+ All Categories
Home > Documents > BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK...

BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK...

Date post: 22-Apr-2020
Category:

Documents
Upload: others
View: 5 times
Download: 0 times
Download Report this document
Share this document with a friend
22
©2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03621-8. MITRE | 1 | BZAR – Hunting Adversary Behaviors with Zeek and ATT&CK Mark Fernandez John Wunder @MITREattack
Transcript
Page 1: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

©2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03621-8. MITRE

| 1 |

BZAR – Hunting Adversary

Behaviors with Zeek and ATT&CK

Mark Fernandez

John Wunder

@MITREattack

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

Page 2: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

What we’ll talk about

▪ Background: ATT&CK and Threat Hunting

▪ Threat Hunting with BZAR

– Zeek Network Security Monitor

– How BZAR works and what it can see

▪ Examples

– Service Execution

– Remote File Copy to Windows Admin Shares

▪ Takeaways

| 2 |

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

Page 3: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

| 3 |

Free, open,

and globally

accessible

A common language

Community-

driven

What is

?A knowledge base

of adversary behavior

Based on

real-world

observations

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

Page 4: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

t al e

e ut o

e te e

le e alat o

e e e a o

e e t al e

o e

ate al o e e t

olle t o

o a o t ol

lt at o

a t

Ta t : the a e a ’ te h al oal

Tech

niq

ues:

ho

w t

he g

oals

are

ach

ieved

| 4 |

Procedures: Specific technique implementation

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

Page 5: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

How can we seethese behaviors?

How can we identify the malicious ones?

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 5 |

Image Source: Pirates of the Caribbean

Image Source: Wikimedia Commons

Page 6: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

How can we see these behaviors?

Perimeter monitoring is not enough

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 6 |

Initial Access

Execution PersistencePrivilege

EscalationDefense Evasion

Credential Access

DiscoveryLateral

MovementCollection

Command and Control

Exfiltration Impact

so we do endpoint monitoring.

Page 7: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 7 |

Defense in depth, amirite?

Image Source: The Office

Page 8: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

What can we do with internal network monitoring?

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 8 |

Initial Access

Execution PersistencePrivilege

EscalationDefense Evasion

Credential Access

DiscoveryLateral

MovementCollection

Command and Control

Exfiltration Impact

The Problem: Internal Network Traffic Can be Very Noisy

Server Message Block (SMB) protocol

Remote Procedure Call (RPC) protocol

Page 9: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 9 |

The Technology: Bro / Zeek Network Security Monitor

Open-source, highly-customizable

Deep-packet inspection

Page 10: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

The Result: B Z A R

Bro / Zeek ATT&CK-based Analytics and Reporting

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 10 |

Bizarre – very strange or unusual

BZAR – open-source Bro/Zeek scripts

https://github.com/mitre-attack/bzar

Page 11: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

l ttle o e about Zeek…

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 11 |

• SMB Protocol Analyzero Message Types 145

• DCE-RPC Protocol Analyzero Interface Definitions 81

o Method Definitions 1,471

• Authentication Protocol Analyzerso Used in SMB and RPC Authentication

• File Extraction Analyzero Extract Files from Network Traffic

o Lateral Movement

How Many Exist in Windows?

How Many Exist in Windows?

Bonus!

Bonus!

Page 12: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

ATT&CK Techniques Detected with BZAR

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 12 |

Page 13: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

ATT&CK Techniques Detected with BZAR

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 13 |

Execution PersistenceDefense

Evasion

Credential

AccessDiscovery

Lateral

Movement

T1035 Service Execution

T1004 Winlogon Helper DLL

T1070 Indicator Removal Host

T1003 Credential

DumpingT1016 System Network Configuration

T1077 Windows Admin Shares

T1047 Windows Mgmt Instrum. (WMI)

T1013 Port Monitors

T1049 System Networks Connections

T1105 Remote File Copy

T1053 Scheduled Task T1018 Remote System

T1033 System Owner/User

T1069 Permission Groups

T1082 System Info

T1083 File and Directory

T1087 Account

T1124 System Time

T1135 Network Share

Page 14: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

What ou a ee etwo k t a …

Techniques that necessarily generate

network traffic

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 14 |

Desktop 1

Desktop 2

Te h que that a e ’t normally executed over the network, but can be

Page 15: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

Execution

T1035 Service Execution

T1047 Windows MgmtInstrumentation (WMI)

T1053 Scheduled Tasks

BZAR Example – Remote Execution

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 15 |

Execution PersistenceDefense

Evasion

Credential

AccessDiscovery

Lateral

Movement

T1035 Service Execution

T1004 Winlogon Helper DLL

T1070 Indicator Removal Host

T1003 Credential

DumpingT1016 System Network Configuration

T1077 Windows Admin Shares

T1047 Windows Mgmt Instrum. (WMI)

