Upload
tranmien
View
223
Download
7
Embed Size (px)
Citation preview
AGENDA
§ Me J§ Assume you are compromised
• Defenses fail. All the time.§ Be Proactive, Think Offense: Hunt!
• What is hunt• Hunt techniques• Benefits of hunt
§ Hunt vs. traditional IR§ Challenges of hunting and how to overcome§ Hunting best practices
ABOUT ME
§ Previous Experience§ 8 years within Federal Government
§ Hunt, Incident Response, Threat Research, etc.§ Currently
• Sr. Threat Research Engineer at Endgame· Analytics!!!
§ Me• Hockey• Weather• Penn State• …oh and tech
Hunting is the proactive, stealthy, and methodical pursuit and eviction of never-before-seen adversaries inside your network without relying on IOCs
HUNTING
§ Adversaries operate on your systems. They leave a trail• Understand what actions they take in the OS: chokepoints• Understand breadcrumbs they leave on and across systems: patterns and
anomalies.§ Gain the right visibility, collect the right data, analyze, detect, and respond
• Lock down systems while you’re doing it• Be stealthy
Today’s cycle isn’t working: prevention, detection, triage, response
TODAY’S REALITY
§ Prevention is important but will be bypassed§ Search and signature-based detection is way behind§ Often, notification is external§ Often, adversaries are already active while a known incident is closed
WHY DOES SIGNATURE DETECTION FAIL?§ On your network
• Encryption• Cloud services – staging, C2, exfiltration, blends in • Tailored and/or ephemeral attack infrastructure
§ On your endpoints • Polymorphism• Malware customization and diversification• Use of legitimate creds and admin tools
§ Assume compromise!• Someone else’s IOCs might not help you• Signatures won’t find everything and will not find what hasn’t been seen before
Attacks are changing and Unique
BE PROACTIVE, THINK OFFENSE
§ Adversaries are winning L§ You can’t afford to wait § Offensive, proactive discovery must be the response
• Search is necessary but insufficient• Look for techniques used by attackers• Look for patterns in the right data
Hunt within your networks, a.k.a Continuous IR
ADVERSARY HUNTING
Searching For IOCs• Detecting Known attacks• Hunters discover and pivot on
indicators
Waiting For An Alert• Reactive after compromise• IR is Late
Gathering Data • Is important but not enough• Need analysis and automation to
detect adversary
Hunting is not…
Confidential and Proprietary 8
Attacker Technique Focused• Signatures are brittle• Attacks are unique and tailored
Proactive• Hunt before an alert • Move from IR to proactive
adversary detection
Stealthy• Evade detection from
adversary• Hardened from adversary
Hunting is…
COMMON HUNT METHODS / TECHNIQUES
§ Indicator of Compromise (IOC)§ Network§ Endpoint§ Manual vs. scheduled vs. continuous§ Outliers/oddities vs. anomaly detection
INDICATOR HUNTING (SEARCHING)
§ What’s search good for?• Will help you react to an external notification• Will help you find well-known campaigns• Will help you consistently find unsophisticated threats• Will help you pivot on IOCs you find in your own network
· Determine the extent of an incident
§ Your hunt solution needs to facilitate search• Security muscle memory• But it needs to do much more
10
If you know what you are looking for it is not hunt, it is search
INDICATOR HUNTING (SEARCHING)
§ Where?•
11
If you know what you are looking for it is not hunt, it is search
HUNTING ON THE NETWORK
§ Network analytics often more noisy than on hosts, but still valuable• Best if you can tie to process
§ Listeners• What ports are listening only a few systems?• What processes have listening sockets on only a few systems?
§ DNS resolutions• What looks like it could be DGA?• What looks like it’s trying to masquerade as a real site?
§ Beaconing• What connections look like they could be malware beacons?
§ Same story – choose, collect, analyze, detect, respond
12
HUNTING ON THE NETWORK CONT.
