• Home

  • Documents

  • Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching...
36
Threat Hunting with BSidesLux 2018 - Xavier Mertens 1

Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

  • Upload
    others

  • View
    4

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Threat Huntingwith

BSidesLux 2018 - Xavier Mertens

1

Page 2: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

<profile> <name>Xavier Mertens</name> <nick>xme</nick> <jobs> <day>Cyber Security Freelance</day> <night>Blogger, ISC Handler, Hacker</night> </jobs> <![CDATA[ https://xavier.mertens.consulting https://blog.rootshell.be https://isc.sans.edu https://www.brucon.org ]]></profile>

Followme!

2

Page 3: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Blue + Red = Purple

3

Page 4: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Threat Hunting 101

4

“The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security solutions.”

Thank you Wikipedia :)

Page 5: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Threat Hunting 101

5

It does not resume to searching for IOC’s…

… but it’s a good first step!

Page 6: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Threat Hunting 101

6

It is based on tools

… but also processes!

Page 7: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Threat Hunting 101

7

Use cases are key!

Read: Focus on what is important to detect for you!

Page 8: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

8 8

Who knows OSSEC?

Page 9: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

OSSEC 101

9

Page 10: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

OSSEC 101

10

Client - Server based (agents) UNIX | Windows | MacOS Log collection & analysis Syscheck (FIM) Rootcheck Interaction with 3rd party tools Active-Response Console tools only(*) Server running on UNIX only Docker available

(*) Alternative web frontends available like Wazuh (https://wazuh.com/)

https://wazuh.com/
Page 11: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

OSSEC 101

11

$ tree /var/ossec -L 1 /var/ossec |-- active-response |-- agentless |-- bin |-- etc |-- lists |-- logs |-- queue |-- rules |-- stats |-- tmp `-- var

Page 12: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Your Mission…

12

Let’s see how we can configure OSSEC with the help of third party tools / data to

detect suspicious activities on a host

Page 13: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Your Mission…

13

Suspicious DNS activity Suspicious files Suspicious processes

Expected time per lab: 20 minutes

Page 14: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Online Lab

14

• Each students has his/her Amazon EC2 host • Write your name on the paper sheet • Connect to your instance • Do NOT misuse or connect to other hosts!

Requirements: Internet connectivity and a SSH client

Some UNIX command line Fu!

Page 15: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Online Lab

15

ssh student@<your-IP-address> Password: BS1desLux

Root access: sudo -s

Page 16: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Up to You!

16

Page 17: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Lab #1

17

Detecting infected hosts trying to contact their C2 server

Monitoring of DNS traffic is a gold mine to spot infected computers!

Page 18: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Lab #1

18

OSSEC can use ‘lists’ to query any fields from rules

<rule id="99002" level="10"> <decoded_as>bind9</decoded_as> <list field="url">lists/baddomains</list> <description> DNS query for malicious domain! </description> </rule>

Page 19: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Lab #3

19

Which domains to search for?http://mirror1.malwaredomains.com/files/justdomains

Page 20: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Lab #1

20

# cd /home/student/lab1 # more README.txt

Page 21: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Up to You!

21

Page 22: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Lab #2

22

Detecting suspicious files

Suspicious or unknown files on a file system might indicate that a system has been

compromized!

Page 23: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Lab #2

23

OSSEC has a feature called ‘rootcheck’ to detect potential rootkits.

Page 24: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Lab #2

24

Let’s grab a list of bad files from a MISP instance and feed OSSEC!

# ./mof.py -t 15d -o /var/ossec/etc/shared/myfiles.txt

Source: https://raw.githubusercontent.com/xme/toolbox/master/mof.py

https://raw.githubusercontent.com/xme/toolbox/master/mof.py
Page 25: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Lab #2

25

cd /home/student/lab2

Page 26: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Up to You!

26

Page 27: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Lab #3

27

Detecting running suspicious processes

Unknown processes running on a host are usually bad signals.

It may indicate a compromised host by a trojan, a RAT or a cryptominer…

Page 28: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Lab #3

28

OSSEC has a feature to monitor output from scripts:

<localfile> <log_format>command</log_format> <command>df -P</command> </localfile>

Page 29: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Lab #3

29

Let’s grab a list of running processes and compare them with a list of “bad” ones

<localfile> <log_format>full_command</log_format> <command>find /proc -name comm -exec cat "{}" \; \ 2>/dev/null |sort -u</command> <frequency>180</frequency> </localfile>

Page 30: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Lab #3

30

What to search for?

