View
273
Download
0
Category
Preview:
Citation preview
Preworkfortoday
● SetupSplunkEnterpriseSecuritySandbox● InstallfreeSplunkonlaptop● InstallMLToolkitapp
hEps://splunkbase.splunk.com/app/2890/
3
> KenWes+nkwestin@splunk.com@kwestin
• 1.5yearatSplunk–SecurityStrategist• BasedinPortland,Oregon• 20yearsintechnologyandsecurity• M.Sc,OSCP,ITPM• Trainedinoffensive&defensivesecurity
$whoami
Agenda• ThreatHun+ngBasics
• ThreatHun+ngDataSources
• SysmonEndpointData
• CyberKillChain
• WalkthroughofACackScenarioUsingCoreSplunk(handson)
• AdvancedThreatHun+ngTechniques&SecurityEssen+als
• EnterpriseSecurityWalkthrough
• ApplyingMachineLearningandDataSciencetoSecurity
LogInCreden+als
January,February&March hEps://54.144.69.125April,May&June hEps://52.55.68.96JulyandAugust hEps://54.164.82.160SeptemberandOctober hEps://52.23.227.212NovemberandDecember hEps://52.202.90.207
User:hunterPass:pr3dat0r
BirthMonth
AmIintherightplace?
Somefamiliaritywith…
● CSIRT/SOCOpera+ons
● GeneralunderstandingofThreatIntelligence
● GeneralunderstandingofDNS,Proxy,andEndpointtypesofdata
7
Whatisthreathun+ng,whydoyouneedit?TheWhat?
• Threathun+ng-theactofaggressively
intercep+ng,trackingand
elimina+ngcyberadversariesasearlyaspossibleintheCyberKillChain2
8
TheWhy?
• Threatsarehuman.Focusedandfundedadversarieswillnotbecounteredbysecurityboxesonthenetwork
alone.Threathuntersareac+velysearchingforthreatstopreventor
minimizedamage[beforeithappens]1
2CyberThreatHun+ng-SamuelAlonsoblog,Jan2016
1TheWho,What,Where,When,WhyandHowofEffec+veThreatHun+ng,SANSFeb2016
“ThreatHun,ngisnotnew,it’sjustevolving!”
Search&Visualisa+on
Enrichment
Data
Automa+on
11
HumanThreatHunter
KeyBuildingBlockstoDriveThreatHun+ngMaturity
Ref:TheheWho,What,Where,When,WhyandHowofEffec+veThreatHun+ng,SANSFeb2016
Objec+ves>Hypotheses>Exper+se
“Agoodintelligenceofficercul,vatesanawarenessofwhatheorshedoesnotknow.Youneedadoseofmodestytoacknowledgeyourownignorance-evenmore,toseekoutyourignorance.Thentheharderpartcomes,tryingtodosomethingaboutit.ThisoFenrequiresanimmodestdetermina,on”HenryA.CrumptonTheArtofIntelligence:LessonsFromAlifeIntheCIA’sClandes+neService
12
SANSThreatHun+ngMaturity
13
AdHocSearch
Sta+s+calAnalysis
Visualiza+onTechniques
Aggrega+on MachineLearning/DataScience
85%55%50%48%32%
Source:SANSIR&ThreatHun+ngSummit2016
Search&Visualisa+on
Enrichment
Data
Automa+on
HumanThreatHunter
HowSplunkhelpsYouDriveThreatHun+ngMaturity
ThreatHun+ngAutoma+onIntegrated&outoftheboxautoma+ontoolingfromar+factquery,contextual“swim-laneanalysis”,anomaly&+meseriesanalysistoadvanceddatascienceleveragingmachinelearning
ThreatHun+ngDataEnrichment
Enrichdatawithcontextandthreat-intelacrossthestackor+metodiscerndeeperpaEernsorrela+onships
Search&VisualiseRela+onshipsforFasterHun+ng
Searchandcorrelatedatawhilevisuallyfusingresultsforfastercontext,analysisandinsight
Ingest&OnboardAnyThreatHun+ngMachineDataSourceEnablefastinges+onofanymachinedatathroughefficient
indexing,abigdatareal+mearchitectureand‘schemaontheread’technology
Hypotheses
AutomatedAnaly+cs
DataScience&MachineLearning
Data&IntelligenceEnrichment
DataSearch
Visualisa+on
Maturity
Hun+ngTools:InternalData
15
