ntxissacsc5 blue 4-the-attack_life_cycle_erich_mueller
 
Ntxissacsc5 blue 2-herding cats and security tools-harold_toomey
Ntxissacsc5 blue 2-herding cats and security tools-harold_toomeyNtxissacsc5 blue 2-herding cats and security tools-harold_toomey
Ntxissacsc5 blue 2-herding cats and security tools-harold_toomey
 

Dernier

Uncommon Grace The Autobiography of Isaac Folorunso
Uncommon Grace The Autobiography of Isaac FolorunsoUncommon Grace The Autobiography of Isaac Folorunso
Uncommon Grace The Autobiography of Isaac Folorunso
Kayode Fayemi
 
Bring back lost lover in USA, Canada ,Uk ,Australia ,London Lost Love Spell C...
Bring back lost lover in USA, Canada ,Uk ,Australia ,London Lost Love Spell C...Bring back lost lover in USA, Canada ,Uk ,Australia ,London Lost Love Spell C...
Bring back lost lover in USA, Canada ,Uk ,Australia ,London Lost Love Spell C...
amilabibi1
 
If this Giant Must Walk: A Manifesto for a New Nigeria
If this Giant Must Walk: A Manifesto for a New NigeriaIf this Giant Must Walk: A Manifesto for a New Nigeria
If this Giant Must Walk: A Manifesto for a New Nigeria
Kayode Fayemi
 
Chiulli_Aurora_Oman_Raffaele_Beowulf.pptx
Chiulli_Aurora_Oman_Raffaele_Beowulf.pptxChiulli_Aurora_Oman_Raffaele_Beowulf.pptx
Chiulli_Aurora_Oman_Raffaele_Beowulf.pptx
raffaeleoman
 
Proofreading- Basics to Artificial Intelligence Integration - Presentation:Sl...
Proofreading- Basics to Artificial Intelligence Integration - Presentation:Sl...Proofreading- Basics to Artificial Intelligence Integration - Presentation:Sl...
Proofreading- Basics to Artificial Intelligence Integration - Presentation:Sl...
David Celestin
 

Dernier (15)

Uncommon Grace The Autobiography of Isaac Folorunso
Uncommon Grace The Autobiography of Isaac FolorunsoUncommon Grace The Autobiography of Isaac Folorunso
Uncommon Grace The Autobiography of Isaac Folorunso
 
ICT role in 21st century education and it's challenges.pdf
ICT role in 21st century education and it's challenges.pdfICT role in 21st century education and it's challenges.pdf
ICT role in 21st century education and it's challenges.pdf
 
Report Writing Webinar Training
Report Writing Webinar TrainingReport Writing Webinar Training
Report Writing Webinar Training
 
Bring back lost lover in USA, Canada ,Uk ,Australia ,London Lost Love Spell C...
Bring back lost lover in USA, Canada ,Uk ,Australia ,London Lost Love Spell C...Bring back lost lover in USA, Canada ,Uk ,Australia ,London Lost Love Spell C...
Bring back lost lover in USA, Canada ,Uk ,Australia ,London Lost Love Spell C...
 
The workplace ecosystem of the future 24.4.2024 Fabritius_share ii.pdf
The workplace ecosystem of the future 24.4.2024 Fabritius_share ii.pdfThe workplace ecosystem of the future 24.4.2024 Fabritius_share ii.pdf
The workplace ecosystem of the future 24.4.2024 Fabritius_share ii.pdf
 
My Presentation "In Your Hands" by Halle Bailey
My Presentation "In Your Hands" by Halle BaileyMy Presentation "In Your Hands" by Halle Bailey
My Presentation "In Your Hands" by Halle Bailey
 
SOLID WASTE MANAGEMENT SYSTEM OF FENI PAURASHAVA, BANGLADESH.pdf
SOLID WASTE MANAGEMENT SYSTEM OF FENI PAURASHAVA, BANGLADESH.pdfSOLID WASTE MANAGEMENT SYSTEM OF FENI PAURASHAVA, BANGLADESH.pdf
SOLID WASTE MANAGEMENT SYSTEM OF FENI PAURASHAVA, BANGLADESH.pdf
 
If this Giant Must Walk: A Manifesto for a New Nigeria
If this Giant Must Walk: A Manifesto for a New NigeriaIf this Giant Must Walk: A Manifesto for a New Nigeria
If this Giant Must Walk: A Manifesto for a New Nigeria
 
Dreaming Marissa Sánchez Music Video Treatment
Dreaming Marissa Sánchez Music Video TreatmentDreaming Marissa Sánchez Music Video Treatment
Dreaming Marissa Sánchez Music Video Treatment
 
