The document discusses advanced threat hunting techniques. It covers defining threat intelligence and the intelligence process. It discusses the challenges of small teams with limited resources and time. It provides examples of doing threat hunting wrong and right, such as using revision control and deployment scripts. It also discusses prioritization techniques, automation, and key performance indicators. The presentation provides examples of sources of samples and success stories. Key lessons are to organize signatures, automate systems, separate queues by type, hold prioritization meetings, and contribute to open source.

1. Advanced Threat Hunting
botconf
December 8, 2017
1

2. © 2018 ThreatConnect, Inc. All Rights Reserved.
Who Am I?
Director of Research Innovation
Research Team
ThreatConnect, Inc.
2

3. © 2018 ThreatConnect, Inc. All Rights Reserved.
Threat Intelligence
A Few Definitions
Tactical
Technical
Operational
Strategic
3

4. © 2018 ThreatConnect, Inc. All Rights Reserved.
Threat Intelligence
A Few Definitions
Tactical
Technical
Operational
Strategic
4

5. © 2018 ThreatConnect, Inc. All Rights Reserved. 5
The Intelligence Process
Source: Joint Intelligence / Joint Publication 2-0
(Joint Chiefs of Staff)

6. © 2018 ThreatConnect, Inc. All Rights Reserved. 6
The
Intelligence
Process
Relationship of
Data, Information,
and Intelligence
Source: Joint Intelligence / Joint Publication 2-0
(Joint Chiefs of Staff)

7. © 2018 ThreatConnect, Inc. All Rights Reserved.
David Bianco’s
“Pyramid of Pain”
7

8. © 2018 ThreatConnect, Inc. All Rights Reserved.
The Pyramid of Pain
Mirrored
8

9. © 2018 ThreatConnect, Inc. All Rights Reserved.
Small Teams
We are a team of ten people
Problem Definition, Part 1
9

10. © 2018 ThreatConnect, Inc. All Rights Reserved.
Limited Resources
Paid data feeds
Large data volume
Signal to noise
Limited tool capacity
Problem Definition, Part 2
10

11. © 2018 ThreatConnect, Inc. All Rights Reserved. 11
Limited Time
Analysts must spend time
analyzing, not moving data
around
Problem Definition, Part 3

12. © 2018 ThreatConnect, Inc. All Rights Reserved. 12

13. © 2018 ThreatConnect, Inc. All Rights Reserved.
Doing It Wrong
Maintaining team YARA rules:
1. On a file server
2. Some person’s laptop
3. Lots of people’s laptops
13

14. © 2018 ThreatConnect, Inc. All Rights Reserved.
Doing It Wrong
Wasting analyst’s time:
1. Downloading files
2. Uploading files
3. Waiting for AMAs to finish
14

15. © 2018 ThreatConnect, Inc. All Rights Reserved. 15

16. © 2018 ThreatConnect, Inc. All Rights Reserved.
Doing It Right
• Use revision control
• We use git!
• Deployment scripts
• Sync with threat intel platform
16

17. © 2018 ThreatConnect, Inc. All Rights Reserved.
YARA Rule
rule Nemucod_JS_Ransom
{
meta:
priority = "Medium"
confidence = "High"
sandbox_restricted = true
strings:
a$ = "If you do not pay in 3 days YOU LOOSE
ALL YOUR FILES" nocase wide ascii
b$ = " + "php4ts.dll";" wide ascii
c$ = ""To restore your files you have to
pay "" wide ascii
condition:
any of them
and new_file
}
17

18. © 2018 ThreatConnect, Inc. All Rights Reserved.
Associations for the Win
18

19. © 2018 ThreatConnect, Inc. All Rights Reserved.
plyara
19
• PLY (Python Lex Yacc)
• Parser handles VirusTotal and vanilla
rules
• Takes a ruleset file as input
• Outputs a python dictionary

20. © 2018 ThreatConnect, Inc. All Rights Reserved.
plyara
https://github.com/8u1a/plyara
20

21. © 2018 ThreatConnect, Inc. All Rights Reserved. 21
Netflix Open Connect Appliance: https://openconnect.netflix.com/en/software/
Send Improvements Upstream!

