YOU ARE DOWNLOADING DOCUMENT

Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Category:

Documents

Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Please tick the box to continue:

Transcript
Page 1: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Huntingwith

© 2019 Xavier Mertens (PassTheSalt Edition) 1

Page 2: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

<profile> <name>Xavier Mertens</name> <nick>xme</nick> <jobs> <day>Cyber Security Freelance</day> <night>Blogger, ISC Handler, Hacker</night> </jobs> <![CDATA[ https://xavier.mertens.consulting https://blog.rootshell.be https://isc.sans.edu https://www.brucon.org ]]></profile>

Followme!

2

Page 3: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Me ♥ OSSEC

3

• Daily usage of OSSEC to monitor my own infrastructure

• OSSEC Advocate • Performed customer’s projects based on OSSEC • My current instance has 5y of backlog (1.4B events :-) • First mention in a blog post: 2010 • Contributions to the project:

• CEF support • GeoIP support

Page 4: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Blue + Red = Purple

4

Page 5: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Hunting 101

5

“The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security solutions.”

Thank you Wikipedia :)

Page 6: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Hunting 101

6

It does not resume to searching for IOC’s…

… but it’s a good first step!

Page 7: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Hunting 101

7

It is based on tools

… but also processes!

Page 8: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Threat Hunting 101

8

Use cases are key!

Read: Focus on what is important to detect for

you!

Page 9: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

IOC’s

9

• IP addresses • Domain names, FQDN • Hashes (MD5, SHA1, SHA256) • Users • User-Agent • Email addresses • Processes • Files • Mutexes • …

Page 10: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

IOC’s

10

<Any data valuable in your $ENV>

The value of an IOC is based on its context! (Quantity <> Quality)

Page 11: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

11 11

Who knows OSSEC?

Page 12: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

OSSEC 101

12

Page 13: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

OSSEC 101

13

Client - Server based (agents) UNIX | Windows | MacOS Log collection & analysis Syscheck (FIM) Rootcheck Interaction with 3rd party tools Active-Response Console tools only(*) Server running on UNIX only Docker available

(*) Alternative web frontends available like Wazuh (https://wazuh.com/)

https://wazuh.com/
Page 14: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

OSSEC 101

14

$ tree /var/ossec -L 1 /var/ossec |-- active-response |-- agentless |-- bin |-- etc |-- lists |-- logs |-- queue |-- rules |-- stats |-- tmp `-- var

Page 15: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Your Mission…

15

Let’s see how we can configure OSSEC with the help of third party tools / data to

detect suspicious activities on a host

Page 16: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Your Mission…

16

Suspicious DNS activity Suspicious files Suspicious processes

Expected time per lab: 20 minutes

Page 17: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Online Lab

17

• Each students has his/her Amazon EC2 host • Select an IP address on:

https://pad.xameco.net/p/ossecpts19 • Connect to your instance • Do NOT misuse or connect to other hosts!

Requirements: Internet connectivity and a SSH client

Some UNIX command line Fu!

https://pad.xameco.net/p/ossecpts19
Page 18: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Online Lab

18

ssh -p 443 student@<your-IP-address> Password: OSSECpts19

Root access: sudo -s

(Feel free to use your beloved editor/shell)

Page 19: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Up to You!

19

Page 20: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #1

20

Detecting infected hosts trying to contact their C2 server

Monitoring of DNS traffic is a gold mine to spot infected computers!

Page 21: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #1

21

OSSEC can use ‘lists’ to query any fields from rules

<rule id="99002" level="10"> <decoded_as>bind9</decoded_as> <list field="url">lists/baddomains</list> <description> DNS query for malicious domain! </description> </rule>

Page 22: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

22

Which domains to search for?http://mirror1.malwaredomains.com/files/justdomains

Page 23: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #1

23

# cd /home/student/lab1 # more README.txt

Page 24: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Up to You!

24

Page 25: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #2

25

Detecting suspicious files

Suspicious or unknown files on a file system might indicate that a system has been

compromized!

Page 26: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #2

26

OSSEC has a feature called ‘rootcheck’ to detect potential rootkits.

Page 27: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #2

27

Let’s grab a list of bad files from a MISP instance and feed OSSEC!

# ./mof.py -t 15d -o /var/ossec/etc/shared/myfiles.txt

Source: https://raw.githubusercontent.com/xme/toolbox/master/mof.py

https://raw.githubusercontent.com/xme/toolbox/master/mof.py
Page 28: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #2

28

# cd /home/student/lab2 # more README.txt

Page 29: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Up to You!