Digital collaboration with Microsoft 365 as extension of Drupal
Digital collaboration with Microsoft 365 as extension of DrupalDigital collaboration with Microsoft 365 as extension of Drupal
Digital collaboration with Microsoft 365 as extension of Drupal
 
AWS Data Engineer Associate (DEA-C01) Exam Dumps 2024.pdf
AWS Data Engineer Associate (DEA-C01) Exam Dumps 2024.pdfAWS Data Engineer Associate (DEA-C01) Exam Dumps 2024.pdf
AWS Data Engineer Associate (DEA-C01) Exam Dumps 2024.pdf
 
Dreaming Music Video Treatment _ Project & Portfolio III
Dreaming Music Video Treatment _ Project & Portfolio IIIDreaming Music Video Treatment _ Project & Portfolio III
Dreaming Music Video Treatment _ Project & Portfolio III
 
Chiulli_Aurora_Oman_Raffaele_Beowulf.pptx
Chiulli_Aurora_Oman_Raffaele_Beowulf.pptxChiulli_Aurora_Oman_Raffaele_Beowulf.pptx
Chiulli_Aurora_Oman_Raffaele_Beowulf.pptx
 
lONG QUESTION ANSWER PAKISTAN STUDIES10.
lONG QUESTION ANSWER PAKISTAN STUDIES10.lONG QUESTION ANSWER PAKISTAN STUDIES10.
lONG QUESTION ANSWER PAKISTAN STUDIES10.
 
Proofreading- Basics to Artificial Intelligence Integration - Presentation:Sl...
Proofreading- Basics to Artificial Intelligence Integration - Presentation:Sl...Proofreading- Basics to Artificial Intelligence Integration - Presentation:Sl...
Proofreading- Basics to Artificial Intelligence Integration - Presentation:Sl...
 

Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck

  • 1. ©2014  Bit9.  All  Rights  Reserved     Advanced  Threat  Hun/ng:     Iden%fy  and  Track  Zero-­‐Day  A3acks   Infiltra%ng  Your  Organiza%on           Jus/n  Falck,  Technical  Product  Manager  –  Carbon  Black   Bit9  +  Carbon  Black     July  16th,  2015  
  • 2.   Background     Threat  Landscape     Advanced  Threats   •  What  are  they?   •  Zero-­‐Days   •  Why  Advanced  Threats  might  not  be  what  you  think  they  are   •  Living  off  the  Land  (“Outsider-­‐Insider”)     Hun/ng   •  What  do  you  hunt?   •  How  do  you  hunt?   •  RelaQonships  MaTer!     Wrap-­‐Up  &  Takeaways   Agenda  
  • 3. Quick  Background  Check   www.linkedin.com/in/jus/nfalck   jfalck@bit9.com     2007  –  2013:  Central  Intelligence  Agency     2013  –  2015:  Goldman  Sachs     Threat  Management  Center  -­‐  Irving,  TX     2015  –  Present:  Bit9  +  Carbon  Black     Technical  Product  Manager  -­‐  CB  
  • 4. The  Evolving  Threat  Landscape   Criminal  Enterprises   •  Broad-­‐based  and   targeted  aTacks   •  Financially   moQvated   •  Geang  more   sophisQcated   Hac/vists   •  Targeted  and   destrucQve   aTacks   •  Unpredictable   moQvaQons   •  Generally  less   sophisQcated   Na/on-­‐States   •  Targeted  and     mulQ-­‐stage  aTacks     •  MoQvated  by   informaQon  and  IP   •  Highly   sophisQcated,   limitless  resources  
  • 6. Endless  Stream  of  Data  Breaches   Source:  InformaQon  is  BeauQful,  www.informaQonisbeauQful.net,  January  2015  
  • 7. DON’T  OVERCOMPLICATE  THE  THREAT   THREAT  MODEL: 1:  OPPORTUNISTIC 2:  NOT
  • 8. Opportunis=c  threats  sell  our  computers.     Goal:  breadth  of  access.       “Advanced”  threats  sell  our  data.       Goal:    precision  of  access.
  • 9. Tradi/onal  Defenses  Were  Designed  for  Opp.  AZacks   OPPORTUNISTIC  ADVANCED   Goal  for  aTacker  is  to   compromise  as  few   endpoints  as  possible   Goal  for  aTacker  is  to   compromise  as  many     endpoints  as  possible   Hosts  Compromised   Time   Hosts  Compromised   Time   DETECTION  THRESHOLD   DETECTION  THRESHOLD   Signature   available   Signature   available  (if  ever)  
  • 10. “Zero-­‐Days”     “Zero-­‐Day”  is  a  term  typically  used  to  refer  to  two  different  scenarios:   •  Zero-­‐Day  Vulnerability:  vulnerability  is  unknown  or  fix/patch  is  not  yet   available   –  “Non-­‐Pub”:  exploit  an  unknown  vulnerability   •  Zero-­‐Day  Malware:  malware  that  is  unknown;  signatures  are  not   available  
  • 11. So  how  “advanced”   are  the  techniques  and   payloads  being  used?  
  • 12. “The (Target) malware utilized is ABSOLUTELY UNSOPHISTICATED and UNINTERESTING” -McAfee Business Week, March 13, 2014
  • 13. But  once  they’re  in…   However  they  get  in,  we  need  to  find  them!   Faster  detec/on  means:   • Shorter  dwell  Qme   • Smaller  scope  for  your  incident  response   • Less  damage  to  your  business     What  do  they  do  once  they’re  in?  
  • 14. They  oben  “Live  off  the  Land”  (and  blend  in)  
  • 15. Living  off  the  Land   Living  Off  the  Land:  the  aZacker  uses  built-­‐in  tools  so  there  are  very  few   new  executables.    The  aZacker  typically  needs  to  do  the  following:     •  Execute  code:   –  Crack/Dump/Guess/Obtain  Valid  CredenQals   »  See  this  with  Backoff  POS  Malware   •  Copy  Data:   –  UQlize  tools  like  robocopy,  xcopy,  cmd.exe  to  gather  data   –  UQlize  “known  good”  tools  for  compression  or  use  scripts   •  Exfil  Data:   –  mp.exe,  net.exe,  Visual  Basic  script  to  control  IE  for  POSTing  data   •  Manipulate:   –  Download  something  not  malicious  but  that  will  trip  up  detecQon   –  When  Admin  logs  in,  credenQals,  keystrokes,  etc.,  are  captured  and  used   •  Persist:   –  Compromise  or  Add  more  user  and  system  accounts   –  Login  to  backup  servers,  staging  servers,  less  noQceable  parts  of  your  enterprise   –  Create  scheduled  jobs  that  will  run  and  re-­‐add  accounts,  communicate  out,  etc.  
  • 16. Living  off  the  Land  (cont’d)     More  Things  to  Consider:   •  PowerShell  is  TOO  Powerful   –  Execute  from  remote  URL   –  Basically  anything  you  would  ever  want  to  write  code  for,  you  can  do  with  powershell,  so  as  an   adversary,  I  can  really  do  some  damage  (powersploit,  etc)   •  Use  Internal  C2  Sites:   –  Use  blog  comments  and/or  wiki  to  give  your  stuff  new  commands  so  there  is  no  outside   communicaQons   •  Use  Well-­‐Known  Social  Networking  and  File-­‐sharing  Sites:   –  TwiTer  (bots)   –  Dropbox   –  Google  Drive   –  Facebook   –  <  Insert  Social  Site  Here  >   •  Find  hardcoded  creden/als,  re-­‐use  same  password  across  an  enterprise,  Single-­‐Sign-­‐ On  design  flaws,  etc.    
  • 17. In  Other  Words…   THEY  ARE  NOW  INSIDERS!     BETTER  DEFENSE  AGAINST  THIS…       LEADS  TO  BETTER  DEFENSE  AGAINST   TRUE  INSIDERS!  
  • 18. So,  back  to  Hun/ng…  
  • 19. Is  Your  Environment  Like  This?  
