• Home

  • Documents

  • Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The...
38
Threat Hunting with © 2019 Xavier Mertens (PassTheSalt Edition) 1

Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

  • Upload
    others

  • View
    4

  • Download
    1

Embed Size (px)

Citation preview

Page 1: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Huntingwith

© 2019 Xavier Mertens (PassTheSalt Edition) 1

Page 2: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

<profile> <name>Xavier Mertens</name> <nick>xme</nick> <jobs> <day>Cyber Security Freelance</day> <night>Blogger, ISC Handler, Hacker</night> </jobs> <![CDATA[ https://xavier.mertens.consulting https://blog.rootshell.be https://isc.sans.edu https://www.brucon.org ]]></profile>

Followme!

2

Page 3: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Me ♥ OSSEC

3

• Daily usage of OSSEC to monitor my own infrastructure

• OSSEC Advocate • Performed customer’s projects based on OSSEC • My current instance has 5y of backlog (1.4B events :-) • First mention in a blog post: 2010 • Contributions to the project:

• CEF support • GeoIP support

Page 4: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Blue + Red = Purple

4

Page 5: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Hunting 101

5

“The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security solutions.”

Thank you Wikipedia :)

Page 6: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Hunting 101

6

It does not resume to searching for IOC’s…

… but it’s a good first step!

Page 7: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Hunting 101

7

It is based on tools

… but also processes!

Page 8: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Hunting 101

8

Use cases are key!

Read: Focus on what is important to detect for

you!

Page 9: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

IOC’s

9

• IP addresses • Domain names, FQDN • Hashes (MD5, SHA1, SHA256) • Users • User-Agent • Email addresses • Processes • Files • Mutexes • …

Page 10: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

IOC’s

10

<Any data valuable in your $ENV>

The value of an IOC is based on its context! (Quantity <> Quality)

Page 11: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

11 11

Who knows OSSEC?

Page 12: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

OSSEC 101

12

Page 13: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

OSSEC 101

13

Client - Server based (agents) UNIX | Windows | MacOS Log collection & analysis Syscheck (FIM) Rootcheck Interaction with 3rd party tools Active-Response Console tools only(*) Server running on UNIX only Docker available

(*) Alternative web frontends available like Wazuh (https://wazuh.com/)

https://wazuh.com/
Page 14: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

OSSEC 101

14

$ tree /var/ossec -L 1 /var/ossec |-- active-response |-- agentless |-- bin |-- etc |-- lists |-- logs |-- queue |-- rules |-- stats |-- tmp `-- var

Page 15: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Your Mission…

15

Let’s see how we can configure OSSEC with the help of third party tools / data to

detect suspicious activities on a host

Page 16: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Your Mission…

16

Suspicious DNS activity Suspicious files Suspicious processes

Expected time per lab: 20 minutes

Page 17: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Online Lab

17

• Each students has his/her Amazon EC2 host • Select an IP address on:

https://pad.xameco.net/p/ossecpts19 • Connect to your instance • Do NOT misuse or connect to other hosts!

Requirements: Internet connectivity and a SSH client

Some UNIX command line Fu!

https://pad.xameco.net/p/ossecpts19
Page 18: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Online Lab

18

ssh -p 443 student@<your-IP-address> Password: OSSECpts19

Root access: sudo -s

(Feel free to use your beloved editor/shell)

Page 19: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Up to You!

19

Page 20: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #1

20

Detecting infected hosts trying to contact their C2 server

Monitoring of DNS traffic is a gold mine to spot infected computers!

Page 21: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #1

21

OSSEC can use ‘lists’ to query any fields from rules

<rule id="99002" level="10"> <decoded_as>bind9</decoded_as> <list field="url">lists/baddomains</list> <description> DNS query for malicious domain! </description> </rule>

Page 22: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

22

Which domains to search for?http://mirror1.malwaredomains.com/files/justdomains

Page 23: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #1

23

# cd /home/student/lab1 # more README.txt

Page 24: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Up to You!

24

Page 25: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #2

25

Detecting suspicious files

Suspicious or unknown files on a file system might indicate that a system has been

compromized!

Page 26: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #2

26

OSSEC has a feature called ‘rootcheck’ to detect potential rootkits.

Page 27: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #2

27

Let’s grab a list of bad files from a MISP instance and feed OSSEC!

# ./mof.py -t 15d -o /var/ossec/etc/shared/myfiles.txt

Source: https://raw.githubusercontent.com/xme/toolbox/master/mof.py

https://raw.githubusercontent.com/xme/toolbox/master/mof.py
Page 28: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #2

28

# cd /home/student/lab2 # more README.txt

Page 29: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Up to You!

