Building Better Indicators: Crowdsourcing Malware IOCs© Copyright 2015 PhishMe, Inc. All rights...

Building Better Indicators: Crowdsourcing Malware IOCs

Sean Wilson Researcher

Researcher @ Phishme Reverse Engineer Incident Responder Twitter: @seanmw flyfishing++;

About me

Building Indicators

Analysis Discovery Development

CrowdSource

Warning: OPSEC!

The Problem •  Small teams rely on host and network AV for information

about threats. •  These alerts are often quite generic and don’t provide

much information other than: ‘Bad has happened…but don’t worry we got it!’

Scenario

Scenario 1a

Triage

Malware Triage

Triage: We Got This!

Recon Weaponization Delivery Exploitation Installation C2 Activity

Detection

Scenario 1b

Recon Weaponization Delivery Exploitation Installation C2 Activity

Intrusion Kill Chain

Detection

What is it?

Trojan.Win32.Generic!BT

RDN/Generic.PUP.z

Trojan.Generic

Gen:Trojan.Heur

Artemis!12345

Sample Analysis

VirusTotal

Malwr Search

Overview

Network Activity

PassiveTotal

Discovery

Early Indicators

System Changes

Dynamic Properties

Static Properties

Google All the Things!

Netflix Scumblr

Trolling the garbage dump of the internet so you don’t have to

DFIR Scumblr Searches •  PassiveTotal •  Totalhash •  VirusTotal •  Malwr •  Cuckoo

Development

What properties are common across

samples?

Are my indicators matching new

(unknown) samples?

Dashboards!

Thanks! @seanmw

Images •  Icon made by Freepik from http://www.flaticon.com is licensed under CC BY 3.0

Building Better Indicators: Crowdsourcing Malware IOCs© Copyright 2015 PhishMe, Inc. All rights...

Documents

Managing IOCs with Local Filesystems - Welcome - Other Services/6... · | Los Alamos National Laboratory | Disadvantages of IOCs that boot from NFS The IOC cannot boot if the network

The NN-IOCS machine is gang tooled type of CNC Automatic

IOC Editor User Guide | Mandiant | FireEye© 2015 Mandiant, a FireEye Company. All rights reserved. 2 IOC Editor IOC Editor is a free editor for Indicators of Compromise (IOCs). IOCs

Honeycon2014: Mining IoCs from Honeypot data feeds

Ducky USB - Indicators of Compromise (IOCs)

CD C) Bedneyimages / Freepik o o CD · 2018. 4. 22. · CD C) Bedneyimages / Freepik o o CD . Title: Sentinelles.jpeg Created Date: 4/21/2018 4:59:54 AM

NOCs – IOCs Relationship Presentation

My Task List Pam Gurd October 31, 2007. O AK R IDGE N ATIONAL L ABORATORY U. S. D EPARTMENT OF E NERGY Title_date Overview HPRF IOCs Cryo IOCs Soft IOCs

$OVER FREEPIK COM - hackethal.info fileCreated Date: 11/17/2014 8:21:25 PM

Must Collect IOCs… Now What?!

Images Freepik - tablettesetpirouettes.com

NOCs–IOCs relationships

IOCS COURSE IN INTERNATIONAL USE...IOCS COURSE IN INTERNATIONAL USE The Spring 2015 edition of East-West Church & Ministry Report, pp. 8-9 reports on a major outreach programme emanating

Machine-Learning for IOCs validation

Credit: freepik - NSTDA

Socket-CAN Device Support for EPICS IOCsSocket-CAN Device Support for EPICS IOCs C. Burandt†, U. Bonnes, J. Enders, N. Pietralla Institut für Kernphysik, Technische Universität

Machine-Learning for IOCs validation - Marco Balduzzi · • Use machine-learning to validate IOCs collected from a high-interaction honeypot • Overcome the limitation of traditional

Background designed by Starline (for Freepik) & Illustrations … · 2018-10-31 · Background designed by Starline (for Freepik) & Illustrations designed by SilvaNatalia (for Freepik)

Home Security Giant ADT Tabs PhishMe for Phishing ...cofense.com/wp-content/uploads/2017/03/PhishMe-ADT-Case...America, ADT Security Services is synonymous with security. When it came

The Changing Relationship between NOCs and IOCs in the LNG