Upload File

post-exploitation hunting with att&ck & elastic...eliminate false positives with enrichment...

  • Home
  • Documents
  • Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability
46
Post-Exploitation Hunting with ATT&CK & Elastic

Upload: others

Post on 21-May-2020

5 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

Post-Exploitation Hunting

with ATT&CK & Elastic

Page 2: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

• John Hubbard •@SecHubb

•SOC Lead at GlaxoSmithKline

•SANS Instructor• SEC511: Continuous Monitoring & Security Operations

• SEC555: SIEM with Tactical Analytics

• Mission: Bring awesome back to the blue team!

Page 3: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪Presumption of Compromise

▪Detection Oriented Defense

▪Hunt Teams Required

▪Post-Exploitation Focus

"Prevention is ideal, detection is a must"

Page 4: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

Hunting post-exploitation requires visibility

1. How do I collect logs?

2. Which logs do I collect?

3. How do I parse and enrich my logs?

4. What do I look for in this mountain of data?

Page 5: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability
Page 6: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪Elasticsearch, Logstash, Kibana

▪Beats platform▪Winlogbeat, Filebeat, Packetbeat, Auditbeat

▪X-Pack (Commercial Elasticsearch plugin)

▪Security, Alerting, Monitoring, Reporting

▪Graph, Machine Learning

▪Can supplement your current SIEM!

Logs Logs Logs

Page 7: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

Enrichment

Page 8: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

• Collects, parses, enriches logs at high volume

• Fast and functional visualizations and dashboards

• Reporting, alerting, correlation

• Machine learning, Graph Analytics

• Horizontal scaling

• FOSS, commercial support / features

• Active community, 3rd party plugin friendly

Page 9: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability
Page 10: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪VISIBILITY required

▪Security, System, Application

▪Sysmon

▪PowerShell

▪Autorun items

▪AppLocker

▪Audit

Page 11: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪Beats

▪NXLog

▪Windows Event Forwarding

▪Syslog, Rsyslog, Syslog-NG

▪Scripts / Scheduled jobs

Winlogbeat FilebeatPacketbeat

Page 12: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪Authentication

▪Windows - Sysmon ▪ SwiftOnSecurity's config file

▪ Process Creation

▪ Network connections from suspicious processes

▪ Registry keys for startup

▪Process creation auditing

▪Autoruns scripted

▪Whitelisting Detections & Preventions

▪PowerShell

Page 13: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪ DNS▪ Windows - dns.log or analytic logging▪ Network Extraction - Bro

▪ HTTP▪ NGFW / Proxy▪ Network Extraction - Bro

▪ SSL Certs - Bro

▪ NetFlow - or Bro

▪ Firewall

▪ HIDS

▪ Full PCAP – Security Onion (comes with Bro!)

Page 14: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪Command & Control (Layer 7 REQUIRED)

▪Unexpected internal to internal traffic

▪Executables

▪SSL Certificates

▪Password spraying, guessing, brute forcing

▪Network share & user scanning

Page 15: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪ Flexible input/output/enrichment options

▪ Buffer and backpressure capable

▪ CSV, XML, Key-Value, JSON make parsing automatic

▪ Enrichment adds context: domain_stats, freq, ASN, GeoIP, OUI, REST

http://www.earthporm.com/people-turned-log-piling-art-form/

Input

Filter

Output

(Queueing)

Page 16: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪Collect high-value host and network logs

▪Enrich logs to reduce false positives

▪Host visibility + Network visibility

▪Attackers live off the land / use custom tools

▪Attackers use all protocols, must see layer 7

Page 17: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability
Page 18: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪Complete "what to look for"

▪Threat model & framework

▪Models attacker activity (TTPs)

▪Post-compromise behavior list

▪Multiple parts ▪ PRE-ATT&CK

▪ ATT&CK Mobile

▪ ATT&CK - Windows / Mac / Linux

Page 19: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability
Page 20: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability
Page 21: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

• Tactics across the top

• What the techniques accomplish

Page 22: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

• Tactics across the top

• What the techniques accomplish

• Techniques in each column

• All known ways of accomplishing

that tactic

Page 23: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

• Tactics across the top

• What the techniques accomplish

• Techniques in each column

• All known ways of accomplishing

that tactic

• Note: Techniques CAN belong to

more than 1 Tactic

• Clickable

• Detections and mitigations

Page 24: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

Tactics – The “What”

▪Persistence

▪Privilege Escalation

▪Credential Access

▪Lateral Movement

▪Command & Control

▪Exfiltration

Techniques – The “How”

▪Bootkit

▪UAC Bypass

▪Credential Dumping

▪Pass the Hash

▪Custom Protocol

▪Exfil over Cmd. & Ctrl.

Page 25: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

Reference: http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

It tells you this piece

Page 26: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪AWESOME blue team checklist!▪High level analytics

▪Most dangerous events to miss

▪Objectively measures your defense!

▪Ask:▪Which can you actually detect?

