SlideShare une entreprise Scribd logo

Attack Simulation and Hunting

•
•
N
nathi mogomotsi

Attack simulation and hunting. BsidesCPT17

Internet
1  sur  46
South Africa – 11 Official Languages Greetings! Afrikaans – Goeie dag English – Hello isiNdebele – Lotjhani isiXhosa – Mholo isiZulu – Sanibona Sepedi – Thobela Sesotho – Dumela Setswana – Dumela SiSwati – Sawubona Tshivenda – Ndaa/Aa Xitsonga – Avuxeni Thank you! Afrikaans – Dankie English – Thanks isiNdebele – Ngiyathokoza isiXhosa – Enkosi isiZulu – Ngiyabonga Sepedi – Ke a leboga Sesotho – Ke a leboha Setswana – Ke a leboga SiSwati – Ngiyabonga Tshivenda –Ndi a livhuwa Xitsonga – ndzi khense
NO TO RACISM/SEXISM/XENOPHOBIA/ETC
Threat Attack Simulations & Hunting Made Easy
#whoami Nathi Mogomotsi @nathimog african, black, grand[son], brother, hacker, n00b, vegan, alcohol, not-french, suck-at-english, God fearing, not-a-saint, no tattoo, biker Sr. Red Teamer @sanlam Hacker @sensepost
How it all started • New job • More time to do research and 1337 hax But… • It wasn’t fun anymore • Now I get to receive pen test reports • I am on the receiving end • Needed to do something about this • Time to help the defenders https://twitter.com/s7ephen/status/925969930134024192
On an Unrelated Note: • I asked my previous boss (Charl) to buy me this book 4~ years I ago • I knew I had some “defensive” blood in me 
How it all started • Watched CG and CN talk • Was impressed, thanks guys • Go watch the talk • Will wait for you…
Why this talk • To share my experience • To share my learnings • Hopefully it will help you get started (you should) • I am not an expert, so this is really basic stuff • Ping me if you have any comments or ideas • nathi@protonmail.com
Why this talk – Pyramid of Pain http://detect-respond.blogspot.co.za/2013/03/the-pyramid-of-pain.html
What is attack simulation ? • Just like a pilot simulator, it is there to put you in the worst possible situation at a lowest level of risk - Chris Nickerson • Understanding attacks that might be used against an organisation in order to improve the organisation’s defence – me • Attack simulations should be done to learn how attackers are likely to achieve goals against your organization – Zane Lackey • Can we detect and/or stop a particular attack ? • Assume compromise – We can be compromised!
What is attack hunting ? • Proactive incident response • Are we hacked by this particular attack ? • Assume compromise – We might be compromised already!
High Level Process|Attack Oriented Defence Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
Attack Techniques Choose a technique you interested in: • Technique used in the wild • Technique from threat reports • Technique you found during your vuln research • Technique from software vendors security bulletins • Technique from hacker tools • Technique from pen testing report
Attack Techniques - MITRE “ATT&CK is useful for understanding security risk against known adversary behavior, for planning security improvements, and verifying defenses work as expected.” https://attack.mitre.org/wiki/Main_Page
Attack Techniques - MITRE
Attack Techniques - Tools Media and your CISO
Attack Techniques - Tools https://www.slideshare.net/JaredAtkinson/purpose-driven-hunt-derbycon-2017
Recap • We identified the technique we want to focus on. Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
Defensive Controls – Cyber Kill Chain
Weaponization Reconnaissance Delivery Exploitation Installation Command & Control Actions on Objectives Detect Deny Disrupt Degrade Deceive Contain Web Analytics Firewall ACL Firewall ACL NIDS NIPS NIPS Vigilant user Proxy filter Inline AV Email Queuing App-Aware Firewall HIDS Vendor Patch EMET, DEP Inter-Zone NIPS HIDS ‘chroot’ Jail AV EPP NIDS Firewall ACL NIPS Tar pit DNS Redirect Trust Zones Audit log Outbound ACL DLP QOS Throttle Honeypot Trust Zones
Recap • We identified the technique we want to focus on. • We understand our current defences. • We identified the technique we want to focus on Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
Simulations – The process Hack yourself first Hack the humans Attack analysis with the blue team Defence controls update Validate new defence controls Activity Tracker
Simulations – Hack yourself first • Test detection tools • Use a test machine identical to your environment • Collect Indicators of Compromise (IoCs) Network artefacts User Agent Strings Dynamic DNS visits Encrypted traffic MIME type downloads Host artefacts New files New services New registry Files that runs on reboot
