Threat Intelligence Field of Dreams
•
3 gefällt mir•1,214 views
Threat Intelligence is by far one of the most over-used buzz words in the security industry. Many professionals have very mixed feelings about Threat Intelligence feeds as well. This discussion is around how LogRhythm’s internal security team utilizes Threat Intelligence to operationalize efficiently and streamline Security Operations processes and help improve an organization’s defenses. We will show how you can generate your own Threat Intelligence and create information sharing loops within like industries to fully realize the team's defensive capabilities. On top of the technical aspects around building out a good Threat Intel program, we will discuss how to manage this from a leadership perspective and get buy-in from the top. Most importantly, once these systems are in place, how we can show value to leadership using key performance indicators and leverage this to improve the overall security program.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Andere mochten auch
Andere mochten auch (20)
Ähnlich wie Threat Intelligence Field of Dreams
Ähnlich wie Threat Intelligence Field of Dreams (20)
Mehr von Greg Foss
Mehr von Greg Foss (10)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Threat Intelligence Field of Dreams
- 2. Company Confidential James Carder CISO | VP LogRhythm Labs Greg Foss Global Security Operations Team Lead
- 5. Company Confidential • Documents (e.g., FBI flash reports) • Blogs, emails • RSS feeds • CSV and text files • STIX • Open IOC • Malware samples • Packet capture • Forensic artifacts (files, email) Actionable data types Intel Reports Indicators of Compromise Raw Data Types • User Behaviors • Endpoint Behaviors • Network Behaviors Your Own Data
- 9. Company Confidential OSINT • Offensive and Defensive • Manual – In Depth Analysis of the target entity or individual(s) • Automated – High level analysis of metadata • Operationalize, Integrate, and Automate OSINT analysis FTW • Define goals – what to analyze, why, how, outputs, etc. • Indicators of Compromise • Data to feedback loops into defensive tools • Research • Attribution • Actors, victims, servers, locations, samples, etc.
- 10. Company Confidential OSINT OPSEC (Manual) • OPSEC : Operational Security • The target cannot know your organization is actively investigating them… • Use a USB-bootable Linux image such as Tails – non-persistent • Run both TOR and a VPN (commercial or use cloud systems) • Virtual Private Servers (VPS) located in other countries • Pay for services using bitcoin and/or pre-paid gift cards • Regardless of solution – understand the service’s logging policy, check for warrant canaries, and know your rights…
- 12. Company Confidential OSINT OPSEC (Automated – Corporate) • Register a Linux Amazon EC2 box (free tier) with no elastic IP • Purchase a Dyn DNS account – for dynamic DNS registration • Establish a PPTP VPN tunnel to the EC2 system(s) • Perform investigative analysis from these cloud-hosted systems and / or local boxes with proper precautions in place • Proxy traffic through and use SSH port forwarding to access services • Following the completion of the analysis, reboot the system. • By default, AWS will assign a new IP unless you use an elastic IP • Reconfigure the tunnels and DNS as necessary (automate this)
- 13. Company Confidential Automating OSINT and Response Domain Tools Passive Total VirusTotal Cisco AMP ThreatGRID Netflow / IDS Firewalls Proxy Endpoint SIEM API SecOps Infrastructure
- 14. Company Confidential Manual OSINT Analysis • Goal-Oriented • Define specific target and understand the data you wish to obtain • Technical – Accounts, Servers, Services, Software, Integrations • Social – Social Media, Photography, Wish Lists, Email • Physical – Address, Home IP Address, Business, Footprint • Logical – Network, Operational Intelligence, Where, When
- 15. Company Confidential A Few OSINT Tools • Maltego • Transforms! • Passive Total • Threat Intel and Maltego API! • Domain Tools IRIS • Whois History, Pivot off of data points (email, address, phone, etc.) • Shodan • The network search engine – everything from open VNC services to C2’s • Facebook / Linkedin / Spokeo / Pipl / etc. • Create fake accounts and use API integrations to automate searches
- 24. Company Confidential Case Study: Operationalizing POS Intel from a Threat Report Threat Report SIEM/Analytics Engine Hits, Alarm, Smart Response No Hits, No Alarm, Smart Response Automated Search using Host and Network IOCs and/or BrutPOS behavior in SIEM and on endpoint POS Network • Containment • Acquisition • Analysis • Confirmation • Remediation • Metrics/Reporting
