BlueHat v17 || Scaling Incident Response - 5 Keys to Successful Defense at Scale
•Als PPTX, PDF herunterladen•
0 gefällt mir•471 views
Matt Swann, Microsoft As defenders, we watch our intrusion detection systems like a hawk so that we know when to jump into action. However, successfully evicting an adversary in a large-scale environment requires capabilities beyond detection. In this talk I describe 5 capabilities that network defenders must have in order to effectively respond to an intrusion in a large-scale service. I describe how we overcame these challenges in Office 365 with pointers to source code and reusable tooling.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie BlueHat v17 || Scaling Incident Response - 5 Keys to Successful Defense at Scale
Ähnlich wie BlueHat v17 || Scaling Incident Response - 5 Keys to Successful Defense at Scale (20)
Mehr von BlueHat Security Conference
Mehr von BlueHat Security Conference (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
BlueHat v17 || Scaling Incident Response - 5 Keys to Successful Defense at Scale
- 1. Scaling Incident Response 5 patterns for successful defense at cloud scale
- 2. the scale of modern cloud services challenges our ability to investigate and respond
- 3. 200k servers many domains – or none at all 15+ terabytes of event logs
- 4. Distributed inventory Proactive forensics Fleet-wide visibility Fleet-wide response Schematized data
- 5. Distributed inventory “My cloud is a hostile environment for an adversary.”
- 6. how can I be confident about the security health of my fleet?
- 10. Proactive forensics “All the data I need is at my fingertips.”
- 11. when I triage an alert, how long does it take to put it in context?
- 12. event store detection results
- 16. Fleet-wide visibility “My optics enable me to match the tempo of my adversary.”
- 17. when I detect an adversary’s activity, how do I find and follow him throughout my fleet?
- 18. ioc store
- 19. ioc store detection results
- 20. job repository
- 21. job repository
- 22. job repository
- 24. Add IP IOC Alerts from processes accessing this IP Dump process memory Extract malware indicators Scan process memory for malware indicators Processes matching these indicators Dump process memory Extract network indicators Add IOCs for new network indicators
- 25. Fleet-wide response “My response capability is independent of the scale of my fleet.”
- 26. we’ve identified our adversary’s TTPs and we’re ready to evict. how do we take action fleet-wide?
- 28. ioc store job repository
- 29. Schematized data “I combine disparate data sources into an intelligent experience.”
- 30. how do we avoid being overwhelmed by all this data?
- 31. Timestamp Machine Domain User EventID EventData 2017-10-31T13:01:59Z machine01 domain1 user01 4688 USER01|DOMAIN|powershell.exe Timestamp MachineName UserName DetectionName DetectionContext 2017-10-31T13:01:59Z MACHINE01.domain1 USER01 PSEncCmd WebClient;IEX 2017-10-31T13:05:59Z MACHINE01.domain1 Beacon 104.46.57.160 Timestamp Name DomainName ProcessName ProcessId ExtractedEntity 2017-10-31T15:15:01Z MACHINE01 domain1 POWERSHELL.EXE 4660 104.46.57.160 Timestamp MachineName ProcessPath PID IOC 2017-10-31T13:01:59Z machine01.DOMAIN1 C:PowerShell.exe 4660 104.46.57.160 Timestamp MachineName Process ProcessId Yara rule 2017-10-31T13:01:59Z MACHINE01.domain1 powershell.exe 4660 Mimikatz
- 32. Timestamp Machine Domain User EventID EventData 2017-10-31T13:01:59Z machine01 domain1 user01 4688 USER01|DOMAIN|powershell.exe Timestamp MachineName UserName DetectionName DetectionContext 2017-10-31T13:01:59Z MACHINE01.domain1 USER01 PSEncCmd WebClient;IEX 2017-10-31T13:05:59Z MACHINE01.domain1 Beacon 104.46.57.160 Timestamp Name DomainName ProcessName ProcessId ExtractedEntity 2017-10-31T15:15:01Z MACHINE01 domain1 POWERSHELL.EXE 4660 104.46.57.160 Timestamp MachineName ProcessPath PID IOC 2017-10-31T13:01:59Z machine01.DOMAIN1 C:PowerShell.exe 4660 104.46.57.160 Timestamp MachineName Process ProcessId Yara rule 2017-10-31T13:01:59Z MACHINE01.domain1 powershell.exe 4660 Mimikatz
- 33. Timestamp MachineName MachineDomain User EventID EventData 2017-10-31T13:01:59Z MACHINE01 domain1 user01 4688 USER01|DOMAIN|powershell.exe Timestamp MachineName MachineDomain UserName DetectionName DetectionContext 2017-10-31T13:01:59Z MACHINE01 domain1 USER01 PSEncCmd WebClient;IEX 2017-10-31T13:05:59Z MACHINE01 domain1 Beacon 104.46.57.160 Timestamp MachineName MachineDomain ProcessName ProcessId ExtractedEntity 2017-10-31T15:15:01Z MACHINE01 domain1 POWERSHELL.EXE 4660 104.46.57.160 Timestamp MachineName MachineDomain ProcessPath PID IOC 2017-10-31T13:01:59Z MACHINE01 domain1 C:PowerShell.exe 4660 104.46.57.160 Timestamp MachineName MachineDomain Process ProcessId Yara rule 2017-10-31T13:01:59Z MACHINE01 domain1 powershell.exe 4660 Mimikatz