• IPAddresses:threatintelligence,blacklist,whitelist,reputa+onmonitoringTools:Firewalls,proxies,SplunkStream,Bro,IDS
• NetworkAr+factsandPaCerns:networkflow,packetcapture,ac+venetworkconnec+ons,historicnetworkconnec+ons,portsandservicesTools:SplunkStream,BroIDS,FPC,Neplow
• DNS:ac+vity,queriesandresponses,zonetransferac+vityTools:SplunkStream,BroIDS,OpenDNS
• Endpoint–HostAr+factsandPaCerns:users,processes,services,drivers,files,registry,hardware,memory,diskac+vity,filemonitoring:hashvalues,integritycheckingandalerts,crea+onordele+onTools:Windows/Linux,CarbonBlack,Tanium,Tripwire,Ac+veDirectory
• VulnerabilityManagementDataTools:TripwireIP360,Qualys,Nessus
• UserBehaviorAnaly+cs:TTPs,usermonitoring,+meofdayloca+on,HRwatchlistSplunkUBA,(Alloftheabove)
Persist,Repeat
ThreatIntelligence
Access/Iden+ty
Endpoint
Network
AEacker,knowrelay/C2sites,infectedsites,IOC,aEack/campaignintentandaEribu+on
Wheretheywentto,whotalkedtowhom,aEacktransmiEed,abnormaltraffic,malwaredownload
Whatprocessisrunning(malicious,abnormal,etc.)Processowner,registrymods,aEack/malwarear+facts,patchinglevel,aEacksuscep+bility
Accesslevel,privilegedusers,likelihoodofinfec+on,wheretheymightbeinkillchain
• Third-partythreatintel• Open-sourceblacklist• Internalthreatintelligence
• Firewall,IDS,IPS• DNS• Email
• Endpoint(AV/IPS/FW)• Malwaredetec+on• PCLM
• DHCP• OSlogs• Patching
• Ac+veDirectory• LDAP• CMDB
• Opera+ngsystem• Database• VPN,AAA,SSO
TypicalDataSources
• Webproxy• NetFlow• Network
Endpoint:MicrosovSysmonPrimer
17
● TAAvailableontheAppStore● GreatBlogPosttogetyoustarted
● IncreasesthefidelityofMicrosovLogging
BlogPost:hEp://blogs.splunk.com/2014/11/24/monitoring-network-traffic-with-sysmon-and-splunk/
LogInCreden+als
January,February&March hEps://54.144.69.125
April,May&June hEps://52.55.68.96
JulyandAugust hEps://54.164.82.160
SeptemberandOctober hEps://52.23.227.212
NovemberandDecember hEps://52.202.90.207
User:hunterPass:pr3dat0r
BirthMonth
DemoStory-KillChainFrameworkSuccessfulbruteforce–downloadsensi+vepdfdocument
WeaponizethepdffilewithZeusMalware
Convincingemailsentwithweaponizedpdf
Vulnerablepdfreaderexploitedbymalware.Droppercreatedonmachine
Dropperretrievesandinstallsthemalware
Persistenceviaregularoutboundcomm
DataExfiltra+on
Source:LockheedMar,n
Servers
Storage
DesktopsEmail Web
Transac+onRecords
NetworkFlows
DHCP/DNS
HypervisorCustomApps
The image cannot be displayed. Your computer
PhysicalAccess
Badges
ThreatIntelligence
Mobile
CMDB
The image cannot be displ
IntrusionDetec+on
Firewall
DataLossPreven+on
An+-Malware
VulnerabilityScans
Tradi+onal
Authen+ca+on
StreamInves+ga+ons–chooseyourdatawisely
24
APTTransac+onFlowAcrossDataSources
25
hEp(proxy)sessiontocommand&controlserver
RemotecontrolStealdataPersistincompanyRentasbotnet
Proxy
ConductBusiness
Createaddi+onalenvironment
GainAccesstosystemTransac+on
ThreatIntelligence
Endpoint
NetworkEmail,Proxy,DNS,andWeb
DataSources
.pdfexecutes&unpacksmalwareoverwri+ngandrunning“allowed”programs
Svchost.exe(malware)
Calc.exe(dropper)
AEackerhackswebsiteSteals.pdffiles
WebPortal.pdf
AEackercreatesmalware,embedin.pdf,
emailstothetarget
Reademail,openaEachment
OurInves+ga+onbeginsbydetec+nghighriskcommunica+onsthroughtheproxy,attheendpoint,andevenaDNScall.
