detecting and blocking suspicious internal network traffic

17

Detecting and Blocking Suspicious Internal Network Traffic By: Damon Gross

Upload: logrhythm

Post on 10-Feb-2017

1.098 views

Category:

Technology

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: Detecting and Blocking Suspicious Internal Network Traffic

Detecting and Blocking Suspicious Internal Network Traffic

By: Damon Gross

Page 2: Detecting and Blocking Suspicious Internal Network Traffic

A customer needed to monitor for suspicious internal network traffic.

Page 3: Detecting and Blocking Suspicious Internal Network Traffic

While they have a firewall between the Internet and their main Web server, they didn’t have one between

the Web server and internal users.

Page 4: Detecting and Blocking Suspicious Internal Network Traffic

Until they could remedy the situation, they utilized LogRhythm’s SmartResponse™ to block activity.

Page 5: Detecting and Blocking Suspicious Internal Network Traffic

The SmartResponse Automation Framework is tightly integrated into the LogRhythm platform, providing seamless continuity across the end-to-end threat detection and response workflow.

Users set up SmartResponse actions to be triggered by specific alarms. These alarms can pass data to the SmartResponse action, enabling dynamic, precise execution.

https://logrhythm.com/products/features/SmartResponse/

https://logrhythm.com/products/features/SmartResponse/

Page 6: Detecting and Blocking Suspicious Internal Network Traffic

Let’s take a look at the setup

Page 7: Detecting and Blocking Suspicious Internal Network Traffic

On your desktop, set up Angry IP to do a port scan against a Web server, simulating internal network traffic.

Setup Angry IP

http://angryip.org/download/

Page 8: Detecting and Blocking Suspicious Internal Network Traffic

By cloning and modifying an existing AI Engine rule for port scans, the LogRhythm platform began picking up and alerting on activity immediately.

We can add vulnerability scanners to a known exclusion list to reduce false positives on the alarm.

Clone and modify the built-in AI Engine Rule

Page 9: Detecting and Blocking Suspicious Internal Network Traffic

The Web UI, starting with 7.1.5, gives not only general alarm information, but specific information about the host infected.

The alarm details the risk level, threat level and additional information. In this example, we can see the Web server has access to internal DB servers.

Gain visibility to an alarm

Page 10: Detecting and Blocking Suspicious Internal Network Traffic

Additionally, we can also see the AI Engine rule block that was used to detect the activity.

Gain visibility to an alarm

Page 11: Detecting and Blocking Suspicious Internal Network Traffic

The SmartResponse attached to this alarm will run on the Web server itself, eliminating the need to have unnecessary ports open to the Web server.

The SmartResponse will setup a Windows Firewall rule to block all incoming traffic from the IP detected by the AI Engine rule.

Attach a SmartResponse to the alarm

Page 12: Detecting and Blocking Suspicious Internal Network Traffic

Once you’ve approved the SmartResponse action, you will see from the LogRhythm Web UI that the firewall rule created on the Web server is firing.

Approve the SmartResponse action

Page 13: Detecting and Blocking Suspicious Internal Network Traffic

View the firewall rule created on the affected host

Page 14: Detecting and Blocking Suspicious Internal Network Traffic

Finally, double check the rule that was created does indeed work.

You should be able to see that the attacking host is no longer able to communicate with the Web server.

Ensure the rule is firing

Page 15: Detecting and Blocking Suspicious Internal Network Traffic

Utilizing SmartResponse, we were able to take action against suspicious internal traffic, while minimizing time to detect and respond to threats.

Page 16: Detecting and Blocking Suspicious Internal Network Traffic

Expand this SmartResponse rule to block other suspicious activities such as communication with a threat list IP address.

Page 17: Detecting and Blocking Suspicious Internal Network Traffic

Click below for more information on deploying this rule in your organization.