Simulations – Hack yourself first (MITRE) • https://github.com/redcanaryco/atomic-red-team • https://www.youtube.com/watch?v=M4SHpDX8GTo
Simulation – hack the humans • Test processes • Test blue team response to alerts • Test IR procedure
Simulations – Attack Analysis with the blue • Show how you did your hack • Kill chain analysis and controls • Map logs to the attack • Handover Indicators of Compromise
https://www.demisto.com/phishing-incident-response-playbook/ Simulations – Kill Chain Analysis and Controls
Simulation – Defence update • To automate detection • Update • FW/IDS/IPS/AV/EDR/<your security product here> • Processes • Deploy Controls • Controls should not be expensive and complex • https://t2.fi/2017/02/05/haroon-meer-keynote-2016/
Simulation – Controls validation • Validate the new defence controls • Create a script to automate this • Should not be fancy • Mainly to help the blue team
Simulation – Activity Tracker
Recap • We identified the technique we want to focus on • We understand our current defences • We tested, updated and validated controls and incident procedures • We know which data sets to use for our hunts Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
Hunting – The process • Collect data sets • Process the data sets • Analyse collection • Malicious activity • Activity tracker
Hunting – Collect data sets • Proxy logs • Anti-Virus logs • Application logs • Sysmon logs • Bro IDS logs • DNS logs • Firewall logs • Netflow data
Hunting – Techniques to process the data sets Searching Stack Counting Grouping Clustering https://sqrrl.com/threat-hunting-reference-guide/ https://speakerdeck.com/davidjbianco/toppling-the-stack-practical-outlier-detection-for-threat-hunters
Hunting – Analyse collection • Search artefacts on the network data sets • Find suspicious hosts • Host threat hunting https://www.sans.org/summit-archives/file/summit-archive-1492556122.pdf
Hunting – Found suspicious activity • Call the forensicators • Execute the IR plan
Hunting – Activity Tracking
Recap • We identified the technique we want to focus on • We understand our current defences • We tested, updated and validated controls and incident procedures • We know which data sets to use for our hunts • We confirmed if we are under attack or not • Hopefully eradicated the threat Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
Measure Effectiveness • Effectiveness is a measure of the success of the operation, overall - Raphael Mudge. • Roberto Rodriguez (@cyb3rWard0g) • https://cyberwardog.blogspot.co.za/2017/07/how-hot-is-your-hunt-team.html
KEY TAKEAWAYS • You get to play part in defence • You get to find bad guys and pen testers • You get to learn other stuff i.e DFIR, network monitoring, rules writing • You get to do cool hacks that actually makes a difference in your org • You get to teach the blue team • You get to learn from them too.. https://medium.com/@sroberts/introduction-to-dfir-d35d5de4c180
More from CN and CG • If you didn’t watch their talk earlier • Go ahead and watch this one • Updated and more awesome • Thanks once again guys
Tools – because you want to automate • CALDERA: Automatic adversary emulation (to be released at BH17 EU) • DumpsterFire – Threat simulations • SQRLL VM – Threat hunting • CCF VM – Incident triage (DFIR) with ELK • Bro IDS – Network monitoring • Sysmon – System monitoring • ELK – Data visualisation • Chris Gates is also releasing something soon ;)
Credits / References / Thank you Credits & Thank you for your contributions • @indi303 • @carnal0wnage • @ jackcr • @DavidJBianco • @Sroberts • @RobertMLee • @Subtee • @Chrissanders88 • DR. Eric Cole • @Jaredcatkinson • @Robwinchester3 • @DAkacki • @cyb3rWard0g Resources • https://github.com/magoo/redteam-plan • http://soc.wa.gov/resources/exercises • https://github.com/redcanaryco/atomic-red-team • https://resources.redcanary.com/atomic-red-team-training-session- nov-2017 • https://github.com/demisto/content Training • Chris Sanders - http://chrissanders.org/training/ • @zanelackey • @haroonmeer • @M_haggis • @mattifestation • @AlanOrlikoski • @PyroTek3 • @SqrrlData • @redcanaryco • Bloodhound Gang
Special Thanks: When I do grow up one day I want to be like these guys • Willem Smit @slackerscoza • Kelvin Adams @nivlek007 • George Pranschke @cheorchie • Chris Gates @carnal0wnage • Awesome people I have ever met! • Keep rocking guys.
“Do whatever you want. Trust your guts, your humanly feelings, your very limited knowledge. This is best effort.” – Julio Auto
Thanks once again, do your best effort to try to be nice to one another & take care of your health!