Tobeginourinves+ga+on,wewillstartwithaquicksearchtofamiliarizeourselveswiththedatasources.
Inthisdemoenvironment,wehaveavarietyofsecurityrelevantdataincluding…
WebDNSProxyFirewallEndpointEmailClick
Takealookattheendpointdatasource.WeareusingtheMicrosovSysmonTA.
Wehaveendpointvisibilityintoallnetworkcommunica+onandcanmapeachconnec+onbacktoaprocess.
}Wealsohavedetailedinfooneachprocessandcanmapitbacktotheuserandparentprocess.}
Letsgetourdaystartedbylookingusingthreatinteltopriori+zeoureffortsandfocusoncommunica+onwithknownhighrisken++es.
Wehavemul+plesourceIPscommunica+ngtohighrisken++esiden+fiedbythese2threatsources.
Weareseeinghighriskcommunica+onfrommul+pledatasources.
Weseemul+plethreatintelrelatedeventsacrossmul+plesourcetypesassociatedwiththeIPAddressofChrisGilbert.Let’stakecloserlookattheIPAddress.
Wecannowseetheownerofthesystem(ChrisGilbert)andthatitisn’taPIIorPCIrelatedasset,sotherearenoimmediatebusinessimplica+onsthatwouldrequireinformingagenciesorexternalcustomerswithinacertain+meframe.
Thisdashboardisbasedoneventdatathatcontainsathreatintelbasedindicatormatch(IPAddress,domain,etc.).ThedataisfurtherenrichedwithCMDBbasedAsset/iden+tyinforma+on.
Wearenowlookingatonlythreatintelrelatedac+vityfortheIPAddressassociatedwithChrisGilbertandseeac+vityspanningendpoint,proxy,andDNSdatasources.
Thesetrendlinestellaveryinteres+ngvisualstory.ItappearsthattheassetmakesaDNSqueryinvolvingathreatintelrelateddomainorIPAddress.
ScrollDo
wn
ScrolldownthedashboardtoexaminethesethreatinteleventsassociatedwiththeIPAddress.
Wethenseethreatintelrelatedendpointandproxyeventsoccurringperiodicallyandlikelycommunica+ngwithaknownZeusbotnetbasedonthethreatintelsource(zeus_c2s).
It’sworthmen+oningthatatthispointyoucouldcreatea+ckettohavesomeonere-imagethemachinetopreventfurtherdamageaswecon+nueourinves+ga+onwithinSplunk.
Withinthesamedashboard,wehaveaccesstoveryhighfidelityendpointdatathatallowsananalysttocon+nuetheinves+ga+oninaveryefficientmanner.Itisimportanttonotethatnearreal-+meaccesstothistypeofendpointdataisnotnotcommonwithinthetradi+onalSOC.
Theini+algoaloftheinves+ga+onistodeterminewhetherthiscommunica+onismaliciousorapoten+alfalseposi+ve.Expandtheendpointeventtocon+nuetheinves+ga+on.
Proxyrelatedthreatintelmatchesareimportantforhelpingustopriori+zeoureffortstowardini+a+nganinves+ga+on.Furtherinves+ga+onintotheendpointisovenvery+meconsumingandoveninvolvesmul+pleinternalhand-offstootherteamsorneedingtoaccessaddi+onalsystems.Thisencryptedproxytrafficisconcerningbecauseofthelargeamountofdata(~1.5MB)beingtransferredwhichiscommonwhendataisbeingexfiltrated.
Exfiltra+onofdataisaseriousconcernandoutboundcommunica+ontoexternalen+tythathasaknownthreatintelindicator,especiallywhenitisencryptedasinthiscase.
Letscon+nuetheinves+ga+on.
Anotherclue.Wealsoseethatsvchost.exeshouldbelocatedinaWindowssystemdirectorybutthisisbeingrunintheuserspace.Notgood.
Weimmediatelyseetheoutboundcommunica+onwith115.29.46.99viahEpsisassociatedwiththesvchost.exeprocessonthewindowsendpoint.Theprocessidis4768.Thereisagreatdealmoreinforma+onfromtheendpointasyouscrolldownsuchastheuserIDthatstartedtheprocessandtheassociatedCMDBenrichmentinforma+on.
