This document summarizes a presentation about company phishing trips. It discusses how phishing kits work and how they are often deployed through unpatched systems or content management systems like WordPress. It also describes ways to detect phishing kits, such as monitoring TLS certificates for domain names similar to your company, and using tools like Certstream to track new certificates. The presentation recommends responding to phishing threats by deploying "honeycreds" - fake credentials placed to observe which ones are tested by attackers. Statistics on hundreds of fake credentials placed showed most were tested within hours or days.

1. Company Phishing Trip
Jared Peck
SANS SIEM SUMMIT
October 7th, 2019

2. Background
Firefighter
Paramedic
Sysadmin
SOC Analyst
Threat Intelligence

3. Why Are We Here?

4. What is a Phishing Kit?
• Pre-packaged
• Easy to deploy
• Often a .zip file
• May be PhaaS
boxman19.zip
apple.zip
username18.zip
bulletprofitlink
16shop

5. PhaaS

6. Pay Your Bill!

7. How are most kits deployed?
• Unpatched Systems!
• Wordpress
• Joomla
• Other CMS Systems

8. Basic Kit

9. Basic Kit

10. Basic Kit – login.php

11. HTML

12. login.php

13. Confirm.php

14. Pwned!

15. Give it Some Legitimacy

16. Let’s Gut a Bigger Phish

17. Let’s Gut a Bigger Phish

18. blockerz.php

19. Sc.php

20. Phisherman?

22. Phishing off the Dox?

23. Real Phisherman?

24. Real Phisherman…(index.php)

25. Famous Phisherman…(index.php)

26. Something Smells Phishy…(index.php)

27. Phisherman’s Friend?

28. Phisherman’s Friend?

29. No Honor Among Thieves
/ Function to get country and country sort;
function country_sort(){
$sorter = "";
$array = array(114,101,115,117,108,116,98,111,120,49,52,64,103,109,97,105,108,46,99,111,109);
$count = count($array);
for ($i = 0; $i < $count; $i++) {
$sorter .= chr($array[$i]);
}
return array($sorter, $GLOBALS['recipient']);
}

30. No Honor Among Thieves
• Translates to “resultbox14@gmail.com”
• Address still registered!

31. Shenanigans

32. Shenanigans

33. Phish Finders

34. Phish Finders
@PhishingAi
@Feedphish
@nullcookies
@JayTHL
@dave_daves
@MSAdministrator
ANYONE TWEETING
@ YOUR COMPANY!

35. Phishing Guides
• Openphish
• Phishtank
• Phishbank
• RSA
• RiskIQ

36. Finding Phish Yourself

37. Finding Phish Yourself
• Certstream (Python)
• Track new TLS certificates issued
• “login.companyname.anysite.com”

38. https://gist.github.com/medic642/
• regex-certstream-slack.py

39. https://gist.github.com/medic642/
regex_certstream_mail.py

40. https://gist.github.com/medic642/
phish_ssdeep.py (in progress!!!)

41. Finding Phish Yourself

42. Finding Phish Yourself
somepoorsap.com/wp-admin/mycompany.com/3b7a4c2a/login.php?state=y

43. Give it Some Legitimacy(again)

44. Splunk all the Things!
index=waf sourcetype=logs (or wherever you have http referrer logs)
| fields http_referrer
| fields - _raw
| where (match(http_referrer, “<regex1>”) OR match(http_referrer,
“<regex2>”) OR <…>)
| stats count by http_referrer

45. So….Now What?

46. “HoneyCreds”

47. First Try

48. Enhance!

49. A Man Has No Name(s)

50. • 1923 Yankees Roster
• 1886 Census List
• Famous shipwrecks?
I See Dead People

51. • 300+ “Honeycreds” placed
• 43% Seen tested
• Over 100 Testing IPs to monitor
• Hundreds of real customer creds
• Shortest = <1 minute
• Longest = ~ 1 year
• Some creds re-tested much later
Statistics

52. • Most credentials were tested within 24 hours
• Average (mean)– ~ 9 days
• Median – 5 hours
• 3-4 other customer creds tested with fakes most
times
More Statistics

53. Summary
• Understand phishing kits targeting your org
• Find these kits in your logs
• Build some regex detection
• Automate!

54. Jared Peck
@medic642
Questions?