  • 21. What  do  you  Hunt?     Do  you  know  what  you’re  looking  for?    Do  they  have  to  be  advanced?   •  Are  you  running  vulnerable  somware?    Is  it  likely  to  be  compromised?   •  Have  you  hardened  your  systems,  have  you  reduced  surface  area?   •  Do  you  have  shared  passwords,  plain-­‐text  credenQals,  etc?   •  If  you  have  too  much  entropy  or  very  few  standards,  hunQng  will  be  DIFFICULT   •  Then  again,  it  is  rarely  “easy”       What  do  the  bad  guys  need  to  do?   •  Execute   •  Communicate   •  Grab  Data   •  Steal/Add  CredenQals   •  Persist  
  • 22. Which comes first… Detection or Collection? By  priori=zing  collec=on  over  detec=on  you  can: (1)  HUNT  MORE  EFFECTIVELY!!! (2)  Rapidly  find  root  cause (3)  Quickly  &  confidently  reconstruct  =melines (4)  Accelerate  Discovery  (determine  scope) (5)  Benefit  from  hindsight  (evolve)
  • 23. Some  Ideas…      §  Are  abnormal  user  accounts  being  used?   §  Do  windows  processes  (lsass,  svchost,  csrss)  have  strange  parents?   §  Are  IE,  Acrobat,  Word,  Notepad,  etc.,  spawning  child  processes?   §  Are  Office  Applica/ons  making  outbound  connec/ons?   §  Is  Java  spawning  command  shells?   §  Is  cmd.exe  running  as  system?   §  Are  user  accounts  being  added  locally?   §  Are  thousands  of  files  being  modified  by  a  single  process?   §  Is  bp  or  robocopy  being  used?   §  Are  processes  execu/ng  that  don’t  have  a  .exe  or  .scr  extension?  
  • 24. Back  to  the  Basics…      §  Are  you  recording  every  command  line  used  by  net.exe  and  looking   for  abnormali/es?   §  Are  you  watching  when  PowerShell.exe  is  used?   §  Are  you  mapping  user  account  ac/vity  to  hosts  to  look  for   abnormal  logins?   §  Are  you  ….    <INSERT  LOTS  OF  STUFF  “TO  DO”  HERE>  
  • 25. “Response  is  the  closest   thing  we  have  in  IT  to   dogfigh/ng”   -­‐  Bruce  Schneier,  Blackhat  2014  Keynote    
  • 26. Time is the dominant parameter. The pilot who goes through the OODA cycle in the shortest time prevails because his opponent is caught responding to situations that have already changed. Col John Boyd 1966  Observe    Orient    Decide    Act  
  • 27. Modern       IR  view   Ac/onable  Endpoint  Visibility   Tradi/onal   IR  view   Events  +  Intelligence     With  no  insight  into  known  bad,  how  can  they  pick   the  needles  out  of  their  data  collecQon  haystack?     Events  +  Intelligence  +  Prevalence       Without  understanding  prevalence,  how  can  they   prioriQze  detecQon  events  to  accelerate  threat   discovery?   Events  +  Intelligence  +  Prevalence  +  Rela/onships     Without  maintaining  the  recorded  relaQonships,  how   do  they  quickly  scope  any  impacted  endpoints  and   lateral  movement?   Events     Most  organizaQons  only  have  a  staQc  view  of  their   business  and  the  data  they  manage  to  collect   What’s  more  ac/onable?   ?  svchost.exe  ran   svchost.exe  was  spawned  by   unsigned  binary  under  abnormal   user  account  and  made  a   network  connecQon  
  • 28. The  very  nature  of  threat  hun%ng   requires  the  human  element   In  IT,  we  hire  staff  to     support  technology   In  security  opera%ons,     we  buy  technology  to   support  staff   Invest  in  tools  that  enable  humans  to  make  quick  decisions  
  • 29. 1   2   3   Hun/ng  Tips   Collect  the  RIGHT  Data   Neslow  data  and  firewall  logs  can  help,  but  if  you  aren’t  seeing   what  is  execuQng  and  what  is  changing  on  your  systems,  you  will   not  have  as  much  hunQng  success.     You  need  to  hunt  where  the  adversaries  live!   Incorporate  Reputa/on  and  Classifica/on  Informa/on   When  you’re  hunQng,  you  should  not  have  to  spend  Qme  manually  checking  the     reputaQon  of  a  binary  or  website,  as  that  greatly  slows  down  your  ability  to     conQnue  to  the  hunt.    Being  able  to  quickly  say  things  are  known  good,  known     Bad  is  key,  as  is  the  ability  to  say  if  it  is  part  of  a  parQcular  campaign  or  aTack.   Analyze  RELATIONSHIPS   RelaQonships  are  key  to  being  able  to  detect  abnormal  behavior.     Sure,  the  adversary  lives  off  the  land,  but  they’re  sQll  going  to  do   unusual  things  with  the  exisQng  tools  available  to  them.     4   Automate  as  much  as  possible!   When  you  know  what  is  normal,  you  should  be  able  to  be  alerted  when  acQvity  occurs  outside   of  what  is  normal.    And  you  should  be  able  to  automate  this.    You  should  also  automate   reputaQon  and  classificaQon  informaQon  retrieval,  and  automate  discovery.    
  • 30. TAKE-­‐AWAYS              
  • 31. Take-­‐Aways    Think  about  how  you  might  hunt  advanced  threats    Can  internal  tools  be  used  against  you?    Do  you  have  proper  context?    Can  you  tell  the  FBI  whether  or  not  you’ve  seen  the  IOCs   they  just  sent  you?    Compare  current  behavior  vs.  older  methods  vs.  “next-­‐ gen”    Enable  your  humans  to  do  some  hunQng    Are  you  focused  on  root  cause?  
  • 32. Thank  You!               jfalck@bit9.com     www.linkedin.com/in/jus/nfalck