Wehaveaworkflowac+onthatwilllinkustoaProcessExplorerdashboardandpopulateitwiththeprocessidextractedfromtheevent(4768).
ThisisastandardWindowsapp,butnotinitsusualdirectory,tellingusthatthemalwarehasagainspoofedacommonfilename.
Wealsocanseethattheparentprocessthatcreatedthissuspicuoussvchost.exeprocessiscalledcalc.exe.
ThishasbroughtustotheProcessExplorerdashboardwhichletsusviewWindowsSysmonendpointdata.
SuspectedMalware
Letscon+nuetheinves+ga+onbyexaminingtheparentprocessasthisisalmostcertainlyagenuinethreatandwearenowworkingtowardarootcause.
ThisisveryconsistentwithZeusbehavior.Theini+alexploita+ongenerallycreatesadownloaderordropperthatwillthendownloadtheZeusmalware.Itseemslikecalc.exemaybethatdownloader/dropper.
SuspectedDownloader/Dropper
Thisprocesscallsitself“svchost.exe,”acommonWindowsprocess,butthepathisnotthenormalpathforsvchost.exe.
…whichisacommontraitofmalwareaEemp+ngtoevadedetec+on.WealsoseeitmakingaDNSquery(port53)thencommunica+ngviaport443.
TheParentProcessofoursuspecteddownloader/dropperisthelegi+matePDFReaderprogram.ThiswilllikelyturnouttobethevulnerableappthatwasexploitedinthisaEack.
SuspectedDownloader/Dropper
SuspectedVulnerableAppWehaveveryquicklymovedfromthreatintelrelatednetworkandendpointac+vitytothelikelyexploita+onofavulnerableapp.Clickontheparentprocesstokeepinves+ga+ng.
WecanseethatthePDFReaderprocesshasnoiden+fiedparentandistherootoftheinfec+on.
ScrollDo
wn
Scrolldownthedashboardtoexamineac+vityrelatedtothePDFreaderprocess.
Chrisopened2nd_qtr_2014_report.pdfwhichwasanaEachmenttoanemail!
Wehaveourrootcause!Chrisopenedaweaponized.pdffilewhichcontainedtheZeusmalware.Itappearstohavebeendeliveredviaemailandwehaveaccesstoouremaillogsasoneofourimportantdatasources.Letscopythefilename2nd_qtr_2014_report.pdfandsearchabitfurthertodeterminethescopeofthiscompromise.
Letssearchthoughmul+pledatasourcestoquicklygetasenseforwhoelsemayhavehavebeenexposedtothisfile.
Wewillcomebacktothewebac+vitythatcontainsreferencetothepdffilebutletsfirstlookattheemaileventtodeterminethescopeofthisapparentphishingaEack.
WehaveaccesstotheemailbodyandcanseewhythiswassuchaconvincingaEack.Thesenderapparentlyhadaccesstosensi+veinsiderknowledgeandhintedatquarterlyresults.
ThereisouraEachment.
HoldOn!That’snotourDomainName!Thespellingisclosebutit’smissinga“t”.TheaEackerlikelyregisteredadomainnamethatisveryclosetothecompanydomainhopingChriswouldnotno+ce.
ThislookstobeaverytargetedspearphishingaEackasitwassenttoonlyoneemployee(Chris).
RootCauseRecap
42
DataSources
.pdfexecutes&unpacksmalwareoverwri+ngandrunning“allowed”programs
hEp(proxy)sessiontocommand&controlserver
RemotecontrolStealdataPersistincompanyRentasbotnet
Proxy
ConductBusiness
Createaddi+onalenvironment
GainAccesstosystemTransac+on
ThreatIntelligence
Endpoint
NetworkEmail,Proxy,DNS,andWeb
.pdfSvchost.exe(malware)
Calc.exe(dropper)
AEackerhackswebsiteSteals.pdffiles
WebPortal.pdf
AEackercreatesmalware,embedin.pdf,
emailstothetarget
Reademail,openaEachment
Weu+lizedthreatinteltodetectcommunica+onwithknownhighriskindicatorsandkickoffourinves+ga+onthenworkedbackwardthroughthekillchaintowardarootcause.
Keytothisinves+ga+veprocessistheabilitytoassociatenetworkcommunica+onswithendpointprocessdata.