▪What techniques pose the most risk?

▪Do those two overlap?

Page 27: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

Post-Exploit

Techniques

Oh crap…

Things we

can detect

Page 28: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

Post-Exploit

TechniquesBecomes

Things we

can detect

Page 29: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪Quantify detection levels

▪Write new analytics, track progress

▪Demonstrate improvement

▪Prove it with red teaming

▪Red Canary atomic-red-team

▪NSA Unfetter Project

▪Rinse, Detect, Repeat

Page 30: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability
Page 31: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪We assume compromise…

▪What would attacker do?

▪ATT&CK Tactics

▪How would they do it? ▪ATT&CK Techniques

▪Example Story: Malicious doc in email▪Macro was run, now what?

PersistencePrivilege

Escalation

Defense

Evasion

Credential

AccessDiscovery

Lateral

MovementExecution Collection Exfiltration

Command

and

Control

Page 32: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪ Item #1 for attackers

▪ATT&CK techniques:▪ New Service

▪ Scheduled Task

▪ Registry Run Keys / Start Folder …

▪Visible in Windows / Sysmon logs▪ New Service = Event ID 7045

▪ Schedule Task = Event ID 4698

▪ Registry Run Keys / Start Folder = Sysmon Event ID 13

▪ Least frequency of occurrence analysis w/ Kibana

Page 33: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability
Page 34: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

"I'm safe, I use AppLocker!"

▪ATT&CK Techniques:

▪Rundll32, RegSvr32

▪PowerShell, Scripting

▪What do these have in common?

▪Whitelisting bypass!

How to find:▪Process creation logs

▪PowerShell logs

▪Sysmon logs

▪ Writing files in odd locations

▪ ImageLoad events (if active)

▪AppLocker 8002/8003

▪ If DLL Rules turned on

Page 35: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability
Page 36: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

Upgrade to meterpreter - Caught Twice!

Page 37: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

PowerShell network connections, let's investigate

Page 38: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

Execution tactic pivoting uncovers Tactic: Credential Access!

Page 39: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability
Page 40: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪Finding the pivot – mimikatz was run…

▪Remote File Copy + Windows Admin Shares

▪Search for Administrator in command line▪ Shared Administrator account – "net use" to move DLL

▪ PsExec to remotely run the DLL

Page 41: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

What was done…

Page 42: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability
Page 43: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

1. VBS set to autostart in registry (Persistence)

2. VBS ran encoded PowerShell (Execution)

3. Download & ran Meterpreter via RunDLL32 (Execution)

4. Used PowerShell based Mimikatz (Cred. Access)

5. Scanned with credentials (Lateral Movement)

6. Pivoted to Admin Desktop via $admin (Lateral Mvmt.)

7. Compressed/Encrypted and Exfil'd data (Exfil)

8. Used DNS Tunneling (Command and Control)

Caught it all!

Page 44: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪ MITRE ATT&CK

▪ Japan CERT “Commands abused by attackers”

▪ http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html

http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html
Page 45: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪Collected high-value host and network data

▪Filtered, parsed, and enriched logs using Elastic stack

▪Quantified defense to management

▪Hunt team:

▪ Implemented MITRE ATT&CK analytics

▪ Looked for signs attacker is already in environment

▪Would have caught every stage of an attack in multiple ways

▪Most importantly: Stopped a wildly expensive breach!

Page 46: Post-Exploitation Hunting with ATT&CK & Elastic...Eliminate false positives with enrichment enabled by Elastic Let ATT&CK guide your analytics Quantify and track detection capability

▪Focus on post-exploitation detection with hunt team

▪Focus on high-value log sources and events

▪Eliminate false positives with enrichment enabled by Elastic

▪Let ATT&CK guide your analytics

▪Quantify and track detection capability

▪Test it, incentivize to constantly improve

▪This setup = Incredible detection superpower!!


DEEP DIVE INTO CYBER REALITY · Operationalize Threat Intelligence The MITRE Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) framework has emerged as a key resource for

sport.center · KMC KMC PCOO "MOKC" CK "KpblnaTcKoe" KpblnaTcKoe" CK "KPblnaTCKoe" KpblnaTcKoe" CK " "KpblnaTcoe" CK CK "KpblnaTcKoe' CK " KPblnaTCKoe" CK "KpblnaTcKoe" CK

MITRE ATT&CKÒ: Design and Philosophy · MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge

MITRE ATT&CK WORKBOOK - EnterpriseTalk

MITRE ATT&CK Enterprise Framework · • LogRhythm Process Monitor and/or EDR (e.g. Carbon Black / Cylance) • LogRhythm Registry Monitor (Windows) and/or EDR (e.g. Carbon Black

CK and CK NAC Clinical

MITRE ATT&CK® as a Framework for Cloud Threat Investigation...ATT&CK framework, and 43% cite the challenge of mapping event data to tactics and techniques. • A large percentage