29

Page 30: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

30

Detecting running suspicious processes

Unknown processes running on a host are usually bad signals.

It may indicate a compromised host by a trojan, a RAT or a cryptominer…

Page 31: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

31

OSSEC has a feature to monitor output from scripts:

<localfile> <log_format>command</log_format> <command>df -P</command> </localfile>

Page 32: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

32

Let’s grab a list of running processes and compare them with a list of “bad” ones

<localfile> <log_format>full_command</log_format> <command>find /proc -name comm -exec cat "{}" \; \ 2>/dev/null |sort -u</command> <frequency>180</frequency> </localfile>

Page 33: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

33

What to search for?

AnXqV.yam BI5zj Carbon Duck.sh Guard.sh JnKihGjn KGlJwfWDbCPnvwEJupeivI1FXsSptuyh NXLAi XJnRj accounts-daemon acpid askdljlqw atd bonn.sh bonns carbon conn.sh conns crypto-pool ddg donns gekoCrw gekoCrw32 ir29xc1 irpbalanc1 jIuc2ggfCAvYmluL2Jhc2gi jaav jva kw.sh kworker34 kxjd lexarbalanc1 lower.sh lowerv2.sh lowerv3.sh minerd minergate minergate-cli minexmr mixnerdx mule mutex myatd performedl polkitd pro.sh pubg pvv root.sh rootv2.sh rootv3.sh servcesa sourplum stratum vsp watch-smart ysaydh AnXqV.yam BI5zj Carbon Duck.sh Guard.sh JnKihGjn KGlJwfWDbCPnvwEJupeivI1FXsSptuyh NXLAi XJnRj accounts-daemon acpid askdljlqw atd bb bonn.sh bonns carbon conn.sh conns crypto-pool ddg donns gekoCrw gekoCrw32 gekoba2anc1 gekoba5xnc1 gekobalanc1 gekobalance gekobalanq1 gekobnc1 ir29xc1 irpbalanc1 irqba2anc1 irqba5xnc1 irqbalance irqbnc1 jIuc2ggfCAvYmluL2Jhc2gi jaav jva kw.sh kworker34 kxjd lexarbalanc1 lower.sh lowerv2.sh lowerv3.sh minerd minergate minergate-cli minexmr mixnerdx mule mutex myatd performedl polkitd pro.sh pubg pvv servcesa sourplum stratum tratum vsp watch-smart wget yam ysaydh

Source: https://isc.sans.edu/forums/diary/Crypto+Mining+Is+More+Popular+Than+Ever/24050/

Page 34: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

34

# cd /home/student/lab3 # more README.txt

Page 35: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Up to You!

35

Page 36: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Wrap-Up

36

Open source tools to the rescue! Use free data sources for IOCs Know your infrastructure! Be proactive!

Page 37: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

About Alerts

37

Local log files JSON (ELK, Splunk, …) Email notifications Syslog (CEF)

Page 38: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

38

10:55:17.578190 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4 (0x0800), \ length 77: 127.0.0.1.38048 > 127.0.0.1.7777: Flags [P.], seq 1:12, ack 1, \ win 342, options [nop,nop,TS val 1437796971 ecr 1437795587], length 11 0x0000: 4500 003f 189c 4000 4006 241b 7f00 0001 E..?..@.@.$..... 0x0010: 7f00 0001 94a0 1e61 97cd 1d9a b8d8 37b8 .......a......7. 0x0020: 8018 0156 fe33 0000 0101 080a 55b3 0a6b ...V.3......U..k

0x0030: 55b3 0503 5468 616e 6b20 596f 7521 0a U...Thank.You!.

@xme | [email protected]


Threat Hunting

Threat Hunting

Internet
THREAT HUNTING- IOCs VS TTPs- Happiest Minds

THREAT HUNTING- IOCs VS TTPs- Happiest Minds

Documents
Kaspersky Threat Hunting · • Immediate protection against any detected threat through automatic antivirus database updates. • Retrospective analysis of incidents and threat hunting,

Kaspersky Threat Hunting · • Immediate protection against any detected threat through automatic antivirus database updates. • Retrospective analysis of incidents and threat hunting,

Documents
Bsides threat hunting

Bsides threat hunting

Technology
Threat hunting workshop

Threat hunting workshop

Technology
Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION [email protected]. ... to put new

Documents
Endgame SANS - Threat Hunting Before the Incident

Endgame SANS - Threat Hunting Before the Incident

Documents
Supercharging SOAR Solutions With Threat Intelligence · Threat Hunting. Proactively and iteratively search through your organization’s networks to detect and isolate advanced and

