Building Better Indicators: Crowdsourcing Malware IOCs© Copyright 2015 PhishMe, Inc. All rights reserved. Images • Icon made by Freepik from is licensed under CC BY 3.0 . Title:

© Copyright 2015 PhishMe, Inc. All rights reserved. © Copyright 2015 PhishMe, Inc. All rights reserved.

Building Better Indicators: Crowdsourcing Malware IOCs

Sean Wilson Researcher

© Copyright 2015 PhishMe, Inc. All rights reserved.

Researcher @ Phishme Reverse Engineer Incident Responder Twitter: @seanmw flyfishing++;

About me


Building Indicators

Analysis Discovery Development


CrowdSource


Warning: OPSEC!


The Problem •  Small teams rely on host and network AV for information

about threats. •  These alerts are often quite generic and don’t provide

much information other than: ‘Bad has happened…but don’t worry we got it!’


Scenario


Scenario 1a


Triage


Malware Triage


Triage: We Got This!

Recon Weaponization Delivery Exploitation Installation C2 Activity

Detection


Scenario 1b



Recon Weaponization Delivery Exploitation Installation C2 Activity

Intrusion Kill Chain

Detection


What is it?

Trojan.Win32.Generic!BT

RDN/Generic.PUP.z

Trojan.Generic

Gen:Trojan.Heur

Artemis!12345




Sample Analysis



VirusTotal



Malwr Search


Overview


Network Activity


PassiveTotal


Discovery

Early Indicators

System Changes

Dynamic Properties

Static Properties


Google All the Things!






Netflix Scumblr

Trolling the garbage dump of the internet so you don’t have to


DFIR Scumblr Searches •  PassiveTotal •  Totalhash •  VirusTotal •  Malwr •  Cuckoo






Development

What properties are common across

samples?

Are my indicators matching new

(unknown) samples?


Dashboards!


Thanks! @seanmw


Images •  Icon made by Freepik from http://www.flaticon.com is licensed under CC BY 3.0

Documents

Building Better Indicators: Crowdsourcing Malware IOCs© Copyright 2015 PhishMe, Inc. All rights reserved. Images • Icon made by Freepik from is licensed under CC BY 3.0 . Title: