Recommended
More Related Content
What's hot
What's hot (6)
Similar to Uncovering and Visualizing Malicious Infrastructure
Similar to Uncovering and Visualizing Malicious Infrastructure (20)
Recently uploaded
Recently uploaded (20)
Uncovering and Visualizing Malicious Infrastructure
- 1. UNCOVERING AND VISUALIZING MALICIOUS INFRASTRUCTURE
- 2. ABOUT US
- 3. Security Research Manager & Security Researcher Cisco Umbrella (formerly OpenDNS) in San Francisco. Joined in 2015 ANDREA SCARFO Previously: System Administrator for 12 years
- 4. JOSH PYORRE Senior Security Research Analyst & Security Researcher Cisco Umbrella (formerly OpenDNS) in San Francisco. Joined in 2015 Consulting for Non-Profits: Previously:
- 5. SUMMARY ▸ Our Research ▸ Finding Maliciousness ▸ Why Build Visualizations ▸ Visualizations and Findings
- 6. OUR RESEARCH
- 7. CRIMINAL ACTIVITY Click here!! Click here!! $$$$$$$$$$$$$$
- 8. SPAM
- 11. WHAT IS THERE TO VISUALIZE? 95.31.22.193 185.90.61.36 185.90.61.37 62.112.8.34 87.229.111.163 188.126.94.79 82.118.242.158 217.195.60.211 84.124.94.11
- 12. COMPROMISED DOMAINS DEPENDS ON THE TYPE OF ATTACK
- 13. PHISHING DOMAINS DEPENDS ON THE TYPE OF ATTACK
- 14. COMMAND & CONTROL DOMAINS (DGAS) DEPENDS ON THE TYPE OF ATTACK
- 15. DEPENDS ON THE INFECTION METHOD SPAM
- 16. DEPENDS ON THE INFECTION METHOD WEBSITE COMPROMISE
- 17. DEPENDS ON THE INFECTION METHOD EXPLOIT KITS
- 19. FEATURES FROM THE IOCS
- 21. ANALYZING DGAS TO FIND THE C&C
- 22. EXAMPLE OF C&C CONTACT More Infected Users act as HTTP proxies between bots and C&Cs Infected users/ computers Accept and carry out commands Made up of Compromised Servers. Act as proxy between Nodes & C&C Backend C&C Backend Control Panel
- 23. C&C CONTACT - DOMAIN FLUX ▸ Large amount of changing DGA domains ▸ NX Domains ▸ Not all are registered - lots of noise to dig through ▸ One of the DGAs will be the C&C with a hosted IP address
- 24. PASSIVE DNS ▸ DOMAIN NAMES: ▸ C&C communications ▸ DGAs - resolving and NX domains ▸ IP ADDRESSES: ▸ Hosting IPs ▸ NAMSERVERS, EMAIL REGISTRANT: ▸ WHOIS Information ▸ HASHES OF MALICIOUS BINARIES: ▸ Dropped by RATS ▸ Contained in Spam ▸ Dropped by compromised websites or malvertising
- 25. 95.31.22.193 Tracking Hailstorm Spam USING PASSIVE DNS
- 26. 95.31.22.193
- 27. SELECT DOMAINS SHOW PHARMA-SPAM DOMAINS
- 28. WE CAN PIVOT AND FIND EVEN MORE DATA
- 29. WE CAN PIVOT AGAIN AND FIND EVEN MORE DATA
- 34. CO-OCCURRING DOMAINS ARE QUERIED JUST BEFORE OR AFTER A DOMAIN
- 35. OSINT WHERE DO YOU GET DATA TO LOOK AT?
- 38. DOMAINS FROM A PCAP IT’S FASTER TO PROGRAMMATICALLY PULL DATA OUT OF A PCAP
- 39. ANOTHER EXAMPLE OF A SITE WITH INTEL YOU COULD USE
- 40. ANOTHER EXAMPLE OF A SITE WITH INTEL YOU COULD USE
- 41. ANOTHER EXAMPLE OF A SITE WITH INTEL YOU COULD USE
- 42. YOU CAN WRITE YARA RULES TO AUTOMATICALLY HUNT FOR THINGS
- 43. AND YOU CAN DOWNLOAD AND PROCESS FILES, GETTING USEFUL INFO
- 44. FEEDS IN ADDITION TO STATIC/HISTORICAL MALICIOUSNESS, THERE ARE LIVE FEEDS
- 46. WHY VISUALS? ▸ Turn Messy Data into Meaningful Information ▸ Help Us Quickly Analyze Threat Hunting Data
- 47. Assessments of change, dynamics, and cause and effect are at the heart of thinking and explanation. To understand is to know… What cause provokes what effect, by what means, at what rate. How then is such knowledge to be represented? ~Edward Tufte
- 48. VISUALS THAT WE LIKE TO USE WE PROCESS WITH PYTHON AND THEN VISUALIZE USING D3 AND MATPLOTLIB
- 49. VISUALS WE LIKE TO USE ▸ Force-Directed Graph ▸ Timelines of First Seen Queries VS Domain Registration ▸ Timelines of Domain Queries ▸ Timelines of Queries From Network Captures ▸ Signature Patterns Built From Queries In Network Capture Files
- 51. SOME OF THE BEAUTIFUL THINGS YOU CAN CREATE WITH FORCE-DIRECTED GRAPHS
- 52. GAMEOVER ZEUS
- 53. MIRAI
- 54. QUERY TIMELINES
- 55. PATTERN MATCHING LOOKING AT THE TIMES OF POSTS AND GETS IN PCAPS
- 56. WHAT MAKES A VISUAL USEFUL?