Thishighvalueandveryrelevantabilitytoworkamalwarerelatedinves+ga+onthroughtorootcausetranslatesintoaverystreamlinedinves+ga+veprocesscomparedtothelegacySIEMbasedapproach.
43
Letsrevisitthesearchforaddi+onalinforma+ononthe2nd_qtr_2014-_report.pdffile.
Weunderstandthatthefilewasdeliveredviaemailandopenedattheendpoint.Whydoweseeareferencetothefileintheaccess_combined(webserver)logs?
Click
Selecttheaccess_combinedsourcetypetoinves+gatefurther.
44
Theresultsshow54.211.114.134hasaccessedthisfilefromthewebportalofbuEergames.com.
Thereisalsoaknownthreatintelassocia+onwiththesourceIPAddressdownloading(HTTPGET)thefile.
45
ClickSelecttheIPAddress,lev-click,thenselect“Newsearch”.WewouldliketounderstandwhatelsethisIPAddresshasaccessedintheenvironment.
46
That’sanabnormallylargenumberofrequestssourcedfromasingleIPAddressina~90minutewindow.
Thislookslikeascriptedac+ongiventheconstanthighrateofrequestsoverthebelowwindow.
ScrollDo
wn
Scrolldownthedashboardtoexamineotherinteres+ngfieldstofurtherinves+gate.
No+cetheGooglebotuseragentstringwhichisanotheraEempttoavoidraisingaEen+on..
47
Therequestsfrom52.211.114.134aredominatedbyrequeststotheloginpage(wp-login.php).It’sclearlynotpossibletoaEemptaloginthismany+mesinashortperiodof+me–thisisclearlyascriptedbruteforceaEack.
Aversuccessfullygainingaccesstoourwebsite,theaEackerdownloadedthepdffile,weaponizeditwiththezeusmalware,thendeliveredittoChrisGilbertasaphishingemail.
TheaEackerisalsoaccessingadminpageswhichmaybeanaEempttoestablishpersistenceviaabackdoorintothewebsite.
KillChainAnalysisAcrossDataSources
48
hEp(proxy)sessiontocommand&controlserver
RemotecontrolStealdataPersistincompanyRentasbotnet
Proxy
ConductBusiness
Createaddi+onalenvironment
GainAccesstosystemTransac+on
ThreatIntelligence
Endpoint
NetworkEmail,Proxy,DNS,andWeb
DataSources
.pdfexecutes&unpacksmalwareoverwri+ngandrunning“allowed”programs
Svchost.exe(malware)
Calc.exe(dropper)
AEackerhackswebsiteSteals.pdffiles
WebPortal.pdf
AEackercreatesmalware,embedin.pdf,
emailstothetarget
Reademail,openaEachment
Wecon+nuedtheinves+ga+onbypivo+ngintotheendpointdatasourceandusedaworkflowac+ontodeterminewhichprocessontheendpointwasresponsiblefortheoutboundcommunica+on.
WeBeganbyreviewingthreatintelrelatedeventsforapar+cularIPaddressandobservedDNS,Proxy,andEndpointeventsforauserinSales.
Inves+ga+oncomplete!LetsgetthisturnedovertoIncidentReponseteam.
Wetracedthesvchost.exeZeusmalwarebacktoit’sparentprocessIDwhichwasthecalc.exedownloader/dropper.
Onceourrootcauseanalysiswascomplete,weshivedoutfocusintotheweblogstodeterminethatthesensi+vepdffilewasobtainedviaabruteforceaEackagainstthecompanywebsite.
Wewereabletoseewhichfilewasopenedbythevulnerableappanddeterminedthatthemaliciousfilewasdeliveredtotheuserviaemail.
AquicksearchintothemaillogsrevealedthedetailsbehindthephishingaEackandrevealedthatthescopeofthecompromisewaslimitedtojusttheoneuser.
Wetracedcalc.exebacktothevulnerableapplica+onPDFReader.