AnXqV.yam BI5zj Carbon Duck.sh Guard.sh JnKihGjn KGlJwfWDbCPnvwEJupeivI1FXsSptuyh NXLAi XJnRj accounts-daemon acpid askdljlqw atd bonn.sh bonns carbon conn.sh conns crypto-pool ddg donns gekoCrw gekoCrw32 ir29xc1 irpbalanc1 jIuc2ggfCAvYmluL2Jhc2gi jaav jva kw.sh kworker34 kxjd lexarbalanc1 lower.sh lowerv2.sh lowerv3.sh minerd minergate minergate-cli minexmr mixnerdx mule mutex myatd performedl polkitd pro.sh pubg pvv root.sh rootv2.sh rootv3.sh servcesa sourplum stratum vsp watch-smart ysaydh AnXqV.yam BI5zj Carbon Duck.sh Guard.sh JnKihGjn KGlJwfWDbCPnvwEJupeivI1FXsSptuyh NXLAi XJnRj accounts-daemon acpid askdljlqw atd bb bonn.sh bonns carbon conn.sh conns crypto-pool ddg donns gekoCrw gekoCrw32 gekoba2anc1 gekoba5xnc1 gekobalanc1 gekobalance gekobalanq1 gekobnc1 ir29xc1 irpbalanc1 irqba2anc1 irqba5xnc1 irqbalance irqbnc1 jIuc2ggfCAvYmluL2Jhc2gi jaav jva kw.sh kworker34 kxjd lexarbalanc1 lower.sh lowerv2.sh lowerv3.sh minerd minergate minergate-cli minexmr mixnerdx mule mutex myatd performedl polkitd pro.sh pubg pvv servcesa sourplum stratum tratum vsp watch-smart wget yam ysaydh

Source: https://isc.sans.edu/forums/diary/Crypto+Mining+Is+More+Popular+Than+Ever/24050/

Page 31: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Lab #3

31

cd /home/student/lab3

Page 32: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Up to You!

32

Page 33: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Wrap-Up

33

Open source tools to the rescue! Use free data sources for IOCs Know your infrastructure! Be proactive!

Page 34: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

About Alerts

34

Local log files JSON (ELK, Splunk, …) Email notifications Syslog (CEF)

Page 35: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

Want more?

35

<self_promotion> A 2-days training is scheduled at DeepSec on this topic </self_promotion>

More info: https://deepsec.net/speaker.html#WSLOT378

https://deepsec.net/speaker.html#WSLOT378
Page 36: Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security

36

10:55:17.578190 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4 (0x0800), \ length 77: 127.0.0.1.38048 > 127.0.0.1.7777: Flags [P.], seq 1:12, ack 1, \ win 342, options [nop,nop,TS val 1437796971 ecr 1437795587], length 11 0x0000: 4500 003f 189c 4000 4006 241b 7f00 0001 E..?..@.@.$..... 0x0010: 7f00 0001 94a0 1e61 97cd 1d9a b8d8 37b8 .......a......7. 0x0020: 8018 0156 fe33 0000 0101 080a 55b3 0a6b ...V.3......U..k

0x0030: 55b3 0503 5468 616e 6b20 596f 7521 0a U...Thank.You!.

@xme | [email protected]


Threat Hunting - csirt.jabarprov.go.id

Threat Hunting - csirt.jabarprov.go.id

Documents
ATT&CKing The Command Line & Hunting For More...Threat Hunting Automation Motivation Current Reality Threat hunting used to detect activity we are currently missing. As defenders,

ATT&CKing The Command Line & Hunting For More...Threat Hunting Automation Motivation Current Reality Threat hunting used to detect activity we are currently missing. As defenders,

Documents
SQRRL threat hunting platform

SQRRL threat hunting platform

Technology
GUIDE TO CYBER THREAT HUNTING - Tyler Technologies

GUIDE TO CYBER THREAT HUNTING - Tyler Technologies

Documents
Industrial Control System Cyber Threat Hunting

Industrial Control System Cyber Threat Hunting

Documents
2020 THREAT HUNTING REPORT - ExtraHop

2020 THREAT HUNTING REPORT - ExtraHop

Documents
Your Practical Guide to 1 – Setting up your threat hunting program Hunt Evil: Your Practical Guide to Threat Hunting 5 3 Common Myths About Hunting Hunting is not a reactive activity

