MT 36 Detecting Evasive

ThreatsNetwork Edition

Events

Opportunistic 85.7%

Exploits 12.3%

Ransomware - 1.2%

Targeted - .5%

FakeAV - .3%

A lot going on in the world

Motives vary

Motives vary

Motives vary

What industry verticals are victims?

46%

19%

12%

8%

4%

4%4%

4%

Targeted Intrusion Victims by Industry Vertical

Manufacturing

Technology Provider

Education

Other Services

Retail

Business Services

Media

Misc. Financial

Source: Targeted Threat Responses Jan 2015 – Sept 2015

Threat groups

• Known Tools (Infrastructure)• Known Targets (pre-Compromise) & Victims (post-Compromise)• Known Techniques & Procedures (Capability)• Known Identity

Candidate Threat

Groups

TG-0416 Vertical Hopscotch

Vertical

Healthcare

Government

Technology Providers

Manufacturing

Financial

Membership Organizations

H2

2011

H1 H2

2012

H1 H2

2013

H1 H2

2014

H1 H2

2015

H1

How are threat groups entering networks?

29%

29%

29%

14%

Targeted Intrusion Access Vector

Phishing

Credential Abuse

Scan & Exploit

Web Exploit

Source: Targeted Threat Responses Jan 2015 – Sept 2015

Phishing…everyday occurrence

Watch your webmail…spear phishing to corporate and personal mail

From: XXXXXXXX XXXXXXXX [mailto:xxxxxx.yyyyyyyy@zzzzzzzzz.zzz]Sent: XXXXXXX, XXXXXXXX ##, 201X 11:01 PMTo: XXXXXXXX, XXXXXXXXSubject: Internal Security Survey

Dear all,Key target is finding and exploring company internal security problems in 201X.Download the report: http://<company web domain>/download/survey.pdfplease fill the report and send to xxxxxx.yyyyyyyy@zzzzzzzzz.zzz tomorrow morning.

IT Department

1. Adversary identifies websites known or suspected to be visited by designated target

2. Identified sites are probed for vulnerability

3. Adversary places exploits on one or more sites where it is likely to be accessed by targets4. Users visit malicious website

5. Exploits are attempted against visitors. Delivery is often filtered by IP or other characteristics

6. Initial foothold malware is delivered to the victim

Site

s of In

tere

stUser Visits

CompromisedSite

Exploit used to deliver initial

foothold malware

Strategic Web Compromise (SWC)

Identify Vulnerable Site & Place

Exploit

Scans website for available vulnerabilities

Deploys chinachopper shell

Adversary can now try to escalate privileges, dump passwords and move laterally in internal network

Identifies Struts with unpatched vulnerabilities

Exploiting weakness

• Exploitation of architecture and configuration vulnerabilities – just as effective– just as devastating– harder to detect

• Use available tools instead of malware– Steal credentials– Use existing administration tools

• Malware removed after initial intrusion compromises credentials

Credential abuse

No malware? No Problem

TG-0416

“Transport rule found on server that blind copies any messages with ?CMS?, ?pw?, ?pwd?, ?pass? or ?password? in the body or subject of an email on server XYZ to email account company2014@outlook.com”

Living off the Land

Current State of Affairs

How victims learned of targeted intrusions across their organizations:

60% Third party detected adversary tradecraft

28%12%

Notified by law enforcement or government entity

Staff discovered threat actor activity

Source: Targeted Threat Responses Jan 2015 – Sept 2015

50%In half of of targeted intrusions, the entry point of the threat actors was undetermined

100%In all intrusions, threat actors “lived off the land” using stolen credentials and native tools to achieve their mission

• Next Generation Toolsets provide only limited value. Tools need to be updated with the latest Threat intelligence, continually monitored, and run by trained professionals.

The industry’s definition of defeat is different from our adversary's definition of winning.

