Threat hunting != Throwing arrow! Hunting for adversaries in your it environment
•
7 j'aime•876 vues
This was present in bdnog6[http://bdnog.org/bdnog6/index.php].
![Md Nahidul Kibria
Co-Founder, Beetles
@nahidupa
[~] $ whoami](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à Threat hunting != Throwing arrow! Hunting for adversaries in your it environment
Similaire à Threat hunting != Throwing arrow! Hunting for adversaries in your it environment (20)
Plus de Nahidul Kibria
Dernier
Dernier (20)
Threat hunting != Throwing arrow! Hunting for adversaries in your it environment
- 1. Threat hunting != Throwing arrow! Hunting for adversaries in your IT environment Md Nahidul kibria Co-Founder, Beetles
- 2. Md Nahidul Kibria Co-Founder, Beetles @nahidupa [~] $ whoami
- 3. Threat hunting is a approach to answer that question. Am i compromised today?
- 4. What is hunting? Hunting as the process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security solutions. “You Can’t Hunt That With a Bow and Arrow!
- 5. What is Threat hunting is and is not. Threat hunting != Throwing arrow!
- 6. Threat landscape Cybercriminals Hacktivists Nation state Insiders
- 11. Sensors >> Data >> monitoring
- 13. Hunting vs. Alerting Alerting 1. Reactive 2. Detect/forget Hunting 1. Proactive 2. Repeated searches
- 14. Let's hunt... But from where?
- 15. Approaches to Threat Hunting 1. Data-centric Hunting 2. Hunting on the Endpoint(DFIR) 3. Deception
- 16. Adversary simulation 1. Attacking web application 2. OS Command execute 3. Download malicious files (powershell webclient) 4. Getting reverse shell 5. Privilege escape 6. Scan internal host 7. Lateral Movement
- 17. Data analysis
- 18. Hunt Lateral MovementAttackers quietly traverse your Network.
- 19. Lateral Movement - Techniques, Tactics & Procedures (TTPs) Psexec File shares Powershell Pass-the-hash Scheduled tasks WMI SMB SSH
- 20. Detect using windows event log /Sysmon
- 22. Psexec psexec.exe -i -s %SystemRoot%system32cmd.exe
- 23. Sysmon event - psexc.exe
- 24. Hunt other TTPs “net” Reconnaissance of Domain Admin Group Command C: > net group "Domain Admin" /domain Credential Harvesting with WMI and WCE net use 172.31.3.16 PASSWORD /user:SANDBOXAdministrator copy w.exe 172.31.3.16c$PerfLogs wmic /NODE:172.31.3.16 /USER:"SANDBOXAdministrator" /PASSWORD:"PASSWORD" process call create "cmd /c C:Perflogsw.exe -w > C:Perflogso.txt" Ref: http://www.crypsisgroup.com/images/site/CG_WhitePaper_Splunkmon_1216.pdf
- 26. Sysmon dashboard
- 28. Hunting Command and Control(c2) C2 via Dynamic DNS Finding the Unknown with HTTP URIs Beacon Detection via Intra-Request Time Deltas Finding C2 in Network Sessions
- 31. Hunt for Data Exfiltration
- 32. Producer-Consumer Ratio for Detecting Data Exfiltration Ref https://github.com/ThreatHuntingProject/ThreatHunting/blob/master/hunts/analyze_producer_consumer_ratio.md
- 33. Hunt for Malware
- 34. Unusual Windows Behavior https://www.sans.org/security-resources/posters/dfir-find-evil/35/download
- 35. Query (NewProcessName: "svchost.exe" AND NOT NewProcessName: "C:WindowsSystem32svchost.exe") OR (NewProcessName: "smss.exe" AND NOT NewProcessName: "C:WindowsSystem32smss.exe") OR (NewProcessName: "wininit.exe" AND NOT NewProcessName: "C:WindowsSystem32wininit.exe") OR (NewProcessName: "taskhost.exe" AND NOT NewProcessName: "C:WindowsSystem32taskhost.exe") OR (NewProcessName: "lsass.exe" AND NOT NewProcessName: "C:WindowsSystem32lsass.exe") OR (NewProcessName: "winlogon.exe" AND NOT NewProcessName: "C:WindowsSystem32winlogon.exe") OR (NewProcessName: "explorer.exe" AND NOT NewProcessName: "C:Windowsexplorer.exe") OR (NewProcessName: "lsm.exe" AND NOT NewProcessName: "C:WindowsSystem32lsm.exe") OR (NewProcessName: "services.exe" AND NOT NewProcessName: "C:WindowsSystem32services.exe") OR (NewProcessName: "csrss.exe" AND NOT NewProcessName: "C:WindowsSystem32csrss.exe")
- 36. Svchost.exe with no -k
- 38. Hunt in memory Malware become fileless- Kovter,Poweliks Volatility-/rekall https://github.com/google/rekall
- 39. DEMO
- 41. The Hunting Maturity Model
- 42. Machine Learning for Incident Detection
Notes de l'éditeur
- New in this con Blue team activity Defense Anyone from incident response Hunting is assume that you are already compromised and now you want to know/verify it.
- Pentesting Web application Synack Owasp Sofo
- Not a new concept Not Alert Driven Not a tool or product Not standardized Not a silver bullet
- It take over month
- When everyone in bdnog your org is in under attack
- psexec.exe -i -s %SystemRoot%\system32\cmd.exe
- http://www.crypsisgroup.com/images/site/CG_WhitePaper_Splunkmon_1216.pdf
- http://blog.sqrrl.com/the-cyber-hunting-maturity-model