Top Banner
Threat Hunting with © 2019 Xavier Mertens (PassTheSalt Edition) 1
38

Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

May 21, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Huntingwith

© 2019 Xavier Mertens (PassTheSalt Edition) 1

Page 2: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

<profile> <name>Xavier Mertens</name> <nick>xme</nick> <jobs> <day>Cyber Security Freelance</day> <night>Blogger, ISC Handler, Hacker</night> </jobs> <![CDATA[ https://xavier.mertens.consulting https://blog.rootshell.be https://isc.sans.edu https://www.brucon.org ]]></profile>

Followme!

2

Page 3: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Me ♥ OSSEC

3

• Daily usage of OSSEC to monitor my own infrastructure

• OSSEC Advocate • Performed customer’s projects based on OSSEC • My current instance has 5y of backlog (1.4B events :-) • First mention in a blog post: 2010 • Contributions to the project:

• CEF support • GeoIP support

Page 4: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Blue + Red = Purple

4

Page 5: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Hunting 101

5

“The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security solutions.”

Thank you Wikipedia :)

Page 6: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Hunting 101

6

It does not resume to searching for IOC’s…

… but it’s a good first step!

Page 7: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Hunting 101

7

It is based on tools

… but also processes!

Page 8: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Hunting 101

8

Use cases are key!

Read: Focus on what is important to detect for

you!

Page 9: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

IOC’s

9

• IP addresses • Domain names, FQDN • Hashes (MD5, SHA1, SHA256) • Users • User-Agent • Email addresses • Processes • Files • Mutexes • …

Page 10: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

IOC’s

10

<Any data valuable in your $ENV>

The value of an IOC is based on its context! (Quantity <> Quality)

Page 11: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

11 11

Who knows OSSEC?

Page 12: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

OSSEC 101

12

Page 13: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

OSSEC 101

13

Client - Server based (agents) UNIX | Windows | MacOS Log collection & analysis Syscheck (FIM) Rootcheck Interaction with 3rd party tools Active-Response Console tools only(*) Server running on UNIX only Docker available

(*) Alternative web frontends available like Wazuh (https://wazuh.com/)

https://wazuh.com/
Page 14: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

OSSEC 101

14

$ tree /var/ossec -L 1 /var/ossec |-- active-response |-- agentless |-- bin |-- etc |-- lists |-- logs |-- queue |-- rules |-- stats |-- tmp `-- var

Page 15: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Your Mission…

15

Let’s see how we can configure OSSEC with the help of third party tools / data to

detect suspicious activities on a host

Page 16: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Your Mission…

16

Suspicious DNS activity Suspicious files Suspicious processes

Expected time per lab: 20 minutes

Page 17: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Online Lab

17

• Each students has his/her Amazon EC2 host • Select an IP address on:

https://pad.xameco.net/p/ossecpts19 • Connect to your instance • Do NOT misuse or connect to other hosts!

Requirements: Internet connectivity and a SSH client

Some UNIX command line Fu!

https://pad.xameco.net/p/ossecpts19
Page 18: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Online Lab

18

ssh -p 443 student@<your-IP-address> Password: OSSECpts19

Root access: sudo -s

(Feel free to use your beloved editor/shell)

Page 19: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Up to You!

19

Page 20: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #1

20

Detecting infected hosts trying to contact their C2 server

Monitoring of DNS traffic is a gold mine to spot infected computers!

Page 21: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #1

21

OSSEC can use ‘lists’ to query any fields from rules

<rule id="99002" level="10"> <decoded_as>bind9</decoded_as> <list field="url">lists/baddomains</list> <description> DNS query for malicious domain! </description> </rule>

Page 22: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

22

Which domains to search for?http://mirror1.malwaredomains.com/files/justdomains

Page 23: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #1

23

# cd /home/student/lab1 # more README.txt

Page 24: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Up to You!

24

Page 25: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #2

25

Detecting suspicious files

Suspicious or unknown files on a file system might indicate that a system has been

compromized!

Page 26: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #2

26

OSSEC has a feature called ‘rootcheck’ to detect potential rootkits.

Page 27: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #2

27

Let’s grab a list of bad files from a MISP instance and feed OSSEC!

# ./mof.py -t 15d -o /var/ossec/etc/shared/myfiles.txt

Source: https://raw.githubusercontent.com/xme/toolbox/master/mof.py

https://raw.githubusercontent.com/xme/toolbox/master/mof.py
Page 28: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #2

28

# cd /home/student/lab2 # more README.txt

Page 29: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Up to You!

29

Page 30: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

30

Detecting running suspicious processes

Unknown processes running on a host are usually bad signals.