XLSTrojan

Comfoo Trojan

Sajdela Trojan

Chinese Infostealer Blue Butterfly Lingbo

Dynamer

Targeted-CG

Orsam

Leouncia

Huntah

Poison Ivy

Bifrose

Hupigon

PcClient

gh0st

Wkysol

ZWShell

Mswab

Mirage

Wykcores

Hydraq

Whitewell

Werchan

Foxjmp

Sanshell

Lostmin

Pirp

httpBrowser

And many more…

Malware doesn’t matter…the adversaries simply don’t care

骑驴找马

• Endpoint security controls fail– AV fails– Whitelisting fails– Novel malware persistence mechanisms

› DLL Side Loading› DLL Search Order Hijack› Binary modification

– Memory based exploits– Rootkits– Even exploitation of the security software itself!

• Network controls fail– Encrypted binary protocols over HTTP– Use of common ports and protocols– Frequently burning infrastructure– Use of public services for C2 and exfil

• Log analysis detections fail

• Mobile Machine Learning Clouds of Advanced Malware Protection fail too!

But I have a magic mobile machine learning cloud of advanced malware protection

Adaptable Persistent Threat

• Not a thing, a who

• Think project management…– Adversary has already planned for most

common defenses and responses– Setbacks trigger planning or strategy shifts, not

abandon

• Plan to fail…– History teaches us that controls fail– Endpoint controls fail– Network controls fail– Log and SIEM analytics fail

How do we win?

Reduce time to detect advanced threat actor activity and reduce effort to respondto their operations

Lots of oppourtunity

We win by disrupting the threat actors before they complete their mission of data exfiltration

~1 month before data loss begins

~2 weeks to data exfiltration

~6 weeks before the threat actors win

I.N.T.E.L.L.I.G.E.N.C.E.

Architecture Affects Visibility

627732;10Mar2015;3:58:15;a.a.a.a;log;vpnroute;;External;inbound;VPN-1 & FireWall-1;;chkma;Network;4;{00000000-0000-0000-0000-000000000000};EPC RULE;MSTerminalServices;x.x.x.17;y.y.y.136;tcp;;;;;3389;2913;;;IKE;ESP: 3DES + MD5 + DEFLATE;x.x.x.17;;;ACMEAPT_Access;VPN-1;VPN;;;;;;;;;;;;;;;;;compromisedusername;;;;;;;;;{11111111-1111-1111-1111-111111111111};IKE;ESP: AES-128 + MD5;38.109.75.18;;;ACMEAPT_Internal;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

How do you win?(The first 6 hours)

• Prevent the exploit

• Detect the malware execution

• Prevent or Monitor the malware execution

Detect potential danger early

DNS Telemetry

Internal name server

.com Root name server

foo.com authoritative name server

Request: A record evil.foo.com

Request: NS record foo.com

Request: A record evil.foo.com

NS Response

A Record Response

A Record

Response

IDS/IPS strategic and tactical detection

How do you win?(The first 6 hours)

• Credential use

• Lateral movement technique

• Execution

06zz.yy:28:01.727 06zz.yy:28:04.703 6 192.168.x.y 0 17 192.168.a.b 2048 1 0 4 24006zz.yy:28:01.759 06zz.yy:28:04.735 16 192.168.a.b 0 6 192.168.x.y 0 1 0 4 24006zz.yy:28:14.199 06zz.yy:28:14.359 6 192.168.x.y 56639 17 192.168.a.b 445 6 6 7 145606zz.yy:28:14.231 06zz.yy:28:14.359 16 192.168.a.b 445 6 192.168.x.y 56639 6 2 5 119806zz.yy:28:16.611 06zz.yy:28:17.667 6 192.168.x.y 56640 17 192.168.a.b 80 6 2 3 20006zz.yy:28:16.643 06zz.yy:28:17.699 16 192.168.a.b 80 6 192.168.x.y 56640 6 4 3 12006zz.yy:28:44.258 06zz.yy:29:23.330 16 192.168.a.b 445 6 192.168.x.y 56644 6 2 128 1073506zz.yy:28:44.258 06zz.yy:29:23.522 6 192.168.x.y 56644 17 192.168.a.b 445 6 2 221 27406606zz.yy:29:56.517 06zz.yy:29:56.837 6 192.168.x.y 56644 17 192.168.a.b 445 6 0 6 111506zz.yy:29:56.549 06zz.yy:29:56.645 16 192.168.a.b 445 6 192.168.x.y 56644 6 0 5 94806zz.yy:30:13.845 06zz.yy:30:13.909 6 192.168.x.y 56644 17 192.168.a.b 445 6 4 3 26406zz.yy:30:13.877 06zz.yy:30:13.909 16 192.168.a.b 445 6 192.168.x.y 56644 6 0 2 224

Internal netflow: What lateral movement looks like

How do you win?