- 25. Company Confidential SIEM/Analytics Engine Domain was opened in the last 7 days or registered by known bad…Smart Response Domain is reputable or categorized as good DNS name isn’t recognized or part of known malicious domain lists…Smart Response…check Domain Tools • Containment • Acquisition • Analysis • Confirmation • Remediation • Metrics/Reporting Internet Browsing Internet Case Study: Operationalizing Intel using Third Party Integrations
- 26. Company Confidential Case Study: Operationalizing Intel from Internal Behaviors / Baselines Assume credentials are stolen SIEM/Analytics Engine Detect: Network traffic to vl.ff.avast.com & su.ff.avast.com Detect: 128 Bit GUID cba871fa-80c9-48bc-9836- 8df3a7f67145 Identify: Avast AV Single Factor • Containment • Acquisition • Analysis • Confirmation • Remediation • Metrics/Reporting Smart Response: Does IT inventory have anything other than McAfee or ESET? If not, Smart Response into IR
- 27. Company Confidential Malware Sandbox e.g. Cuckoo Historical Case Data Analyst e.g. Malware, Forensics External Services e.g. Domain Tools, Virus Total Threat Intelligence e.g. ISACs, Threat Feeds, Flash Reports Offer Services to your friends Collect Intel & Collaborate Vulnerability Intelligence If you build it…they will come…
- 29. Company Confidential Is attribution important? • “If you know the enemy and know yourself you need not fear the results of a hundred battles” – Sun Tzu • “All warfare is based on deception. Hence, when we are able to attack we must seem unable, when using our force we must appear inactive, when we are near we must make the enemy believe we are far away, when we are far away we must make him believe we are near” – Sun Tzu
- 30. Company Confidential • Who did it? • Why did they do it? • What were they after? • Could we have prevented it? • APT, China • China 5yr plan, don’t know • Research data, intellectual property, I don’t know • No, not without more budget “China stole it, specifically an APT group out of A province. The data was then transferred to person B, located in province C. Then person B sent it to person D in Russia. Once in Russia, the stolen data ended up on person E’s table.” What if attribution was real’ized?
- 32. Company Confidential Honey Tokens and Document Bugging Tracking file access, modification, exfiltration, etc… • Use File Integrity Monitoring to track file interactions • Any predefined item, instrumented to generate a unique log • Strings, Drives, Directories, Hashes, ‘employees’
- 33. Company Confidential File Integrity Monitoring – Built in to Windows Logging
- 34. Company Confidential Document Bugging – How To • WebBug Background Information: http://ha.ckers.org/webbug.html • WebBug Server: https://bitbucket.org/ethanr/webbugserver • Bugged Files – Is Your Document Telling on You? Daniel Crowley and Damon Smith (Chaos Communication Camp 2015) https://www.youtube.com/watch?v=j5cjFul4ZIc
- 35. Company Confidential Document Tracking Same tricks used by Marketing / Sales for years. Normally for tracking emails, clicks, downloads, etc. Why loading external images within email is risky…
- 37. Company Confidential Issues with Document Tracking When a document is opened up offline, it is possible that information will be divulged about the tracking service itself. Be cognizant of this when bugging documents.
- 38. Company Confidential Issues with Document Tracking Visiting the site directly Dead giveaway that something phishy is up…
- 39. Company Confidential Issues with Document Tracking You may even get your domain flagged This can hinder your tracking ability Ensure that you check regularly…
- 40. Company Confidential Taking it a step further… • Honeybadger, Flash, Java, Client Side Code If you are able to execute code on the endpoint, you can uncover the true location, regardless of proxy
- 41. Company Confidential No help in court… • Evidence obtained via webbugs, tracing, or similar forms of tracking may not be admissible in court, as this could be considered entrapment. • FBI Case – Operation Torpedo • https://www.wired.com/2014/08/operation_torpedo/
- 42. Company Confidential Legalities of Document Bugging • Is it spying? • Can you really get in trouble for tracking your own things? • All boils down to intent…very grey area.
- 69. Company Confidential Conclusion • Developing and leveraging actionable OSINT data can help operationalize Threat Intelligence • Develop a cyclical Threat Intelligence ecosystem and implement automated responses to known threats • Take proactive measures by laying traps and various flags that will notify the SOC to anomalous activity • Use active defense techniques to learn more about the adversary and attempt to gain attribution • Understand the shortcomings of attribution and document bugging to avoid common pitfalls • Communicate across various departments and coordinate defensive efforts
- 70. Company Confidential James Carder James.Carder@LogRhythm.com CISO | VP LogRhythm Labs Greg Foss Greg.Foss@LogRhythm.com Global Security Operations Team Lead Thank You!