+ All Categories
Home > Technology > Threat Hunting 102: Beyond the Basics

Threat Hunting 102: Beyond the Basics

Date post: 08-Apr-2017
Category:

Technology
Upload: cybereason
View: 36 times
Download: 2 times
Download Report this document
Share this document with a friend
16
Hunting 102 Beyond the Basics
Transcript
Page 1: Threat Hunting 102: Beyond the Basics

Hunting 102Beyond the Basics

Page 2: Threat Hunting 102: Beyond the Basics

#whoami

Brad MechaHunting Team Manager at Cybereason

Former Technology Consultant / Cyber Defense at RSA Former CIRT Lead at a Global Advanced Manufacturing Organization

Page 3: Threat Hunting 102: Beyond the Basics

Why we’re here today

Quick Hunting Refresher

I’m Hunting!! Now What?

Giving Back & Process Integration

Expanded PowerShell Use Case

Page 4: Threat Hunting 102: Beyond the Basics

The process of proactivelydiscovering undesirable activity to illicit a positive outcome.

Refresher: Hunting defined.

Page 5: Threat Hunting 102: Beyond the Basics

Refresher: Why?

Prepare? Its very hard to defend what you can’t see and don’t understand.

Be proactive? Don’t wait for bad to happen? Then have to react to fix.

Fix stuff? Especially before it breaks!

Page 6: Threat Hunting 102: Beyond the Basics

Adapt or Perish. Learning is discovery, the discovery of the cause of our ignorance. However, the best way of learning is not the computation of information. Learning is discovering, uncovering what is there in us. When we discover, we are uncovering our own ability, our own eyes, in order to find our potential, to see what is going on, to discover how we can enlarge our lives, to find means at our disposal that will let us cope with a difficult situation.

--Bruce Lee

Page 7: Threat Hunting 102: Beyond the Basics

The Hunting Process

Motivation + Hypothesis

DataCollection

Tooling / Analysis Outcomes

Automation*

Page 8: Threat Hunting 102: Beyond the Basics

I’m Hunting! Now What? We’re Giving Back!

Incidents

Detection Improvements / New Collection Techniques

Prevention w/ Confidence

Config Management / Compliance / Audit

Improve Response / Triage

Page 9: Threat Hunting 102: Beyond the Basics

Incident Response Process

Prepare

Detect

RespondContain / Eradicate

Post-Mortem / Prevent

Page 10: Threat Hunting 102: Beyond the Basics

Motivation + Hypothesis

DataCollection

Tooling / Analysis Outcomes

Automation*

Prepare

Detect

RespondContain / Eradicate

Post-Mortem / Prevent

Hunting Process Incident Response Process

Escalated Incident

High Fidelity Detections

Use blind spots / Gaps as sources of Motivation and Hypothesis/

New Data Collection and Analysis TechniquesImprove Triage and Response SOPs

Page 11: Threat Hunting 102: Beyond the Basics

Hunting: A Deeper Dive

Previous Outcomes create new Motivation + Hypothesis’

Introducing new datasets to expand previous outcomes

Data stacking becomes more crucial to the journey to analysis / data science

Page 12: Threat Hunting 102: Beyond the Basics

Expanded Hunting: Powershell

Page 13: Threat Hunting 102: Beyond the Basics

© 2015 Cybereason Inc. All rights reserved.

Powershell

Service = commandline:powershell or .ps*

FilelessTechniques

Process Execution

Network Comms

PersistenceRegistry

Services

Hidden

Obfuscated

Shellcode / DLL

Execution

Encoded

Download Commands

Parent / Child

Profiling

Int2ExtProfiling

DNS Queries

Registry = commandline:powershell or .ps*

commandLine:hidden|1|-nop|iex|-invoke|ICM|scriptblock,

commandLine:`|1|^|+|$|*|&|.

commandLine:nop|nonl|nol|bypass|e|enc|ec

commandLine: DownloadFile|IWR|Invoke-WebRequest|IRM|Invoke-RestMethod|DownloadString|BITS

commandLine:dllimport|virtualalloc

Parent: wscript|mshta|MSOffice|Browser|WMI*

Connections → Filter:isExternalConnection:true

URL: .ps*

DNS Query: TXT C2

DNS Query: Received vs Transmitted Ratios

Page 14: Threat Hunting 102: Beyond the Basics

Giving Back…Incident Escalation

Incident 1: Powershell WebClient –Downloading Stage 2 Payload

Incident 2: Remote .ps file execution / Invoking shellcode

Incident 3: Mismatched Services – Adversarial use of .ps

Incident 4: Data Exfil – Powershell BITSTransfer

Page 15: Threat Hunting 102: Beyond the Basics

Giving Back…PreventionBlock execution of PowerShell.exe on all systems where it’s not in use for administrative purposes

Force specific Parent/Child Process Relationships – MSOffice|Wscript|Mshta|Browsers|WMI spawning Powershell.exe

Anchor Powershell scripts to a specific server directories, block .ps* from running directly on a system

Use endpoint firewall to prevent powershell.exe from connecting to non-approved IPs

Block “Bypass” “Hidden” ”Download String” “WebClient” ”DLLImport” “VirtualAlloc” as a command line argument for execution by an unauthorized user

See #2 for allowing valid applications

Page 16: Threat Hunting 102: Beyond the Basics

[email protected]

@cybereason

Thank you!


Recommended
Enabling a Threat Hunting Capability in AWS

Enabling a Threat Hunting Capability in AWS

Documents

2019 THREAT HUNTING REPORT - DomainTools · threats (58%), improving speed and accuracy of threat response (53%) and reducing the number of breaches (52%). THREAT HUNTING GOALS What

2019 THREAT HUNTING REPORT - DomainTools · threats (58%), improving speed and accuracy of threat response (53%) and reducing the number of breaches (52%). THREAT HUNTING GOALS What

Documents

FALCON OVERWATCH MANAGED THREAT HUNTING · Director of Information Technology, TransPak. CrowdStrike Products FALCON OVERWATCH MANAGED THREAT HUNTING CROWDSTRIKE MANAGED THREAT HUNTING

FALCON OVERWATCH MANAGED THREAT HUNTING · Director of Information Technology, TransPak. CrowdStrike Products FALCON OVERWATCH MANAGED THREAT HUNTING CROWDSTRIKE MANAGED THREAT HUNTING

Documents

Threat hunting as SOC process

Threat hunting as SOC process

Technology

The Elastic Guide to Threat Hunting - copyright

The Elastic Guide to Threat Hunting - copyright

Documents

SACON - Threat hunting (Chandra Prakash)

SACON - Threat hunting (Chandra Prakash)

Technology

Kaspersky Threat Hunting · • Immediate protection against any detected threat through automatic antivirus database updates. • Retrospective analysis of incidents and threat hunting,

Kaspersky Threat Hunting · • Immediate protection against any detected threat through automatic antivirus database updates. • Retrospective analysis of incidents and threat hunting,

Documents

Threat Hunting with Splunk Hands-on

Threat Hunting with Splunk Hands-on

Technology

Threat Hunting - csirt.jabarprov.go.id

Threat Hunting - csirt.jabarprov.go.id

Documents

ATT&CKing The Command Line & Hunting For More...Threat Hunting Automation Motivation Current Reality Threat hunting used to detect activity we are currently missing. As defenders,

ATT&CKing The Command Line & Hunting For More...Threat Hunting Automation Motivation Current Reality Threat hunting used to detect activity we are currently missing. As defenders,

Documents

Threat Hunting in Windows – Are You Hunting or Being Hunted?

Threat Hunting in Windows – Are You Hunting or Being Hunted?

Software

Your Practical Guide to 1 – Setting up your threat hunting program Hunt Evil: Your Practical Guide to Threat Hunting 5 3 Common Myths About Hunting Hunting is not a reactive activity.

Your Practical Guide to 1 – Setting up your threat hunting program Hunt Evil: Your Practical Guide to Threat Hunting 5 3 Common Myths About Hunting Hunting is not a reactive activity.

Documents

Threat hunting workshop

Threat hunting workshop

Technology

Enabling Efficient Cyber Threat Hunting with Cyber Threat ...

Enabling Efficient Cyber Threat Hunting with Cyber Threat ...

Documents

Threat Hunting with Splunk

Threat Hunting with Splunk

Technology

SQRRL threat hunting platform

SQRRL threat hunting platform

Technology

Endgame SANS - Threat Hunting Before the Incident

Endgame SANS - Threat Hunting Before the Incident

Documents

(CMC THREAT HUNTING SERVICE)

(CMC THREAT HUNTING SERVICE)

Documents