• Tactical and Strategic detection of webshells

Internal netflow: What network exploration looks like06xx.yy:22:17.523 06xx.yy:22:17.523 6 192.168.x.y 60616 17 192.168.1.0 137 17 0 1 7806xx.yy:22:17.523 06xx.yy:22:17.523 6 192.168.x.y 60616 17 192.168.1.1 137 17 0 1 7806xx.yy:22:17.523 06xx.yy:22:17.523 6 192.168.x.y 60616 17 192.168.1.2 137 17 0 1 7806xx.yy:22:17.555 06xx.yy:22:17.555 6 192.168.x.y 60616 17 192.168.1.3 137 17 0 1 7806xx.yy:22:17.555 06xx.yy:22:17.555 6 192.168.x.y 60616 17 192.168.1.4 137 17 0 1 7806xx.yy:22:17.555 06xx.yy:22:17.555 6 192.168.x.y 60616 17 192.168.1.5 137 17 0 1 7806xx.yy:22:17.587 06xx.yy:22:17.587 6 192.168.x.y 60616 17 192.168.1.6 137 17 0 1 7806xx.yy:22:17.587 06xx.yy:22:17.587 6 192.168.x.y 60616 17 192.168.1.7 137 17 0 1 7806xx.yy:22:17.587 06xx.yy:22:17.587 6 192.168.x.y 60616 17 192.168.1.8 137 17 0 1 7806xx.yy:22:17.619 06xx.yy:22:17.619 6 192.168.x.y 60616 17 192.168.1.10 137 17 0 1 7806xx.yy:22:17.619 06xx.yy:22:17.619 6 192.168.x.y 60616 17 192.168.1.11 137 17 0 1 78

(more or less sequentially mapping the environment)

06xx.yy:42:45.159 06xx.yy:42:49.159 9 192.168.x.y 60616 0 192.168.253.78 137 17 0 1 7806xx.yy:42:45.159 06xx.yy:42:49.159 9 192.168.x.y 60616 0 192.168.253.79 137 17 0 1 7806xx.yy:42:45.167 06xx.yy:42:49.171 9 192.168.x.y 60616 0 192.168.253.80 137 17 0 1 7806xx.yy:42:45.179 06xx.yy:42:49.179 9 192.168.x.y 60616 0 192.168.253.81 137 17 0 1 7806xx.yy:42:45.191 06xx.yy:42:49.191 9 192.168.x.y 60616 0 192.168.253.82 137 17 0 1 7806xx.yy:42:47.063 06xx.yy:42:47.063 9 192.168.x.y 60616 0 192.168.253.255 137 17 0 1 78

Scanned ~65k IPs in rapid succession…

How do you win?

• Without significant tripwires, data exfiltration of sensitive intellectual property occurred in 6 weeks

• With proper visibility, the threat actors could have been detected at least 6 different ways within the first 6 hours of the intrusion

Placeholder:iSensor Slide Showing China Chopper Commands

Exfil

• Top talkers

• Outbound flows

• Firewall/Proxy monitoring

Redefine winning

Redefine winning

The optimal security continuum

Threat Intelligence

People Process

Technology

Context to answer the questions that matter

What is it? Is it really a threat?Did it succeed? What happened next?

Who was behind it? What are their intentions?Did they achieve their objectives yet?

How did they get in, where are they, how do I get them out and prevent them from winning?

What should I do next?

Intelligence on threat actors

Ability to collect telemetry and apply that intelligencein the network and at the endpoint

Analytics beyond malware and signatures

Who has the first question?

Thanks!