• Home

  • Documents

  • Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic...
26

Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

  • Upload
    others

  • View
    4

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address
Page 2: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Hunting Security Breaches in the Modern Threat Landscape Session ID 1.2

Lewis Tan CISSP, OPST

AMP Specialist, APJC

Advance Threat Solution, GSSO

Page 3: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

Industrialization of Hacking There is a multi-billion dollar global industry targeting your prized assets

$450 Billion

to

$1 Trillion Social

Security $1

Mobile Malware

$150

$ Bank

Account Info >$1000 depending

on account type and balance

Facebook Accounts $1 for an

account with 15 friends

Credit Card Data

$0.25-$60

Malware Development

$2500 (commercial

malware)

DDoS

DDoS as A Service ~$7/hour

Spam $50/500K

emails Medical

Records >$50

Exploits $1000- $300K

© 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3

Page 4: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public 4

Minutes to compromise, Months to discover & remediate

Source: Verizon http://www.wired.com/images_blogs/threatlevel/2012/03/Verizon-Data-Breach-Report-2012.pdf

Page 5: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public © 2015 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5

Not About Detections, But About Incident Response

Page 6: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

Outwit Cyber Attackers

Assume Compromise

Improve Your Security Posture

Think like an Attacker

Page 7: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

Think Like An Attacker

Page 8: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

F/W, NIPS,

Proxies, AV

gateways, WAF

Hacker’s perspective

Page 9: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

F/W, NIPS,

Proxies, AV

gateways, WAF

SSL, Port

Knocking,

Event/Tim

e Trigger

Hacker’s Perspective

Page 10: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

APT / Advanced Malware

Is now a tool for financial gain

Uses formal Development Techniques • Sandbox aware

• Quality Assurance to evade detection

• 24/7 Tech support available

Has become a math problem • End Point AV Signatures ~20 Million

• Total KNOWN Malware Samples ~100 M

• AV Efficacy Rate ~50%

Page 11: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

How do organizations address this?

11

Page 12: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

How do organizations address this?

12

• Time

• Tools

• Expense

Page 13: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Effective Malware Protection Strategies

Page 14: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

Network-Integrated,

Broad Sensor Base,

Context and

Automation

Continuous Advanced

Threat Protection, Big

Data Analytics

Security Intelligence

Agile and Open

Platforms,

Built for Scale,

Consistent Control,

Management

Strategic Imperatives

Network Endpoint Mobile Virtual Cloud

Visibility-Driven Threat-Focused Platform-Based

Page 15: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

Where do I start?

How bad is the

situation?

What systems were

affected?

What did the threat

do?

How do we recover?

How do we keep it

from happening

again?

Confirm Infection

Analyze Malware

Malware Proliferation

Remediate

Search

Network

Traffic

Search

Device

Logs

Scan

Devices

Define

Rules

(from

profile)

Build Test

Bed

Static &

Dynamic

Analysis

Device

Analysis

Network

Analysis

Proliferatio

n Analysis

Notification Quarantine Triage

Malware

Profile

Stop

Search for Re-infection

Update Profile

Confirm

Infe

ctio

n Id

entifie

d

Cannot Identify Infection No

Infection

Addressing Malware Issues It’s how quickly you can detect the infection, understand scope, and remediate the problem

Page 16: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

F/W, NIPS,

Proxies, AV

gateways, WAF

SSL, Port

Knocking,

Event/Tim

e Trigger

East – West

80%

North –

South

20%

50%

Effective solution = ROI

Page 17: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

F/W, NIPS,

Proxies, AV

gateways, WAF

SSL, Port

Knocking,

Event/Tim

e Trigger

East – West

80%

North –

South

20%

50%

Effective solution = ROI

Page 18: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

Plan B: Retrospection

– Track system behaviors regardless of disposition

– “In-flight” correction

– Contain & correct damage, expel embedded intruders

Reveals malicious activity

Mode: Incident Response

Plan A: Prevention

– Speed: Real-time, dynamic decisions trained on real-world data

– High accuracy, low false positives / negatives

Raise the bar, reduce attack surface

Mode: Security control

Do Security Different!

Page 19: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

Desire to break the chain as far to the left as possible.