Recommandé

How to Plan Purple Team Exercises
How to Plan Purple Team ExercisesHow to Plan Purple Team Exercises
How to Plan Purple Team Exercises
Haydn Johnson
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
Digit Oktavianto
 
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Jorge Orchilles
 
Security Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMESecurity Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SME
AlienVault
 
The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)
PECB
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Katie Nickels
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
ZaiffiEhsan
 
Cyber threat intelligence ppt
Cyber threat intelligence pptCyber threat intelligence ppt
Cyber threat intelligence ppt
Kumar Gaurav
 

Recommandé

How to Plan Purple Team Exercises
How to Plan Purple Team ExercisesHow to Plan Purple Team Exercises
How to Plan Purple Team Exercises
Haydn Johnson
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
Digit Oktavianto
 
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Jorge Orchilles
 
Security Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMESecurity Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SME
AlienVault
 
The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)
PECB
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Katie Nickels
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
ZaiffiEhsan
 
Cyber threat intelligence ppt
Cyber threat intelligence pptCyber threat intelligence ppt
Cyber threat intelligence ppt
Kumar Gaurav
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence
Sirius
 
SOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOCSOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOC
Priyanka Aash
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
S.E. CTS CERT-GOV-MD
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations center
CMR WORLD TECH
 
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation ExercisesPurple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Jorge Orchilles
 
Optimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to SuccessOptimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to Success
Sirius
 
What is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityWhat is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda Security
Panda Security
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
Michael Nickle
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metrics
Mark Arena
 
Cyber Threat Intelligence Integration Center -- ONDI
Cyber Threat Intelligence Integration Center -- ONDICyber Threat Intelligence Integration Center -- ONDI
Cyber Threat Intelligence Integration Center -- ONDI
David Sweigert
 
Threat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceThreat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement Matrice
Vishal Kumar
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
What We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case StudyWhat We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case Study
Priyanka Aash
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیت
ReZa AdineH
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)
Shah Sheikh
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1
Priyanka Aash
 
Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)
phexcom1
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat Intelligence
NTT Innovation Institute Inc.
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down Intruders
Infosec
 
Security operation center.pdf
Security operation center.pdfSecurity operation center.pdf
Security operation center.pdf
Skillmine Technology Consulting
 
Threat Hunting Professional Online Training Course
Threat Hunting Professional Online Training CourseThreat Hunting Professional Online Training Course
Threat Hunting Professional Online Training Course
ShivamSharma909
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
Spyglass Security
 

Contenu connexe

Tendances

6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence
Sirius
 
Optimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to SuccessOptimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to Success
Sirius
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیت
ReZa AdineH
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down Intruders
Infosec
 

Tendances (20)

6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence
 
SOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOCSOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOC
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations center
 
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation ExercisesPurple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
 
Optimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to SuccessOptimizing Security Operations: 5 Keys to Success
Optimizing Security Operations: 5 Keys to Success
 