Request More Information

https://logrhythm.com/request-more-information/

Blocking - Habitat Denver of Blocking we install: • Ladder blocking • Deadwood (drywall nailers) • Fire blocking • Kitchen cabinet blocking • Bathroom vanity & cabinet blocking

Linguaskill: Building a validity argument for the Speaking ......Reference (CEFR) grades with human examiners. • Marking of Responses: The auto-marker is capable of detecting suspicious

Detecting Probe-resistant Proxies - NDSS Symposium · for discovering and blocking proxies (e.g. passive analysis [42] or distribution system enumeration [14]), these attacks are

Recognize Suspicious UASRecognize Suspicious UAS · 2020. 8. 11. · Recognize Suspicious UASRecognize Suspicious UAS Unmanned aircraft systems (UAS) are used for a range of tactical

Shunting: Detecting and Blocking Network Attacks at Ultra-High Speeds

Internet Ideal: Simple Network Modelmdamian/Past/networksfa12/Notes/... · 2013-01-15 · – Detecting suspicious traffic ... – But allows internal clients to connect to outside

Guide to Comply with Canada’s Anti-Money …...3.2.1 Defining the Purpose and Intended Nature of a Business Relationship29 3.2.2 Ongoing Monitoring: Detecting Suspicious Transactions

Validation of the Nationwide Suspicious Activity Reporting ... · Validation of the Nationwide Suspicious Activity Reporting (SAR) Initiative: Identifying Suspicious Activities from

Harbor Monitoring Network System for Detecting Suspicious ... · countermeasures. In Japan, too, the government and commer- ... surveillance, are not so advanced and are considered

Detection and Blocking of Anomaly DNS Traffic by Analyzing ...and suspicious uses of TXT records. Consequently, DNS pack-ets which are currently considered to be secure network trafc

A DGA Odyssey PDNS Driven DGA Analysis · PDF fileOutline • Background info • From PDNS Data to Suspicious DGA • From Suspicious DGA to Malware Sample • Blocking Experience

Detecting suspicious behaviors. BBAC currently examines data streams of HTTP requests and TCP traffic within a distributed stream processing framework

Event prediction CS 590v. Applications Video search Surveillance – Detecting suspicious activities – Illegally parked cars – Abandoned bags Intelligent

Non-Blocking Communications · Blocking and Non-Blocking Send and receive can be blocking or non-blocking. A blocking send can be used with a non-blocking receive, and vice-versa

An improved algorithm for detecting blocking eventss2sprediction.net/file/meetings_presentations/03_Bleck_S2S_blockin… · The streamline curvatureK s (the inverse of the radius

Detecting Suspicious Claims : AnOperational Perspective

Verilog Blocking and Non Blocking

Splunk conf2014 - Detecting Fraud and Suspicious Events Using Risk Scoring

Detecting and Blocking the IP Spoofer by Path Backscatter

Detecting and Neutralizing Drone Threats · Dedrone’s data processing software, DroneTracker, ... Passive countermeasures protect your facility by leading people to safety, blocking

Blocking “ccTLD Blocking”, “Strict Geo-location · 2016-01-26 · Blocking – “ccTLD Blocking”, “Strict Geo-location Blocking” or a “Country Lens Approach”? Dan

Innovations in Detecting Suspicious Claims 1 MEASURE, MANAGE, & REDUCE RISK SM

Evaluating a New Proposal for Detecting Data Falsification ... · conclude from their analysis of survey data that multiple factors might contribute to suspicious-looking patterns

Suspicious Packaging

BLOCKING AND BRACING Blocking & Bracing 1 Blocking and Bracing

Bluedon Intrusion Prevention Systembluedon.com/en/files/BluedonIPS.pdf · 2017-12-28 · monitoring the network transmission in real -time, detecting suspicious behaviors automatically,

Suspicious Behavior Detection: Current Trends and …pengcui.thumedialab.com/papers/suspicious behavior-survey...niques for detecting suspicious behaviors that have existed over the

NPO Red Flag Indicators 2018 Report - austrac.gov.au · INTRODUCTION Red flag indicators of suspicious financial activity are valuable tools for detecting potentially illicit behaviour

Detecting Suspicious Claims : AnOperational AnOperationalPerspective Marty Ellingsworth Director, Operations Research Customer Research and Strategies

DRONE DETECTION RADAR SYSTEM - metasensing · 2019-05-27 · by MetaSensing Radar. MetaSensing’s solution for detecting and tracking suspicious or not authorized drones, cars or

Shunting: Detecting and Blocking Network Attacks at Ultra-High SpeedsVern Paxson, Nicholas Weaver, and José María González Shunting: Detecting and Blocking

Suspicious Minds

Suspicious Shrimp

Detecting and Blocking Encrypted Anonymous Traffic using ...ijariie.com/...Blocking...Using_Deep_Packet_Inspection_ijariie8319.pdf · For capturing the packets we need Wireshark so

Suspicious Packages