29

Page 30: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

30

Detecting running suspicious processes

Unknown processes running on a host are usually bad signals.

It may indicate a compromised host by a trojan, a RAT or a cryptominer…

Page 31: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

31

OSSEC has a feature to monitor output from scripts:

<localfile> <log_format>command</log_format> <command>df -P</command> </localfile>

Page 32: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

32

Let’s grab a list of running processes and compare them with a list of “bad” ones

<localfile> <log_format>full_command</log_format> <command>find /proc -name comm -exec cat "{}" \; \ 2>/dev/null |sort -u</command> <frequency>180</frequency> </localfile>

Page 33: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

33

What to search for?

AnXqV.yam BI5zj Carbon Duck.sh Guard.sh JnKihGjn KGlJwfWDbCPnvwEJupeivI1FXsSptuyh NXLAi XJnRj accounts-daemon acpid askdljlqw atd bonn.sh bonns carbon conn.sh conns crypto-pool ddg donns gekoCrw gekoCrw32 ir29xc1 irpbalanc1 jIuc2ggfCAvYmluL2Jhc2gi jaav jva kw.sh kworker34 kxjd lexarbalanc1 lower.sh lowerv2.sh lowerv3.sh minerd minergate minergate-cli minexmr mixnerdx mule mutex myatd performedl polkitd pro.sh pubg pvv root.sh rootv2.sh rootv3.sh servcesa sourplum stratum vsp watch-smart ysaydh AnXqV.yam BI5zj Carbon Duck.sh Guard.sh JnKihGjn KGlJwfWDbCPnvwEJupeivI1FXsSptuyh NXLAi XJnRj accounts-daemon acpid askdljlqw atd bb bonn.sh bonns carbon conn.sh conns crypto-pool ddg donns gekoCrw gekoCrw32 gekoba2anc1 gekoba5xnc1 gekobalanc1 gekobalance gekobalanq1 gekobnc1 ir29xc1 irpbalanc1 irqba2anc1 irqba5xnc1 irqbalance irqbnc1 jIuc2ggfCAvYmluL2Jhc2gi jaav jva kw.sh kworker34 kxjd lexarbalanc1 lower.sh lowerv2.sh lowerv3.sh minerd minergate minergate-cli minexmr mixnerdx mule mutex myatd performedl polkitd pro.sh pubg pvv servcesa sourplum stratum tratum vsp watch-smart wget yam ysaydh

Source: https://isc.sans.edu/forums/diary/Crypto+Mining+Is+More+Popular+Than+Ever/24050/

Page 34: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Lab #3

34

# cd /home/student/lab3 # more README.txt

Page 35: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Up to You!

35

Page 36: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

Wrap-Up

36

Open source tools to the rescue! Use free data sources for IOCs Know your infrastructure! Be proactive!

Page 37: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

About Alerts

37

Local log files JSON (ELK, Splunk, …) Email notifications Syslog (CEF)

Page 38: Threat Hunting with - 2019 Pass the SALT | homepage · 2019-07-04 · Threat Hunting 101 5 “The process of proactively and iteratively searching through networks to detect and isolate

38

10:55:17.578190 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4 (0x0800), \ length 77: 127.0.0.1.38048 > 127.0.0.1.7777: Flags [P.], seq 1:12, ack 1, \ win 342, options [nop,nop,TS val 1437796971 ecr 1437795587], length 11 0x0000: 4500 003f 189c 4000 4006 241b 7f00 0001 E..?..@.@.$..... 0x0010: 7f00 0001 94a0 1e61 97cd 1d9a b8d8 37b8 .......a......7. 0x0020: 8018 0156 fe33 0000 0101 080a 55b3 0a6b ...V.3......U..k

0x0030: 55b3 0503 5468 616e 6b20 596f 7521 0a U...Thank.You!.