What is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda SecurityWhat is Threat Hunting? - Panda Security
What is Threat Hunting? - Panda Security
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metrics
 
Cyber Threat Intelligence Integration Center -- ONDI
Cyber Threat Intelligence Integration Center -- ONDICyber Threat Intelligence Integration Center -- ONDI
Cyber Threat Intelligence Integration Center -- ONDI
 
Threat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement MatriceThreat Hunting Procedures and Measurement Matrice
Threat Hunting Procedures and Measurement Matrice
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
 
What We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case StudyWhat We’ve Learned Building a Cyber Security Operation Center: du Case Study
What We’ve Learned Building a Cyber Security Operation Center: du Case Study
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیت
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1
 
Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat Intelligence
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down Intruders
 
Security operation center.pdf
Security operation center.pdfSecurity operation center.pdf
Security operation center.pdf
 

Similaire à Attack Simulation and Hunting

Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
Spyglass Security
 
Hunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsHunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark Arts
Spyglass Security
 
Incorporating Threat Intelligence into Your Enterprise Communications Systems...
Incorporating Threat Intelligence into Your Enterprise Communications Systems...Incorporating Threat Intelligence into Your Enterprise Communications Systems...
Incorporating Threat Intelligence into Your Enterprise Communications Systems...
EC-Council
 
Managing Next Generation Threats to Cyber Security
Managing Next Generation Threats to Cyber SecurityManaging Next Generation Threats to Cyber Security
Managing Next Generation Threats to Cyber Security
Priyanka Aash
 
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
Gnanavi2
 
Applying Machine Learning to Network Security Monitoring - BayThreat 2013
Applying Machine Learning to Network Security Monitoring - BayThreat 2013Applying Machine Learning to Network Security Monitoring - BayThreat 2013
Applying Machine Learning to Network Security Monitoring - BayThreat 2013
Alex Pinto
 
Cause 11 im final
Cause 11 im finalCause 11 im final
Cause 11 im final
cavapyta
 
Cause 11 im final
Cause 11 im finalCause 11 im final
Cause 11 im final
cavapyta
 
Hunting before a Known Incident
Hunting before a Known IncidentHunting before a Known Incident
Hunting before a Known Incident
EndgameInc
 
Join the hunt: Threat hunting for proactive cyber defense.pptx
Join the hunt: Threat hunting for proactive cyber defense.pptxJoin the hunt: Threat hunting for proactive cyber defense.pptx
Join the hunt: Threat hunting for proactive cyber defense.pptx
Infosec
 

Similaire à Attack Simulation and Hunting (20)

Threat Hunting Professional Online Training Course
Threat Hunting Professional Online Training CourseThreat Hunting Professional Online Training Course
Threat Hunting Professional Online Training Course
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
 
Hunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsHunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark Arts
 
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
 
Incorporating Threat Intelligence into Your Enterprise Communications Systems...
Incorporating Threat Intelligence into Your Enterprise Communications Systems...Incorporating Threat Intelligence into Your Enterprise Communications Systems...
Incorporating Threat Intelligence into Your Enterprise Communications Systems...
 
Cyber Incident Response & Digital Forensics Lecture
Cyber Incident Response & Digital Forensics LectureCyber Incident Response & Digital Forensics Lecture
Cyber Incident Response & Digital Forensics Lecture
 
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
 
Managing Next Generation Threats to Cyber Security
Managing Next Generation Threats to Cyber SecurityManaging Next Generation Threats to Cyber Security
Managing Next Generation Threats to Cyber Security
 
Janitor vs cleaner
Janitor vs cleanerJanitor vs cleaner
Janitor vs cleaner
 
Threat Hunting by Falgun Rathod - Cyber Octet Private Limited
Threat Hunting by Falgun Rathod - Cyber Octet Private LimitedThreat Hunting by Falgun Rathod - Cyber Octet Private Limited
Threat Hunting by Falgun Rathod - Cyber Octet Private Limited
 