It may indicate a compromised host by a trojan, a RAT or a cryptominer…

Page 31: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

31

OSSEC has a feature to monitor output from scripts:

<localfile> <log_format>command</log_format> <command>df -P</command> </localfile>

Page 32: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

32

Let’s grab a list of running processes and compare them with a list of “bad” ones

<localfile> <log_format>full_command</log_format> <command>find /proc -name comm -exec cat "{}" \; \ 2>/dev/null |sort -u</command> <frequency>180</frequency> </localfile>

Page 33: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

33

What to search for?

AnXqV.yam BI5zj Carbon Duck.sh Guard.sh JnKihGjn KGlJwfWDbCPnvwEJupeivI1FXsSptuyh NXLAi XJnRj accounts-daemon acpid askdljlqw atd bonn.sh bonns carbon conn.sh conns crypto-pool ddg donns gekoCrw gekoCrw32 ir29xc1 irpbalanc1 jIuc2ggfCAvYmluL2Jhc2gi jaav jva kw.sh kworker34 kxjd lexarbalanc1 lower.sh lowerv2.sh lowerv3.sh minerd minergate minergate-cli minexmr mixnerdx mule mutex myatd performedl polkitd pro.sh pubg pvv root.sh rootv2.sh rootv3.sh servcesa sourplum stratum vsp watch-smart ysaydh AnXqV.yam BI5zj Carbon Duck.sh Guard.sh JnKihGjn KGlJwfWDbCPnvwEJupeivI1FXsSptuyh NXLAi XJnRj accounts-daemon acpid askdljlqw atd bb bonn.sh bonns carbon conn.sh conns crypto-pool ddg donns gekoCrw gekoCrw32 gekoba2anc1 gekoba5xnc1 gekobalanc1 gekobalance gekobalanq1 gekobnc1 ir29xc1 irpbalanc1 irqba2anc1 irqba5xnc1 irqbalance irqbnc1 jIuc2ggfCAvYmluL2Jhc2gi jaav jva kw.sh kworker34 kxjd lexarbalanc1 lower.sh lowerv2.sh lowerv3.sh minerd minergate minergate-cli minexmr mixnerdx mule mutex myatd performedl polkitd pro.sh pubg pvv servcesa sourplum stratum tratum vsp watch-smart wget yam ysaydh

Source: https://isc.sans.edu/forums/diary/Crypto+Mining+Is+More+Popular+Than+Ever/24050/

Page 34: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

34

# cd /home/student/lab3 # more README.txt

Page 35: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Up to You!

35

Page 36: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Wrap-Up

36

Open source tools to the rescue! Use free data sources for IOCs Know your infrastructure! Be proactive!

Page 37: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

About Alerts

37

Local log files JSON (ELK, Splunk, …) Email notifications Syslog (CEF)

Page 38: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

38

10:55:17.578190 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4 (0x0800), \ length 77: 127.0.0.1.38048 > 127.0.0.1.7777: Flags [P.], seq 1:12, ack 1, \ win 342, options [nop,nop,TS val 1437796971 ecr 1437795587], length 11 0x0000: 4500 003f 189c 4000 4006 241b 7f00 0001 E..?..@.@.$..... 0x0010: 7f00 0001 94a0 1e61 97cd 1d9a b8d8 37b8 .......a......7. 0x0020: 8018 0156 fe33 0000 0101 080a 55b3 0a6b ...V.3......U..k

0x0030: 55b3 0503 5468 616e 6b20 596f 7521 0a U...Thank.You!.

@xme | [email protected]


Related Documents
Threat Hunting 102: Beyond the Basics

Threat Hunting 102: Beyond the Basics

Category: Technology
Building a Successful Threat Hunting Program

Building a Successful Threat Hunting Program

Category: Technology
ATT&CKing The Command Line & Hunting For More...Threat Hunting Automation Motivation Current Reality Threat hunting used to detect activity we are currently missing. As defenders,

ATT&CKing The Command Line & Hunting For More...Threat...

Category: Documents
Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

Hunting Threat Actors with TLS Certificates · HUNTING...

Category: Documents
Cyber Threat Hunting with Phirelight

Cyber Threat Hunting with Phirelight

Category: Technology
GUIDE TO CYBER THREAT HUNTING - Tyler Technologies

GUIDE TO CYBER THREAT HUNTING - Tyler Technologies

Category: Documents
Threat Hunting

Threat Hunting

Category: Internet
Industrial Control System Cyber Threat Hunting

Industrial Control System Cyber Threat Hunting

Category: Documents
Enabling Efficient Cyber Threat Hunting with Cyber Threat ...

Enabling Efficient Cyber Threat Hunting with Cyber Threat...

Category: Documents
Automate Threat Intelligence Security Actions Using ... Phanto… · Threat Hunting | Proactively and iteratively search through networks to detect and isolate advanced threats that

Automate Threat Intelligence Security Actions Using ......

Category: Documents
Threat Hunting Guide - Broadcom Inc.

Threat Hunting Guide - Broadcom Inc.

Category: Documents
Workshop threat-hunting

Workshop threat-hunting

Category: Data & Analytics