SQLInjec+on● SQLinjec+on● Codeinjec+on● OScommanding● LDAPinjec+on● XMLinjec+on● XPathinjec+on● SSIinjec+on● IMAP/SMTPinjec+on● Bufferoverflow
TheanatomyofaSQLinjec+onaEack
SELECT * FROM users WHERE email='xxx@xxx.com' OR 1 = 1 -- ' AND password='xxx';
xxx@xxx.xxx' OR 1 = 1 -- '
xxx
admin@admin.sys
1234
AnaEackermightsupply:
Whathavewehere?Ourlearningenvironmentconsistsof:• Abunchofpublically-accessiblesingle
Splunkservers• Eachwith~5.5Mevents,fromreal
environmentsbutmassaged:
• WindowsSecurityevents• Apachewebaccesslogs• BroDNS&HTTP• PaloAltotrafficlogs• Someothervariousbits
hEps://splunkbase.splunk.com/app/1528/
SearchforpossibleSQLinjec+oninyourevents:ü looksforpaEernsinURIqueryfieldtoseeif
anyonehasinjectedthemwithSQLstatements
ü usestandarddevia+onsthatare2.5+mesgreaterthantheaveragelengthofyourURIqueryfield
Macrosused• sqlinjec+on_paEern(sourcetype,uriqueryfield)• sqlinjec+on_stats(sourcetype,uriqueryfield)
RegularExpressionFTWsqlinjec+on_rexisasearchmacro.Itcontains:(?<injec,on>(?i)select.*?from|union.*?select|\'$|delete.*?from|update.*?set|alter.*?table|([\%27|\'](%20)*=(%20)*[\%27|\'])|\w*[%27|\']or)Whichmeans:Inthestringwearegiven,lookforANYofthefollowingmatchesandputthatintothe“injec+on”field.• AnythingcontainingSELECTfollowedbyFROM• AnythingcontainingUNIONfollowedbySELECT• Anythingwitha‘attheend• AnythingcontainingDELETEfollowedbyFROM• AnythingcontainingUPDATEfollowedbySET• AnythingcontainingALTERfollowedbyTABLE• A%27ORa‘andthena%20andanyamountofcharactersthena%20andthena%27ORa‘
• Note:%27isencoded“’”and%20isencoded<space>• Anyamountofwordcharactersfollowedbya%27ORa‘andthen“or”
Summary:WebaEacks/SQLinjec+on● SQLinjec+onprovideaEackerswitheasyaccesstodata● Detec+ngadvancedSQLinjec+onishard–useanapp!
● UnderstandwhereSQLiishappeningonyournetworkandputastoptoit.
● AugmentyourWAFwithenterprise-wideSplunksearches.
domain=corp;user=dave;password=12345
encrypt
DNSQuery:ZG9tYWluPWNvcnA7dXNlcj1kYXZlO3Bhc3N3b3JkPTEyMzQ1DQoNCg==.aEack.com
ZG9tYWluPWNvcnA7dXNlcj1kYXZlO3Bhc3N3b3JkPTEyMzQ1DQoNCg==
FrameworkPOS:acard-stealingprogramthatexfiltratesdatafromthetarget’snetworkbytransmi�ngitasdomainnamesystem(DNS)traffic
Butthebigdifferenceisthewayhowstolendataisexfiltrated:themalwareusedDNSrequests!hEps://blog.gdatasovware.com/2014/10/23942-new-frameworkpos-
variant-exfiltrates-data-via-dns-requests
“”
…feworganiza,onsactuallykeepdetailedlogsorrecordsoftheDNStraffictraversingtheirnetworks—makingitanidealwaytosiphondatafromahackednetwork.