Supercharging SOAR Solutions With Threat Intelligence · Threat Hunting. Proactively and iteratively search through your organization’s networks to detect and isolate advanced and

Documents
Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Documents
Threat Hunting with Splunk Hands-on

Threat Hunting with Splunk Hands-on

Technology
Threat Hunting 102: Beyond the Basics

Threat Hunting 102: Beyond the Basics

Technology
Cyber Threat Hunting with Phirelight

Cyber Threat Hunting with Phirelight

Technology
IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

Documents
Developing an Adaptive Threat Hunting Solution: The

Developing an Adaptive Threat Hunting Solution: The

Documents
The Elastic Guide to Threat Hunting - copyright

The Elastic Guide to Threat Hunting - copyright

Documents
Introduction into Threat Hunting - Sri Lanka CERT|CC · What is Threat Hunting Cyber threat hunting is an active cyber defence activity. It is "the process of proactively and iteratively

Introduction into Threat Hunting - Sri Lanka CERT|CC · What is Threat Hunting Cyber threat hunting is an active cyber defence activity. It is "the process of proactively and iteratively

Documents
DEMYSTIFYING THREAT HUNTING · 2021. 1. 26. · We wanted to clear up the confusion. Demystifying Threat Hunting will explain: • What threat hunting is – and what it isn’t

DEMYSTIFYING THREAT HUNTING · 2021. 1. 26. · We wanted to clear up the confusion. Demystifying Threat Hunting will explain: • What threat hunting is – and what it isn’t

Documents
Enabling Efficient Cyber Threat Hunting with Cyber Threat

Enabling Efficient Cyber Threat Hunting with Cyber Threat

Documents
Examples and Goals of Threat Hunting - USALearning · Examples and Goals of Threat Hunting. ... //. ... and they need to answer questions

Examples and Goals of Threat Hunting - USALearning · Examples and Goals of Threat Hunting. ... //. ... and they need to answer questions

Documents
Threat hunting with MITRE ATT&CK

Threat hunting with MITRE ATT&CK

Documents
Automate Threat Intelligence Security Actions Using ... Phanto… · Threat Hunting | Proactively and iteratively search through networks to detect and isolate advanced threats that

Automate Threat Intelligence Security Actions Using ... Phanto… · Threat Hunting | Proactively and iteratively search through networks to detect and isolate advanced threats that

Documents
GUIDE TO CYBER THREAT HUNTING - Tyler Technologies

GUIDE TO CYBER THREAT HUNTING - Tyler Technologies

Documents
“Threat Hunting in Active Directory Environment”

“Threat Hunting in Active Directory Environment”

Documents
Threat Hunting in Windows – Are You Hunting or Being Hunted?

Threat Hunting in Windows – Are You Hunting or Being Hunted?

Software
Threat Hunting - csirt.jabarprov.go.id

Threat Hunting - csirt.jabarprov.go.id

Documents
Threat Hunting with Qualys€¦ · Threat Hunting with Qualys: Going Beyond Your EDR Solutions. Adversary Threat Tactics are Changing Early 2010s Zero ... Rapidly weaponizing newly-disclosed

Threat Hunting with Qualys€¦ · Threat Hunting with Qualys: Going Beyond Your EDR Solutions. Adversary Threat Tactics are Changing Early 2010s Zero ... Rapidly weaponizing newly-disclosed

Documents
Threat Hunting Report can be viewed here - News · THREAT HUNTING REPORT 3. THRET HNTING REPORT 4 KEY SURVEY FINDINGS ... Among the respondents to the threat hunting survey, six in

Threat Hunting Report can be viewed here - News · THREAT HUNTING REPORT 3. THRET HNTING REPORT 4 KEY SURVEY FINDINGS ... Among the respondents to the threat hunting survey, six in

Documents
Building a Successful Threat Hunting Program

Building a Successful Threat Hunting Program

Technology
TTPs for Threat Hunting in Refineries · TTPs for Threat Hunting in Refineries Dan Gunter | Twitter: @dan_gunter Principal Threat Analyst @ Dragos October 2018. ... •Not Red Teaming

TTPs for Threat Hunting in Refineries · TTPs for Threat Hunting in Refineries Dan Gunter | Twitter: @dan_gunter Principal Threat Analyst @ Dragos October 2018. ... •Not Red Teaming

Documents
Industrial Control System Cyber Threat Hunting

Industrial Control System Cyber Threat Hunting

Documents