§ Passive DNS• Monitor UDP Traffic (port 53)• Store -> Monitor -> HUNT
§ Apply to Fast Flux• Benign domains -> homogenous IP space• Malicious domains -> greater heterogeneity -> HUNT
§ DGA• Domains with abnormal lexicographical structure
· Also think about NXDOMAIN• Random forest classification tree with features:
· consonant-to-vowel ratio, longest consonant sequence, entropy, common ngrams with dictionary words, etc. (https://github.com/endgameinc/SANS_THIR16)
§ TCP vs PID• Which processes spawn generate network traffic?• Which ones are anomalous?
13
HUNTING ON ENDPOINTS§ Autoruns locations
• What’s persisting on only a few hosts?• What’s executing out of a strange location?
§ Running processes• What has a hash mismatch across hosts?• Which process has a loaded module not present on other systems?
§ Execution artifacts• What strange powershell commands have been run?• Where do I see unusual remote process executions?
§ Many other possibilities§ Choose what to hunt on, collect, analyze, detect, respond
14
HUNTING ON ENDPOINTS CONT.§ Yara
• Transfer Yara binary to target machine w/ native Windows functionality· PS> copy yara.exe \\TARGET-HOST\C$\TEMP\yara.exe
• Transfer rules· PS> copy rules.yara \\TARGET-HOST\C$\TEMP\rules.yara
• Execute scan w/ Invoke-Command· PS> Invoke-Command -ComputerName TARGET -ScriptBlock {
c:\TEMP\yara.exe c:\TEMP\rules.yara c:\targetdir } -credential USER§ Gotcha
• Highly dependent on rules, signature based L
15
HUNTING ON ENDPOINTS CONT.§ Autoruns
• Transfer binary (with msvcr100.DLL) to target machine w/ native Windows functionality· PS> copy autorunsc.exe \\TARGET-HOST\C$\TEMP\autorunsc.exe· PS> copy msvcr100.dll \\TARGET-HOST\C$\TEMP\msvcr100.dll
• Execute program w/ Invoke-Command (w/ optional output)· PS> Invoke-Command -ComputerName TARGET -ScriptBlock {
c:\TEMP\autorunsc.exe –a (??) –h (>> c:\TEMP\autoruns-output.txt) } -credential USER• Collect output
· PS> copy \\TARGET-HOST\C$\TEMP\autoruns-output.txt c:\directory§ Analysis
• Check hashes (e.g. VirusTotal)• Compare host to hash (e.g. cat hash-map.txt | cut -d’:’-f2 > hashes.txt)• Locations (e.g. startup in C:\Temp, uh oh)
16
BENEFITS OF HUNT
§ Reduce dwell time before discovery è Reduced costs• Shorter dwell time usually means reduced incident complexity• Shorter dwell time usually means less loss or damage
§ Break the cycle of reactivity§ Build new security muscle memory
• By continuous hunting, one gains an ability to see and react to patterns and anomalies
“Organizations that proactively work to discover incidents — ‘hunt’ for them — have a better chance of finding them and effectively reducing their impact” Gartner 2016
HUNT AND INCIDENT RESPONSE
§ Very similar methods and skills required§ Similar tools and techniques§ Assume breach and find it vs known starting point
• Steps from there are remarkably similar.
§ Don’t wait for the incident. Go find it.• IR teams can be the hunters• Consider hunting
18
HUNTING CHALLENGES
• Hiding from the adversary
• Strong anti-tampering to prevent detection gaps
Lack of Resources
Drowning in Data
Tipping off the Adversary
• Knowing where to look for the problem
• Search is not enough• Automating analysis
at scale
• Process• People • Technology
ENDGAME : ADVANTAGES
Confidential and Proprietary
Detects never-before-seen attacks
IOC INDEPENDENTPROTECTION
Enables zero business disruption
Prevents adversary disruption
STEALTHOPERATIONS
PRECISION RESPONSE
Transforms hunt, IR and SOC teams
HUNTAUTOMATION
20Endgame protects at earliest and all phases of kill chain
SUMMARY
§ The current detection and IR cycle doesn’t work§ Transform the IR cycle into a Hunt cycle§ Start hunting now§ Automate, automate, automate
21