T1013 Port Monitors

T1049 System Networks Connections

T1105 Remote File Copy

T1053 Scheduled Task T1018 Remote System

T1033 System Owner/User

T1069 Permission Groups

T1082 System Info

T1083 File and Directory

T1087 Account

T1124 System Time

T1135 Network Share

Page 16: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 16 |

• Indicators: Four (4) RPC Functionso svcctl :: CreateServiceA

o svcctl :: CreateServiceW

o svcctl :: StartServiceA

o svcctl :: StartServiceW

• Analytics: Simpleo Detect any of the 4 RPC functions

o Zeek event handlers

• dce_rpc_request()

• dce_rpc_response()

Execution

T1035 Service Execution

BZAR Example – T1035 Service Execution

Page 17: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 17 |

• Reporting: Write to Zeek Notice Logo “ :: ”

o “svcctl::StartServiceW”

o IP addresses & TCP/UDP ports

o Zeek connection ID

Execution

T1035 Service Execution

BZAR Example – T1035 Service Execution

Important: MUST be tuned for your environment!

Page 18: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 18 |

Lateral Movement

T1077 Windows Admin Shares

T1105 Remote File Copy

Execution PersistenceDefense

Evasion

Credential

AccessDiscovery

Lateral

Movement

T1035 Service Execution

T1004 Winlogon Helper DLL

T1070 Indicator Removal Host

T1003 Credential

DumpingT1016 System Network Configuration

T1077 Windows Admin Shares

T1047 Windows Mgmt Instrum. (WMI)

T1013 Port Monitors

T1049 System Networks Connections

T1105 Remote File Copy

T1053 Scheduled Task T1018 Remote System

T1033 System Owner/User

T1069 Permission Groups

T1082 System Info

T1083 File and Directory

T1087 Account

T1124 System Time

T1135 Network Share

BZAR Example – Lateral Movement

Page 19: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 19 |

• Indicators: Two (2) SMB Commandso SMBv1 Write

o SMBv2 Write

• Analytics: Complexo Detect SMB Write to Windows Admin Shares

o ADMIN$ or C$ only

o Ignore IPC$ (e.g., names pipes)

o Zeek event handlers

• smb1_write_andx_response()

• smb2_write_request()

BZAR Example – Lateral Movement

Lateral Movement

T1077 Windows Admin Shares

T1105 Remote File Copy

Page 20: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 20 |

• Reporting: Write to Zeek Notice Logo “ ::Lateral_Movement”

o “ :: ”

o IP addresses & TCP/UDP ports

o Zeek connection ID

o Full Universal Naming Convention (UNC) path and file name

Lateral Movement

T1077 Windows Admin Shares

T1105 Remote File Copy

Important: MUST be tuned for your environment!

BZAR Example – Lateral Movement

Page 21: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

Summary

▪ Monitor your endpoints

– – ’

▪ Think outside the box

– – ’

▪ Think at different levels of abstraction

– – Low-fidelity indicators can help you build-up analytics and reporting

▪ Integrate into your overall monitoring approach

– – Network alerts and endpoint alerts can co-exist

▪ Tune for your environment!

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.

| 21 |

Page 22: BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

| 22 |

attack.mitre.org

medium.com/mitre-attack

[email protected]

@MITREattack

https://github.com/mitre-attack/bzar

© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03730-14.


Recommended
Social Media Presentation - Savannah Chamber Small Business Luncheon (Melissa Yao, Amy Brock, & Zeek Coleman)

Social Media Presentation - Savannah Chamber Small Business Luncheon (Melissa Yao, Amy Brock, & Zeek Coleman)

Documents

MLM Analyst Len Clements Reviews What Happened To Zeek Rewards

MLM Analyst Len Clements Reviews What Happened To Zeek Rewards

Documents

COR13 COR14 COR15 COR16 COJA COJC - Digilentincarty_sch.pdf · ck _s da ck _s cl ck _s ck ck _s s ck _mis o ck _mo si ck _an0_p ck _an1_p ck _an2_p ck _an3_p ck _an4_p ck _an5_p ck

COR13 COR14 COR15 COR16 COJA COJC - Digilentincarty_sch.pdf · ck _s da ck _s cl ck _s ck ck _s s ck _mis o ck _mo si ck _an0_p ck _an1_p ck _an2_p ck _an3_p ck _an4_p ck _an5_p ck

Documents

Zeek rewards konto bids

Zeek rewards konto bids

Education

Lab 3: Parsing, Reading and Organizing Zeek Filesce.sc.edu/cyberinfra/workshops/Material/Zeek/Lab 3.pdf · • | sort: uses the sort command to organize the rows in alphabetical order.

Lab 3: Parsing, Reading and Organizing Zeek Filesce.sc.edu/cyberinfra/workshops/Material/Zeek/Lab 3.pdf · • | sort: uses the sort command to organize the rows in alphabetical order.