hEp://krebsonsecurity.com/2015/05/deconstruc+ng-the-2014-sally-beauty-breach/#more-30872
“”
DNSexfiltra+on
hEps://splunkbase.splunk.com/app/2734/
DNSexfildetec+on–tricksofthetradeü parseURLs&complicatedTLDs(TopLevelDomain)ü calculateShannonEntropy
Listofprovidedlookups• ut_parse_simple(url)• ut_parse(url,list)orut_parse_extended(url,list)• ut_shannon(word)• ut_countset(word,set)• ut_suites(word,sets)• ut_meaning(word)• ut_bayesian(word)• ut_levenshtein(word1,word2)
Examples• Thedomainaaaaa.comhasaShannonEntropyscoreof1.8(verylow)• Thedomaingoogle.comhasaShannonEntropyscoreof2.6(ratherlow)• A00wlkj—(-a.aslkn-C.a.2.sk.esasdfasf1111)-890209uC.4.comhasaShannon
Entropyscoreof3(ratherhigh)
Layman’sdefini+on:ascorereflec+ngtherandomnessormeasureofuncertaintyofastring
ShannonEntropy
Detec+ngDataExfiltra+on
index=brosourcetype=bro_dns|`ut_parse(query)`|`ut_shannon(ut_subdomain)`|evalsublen=length(ut_subdomain)|tableut_domainut_subdomainut_shannonsublen
TIPSq LeverageourBroDNSdataq CalculateShannonEntropyscoresq Calculatesubdomainlengthq DisplayDetails
Detec+ngDataExfiltra+on
…|statscountavg(ut_shannon)asavg_shaavg(sublen)asavg_sublenstdev(sublen)asstdev_sublenbyut_domain|searchavg_sha>3avg_sublen>20stdev_sublen<2
TIPSq LeverageourBroDNSdataq CalculateShannonEntropyscoresq Calculatesubdomainlengthq Displaycount,scores,lengths,
devia+ons
Detec+ngDataExfiltra+onRESULTS• Exfiltra+ngdatarequiresmanyDNSrequests–lookforhighcounts• DNSexfiltra+ontomooo.comandchickenkiller.com
Summary:DNSexfiltra+on● Exfiltra+onbyDNSandICMPisaverycommontechnique● Manyorganiza+onsdonotanalyzeDNSac+vity–donotbelikethem!● NoDNSlogs?NoSplunkStream?LookatFWbytecounts
hEps://splunkbase.splunk.com/app/3435/
Iden+fybadguysinyourenvironment:ü 45+usecasescommoninUEBAproducts,all
freeonSplunkEnterpriseü TargetexternalaEackersandinsiderthreatü Scalesfromsmalltomassivecompaniesü Savefromtheapp,sendresultstoES/UBA
ThemostwidelydeployedUEBAvendorinthemarketisSplunkEnterprise,butnooneknowsit.
Solveusecasesyoucantodayforfree,thenuseSplunkUBAforadvancedMLdetec+on.
SplunkSecurityEssen+als
TimeSeriesAnalysiswithStandardDevia+on
FirstTimeSeenpoweredbystats
GeneralSecurityAnaly+csSearches
TypesofUseCases
● Howdoestheappwork?– Leveragesprimarily| stats forUEBA– AlsoimplementsseveraladvancedSplunksearches(URLToolbox,etc.)
● WhycallitUEBA?– TheseusecasesareoveninUEBAtools– 2/3ofusecasebuildonabaseline,whichisahallmarkofUEBA– 1/3areadvancedanaly+csthatothervendorsshowcaseintheirUEBA
● Howdoesitscale?– Appautomatestheu+liza+onofhighscaletechniques– SummaryindexingforTimeSeries,cachinginlookupforFirstTime
79
SplunkEnterprise
-BigDataAnaly+csPlaporm-
SplunkEnterpriseSecurity
-SecurityAnaly+csPlaporm-
ThreatHun+ngwithSplunk
Hypotheses
AutomatedAnaly+cs
DataScience&MachineLearning
Data&IntelligenceEnrichment
DataSearch
Visualisa+on
Maturity
ThreatHun+ngDataEnrichment
ThreatHun+ngAutoma+on
Ingest&OnboardAnyThreatHun+ng
MachineDataSource
Search&VisualiseRela+onshipsforFasterHun+ng
Filterable
KSIsspecifictoRisk
Riskassignedtosystem,userorother
UnderAdvancedThreat,selectRiskAnalysis
Filterable,downtoIoC
KSIsspecifictoThreat
Mostac+vethreatsource
Scrolldown… Scroll
UnderAdvancedThreat,selectThreatAc+vity
DatafromassetframeworkConfigurableSwimlanes
Darker=moreevents
Allhappenedaroundsame+meChangeto“Today”ifneeded
AssetInves+gator,enter“192.168.56.102”
SupervisedMachineLearning
95
DomainName TotalCnt RiskFactor AGD SessionTime RefEntropy NullUa Outcome
yyfaimjmocdu.com 144 6.05 1 1 0 0 Maliciousjjeyd2u37an30.com 6192 5.05 0 1 0 0 Maliciouscdn4s.steelhousemedia.com 107 3 0 0 0 0 Benignlog.tagcade.com 111 2 0 1 0 0 Benigngo.vidprocess.com 170 2 0 0 0 0 Benignstatse.webtrendslive.com 310 2 0 1 0 0 Benigncdn4s.steelhousemedia.com 107 1 0 0 0 0 Benignlog.tagcade.com 111 1 0 1 0 0 Benign
UnsupervisedMachineLearning
• Notuning
• Programma+callyfindstrends
• UBAisprimarilyunsupervised
• Rigorouslytestedforfit
97
AlgorithmRawSecurityData AutomatedClustering
MLToolkit&Showcase• SplunkSupportedframeworkforbuildingMLApps
– Getitforfree:hEp://+ny.cc/splunkmlapp
• LeveragesPythonforScien+ficCompu+ng(PSC)add-on:– Open-sourcePythondatascienceecosystem– NumPy,SciPy,scitkit-learn,pandas,statsmodels
• Showcaseusecases:PredictHardDriveFailure,ServerPowerConsump+on,Applica+onUsage,CustomerChurn&more
• Standardalgorithmsoutofthebox:– Supervised:Logis+cRegression,SVM,LinearRegression,RandomForest,etc.– Unsupervised:KMeans,DBSCAN,SpectralClustering,PCA,KernelPCA,etc.