501 ch 8 risk management tools
501 ch 8 risk management tools501 ch 8 risk management tools
501 ch 8 risk management tools
 
Computer Forensic
Computer ForensicComputer Forensic
Computer Forensic
 
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
 
Applying Machine Learning to Network Security Monitoring - BayThreat 2013
Applying Machine Learning to Network Security Monitoring - BayThreat 2013Applying Machine Learning to Network Security Monitoring - BayThreat 2013
Applying Machine Learning to Network Security Monitoring - BayThreat 2013
 
Cause 11 im final
Cause 11 im finalCause 11 im final
Cause 11 im final
 
Cause 11 im final
Cause 11 im finalCause 11 im final
Cause 11 im final
 
2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion Detection2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion Detection
 
Hunting before a Known Incident
Hunting before a Known IncidentHunting before a Known Incident
Hunting before a Known Incident
 
Join the hunt: Threat hunting for proactive cyber defense.pptx
Join the hunt: Threat hunting for proactive cyber defense.pptxJoin the hunt: Threat hunting for proactive cyber defense.pptx
Join the hunt: Threat hunting for proactive cyber defense.pptx
 
H@dfex 2015 malware analysis
H@dfex 2015 malware analysisH@dfex 2015 malware analysis
H@dfex 2015 malware analysis
 

Dernier

Pune Airport ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready...
Pune Airport ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready...Pune Airport ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready...
Pune Airport ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready...
tanu pandey
 
VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...
VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...
VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...
SUHANI PANDEY
 
WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)
WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)
WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)
Delhi Call girls
 
Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.
soniya singh
 
Call Now ☎ 8264348440 !! Call Girls in Shahpur Jat Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Shahpur Jat Escort Service Delhi N.C.R.Call Now ☎ 8264348440 !! Call Girls in Shahpur Jat Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Shahpur Jat Escort Service Delhi N.C.R.
soniya singh
 
Low Sexy Call Girls In Mohali 9053900678 🥵Have Save And Good Place 🥵
Low Sexy Call Girls In Mohali 9053900678 🥵Have Save And Good Place 🥵Low Sexy Call Girls In Mohali 9053900678 🥵Have Save And Good Place 🥵
Low Sexy Call Girls In Mohali 9053900678 🥵Have Save And Good Place 🥵
Chandigarh Call girls 9053900678 Call girls in Chandigarh
 
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
SUHANI PANDEY
 
VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting High Prof...
VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting High Prof...VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting High Prof...
VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting High Prof...
singhpriety023
 
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
soniya singh
 
Al Barsha Night Partner +0567686026 Call Girls Dubai
Al Barsha Night Partner +0567686026 Call Girls DubaiAl Barsha Night Partner +0567686026 Call Girls Dubai
Al Barsha Night Partner +0567686026 Call Girls Dubai
Escorts Call Girls
 
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort ServiceBusty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
Delhi Call girls
 
Ganeshkhind ! Call Girls Pune - 450+ Call Girl Cash Payment 8005736733 Neha T...
Ganeshkhind ! Call Girls Pune - 450+ Call Girl Cash Payment 8005736733 Neha T...Ganeshkhind ! Call Girls Pune - 450+ Call Girl Cash Payment 8005736733 Neha T...
Ganeshkhind ! Call Girls Pune - 450+ Call Girl Cash Payment 8005736733 Neha T...
SUHANI PANDEY
 
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort ServiceEnjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
Delhi Call girls
 
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...
Escorts Call Girls
 
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
Diya Sharma
 
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
Call Girls In Delhi Whatsup 9873940964 Enjoy Unlimited Pleasure
 
6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...
6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...
6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...
@Chandigarh #call #Girls 9053900678 @Call #Girls in @Punjab 9053900678
 
Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...
Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...
Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...
SUHANI PANDEY
 

Dernier (20)

Pune Airport ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready...
Pune Airport ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready...Pune Airport ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready...
Pune Airport ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready...
 