22. © 2018 ThreatConnect, Inc. All Rights Reserved. 22
Netflix Open Connect Appliance: https://openconnect.netflix.com/en/software/
Send Improvements Upstream!

23. © 2018 ThreatConnect, Inc. All Rights Reserved.
Demo: plyara
23

24. © 2018 ThreatConnect, Inc. All Rights Reserved.
Jupyter
Notebook Programming
Cells
Somewhere between REPL
and monolithic script
https://jupyter.org/
24

25. © 2018 ThreatConnect, Inc. All Rights Reserved.
Prioritization
25

26. © 2018 ThreatConnect, Inc. All Rights Reserved.
Lottery Queue
26

27. © 2018 ThreatConnect, Inc. All Rights Reserved. 27
Scoring

28. © 2018 ThreatConnect, Inc. All Rights Reserved.
Non-Intuitive Ordering
High Priority / High Confidence
High Priority / Medium Confidence
Medium Priority / High Confidence
Medium Priority / Medium Confidence
High Priority / Low Confidence
Medium Priority / Low Confidence
Low Priority / Low Confidence
28

29. © 2018 ThreatConnect, Inc. All Rights Reserved.
Non-Intuitive Ordering
29
High Priority / High Confidence
High Priority / Medium Confidence
Medium Priority / High Confidence
Medium Priority / Medium Confidence
High Priority / Low Confidence
Medium Priority / Low Confidence
Low Priority / Low Confidence

30. © 2018 ThreatConnect, Inc. All Rights Reserved.
Prioritization
Meetings
30

31. © 2018 ThreatConnect, Inc. All Rights Reserved.
Automate
AMAs
• Cuckoo Sandbox
• Joe Sandbox Cloud
• VxStream
• VMRay
• Lastline
• ThreatGrid
• ReversingLabs
• Your AMA Here!
31

32. © 2018 ThreatConnect, Inc. All Rights Reserved.
Future Work
• Data claimed
• Dataset analyzed
• Intelligence published
• Blog published
• New account created
• New customer
Business Value (BV)
32

33. © 2018 ThreatConnect, Inc. All Rights Reserved.
Happy Bean Counters
Budgets
• Maximize collection -> exploitation
• Collect metrics on utilization
• Establish KPIs
• AMAs at maximum capacity
33

34. © 2018 ThreatConnect, Inc. All Rights Reserved.
Key Performance Indicators
Speaking to Management
A Key Performance Indicator is a
measurable value that demonstrates how
effectively a company is achieving key
business objectives.
34

35. © 2018 ThreatConnect, Inc. All Rights Reserved.
Sources of Samples
35
• Carved from Network Capture (Use Bro!!)
• Incoming email attachments
• Endpoint collections (AV and otherwise)

36. © 2018 ThreatConnect, Inc. All Rights Reserved.
Sources of Samples
• Carved from Network Capture (Use Bro!!)
• Incoming email attachments
• Endpoint collections (AV and otherwise)
• Supply chain (CCleaner!!!!!!!!!!)
36

37. © 2018 ThreatConnect, Inc. All Rights Reserved. 37
https://threatconnect.com/blog/
kasperagent-malware-campaign/
Success
Stories

38. © 2018 ThreatConnect, Inc. All Rights Reserved. 38

39. © 2018 ThreatConnect, Inc. All Rights Reserved. 39
Success
Stories

40. © 2018 ThreatConnect, Inc. All Rights Reserved.
Success Stories
40
Success Stories

41. © 2018 ThreatConnect, Inc. All Rights Reserved.
• Organize signatures in revision control
• Automate between systems in tool chain
• Separate queues by signature type
• Attack Pattern
• Malware family / Adversary
• Periodic prioritization meetings
• SEND YOUR OPEN SOURCE CHANGES UPSTREAM!!!!!
Key Takeaways and Lessons Learned
41

42. © 2018 ThreatConnect, Inc. All Rights Reserved. 42

43. © 2018 ThreatConnect, Inc. All Rights Reserved.
Thank You
threatconnect.com/blog
@ThreatConnect
@MalwareUtkonos