- 57. QUESTIONS WE ASK OURSELVES When showing quantities, what will make the visual clear?
- 58. Am I placing the data in an appropriate context? force directed graphs: intuitive for networks QUESTIONS WE ASK OURSELVES
- 59. QUESTIONS WE ASK OURSELVES How can I … . reduce visual clutter ? . clarify primary information ? . highlight notable content ?
- 60. QUESTIONS WE ASK OURSELVES How can I assess change and rates of change ? ▸ Queries on Different Days to Same Domain Reveal Patterns, Assessed Change, and Rates of Change. ▸ We See This On Domains Which Show a Sudden Spike (the assessed change) and How Many Queries There Were On The Spike (or if it ever happened) Low Query Traffic Spike
- 61. VISUAL EXAMPLES OF ATTACK CAMPAIGNS
- 62. EMOTET
- 63. FORCE-DIRECTED GRAPH : EMOTET IPS AND DOMAINS OFTEN, YOU JUST HAVE A LISTS OF DOMAINS AND IPS
- 64. FORCE-DIRECTED GRAPH : EMOTET IPS AND DOMAINS PUT THAT LIST INTO A FORCE GRAPH
- 65. FORCE-DIRECTED GRAPH : EMOTET IPS AND DOMAINS FIND THE THINGS THAT STAND OUT
- 66. FORCE-DIRECTED GRAPH : EMOTET IPS AND DOMAINS FIND THE THINGS THAT STAND OUT
- 67. ENRICH THAT WITH ADDITIONAL PASSIVE DNS DATA AND TURN LABELS ON TO GET MORE INFO
- 68. THIS DOMAIN, ASSOCIATED WITH EMOTET WILL BE SEEN AGAIN LATER
- 69. TIMELINES
- 70. GRABBING JUST SOME PCAPS TO LOOK AT
- 73. PULL OUT THE DOMAINS WITH PYTHON
- 74. FROM ONE NETWORK CAPTURE BUILD A TIMELINE, SHOWING THE TIMES EMAILS WERE RECEIVED AND WHEN DOMAINS WERE FIRST-SEEN IN DNS
- 75. LOOKING AT INFORMATION ON THE DOMAINS IN THOSE PCAPS
- 76. LOOKING AT INFORMATION ON THE DOMAINS IN THOSE PCAPS
- 77. LOOKING AT INFORMATION ON THE DOMAINS IN THOSE PCAPS
- 78. ACTUALLY VISITING THE DOMAIN, A COMPROMISED INSTANCE OF WORDPRESS
- 79. VIEWING ALL THE EMOTET DOMAINS FROM A LOT OF PCAPS ON A TIMELINE TO FIND PATTERNS
- 80. PATTERNS
- 81. LOOKING AT THE TIMES IN BETWEEN POSTS AND GETS IN PCAPS
- 82. LOOKING AT THE TIMES IN BETWEEN POSTS AND GETS IN PCAPS
- 83. Times In Between Events } LOOKING AT THE TIMES IN BETWEEN POSTS AND GETS IN PCAPS
- 85. LOOKING AT THE TIMES IN BETWEEN POSTS AND GETS IN PCAPS
- 86. TRICKBOT
- 87. GRAPHS
- 90. ENRICHING THOSE SMALL CONNECTIONS TO FIND ADDITIONAL RELATIONSHIPS
- 91. TURN LABELS ON TO ELABORATE THE RELATIONSHIPS
- 92. TIMELINES
- 93. VIEWING ALL THE TRICKBOT DOMAINS FROM A LOT OF PCAPS ON A TIMELINE TO FIND PATTERNS
- 94. PATTERNS
- 95. LOOKING AT THE TIMES IN BETWEEN POSTS AND GETS IN PCAPS
- 96. HANCITOR
- 97. TIMELINES
- 98. VIEWING ALL THE HANCITOR DOMAINS FROM A LOT OF PCAPS ON A TIMELINE TO FIND PATTERNS
- 103. TURN LABELS ON TO ELABORATE THE RELATIONSHIPS
- 104. TURN LABELS ON TO ELABORATE THE RELATIONSHIPS
- 105. WE SEE MYKEEPTAKE.XYZ, FROM EMOTET IN HANCITOR TOO
- 106. PATTERNS
- 107. LOOKING AT THE TIMES IN BETWEEN POSTS AND GETS IN PCAPS
- 109. VIEWING TRICKBOT, EMOTET, AND HANCITOR ALL TOGETHER TO FIND SHARED INFRASTRUCTURE
- 110. EmotetCOMPARING THE TIMES OF DOMAINS BEING USED
- 111. Emotet Hancitor COMPARING THE TIMES OF DOMAINS BEING USED
- 112. Emotet Hancitor Trickbot COMPARING THE TIMES OF DOMAINS BEING USED
- 113. COMPARING THE QUERIES OF DOMAINS BEING USED