Your Practical Guide to 1 – Setting up your threat hunting program Hunt Evil: Your Practical Guide to Threat Hunting 5 3 Common Myths About Hunting Hunting is not a reactive activity

Documents
Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Documents
Supercharging SOAR Solutions With Threat Intelligence · Threat Hunting. Proactively and iteratively search through your organization’s networks to detect and isolate advanced and

Supercharging SOAR Solutions With Threat Intelligence · Threat Hunting. Proactively and iteratively search through your organization’s networks to detect and isolate advanced and

Documents
Hands-on Learning Experiences for Cyber Threat Hunting Education · Cyber Hunting • Cyber threat hunting has emerged as a critical part of cyber security practice. However, –

Hands-on Learning Experiences for Cyber Threat Hunting Education · Cyber Hunting • Cyber threat hunting has emerged as a critical part of cyber security practice. However, –

Documents
Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION [email protected]. ... to put new

Documents
Workshop threat-hunting

Workshop threat-hunting

Data & Analytics
Threat hunting as SOC process

Threat hunting as SOC process

Technology
Threat Hunting in Windows – Are You Hunting or Being Hunted?

Threat Hunting in Windows – Are You Hunting or Being Hunted?

Software
Towards a Threat Hunting Automation Maturity Model

Towards a Threat Hunting Automation Maturity Model

Technology
THREAT HUNTING- IOCs VS TTPs- Happiest Minds

THREAT HUNTING- IOCs VS TTPs- Happiest Minds

Documents
Threat hunting with MITRE ATT&CK

Threat hunting with MITRE ATT&CK

Documents
Threat Hunting with Splunk

Threat Hunting with Splunk

Technology
(CMC THREAT HUNTING SERVICE)

(CMC THREAT HUNTING SERVICE)

Documents
Threat Hunting Guide - Broadcom Inc

Threat Hunting Guide - Broadcom Inc

Documents
Threat Hunting Using a Machine Learning Approach

Threat Hunting Using a Machine Learning Approach

Documents
Endgame SANS - Threat Hunting Before the Incident

Endgame SANS - Threat Hunting Before the Incident

Documents
DEMYSTIFYING THREAT HUNTING · 2021. 1. 26. · We wanted to clear up the confusion. Demystifying Threat Hunting will explain: • What threat hunting is – and what it isn’t

DEMYSTIFYING THREAT HUNTING · 2021. 1. 26. · We wanted to clear up the confusion. Demystifying Threat Hunting will explain: • What threat hunting is – and what it isn’t

Documents
Building a Successful Threat Hunting Program

Building a Successful Threat Hunting Program

Technology
Threat Hunting

Threat Hunting

Internet
Threat Hunting with Splunk Hands-on

Threat Hunting with Splunk Hands-on

Technology
Introduction into Threat Hunting - Sri Lanka CERT|CC · What is Threat Hunting Cyber threat hunting is an active cyber defence activity. It is "the process of proactively and iteratively

Introduction into Threat Hunting - Sri Lanka CERT|CC · What is Threat Hunting Cyber threat hunting is an active cyber defence activity. It is "the process of proactively and iteratively

Documents
TTPs for Threat Hunting in Refineries · TTPs for Threat Hunting in Refineries Dan Gunter | Twitter: @dan_gunter Principal Threat Analyst @ Dragos October 2018. ... •Not Red Teaming

TTPs for Threat Hunting in Refineries · TTPs for Threat Hunting in Refineries Dan Gunter | Twitter: @dan_gunter Principal Threat Analyst @ Dragos October 2018. ... •Not Red Teaming

Documents
The awakening of cyber threat hunting: Intelligence

The awakening of cyber threat hunting: Intelligence

Documents
Proactive Threat Hunting Combining the use of …Proactive Threat Hunting Combining the use of threat intelligence, analytics and automated security tools with human smarts Benefits

Proactive Threat Hunting Combining the use of …Proactive Threat Hunting Combining the use of threat intelligence, analytics and automated security tools with human smarts Benefits

Documents