systemic threat hunting: using continuous detection improvement to … · systemic threat hunting:...
Post on 11-May-2020
10 Views
Preview:
TRANSCRIPT
Joe MolesDIRECTOR DETECTION OPERATIONS, RED CANARY
@FLYINGMONKEY127
Jared MyersTHREAT RESEARCHER,CARBON BLACK
@JMYERS36
Presenters
Azeem KhanCUSTOMER@AZEEMNOW
Overview• Defining hunting
• How to use hunting to improve automation
• How to use endpoint telemetry for hunting
• Customer Experience
Actively looking for anomalous activity that has not been identified by your existing
toolsets by searching through various sources of data
“the collective name for any manual or machine-assisted technique used to detect security incidents” – David Bianco
What is Threat Hunting?
The goals of threat hunting:
• Identify solid evidence indicating the presence or residual activity of attackers
within a network or computing environment
• Assess you existing security and network and identifying gaps
• Improve your prevention and detection coverage
What is Threat Hunting?
Threat Hunting 101
Look for Bad Thing
Find Bad Thing
Figure Out How to Find Bad Thing Faster Next Time
But It’s All About How You Get There
Least Efficient Most Efficient
Ad hoc hunting
Newest research report
I have a hunch
When you have the time
Automation
Let your tools do the work
for you (not what you think)
“Today’s attackers have the upper hand due to the problematic economics of computer security. Attackers have the concrete and inexpensive task of finding a single flaw to break a system. Defenders on the other hand are required to anticipate and deny any possible flaw – a goal both difficult to measure and expensive to achieve. Only automation can upend these economics.”
– Defense Advanced Research Projects Agency
Automation Could Change Economics
“The first rule of any technology used in a business is that automation applied to an
efficient operation will magnify the efficiency.”
“The second is that automation applied to an inefficient operation will magnifythe inefficiency.”
-Bill Gates
Automation Magnifies (In)Efficiencies
TTPs (Tools, Techniques, and Procedures) are the new IOCs (Indicators)
Limited number of actions attackers will take following installation
Need to have a system in place to detect these types of behaviors
IOCs vs. Behaviors
Persistence Privilege Escalation Defense Evasion Credential Access Discovery
Accessibility Features Accessibility Features Exploitation of Vulnerability Brute Force Account Discovery
AppInit DLLs AppInit DLLs Bypass User Account Control Credential DumpingApplication Window
Discovery
Basic Input/Output System Bypass User Account Control Code Signing Credential Manipulation File and Directory Discovery
Bootkit DLL Injection Disabling Security Tools Credentials in FilesLocal Network Configuration
Discovery
Credit: attack.mitre.org
Splits the difference between hunting and signature-based detection
Collect All Endpoint Data
EDR sensor leveraged for raw feed of endpoint telemetry
Establish Hypothesis
• New threat report• Mapping current detection capabilities to Kill Chain, MITRE ATT&CK Matrix• “What does this look like on the endpoint?”
Hunting
Hunt retrospectively within existing customer environments to validate hypothesis
Detector Development
Codify the behavior or component observations
GOAL: Automatically identify this behavior in the future
Threat Detection
Look for suspicious and malicious behaviors in aggregate
Detector = 1 behavior
RC Detection = N +1 behaviors
BAU Triage and Investigation
Red Canary analysts review events and either 1) confirm threat 2) perform one-
time hide3) granularly
suppress events like this moving forward
Red Canary’s Approach to Hunting
Persistence #449: AUTORUN-REG-SHELLModification of known Window registry keys that will trigger application to start at boot or user login by unsigned binaries; http://technet.microsoft.com/en-us/magazine/ee851671.aspx
registry modification of <autorun keys>
+spawns process of known <scripts / shells>
cmd.exewscript.exepowershell.exereg.execscript.exe… and many more
\control\ panel\desktop\scrnsave.exe shellex\contextmenuhandlers
\software\classes\allfilesystemobjects\shellex\contextmenuhandlers
… and many many more
What if I want to detect
process named (or is) ‘powershell.exe’
+makes a remote thread / open thread call to a process named 'lsass.exe’
We want to see PowerShell or any renamed versions of PowerShell
Privileged Escalation #370: CROSSPROC-POWERSHELL-TO-LSASSPossible credential stealing via Mimikatz, Metasploit or similar attack tool.