Page 19

Defensive/protective measures Clean-up costs

Long response time

Long

remediation

time Reduced

response time

Reduced

remediation time

through RCA

Indicators of Compromise

REACTIVE

SECURITY POSTURE PROACTIVE SECURITY

Device Trajectory &

Threat Root Cause

File Trajectory

& Outbreak

Control

Page 20: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

Use Case: Threat Hunting with a Generic IOC Event

Can begin search using any data from the IOC Event – SHA, URL, IP Address

Device Trajectory can be used to determine host details – Link between processes, File name, Location on disk

File Trajectory can be used to focus on the threat – Malware Gateway, Threat Details, File Analysis

Custom Detection to control files – Remediate without escalation, Quickly quarantine files, Immediate protection across

all systems

Page 21: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

Threat Hunting: Trajectory

21

Outlook.exe is running

Email drops photo.zip as an attachment

explorer.exe called to extract contents

photo.exe was executed photo.exe contacts

a website via http

photo.exe drops several additional components

Executes a file named csrss.exe in the Outlook TMP directory

Beacons to the site listed in our cracked DGA - IOC Events

Page 22: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

These

applications

are affected What

The breach

affected

these areas Where

This is the

scope of

exposure over

time When

Here is the origin

and progression

of the threat How

Focus on these

users first Who

AMP Provides Contextual Awareness and Visibility That Allows You to Take Control of an Attack Before It Causes Damage

Page 23: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

Cisco’s AMP Everywhere Strategy Means Protection Across the Extended Network

MAC

AMP for

Networks

PC

AMP for

Cloud Web

Security

& Hosted Email

CWS

Virtual

AMP on Web &

Email Security

Appliances

Mobile

AMP on ASA

Firewall with

FirePOWER

Services

AMP for Endpoints

AMP Private Cloud

Virtual Appliance AMP Threat Grid

Dynamic Malware Analysis +

Threat Intelligence Engine

Page 24: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

Cisco AMP is Both Point-in-Time and Continuous

Retrospective Security

Continuous Analysis – PLAN B

0001110 1001 1101 1110011 0110011 101000 0110 00 0111000 111010011 101 1100001 110

1000111010011101 1100001110001110 1001 1101 1110011 0110011 101000 0110 00

0100001100001 1100 0111010011101 1100001110001110 1001 1101 1110011 0110011 101000 0110 00

Breadth and Control points:

File Fingerprint and

Metadata

File and Network I/O

Process Information

Telemetry

Stream

Continuous

feed

Web WWW

Endpoints

Network Email

Devices IPS

Point-in-Time Protection

File Reputation & Sandboxing – PLAN A

Dynamic

Analysis

Machine

Learning

Fuzzy

Finger-

printing

Advanced

Analytics

One-to-One

Signature

Page 25: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Cisco and/or its affiliates. All rights reserved. Presentation_ID Cisco Public

Conclusion The Malware Approach…

Attackers are determined and resourceful

– Malware still on devices, detection not 100%

– Point-in-time detection is not sufficient

– Attacks evolved over time

– Integrated response required to be effective

Cisco AMP solves business problems

– Where do I start?

– What is the scope and how bad is the situation?

– What was the point and method of entry?

– Can I control and remediate across the network and endpoints?

Computer

Virtual Machine

Mobile

Mobile

Virtual Machine Computer

Network

Collective

Security

Intelligence

Cloud

Mobile

Mobile

Page 26: Hunting Security Breaches in the Modern Threat Landscape...Use Case: Threat Hunting with a Generic IOC Event Can begin search using any data from the IOC Event –SHA, URL, IP Address

Sysmon İle Siber Tehdit Avcılığı (Threat Hunting)

Sysmon İle Siber Tehdit Avcılığı (Threat Hunting)

Engineering
ATT&CKing The Command Line & Hunting For More...Threat Hunting Automation Motivation Current Reality Threat hunting used to detect activity we are currently missing. As defenders,

ATT&CKing The Command Line & Hunting For More...Threat Hunting Automation Motivation Current Reality Threat hunting used to detect activity we are currently missing. As defenders,

Documents
FALCON OVERWATCH MANAGED THREAT HUNTING · Director of Information Technology, TransPak. CrowdStrike Products FALCON OVERWATCH MANAGED THREAT HUNTING CROWDSTRIKE MANAGED THREAT HUNTING

FALCON OVERWATCH MANAGED THREAT HUNTING · Director of Information Technology, TransPak. CrowdStrike Products FALCON OVERWATCH MANAGED THREAT HUNTING CROWDSTRIKE MANAGED THREAT HUNTING