@xme | [email protected]


Related Documents
Threat Hunting
Threat Hunting
Category: Internet
Introduction into Threat Hunting - Sri Lanka CERT|CC · What is Threat Hunting Cyber threat hunting is an active cyber defence activity. It is "the process of proactively and iteratively
Introduction into Threat Hunting - Sri Lanka CERT|CC ·...
Category: Documents
Threat hunting as SOC process
Threat hunting as SOC process
Category: Technology
Endgame SANS - Threat Hunting Before the Incident
Endgame SANS - Threat Hunting Before the Incident
Category: Documents
The Elastic Guide to Threat Hunting - copyright
The Elastic Guide to Threat Hunting - copyright
Category: Documents
Abstract Tools for Effective Threat Hunting
Abstract Tools for Effective Threat Hunting
Category: Technology
IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting
IOT: EXPLORING THE THREAT SURFACEintro the big idea securing...
Category: Documents
2020 THREAT HUNTING REPORT - ExtraHop
2020 THREAT HUNTING REPORT - ExtraHop
Category: Documents
Enabling Efficient Cyber Threat Hunting with Cyber Threat ...
Enabling Efficient Cyber Threat Hunting with Cyber Threat...
Category: Documents
Threat Hunting Guide - Broadcom Inc.
Threat Hunting Guide - Broadcom Inc.
Category: Documents
Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with Phirelight
Category: Technology
Towards a Threat Hunting Automation Maturity Model
Towards a Threat Hunting Automation Maturity Model
Category: Technology
Threat Hunting with ELK training - Intellectual Point
Threat Hunting with ELK training - Intellectual Point
Category: Documents
ATT&CKing The Command Line & Hunting For More...Threat Hunting Automation Motivation Current Reality Threat hunting used to detect activity we are currently missing. As defenders,
ATT&CKing The Command Line & Hunting For More...Threat...
Category: Documents
Threat Hunting with Splunk
Threat Hunting with Splunk
Category: Technology
Threat Hunting in Windows – Are You Hunting or Being Hunted?
Threat Hunting in Windows – Are You Hunting or Being...
Category: Software
Threat Hunting with · Threat Hunting 101 4 “The process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security
Threat Hunting with · Threat Hunting 101 4 “The process....
Category: Documents
Supercharging SOAR Solutions With Threat Intelligence · Threat Hunting. Proactively and iteratively search through your organization’s networks to detect and isolate advanced and
Supercharging SOAR Solutions With Threat Intelligence ·...
Category: Documents
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
Category: Technology
Threat Hunting Report can be viewed here - News · THREAT HUNTING REPORT 3. THRET HNTING REPORT 4 KEY SURVEY FINDINGS ... Among the respondents to the threat hunting survey, six in
Threat Hunting Report can be viewed here - News · THREAT.....
Category: Documents
Proactive Threat Hunting Combining the use of …Proactive Threat Hunting Combining the use of threat intelligence, analytics and automated security tools with human smarts Benefits
Proactive Threat Hunting Combining the use of …Proactive.....
Category: Documents
FALCON OVERWATCH MANAGED THREAT HUNTING · Director of Information Technology, TransPak. CrowdStrike Products FALCON OVERWATCH MANAGED THREAT HUNTING CROWDSTRIKE MANAGED THREAT HUNTING
FALCON OVERWATCH MANAGED THREAT HUNTING · Director of...
Category: Documents
(CMC THREAT HUNTING SERVICE)
(CMC THREAT HUNTING SERVICE)
Category: Documents
DEMYSTIFYING THREAT HUNTING · 2021. 1. 26. · We wanted to clear up the confusion. Demystifying Threat Hunting will explain: • What threat hunting is – and what it isn’t.
DEMYSTIFYING THREAT HUNTING · 2021. 1. 26. · We wanted.....
Category: Documents
Threat Hunting with Qualys€¦ · Threat Hunting with Qualys: Going Beyond Your EDR Solutions. Adversary Threat Tactics are Changing Early 2010s Zero ... Rapidly weaponizing newly-disclosed
Threat Hunting with Qualys€¦ · Threat Hunting with...
Category: Documents
Threat Hunting 102: Beyond the Basics
Threat Hunting 102: Beyond the Basics
Category: Technology
Threat Hunting - csirt.jabarprov.go.id
Threat Hunting - csirt.jabarprov.go.id
Category: Documents
GUIDE TO CYBER THREAT HUNTING - Tyler Technologies
GUIDE TO CYBER THREAT HUNTING - Tyler Technologies
Category: Documents
“Threat Hunting in Active Directory Environment”
“Threat Hunting in Active Directory Environment”
Category: Documents
Kaspersky Threat Hunting · • Immediate protection against any detected threat through automatic antivirus database updates. • Retrospective analysis of incidents and threat hunting,
Kaspersky Threat Hunting · • Immediate protection...
Category: Documents