HPH-Sector Cyber Threat Actor Modeling with Mitre ATT&CK · audience. Threat Briefings & Webinar. Briefing document and presentation that provides actionable information on health

Mapping Industrial Cybersecurity Threats to MITRE ATT&CK

ck ck ck ck - s3-ap-southeast-1.amazonaws.com€¦ · a bk, b ck a (ck)k ck ,b ck a a b b L.H.S. b b c c ck ck ck ck ck ck c c c k c k c k c k ... 11 AN NB AB 24 12 cm and 22 C u

enn with - I T.A.K.E. (Un) confitakeunconf.com/.../Automate-all-things-AWS-with-Ansible.pdfAWS WITH ANSIBLE elastic elastic elastic iii elastic elastic elastic elastic elastic elastic

BZAR Hunting Adversary Behaviors with Zeek and ATT&CK · What we’ll talk about Background: ATT&CK and Threat Hunting Threat Hunting with BZAR –Zeek Network Security Monitor –How

First Look Showcase · ATT&CK™ framework Qualys Security Conference, 2018 December 6, 2018 Breach & Attack Simulation 46 . Technical Approach Automated simulation of real-world

How to Submit a Threat Profile to MITRE ATT&CK · How to Submit a Threat Profile to MITRE ATT&CK Walker Johnson September 2018

Detecting Cyber Threats with ATT&CK™ Based Analytics365.himss.org/sites/himss365/files/365/handouts/550231465/handout... · Examples: Carbanak, Lazarus Group, TinyZBot, Duqu,

The Essential Guide to the MITRE ATT&CK Evaluation Round 3

AND THE IMPORTANCE OF SPEED ADVERSARY ......ADVERSARY TRADECRAFT AND THE IMPORTANCE OF SPEED 20 REGIONAL ATT&CK TECHNIQUE TRENDS CrowdStrike observed significant variations in the

Module 4: Storing and Analyzing ATT&CK-Mapped Data 4 Slides.pdf · Module 4: Storing and Analyzing ATT&CK-Mapped Data ©2019 The MITRE Corporation. ALL RIGHTS RESERVED Approved for

| 1 | Using ATT&CK to Find Cyber Threats and Bolster Cyber Defense€¦ · Deconstructing the Lifecycle Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential

Detecting Cyber Threats with ATT&CK -Based Analytics · DLL Search Order Hijacking Brute Force Account Discovery Windows Remote Management Audio Capture Automated Exfiltration Commonly

COR13 COR14 COR15 COR16 COJA COJC - Digilentincarty_sch.pdf · ck _s da ck _s cl ck _s ck ck _s s ck _mis o ck _mo si ck _an0_p ck _an1_p ck _an2_p ck _an3_p ck _an4_p ck _an5_p ck

Finding Cyber Threats with ATT&CK-Based Analytics · PDF fileFinding Cyber Threats with ATT&CK ... 6 2.3 Principle 3 ... Windows® service3 with a name that is easily assumed by the

Module 2: Mapping to ATT&CK from a Finished Report 2 Slides.pdf · Module 1 Module 2 Module 3 Module 4 Module 5. Why is it Difficult to Map CTI to ATT&CK? ... –Initial Access -

How To Get Started Testing with The MITRE ATT&CK Framework · map those capabilities to the MITRE ATT&CK tactics and techniques that you can then use to test the configuration and

Sharing Threat Intelligence & Playbooks Speaker... · Operationalizing ATT&CK 8 Criteria 1 Collection 2 Analysis 3 Investigation 4 Dissemination 5 Determine if candidates meet minimum

Post-Exploitation Hunting with ATT&CK & Elastic · Hunting post-exploitation requires visibility 1. How do I collect logs? 2. Which logs do I collect? 3. How do I parse and enrich

APT ATT&CK™ - Threat-based Purple Teaming with ATT&CK ... · Approved for public release. Distribution unlimited 19-00696-5 What is a behavior? Stages of a behavior 1.Prerequisites–What

Cyber Threat Intelligence: A Team Sport...ATT&CK is grounded in empirical data from cyber incidents Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral

MITRE ATT&CK™: Design and Philosophy · ATT&CK was created out of a need to systematically categorize adversary behavior as part of conducting structured adversary emulation exercises

Module 5: Making Defensive Recommendations from ATT&CK ... 5 Slides.pdf · Module 5: Making Defensive Recommendations from ATT&CK-Mapped Data ©2019 The MITRE Corporation. ALL RIGHTS

OSQUERY Breach ATT&CK - MacAdmins Conference

Threat hunting with MITRE ATT&CK

Learning the Associations of MITRE ATT&CK Adversarial

ICS ATT&CK - ACSAC 2017 · DLL Search Order Hijacking Keychain Peripheral Device Discovery Windows Remote Management Automated Collection Exfiltration Over Command and Control Channel

Post-Exploitation Hunting with ATT&CK & Elastic · Syslog, Rsyslog, Syslog-NG ... PowerPoint Presentation Author: John Hubbard Created Date: 11/29/2017 3:36:26 PM