What if I want to detect
Lateral Movement #587: REMOTE-POWERSHELL-CROSSPROC
Looks for remote PowerShell instance (wsmprovhost.exe) cross process; this would be indicative of a user remotely running certain PowerShell post-exploitation tools. Testing yields very few FPs in the wild.
parent process is 'svchost.exe’
+process name is 'wsmprovhost.exe’
+makes a remote thread / open thread call
What if I want to detect
Proper VisibilityProper visibility is the right combination of people and tools
• You need to equip your personnel with the right tools
Which provide visibility into the different channels
• Tools will augment your analyst not replace them
Adaptive HuntingUnderstand what is normal in your environment
Get into a Collection and Analysis cycle
Then look for anomalies and outliers
Hunt for characteristics of attacks
When hunting don’t just look at IOCs…Look past them as well.
• Shift away from a narrowly focused approach
• Vet your sources
• Extract more from IOCs
• Understand what is relevant to you
Implementing Threat Hunting in the Real World
PRE-DEPLOYMENT STAGE
Visibility Lacked organizational knowledge, limited collection of endpoint data
Detection Notified by an alert or by end users
Triage Ineffective, time-consuming, and lacked enterprise level scalability
Remediation Required physical access, no remote remediation, re-building systems
Retrospection No central database to search and review traces of previous instances
Hardening Difficult to accomplish without knowing the root cause of the compromise
Integration Many different tools but no integration among them
Hunting Reactive, usually in response to an incident, firefighting
DEPLOYMENT OPERATIONAL
Implementing Threat Hunting in the Real World
DEPLOYMENT
Visibility Continuous collection and access to endpoint data, everything recorded
Detection Auto processing of IOCs, helpful in identifying known-bad
Triage Significate capability, quick enterprise-wide search, determine the scope, severity and prioritize
Remediation Ability to remediate remote systems, less re-building
Retrospection Much better awareness of the environment but still not going beyond detection
Hardening Started seeing patterns, help standardize approved applications/tools
Integration Much better than the pre-deployment stage but still needed improvement
Hunting -Under-utilized due to lack of resources, inability to properly consume data, something bad happens - we review Carbon Black: reactive
PRE-DEPLOYMENTSTAGE OPERATIONAL
Implementing Threat Hunting in the Real World
DEPLOYMENT OPERATIONAL
Visibility Still continuous collection but now being reviewed and processed by experts
Detection Provides fast and accurate threat information which has been already investigated by an Red Canary analyst and requires specific action on our end
Triage -Provide complete scope of the incident which significantly reduces the time between identification to remediation
Remediation From guidance received from Red Canary, able to conduct proper remediation
Retrospection -Utilize Red Canary portal to identify trends and measure effectiveness-Take closer look at other existing tools and identify opportunities for tuning
Hardening Continue to review and improve our processes and configurations
Integration Leveraging integration between SIEM and Incident Tracking system
Hunting -Going beyond detection by combining Carbon Black technology and Red Canary expertise; efficient implementation of Threat Hunting - Allows us to identify/close security gaps and better align our priorities and roadmap items
PRE-DEPLOYMENTSTAGE
Tracking Your Hunting SuccessCritical to measure your hunting effectiveness
Quarterly:
• What were the results of your hunts?
• What new understanding do you have of your environment?
• How did you automate parts of previous hunt?
Is your team on the hunt?
Drive your team to improve
• Red team pop quiz
• Threat Bounty
• Schedule time aka Hunting season
top related