Russian Call Girls in %(+971524965298 )# Call Girls in Dubai
Russian Call Girls in %(+971524965298 )# Call Girls in DubaiRussian Call Girls in %(+971524965298 )# Call Girls in Dubai
Russian Call Girls in %(+971524965298 )# Call Girls in Dubai
 
VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...
VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...
VVIP Pune Call Girls Mohammadwadi WhatSapp Number 8005736733 With Elite Staff...
 
WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)
WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)
WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)
 
Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Rani Bagh Escort Service Delhi N.C.R.
 
Call Now ☎ 8264348440 !! Call Girls in Shahpur Jat Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Shahpur Jat Escort Service Delhi N.C.R.Call Now ☎ 8264348440 !! Call Girls in Shahpur Jat Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Shahpur Jat Escort Service Delhi N.C.R.
 
Low Sexy Call Girls In Mohali 9053900678 🥵Have Save And Good Place 🥵
Low Sexy Call Girls In Mohali 9053900678 🥵Have Save And Good Place 🥵Low Sexy Call Girls In Mohali 9053900678 🥵Have Save And Good Place 🥵
Low Sexy Call Girls In Mohali 9053900678 🥵Have Save And Good Place 🥵
 
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
 
VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting High Prof...
VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting High Prof...VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting High Prof...
VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting High Prof...
 
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
 
Al Barsha Night Partner +0567686026 Call Girls Dubai
Al Barsha Night Partner +0567686026 Call Girls DubaiAl Barsha Night Partner +0567686026 Call Girls Dubai
Al Barsha Night Partner +0567686026 Call Girls Dubai
 
Call Girls Ludhiana Just Call 98765-12871 Top Class Call Girl Service Available
Call Girls Ludhiana Just Call 98765-12871 Top Class Call Girl Service AvailableCall Girls Ludhiana Just Call 98765-12871 Top Class Call Girl Service Available
Call Girls Ludhiana Just Call 98765-12871 Top Class Call Girl Service Available
 
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort ServiceBusty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
 
Ganeshkhind ! Call Girls Pune - 450+ Call Girl Cash Payment 8005736733 Neha T...
Ganeshkhind ! Call Girls Pune - 450+ Call Girl Cash Payment 8005736733 Neha T...Ganeshkhind ! Call Girls Pune - 450+ Call Girl Cash Payment 8005736733 Neha T...
Ganeshkhind ! Call Girls Pune - 450+ Call Girl Cash Payment 8005736733 Neha T...
 
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort ServiceEnjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
 
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...
(+971568250507 ))# Young Call Girls in Ajman By Pakistani Call Girls in ...
 
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
₹5.5k {Cash Payment}New Friends Colony Call Girls In [Delhi NIHARIKA] 🔝|97111...
 
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
 
6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...
6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...
6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...
 
Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...
Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...
Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...
 