Documents
Threat Hunting with Splunk

Threat Hunting with Splunk

Technology
Threat hunting workshop

Threat hunting workshop

Technology
Cyber Threat Hunting with Phirelight

Cyber Threat Hunting with Phirelight

Technology
Enabling Efficient Cyber Threat Hunting with Cyber Threat

Enabling Efficient Cyber Threat Hunting with Cyber Threat

Documents
TTPs for Threat Hunting in Refineries · TTPs for Threat Hunting in Refineries Dan Gunter | Twitter: @dan_gunter Principal Threat Analyst @ Dragos October 2018. ... •Not Red Teaming

TTPs for Threat Hunting in Refineries · TTPs for Threat Hunting in Refineries Dan Gunter | Twitter: @dan_gunter Principal Threat Analyst @ Dragos October 2018. ... •Not Red Teaming

Documents
Threat Hunting 102: Beyond the Basics

Threat Hunting 102: Beyond the Basics

Technology
Threat Hunting with ELK training - Intellectual Point

Threat Hunting with ELK training - Intellectual Point

Documents
IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

Documents
Building a Successful Threat Hunting Program

Building a Successful Threat Hunting Program

Technology
Bsides threat hunting

Bsides threat hunting

Technology
Threat Hunting Report can be viewed here - News · THREAT HUNTING REPORT 3. THRET HNTING REPORT 4 KEY SURVEY FINDINGS ... Among the respondents to the threat hunting survey, six in

Threat Hunting Report can be viewed here - News · THREAT HUNTING REPORT 3. THRET HNTING REPORT 4 KEY SURVEY FINDINGS ... Among the respondents to the threat hunting survey, six in

Documents
Threat hunting as SOC process

Threat hunting as SOC process

Technology
The Elastic Guide to Threat Hunting - copyright

The Elastic Guide to Threat Hunting - copyright

Documents
Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION [email protected]. ... to put new

Documents
Developing an Adaptive Threat Hunting Solution: The

Developing an Adaptive Threat Hunting Solution: The

Documents
GUIDE TO CYBER THREAT HUNTING - Tyler Technologies

GUIDE TO CYBER THREAT HUNTING - Tyler Technologies

Documents
DEMYSTIFYING THREAT HUNTING · 2021. 1. 26. · We wanted to clear up the confusion. Demystifying Threat Hunting will explain: • What threat hunting is – and what it isn’t

DEMYSTIFYING THREAT HUNTING · 2021. 1. 26. · We wanted to clear up the confusion. Demystifying Threat Hunting will explain: • What threat hunting is – and what it isn’t

Documents
Proactive Threat Hunting Combining the use of …Proactive Threat Hunting Combining the use of threat intelligence, analytics and automated security tools with human smarts Benefits

Proactive Threat Hunting Combining the use of …Proactive Threat Hunting Combining the use of threat intelligence, analytics and automated security tools with human smarts Benefits

Documents
Endgame SANS - Threat Hunting Before the Incident

Endgame SANS - Threat Hunting Before the Incident

Documents
Threat Hunting Using a Machine Learning Approach

Threat Hunting Using a Machine Learning Approach

Documents
Kaspersky Threat Hunting · • Immediate protection against any detected threat through automatic antivirus database updates. • Retrospective analysis of incidents and threat hunting,

Kaspersky Threat Hunting · • Immediate protection against any detected threat through automatic antivirus database updates. • Retrospective analysis of incidents and threat hunting,

Documents
Threat Hunting

Threat Hunting

Internet
Abstract Tools for Effective Threat Hunting

Abstract Tools for Effective Threat Hunting

Technology
Industrial Control System Cyber Threat Hunting

Industrial Control System Cyber Threat Hunting

Documents
(CMC THREAT HUNTING SERVICE)

(CMC THREAT HUNTING SERVICE)

Documents
2020 THREAT HUNTING REPORT - ExtraHop

2020 THREAT HUNTING REPORT - ExtraHop

Documents
Hands-on Learning Experiences for Cyber Threat Hunting Education · Cyber Hunting • Cyber threat hunting has emerged as a critical part of cyber security practice. However, –

Hands-on Learning Experiences for Cyber Threat Hunting Education · Cyber Hunting • Cyber threat hunting has emerged as a critical part of cyber security practice. However, –

Documents