Tracing Transactions - Threat Hunting for Financially Motivated APTs.pdf
•
1 like•104 views
This document discusses tactics and techniques related to the FIN7 threat group. It mentions that FIN7 has been known to use PHP Mailer in phishing campaigns for initial access. It also notes that FIN7 has used legitimate services like Google Docs and Pastebin for command and control. The document further states that FIN7 generally uses existing credentials and built-in remote access applications to move laterally within networks.
Recommended
Recommended
More Related Content
Similar to Tracing Transactions - Threat Hunting for Financially Motivated APTs.pdf
Similar to Tracing Transactions - Threat Hunting for Financially Motivated APTs.pdf (20)
More from Brandon DeVault
More from Brandon DeVault (12)
Recently uploaded
Recently uploaded (20)
Tracing Transactions - Threat Hunting for Financially Motivated APTs.pdf
- 2. Security Analytics Alert Triage and Investigation Investigation Hunting Leads Threat Hunting (Intel, hypothesis, IoA, etc.)
- 5. Threat Intelligence • “FIN7 has been known to use PHP Mailer in their phishing campaigns” Initial Access • “FIN7 has been seen using legitimate services like Google docs and Pastebin for C2 in recent activity” Command and Control (C2) • “FIN7 generally uses existing credentials and built-in remote access applications to move laterally” Lateral Movement
- 6. Tools • Email Logs • Zeek • Elasticsearch / Kibana
- 7. Data Analyzers pastebin.com No text analyzers applied Requires exact match for search pastebin com “Tokenizer” applied Allows for full-text search
- 8. Developer Time! ??? What do you call the log entry for: Source IP Address
- 10. Initial Access “FIN7 has been known to use PHP Mailer in their phishing campaigns”
- 11. EXEC 172.32.21.0/24 Globo-FW-01 Globo-SW-01 ISP Globo-SW-02 AD/DNS 172.32.245.20 Email 172.32.245.222 Elasticsearch 172.32.245.125 Datacenter 172.32.245.0/24 Engineering 172.32.24.0/24 HR 172.32.22.0/24 Globo-FW-EXT Ascension Ops Admin 172.32.37.0/24 Finance 172.32.23.0/24 Azure Cloud Storage Globomantics Research Facility Network Diagram Globo-R-01 172.32.1.0/24
- 12. User Agents Software Making Requests for a User • Web Browsers • Email Readers • Shell Applications
- 13. Email Headers • Experimental or Extensions of the standard email header • X-Original-To • X-Campaign • X-Mailer
- 14. Demo! SMTP Email Headers Analysis
- 15. Command and Control (C2) • “FIN7 has been seen using legitimate services like Google docs and Pastebin for C2 in recent activity”
- 16. Bidirectional Command and Control (C2) Commands sent Feedback/results
- 19. Lateral Movement • “FIN7 generally uses existing credentials and built-in remote access applications to move laterally”
- 21. The Kingdom
- 24. Lateral Movement Administrative credentials compromised Malware: Keylogger or Mimikatz
- 25. Review, Automate, and Improve Intel Identify Protect Detect Respond Recover Emulate
- 26. Questions? • https://github.com/Pluralsight-SORCERI • www.devaultsecurity.com • linkedin. • twitter. devaultsecurity.com • github. • brandon-devault@pluralsight.com • https://app.pluralsight.com/profile/author/brandon-devault }