Attack Simulation and Hunting

  • 1. South Africa – 11 Official Languages Greetings! Afrikaans – Goeie dag English – Hello isiNdebele – Lotjhani isiXhosa – Mholo isiZulu – Sanibona Sepedi – Thobela Sesotho – Dumela Setswana – Dumela SiSwati – Sawubona Tshivenda – Ndaa/Aa Xitsonga – Avuxeni Thank you! Afrikaans – Dankie English – Thanks isiNdebele – Ngiyathokoza isiXhosa – Enkosi isiZulu – Ngiyabonga Sepedi – Ke a leboga Sesotho – Ke a leboha Setswana – Ke a leboga SiSwati – Ngiyabonga Tshivenda –Ndi a livhuwa Xitsonga – ndzi khense
  • 4. #whoami Nathi Mogomotsi @nathimog african, black, grand[son], brother, hacker, n00b, vegan, alcohol, not-french, suck-at-english, God fearing, not-a-saint, no tattoo, biker Sr. Red Teamer @sanlam Hacker @sensepost
  • 5. How it all started • New job • More time to do research and 1337 hax But… • It wasn’t fun anymore • Now I get to receive pen test reports • I am on the receiving end • Needed to do something about this • Time to help the defenders https://twitter.com/s7ephen/status/925969930134024192
  • 6. On an Unrelated Note: • I asked my previous boss (Charl) to buy me this book 4~ years I ago • I knew I had some “defensive” blood in me 
  • 7. How it all started • Watched CG and CN talk • Was impressed, thanks guys • Go watch the talk • Will wait for you…
  • 8. Why this talk • To share my experience • To share my learnings • Hopefully it will help you get started (you should) • I am not an expert, so this is really basic stuff • Ping me if you have any comments or ideas • nathi@protonmail.com
  • 9. Why this talk – Pyramid of Pain http://detect-respond.blogspot.co.za/2013/03/the-pyramid-of-pain.html
  • 10. What is attack simulation ? • Just like a pilot simulator, it is there to put you in the worst possible situation at a lowest level of risk - Chris Nickerson • Understanding attacks that might be used against an organisation in order to improve the organisation’s defence – me • Attack simulations should be done to learn how attackers are likely to achieve goals against your organization – Zane Lackey • Can we detect and/or stop a particular attack ? • Assume compromise – We can be compromised!
  • 11. What is attack hunting ? • Proactive incident response • Are we hacked by this particular attack ? • Assume compromise – We might be compromised already!
  • 12. High Level Process|Attack Oriented Defence Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
  • 13. Attack Techniques Choose a technique you interested in: • Technique used in the wild • Technique from threat reports • Technique you found during your vuln research • Technique from software vendors security bulletins • Technique from hacker tools • Technique from pen testing report
  • 14. Attack Techniques - MITRE “ATT&CK is useful for understanding security risk against known adversary behavior, for planning security improvements, and verifying defenses work as expected.” https://attack.mitre.org/wiki/Main_Page
  • 16. Attack Techniques - Tools Media and your CISO
  • 17. Attack Techniques - Tools https://www.slideshare.net/JaredAtkinson/purpose-driven-hunt-derbycon-2017
  • 18. Recap • We identified the technique we want to focus on. Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
  • 19. Defensive Controls – Cyber Kill Chain
  • 20. Weaponization Reconnaissance Delivery Exploitation Installation Command & Control Actions on Objectives Detect Deny Disrupt Degrade Deceive Contain Web Analytics Firewall ACL Firewall ACL NIDS NIPS NIPS Vigilant user Proxy filter Inline AV Email Queuing App-Aware Firewall HIDS Vendor Patch EMET, DEP Inter-Zone NIPS HIDS ‘chroot’ Jail AV EPP NIDS Firewall ACL NIPS Tar pit DNS Redirect Trust Zones Audit log Outbound ACL DLP QOS Throttle Honeypot Trust Zones
  • 21. Recap • We identified the technique we want to focus on. • We understand our current defences. • We identified the technique we want to focus on Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
  • 22. Simulations – The process Hack yourself first Hack the humans Attack analysis with the blue team Defence controls update Validate new defence controls Activity Tracker
  • 23. Simulations – Hack yourself first • Test detection tools • Use a test machine identical to your environment • Collect Indicators of Compromise (IoCs) Network artefacts User Agent Strings Dynamic DNS visits Encrypted traffic MIME type downloads Host artefacts New files New services New registry Files that runs on reboot