- 34. Timestamp MachineName MachineDomain UserName EventID EventData 2017-10-31T13:01:59Z MACHINE01 domain1 user01 4688 USER01|DOMAIN|powershell.exe Timestamp MachineName MachineDomain UserName DetectionName DetectionContext 2017-10-31T13:01:59Z MACHINE01 domain1 user01 PSEncCmd WebClient;IEX 2017-10-31T13:05:59Z MACHINE01 domain1 Beacon 104.46.57.160 Timestamp MachineName MachineDomain ProcessName ProcessId ExtractedEntity 2017-10-31T15:15:01Z MACHINE01 domain1 powershell.exe 4660 104.46.57.160 Timestamp MachineName MachineDomain ProcessName ProcessId IOC 2017-10-31T13:01:59Z MACHINE01 domain1 powershell.exe 4660 104.46.57.160 Timestamp MachineName MachineDomain ProcessName ProcessId Yara rule 2017-10-31T13:01:59Z MACHINE01 domain1 powershell.exe 4660 Mimikatz
- 35. Timestamp MachineName MachineDomain UserName EventID EventData 2017-10-31T13:01:59Z MACHINE01 domain1 user01 4688 USER01|DOMAIN|powershell.exe Timestamp MachineName MachineDomain UserName DetectionName IPAddress DetectionContext 2017-10-31T13:01:59Z MACHINE01 domain1 user01 PSEncCmd WebClient;IEX 2017-10-31T13:05:59Z MACHINE01 domain1 Beacon 104.46.57.160 Timestamp MachineName MachineDomain ProcessName ProcessId IPAddress 2017-10-31T15:15:01Z MACHINE01 domain1 powershell.exe 4660 104.46.57.160 Timestamp MachineName MachineDomain ProcessName ProcessId IPAddress 2017-10-31T13:01:59Z MACHINE01 domain1 powershell.exe 4660 104.46.57.160 Timestamp MachineName MachineDomain ProcessName ProcessId Yara rule 2017-10-31T13:01:59Z MACHINE01 domain1 powershell.exe 4660 Mimikatz
- 37. Summary
- 38. we must empower our defenders with capabilities that scale to the size of our cloud
Hinweis der Redaktion
- Matt is a Principal Engineering Manager in the OneDrive and SharePoint team at Microsoft. He drove the security development process for SharePoint 2010 and 2013, then built a team focused on cloud security for SharePoint Online. Matt is passionate about intrusion detection, incident response and catching adversaries. When he’s not catching bad guys, you can find him at home with his kids or hiking in Washington's beautiful Cascades. -----------------------------------
- latency – coverage – data overload – means we are not effective, which means we lose – even if we successfully detected!
- 5 superpowers that have enabled us to meet this challenge in Office 365
- log it before you need it so you can determine when something changed and what the state was at the time of compromise e.g. daily dump of all ASEP registry keys (there are many!)
- once you’ve captured the data, you’ll find that it lets you build better detections as well
- Another pattern is just-in-time forensic capture e.g. when a high-severity alert is detected, dump the entire state of the machine into the data store
- Another pattern is just-in-time forensic capture e.g. when a high-severity alert is detected, dump the entire state of the machine into the data store
- if I’m investigating an adversary, I might know DNS hostnames or IP addresses he uses I can distribute those IOCs to every agent in real-time via a pull model from an Azure cloud service
- when an adversary runs malware on these machines, I will get a real-time alert from the IOC match
- another technique I can use is to distribute a job across each machine a job is a set of parameters for a hard-coded task in each agent. this is not remote code execution the job repository will gradually distribute the job across the fleet to reduce impact
- for example, this might be a yara job
- yara allows me to locate malware signatures in memory on disk
- if one of the machines finds a match, it sends an alert back to our detection repository
- together, IOCs and jobs build a virtuous cycle that allows me to track my adversary across my fleet in real-time
- let’s use our job system to apply a disruptive action across the fleet – blocking an IP address by adding a static route, or a DNS hostname by updating the hosts file
- similarly, we can use our IOC service to take disruptive action autonomously. instead of just alerting when an IOC is matched, we can suspend the thread or suspend the process. e.g. thread injection
- Raw event logs Detection results Forensic data IOC hits Job results