• Implementoneof300+algorithmsbyedi+ngPythonscripts
103
SplunkEnterprise
-BigDataAnaly+csPlaporm-
SplunkEnterpriseSecurity
-SecurityAnaly+csPlaporm-
ThreatHun+ngwithSplunk
ThreatHun+ngDataEnrichment
ThreatHun+ngAutoma+on
Ingest&OnboardAnyThreatHun+ng
MachineDataSource
Search&VisualiseRela+onshipsforFasterHun+ng
Hypotheses
AutomatedAnaly+cs
DataScience&MachineLearning
Data&IntelligenceEnrichment
DataSearch
Visualisa+on
Maturity
UserBehaviorAnaly+cs
-SecurityDataSciencePlaporm-
104
MachineLearningSecurityUseCasesMachine
LearningUseCases
PolymorphicAEackAnalysis
BehavioralPeerGroupAnalysis
User&En+tyBehaviorBaseline
Entropy/RareEventDetec+on
CyberAEack/ExternalThreatDetec+on
Reconnaissance,BotnetandC&CAnalysis
LateralMovementAnalysis
Sta+s+calAnalysis
DataExfiltra+onModels
IPReputa+onAnalysis
InsiderThreatDetec+on
User/DeviceDynamicFingerprin+ng
SplunkUBAUseCases
ACCOUNTTAKEOVER• Privilegedaccountcompromise• Dataexfiltra+on
LATERALMOVEMENT
• Pass-the-hashkillchain• Privilegeescala+onSUSPICIOUSACTIVITY• Misuseofcreden+als• Geo-loca+onanomalies
MALWAREATTACKS• Hiddenmalwareac+vityBOTNET,COMMAND&CONTROL
• Malwarebeaconing• Dataleakage
USER&ENTITYBEHAVIORANALYTICS• Suspiciousbehaviorbyaccountsor
devices
EXTERNALTHREATSINSIDERTHREATS
SplunkUserBehaviorAnaly+cs(UBA)• ~100%ofbreachesinvolvevalidcreden+als(MandiantReport)• Needtounderstandnormal&anomalousbehaviorsforALLusers• UBAdetectsAdvancedCyberaEacksandMaliciousInsiderThreats• LotsofMLunderthehood:
– BehaviorBaselining&Modeling– AnomalyDetec+on(30+models)– AdvancedThreatDetec+on
• E.g.,DataExfilThreat:– “Sawthisstrangelogin&datatransferforuserkwes+n
at3aminChina…”– SurfacethreattoSOCAnalysts
Raw Events
1
Statistical methods
Security semantics
2 Threat Models
Lateralmovement
ML
Patterns
Sequences
Beaconing
Land-speedviola+on
Threats
Kill chain sequence
5
Supporting evidence
Threat scoring
Graph Mining
4
Con
tinuo
us s
elf-l
earn
ing!
Anomalies graph
Entity relationship graph
3
Anomalies
RAW SECURITY EVENTS
ANOMALIES ANOMALY CHAINS (THREATS)
MACHINE LEARNING
GRAPH MINING
THREAT MODELS
Lateral Movement Beaconing Land-Speed Violation
HCI
Anomalies graph Entity relationship graph
Kill chain sequence Forensic artifacts Threat/Risk scoring
FEEDBACK
SecurityWorkshops
● SecurityReadinessWorkshop● DataScienceWorkshop● EnterpriseSecurityBenchmarkAssessment
Recommended