Documents

Effects of hemolysis on the assays of serum CK, CK-MB ... · Effects of hemolysis on the assays of serum CK, CK-MB activities and CK-MB (mass), troponin and myoglobin measurements

Effects of hemolysis on the assays of serum CK, CK-MB ... · Effects of hemolysis on the assays of serum CK, CK-MB activities and CK-MB (mass), troponin and myoglobin measurements

Documents

sport.center · KMC KMC PCOO "MOKC" CK "KpblnaTcKoe" KpblnaTcKoe" CK "KPblnaTCKoe" KpblnaTcKoe" CK " "KpblnaTcoe" CK CK "KpblnaTcKoe' CK " KPblnaTCKoe" CK "KpblnaTcKoe" CK

sport.center · KMC KMC PCOO "MOKC" CK "KpblnaTcKoe" KpblnaTcKoe" CK "KPblnaTCKoe" KpblnaTcKoe" CK " "KpblnaTcoe" CK CK "KpblnaTcKoe' CK " KPblnaTCKoe" CK "KpblnaTcKoe" CK

Documents

Figure 5.11 Y 6 Greensville Tier 3 Study Area · PDF fileH a m i l t o n Strabane Ck. 228 Willoughby Ck. 215 Mountsberg Ck. 210 232 ... Spencer Ck. Spring Ck. Sulphur Ck. W. Spencer

Figure 5.11 Y 6 Greensville Tier 3 Study Area · PDF fileH a m i l t o n Strabane Ck. 228 Willoughby Ck. 215 Mountsberg Ck. 210 232 ... Spencer Ck. Spring Ck. Sulphur Ck. W. Spencer

Documents

Lab 7: Introduction to Zeek Signaturesce.sc.edu/cyberinfra/workshops/workshop_2020/zeek_labs... · 2020. 6. 12. · Lab 7: Introduction to Zeek Signatures Page 6 • :

Lab 7: Introduction to Zeek Signaturesce.sc.edu/cyberinfra/workshops/workshop_2020/zeek_labs... · 2020. 6. 12. · Lab 7: Introduction to Zeek Signatures Page 6 • :

Documents

CK and CK NAC Clinical

CK and CK NAC Clinical

Documents

Ransomware detection - Zeek

Ransomware detection - Zeek

Documents

Rotation From CK #2 to CK #1 (DOY 189-190) · X-Axis (CK #1 = 10189_10194ra.bc; CK #2 = 10176_10211pg_live.bc) Rotation From CK #2 to CK #1 (DOY 189-190) 10189_10194_temp3.doc Thu

Rotation From CK #2 to CK #1 (DOY 189-190) · X-Axis (CK #1 = 10189_10194ra.bc; CK #2 = 10176_10211pg_live.bc) Rotation From CK #2 to CK #1 (DOY 189-190) 10189_10194_temp3.doc Thu

Documents

Zeek Rewards - Copy ad, Paste Ad, Share in the Profits! $$$

Zeek Rewards - Copy ad, Paste Ad, Share in the Profits! $$$

Business

Idaho Logging Safety News...Page 2 Idaho Logging Safety News and MEL CALENE SAM FLETCHER and ZEEK KENT who work for Musselman Rental. Zeek is a fairly big fellow so when Terry blew

Idaho Logging Safety News...Page 2 Idaho Logging Safety News and MEL CALENE SAM FLETCHER and ZEEK KENT who work for Musselman Rental. Zeek is a fairly big fellow so when Terry blew

Documents

THE ACA AND YOU AND MEDICARE TOO Angela Zeek Bluegrass SHIP Coordinator 2013.

THE ACA AND YOU AND MEDICARE TOO Angela Zeek Bluegrass SHIP Coordinator 2013.

Documents

ck ck ck ck - s3-ap-southeast-1.amazonaws.com€¦ · a bk, b ck a (ck)k ck ,b ck a a b b L.H.S. b b c c ck ck ck ck ck ck c c c k c k c k c k ... 11 AN NB AB 24 12 cm and 22 C u

ck ck ck ck - s3-ap-southeast-1.amazonaws.com€¦ · a bk, b ck a (ck)k ck ,b ck a a b b L.H.S. b b c c ck ck ck ck ck ck c c c k c k c k c k ... 11 AN NB AB 24 12 cm and 22 C u

Documents

DDDD----D ck DispatchD ck Dispatchddockers.homestead.com/DDockDispatch/D_Dock_Dispatch_July_17__2009.pdfDDDD----D ck DispatchD ck Dispatch Volume No. 9 Issue No. 4 July 17, 2009uly

DDDD----D ck DispatchD ck Dispatchddockers.homestead.com/DDockDispatch/D_Dock_Dispatch_July_17__2009.pdfDDDD----D ck DispatchD ck Dispatch Volume No. 9 Issue No. 4 July 17, 2009uly

Documents

Lab 7: Advanced Zeek Scripting for Anomaly and Malicious Event …ce.sc.edu/cyberinfra/workshops/Material/Zeek/Lab 7.pdf · Lab 7: Advanced Zeek Scripting for Anomaly and Malicious

Lab 7: Advanced Zeek Scripting for Anomaly and Malicious Event …ce.sc.edu/cyberinfra/workshops/Material/Zeek/Lab 7.pdf · Lab 7: Advanced Zeek Scripting for Anomaly and Malicious

Documents