  • 24. Simulations – Hack yourself first (MITRE) • https://github.com/redcanaryco/atomic-red-team • https://www.youtube.com/watch?v=M4SHpDX8GTo
  • 25. Simulation – hack the humans • Test processes • Test blue team response to alerts • Test IR procedure
  • 26. Simulations – Attack Analysis with the blue • Show how you did your hack • Kill chain analysis and controls • Map logs to the attack • Handover Indicators of Compromise
  • 28. Simulation – Defence update • To automate detection • Update • FW/IDS/IPS/AV/EDR/<your security product here> • Processes • Deploy Controls • Controls should not be expensive and complex • https://t2.fi/2017/02/05/haroon-meer-keynote-2016/
  • 29. Simulation – Controls validation • Validate the new defence controls • Create a script to automate this • Should not be fancy • Mainly to help the blue team
  • 31. Recap • We identified the technique we want to focus on • We understand our current defences • We tested, updated and validated controls and incident procedures • We know which data sets to use for our hunts Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
  • 32. Hunting – The process • Collect data sets • Process the data sets • Analyse collection • Malicious activity • Activity tracker
  • 33. Hunting – Collect data sets • Proxy logs • Anti-Virus logs • Application logs • Sysmon logs • Bro IDS logs • DNS logs • Firewall logs • Netflow data
  • 34. Hunting – Techniques to process the data sets Searching Stack Counting Grouping Clustering https://sqrrl.com/threat-hunting-reference-guide/ https://speakerdeck.com/davidjbianco/toppling-the-stack-practical-outlier-detection-for-threat-hunters
  • 35. Hunting – Analyse collection • Search artefacts on the network data sets • Find suspicious hosts • Host threat hunting https://www.sans.org/summit-archives/file/summit-archive-1492556122.pdf
  • 36. Hunting – Found suspicious activity • Call the forensicators • Execute the IR plan
  • 38. Recap • We identified the technique we want to focus on • We understand our current defences • We tested, updated and validated controls and incident procedures • We know which data sets to use for our hunts • We confirmed if we are under attack or not • Hopefully eradicated the threat Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
  • 39. Measure Effectiveness • Effectiveness is a measure of the success of the operation, overall - Raphael Mudge. • Roberto Rodriguez (@cyb3rWard0g) • https://cyberwardog.blogspot.co.za/2017/07/how-hot-is-your-hunt-team.html
  • 40. KEY TAKEAWAYS • You get to play part in defence • You get to find bad guys and pen testers • You get to learn other stuff i.e DFIR, network monitoring, rules writing • You get to do cool hacks that actually makes a difference in your org • You get to teach the blue team • You get to learn from them too.. https://medium.com/@sroberts/introduction-to-dfir-d35d5de4c180
  • 41. More from CN and CG • If you didn’t watch their talk earlier • Go ahead and watch this one • Updated and more awesome • Thanks once again guys
  • 42. Tools – because you want to automate • CALDERA: Automatic adversary emulation (to be released at BH17 EU) • DumpsterFire – Threat simulations • SQRLL VM – Threat hunting • CCF VM – Incident triage (DFIR) with ELK • Bro IDS – Network monitoring • Sysmon – System monitoring • ELK – Data visualisation • Chris Gates is also releasing something soon ;)
  • 43. Credits / References / Thank you Credits & Thank you for your contributions • @indi303 • @carnal0wnage • @ jackcr • @DavidJBianco • @Sroberts • @RobertMLee • @Subtee • @Chrissanders88 • DR. Eric Cole • @Jaredcatkinson • @Robwinchester3 • @DAkacki • @cyb3rWard0g Resources • https://github.com/magoo/redteam-plan • http://soc.wa.gov/resources/exercises • https://github.com/redcanaryco/atomic-red-team • https://resources.redcanary.com/atomic-red-team-training-session- nov-2017 • https://github.com/demisto/content Training • Chris Sanders - http://chrissanders.org/training/ • @zanelackey • @haroonmeer • @M_haggis • @mattifestation • @AlanOrlikoski • @PyroTek3 • @SqrrlData • @redcanaryco • Bloodhound Gang
  • 44. Special Thanks: When I do grow up one day I want to be like these guys • Willem Smit @slackerscoza • Kelvin Adams @nivlek007 • George Pranschke @cheorchie • Chris Gates @carnal0wnage • Awesome people I have ever met! • Keep rocking guys.
  • 45. “Do whatever you want. Trust your guts, your humanly feelings, your very limited knowledge. This is best effort.” – Julio Auto
  • 46. Thanks once again, do your best effort to try to be nice to one another & take care of your health!