Regardless of how experienced you are when it comes to SIEM, you should constantly be looking for new security use cases and insights to maintain high levels of protection in your environment. However, the landscape is changing so quickly that this needs to be supported with an analytics-driven approach to ensure you are ahead of adversaries and are prioritizing the right threats. At the moment, you might be following best-practice frameworks, such as CIS20, or implementing the kill-chain model. This webinar will run through one of the recent analytics stories published by the Splunk Security Research team that map to these processes, providing you with insights on how to continue your analytics security journey through the “Brand Monitoring” Story and related searches. This will demonstrate how you can customize your environment to detect attempts to fool employees or customers into interacting with malicious infrastructure. Watch our webinar to learn : - What Analytic Stories are and what they look like - How you can begin adopting Analytic Stories in your environment - What tactics and techniques adversaries use when attempting to abuse your brand - How you can implement and customize the brand-monitoring analytic story in your environment - How you can further operationalize the Analytic Stories with Splunk Enterprise Security View the recording here: https://www.splunk.com/en_us/form/analytics-driven-security.html

1. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Analytics-Driven Security
How to start and continue the journey?
But How and Where?
Paul Bryant, Field Product Manager
Matthias Maier, Director Security Product Marketing

2. © 2017 SPLUNK INC.
During the course of this presentation, we may make forward-looking statements regarding future events or
the expected performance of the company. We caution you that such statements reflect our current
expectations and estimates based on factors currently known to us and that actual events or results could
differ materially. For important factors that may cause actual results to differ from those contained in our
forward-looking statements, please review our filings with the SEC.
The forward-looking statements made in this presentation are being made as of the time and date of its live
presentation. If reviewed after its live presentation, this presentation may not contain current or accurate
information. We do not assume any obligation to update any forward-looking statements we may make. In
addition, any information about our roadmap outlines our general product direction and is subject to change
at any time without notice. It is for informational purposes only and shall not be incorporated into any contract
or other commitment. Splunk undertakes no obligation either to develop the features or functionality
described or to include any such feature or functionality in a future release.
Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in
the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.
Forward-Looking Statements

3. © 2017 SPLUNK INC.
Analytics-
Driven
Security
Where to
start and
how?
Threat
Surface
How
adversary's fool
your employees
and customers
Getting
started with
Analytics-
Driven
Security
Brand
Monitoring
Next Steps
What you will learn

4. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Spelunking:
to explore
underground caves
Our Mission:

5. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Exploring different
caves with the same
equipment
Why buying new each
time?

6. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Analytics-Driven Security
RISK-BASED CONTEXT AND
INTELLIGENCE
CONNECTING
DATA AND PEOPLE

7. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Security Nerve Center
Cloud
Security
Endpoints
Orchestration
WAF & App
Security
Threat Intelligence
Network
Web Proxy
Firewall
Identity and Access

8. © 2017 SPLUNK INC.
Collaborative SOC
Solve across multiple domains
Establish security operations
Specific problem
Nerve center for security

9. © 2017 SPLUNK INC.
Analytics-Driven Security: Portfolio
Premium Solution
Enterprise Security
3rd Party Apps &
Add-ons (590+)
Premium Solution
User Behavior Analytics
Search and
Investigate
Monitoring &
Alerting
Dashboards
and Reports
Incident &
Breach Response
Splunk Security Apps & Add-ons
Network data
RDBMS (any) data Windows host data
Exchange data
Analytics for Hadoop
PCI ComplianceSecurity Essentials
App for AWS
ML Toolkit
Google Cloud
Microsoft Cloud
Windows Infrastructure
Discover
Anomalous
Behavior
Detect Unknown
Threats
Automation &
Orchestration
Threat
Detection
Security
Operations
Platform for Operational Intelligence

10. © 2017 SPLUNK INC.
Adaptive Defense
at Machine Speed
Extend Data Platform and Analytics
Actionable Detect and Response Content
Pre-packaged, Targeted Apps
CONTINUOUS
INNOVATION

11. © 2017 SPLUNK INC.
Collaborative SOC
Solve across multiple domains
Establish security operations
Specific problem
Nerve center for security
Poll:
Where are you in
the journey
currently?

12. © 2017 SPLUNK INC.
Analytics-
Driven
Security
Where to
start and
how?
Threat
Surface
How
adversary's fool
your employees
and customers
Getting
started with
Analytics-
Driven
Security
Brand Monitoring
Next steps
Q&A
Agenda

13. © 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2016 SPLUNK INC. CONFIDENTIAL. INTERNAL USE ONLY.
What tactics and techniques are
adversaries using to abuse your brand
Fool your employees and customers

14. © 2017 SPLUNK INC.
…..typosquatting is the practise of creating a url which is similar to a known url
for the purposes of deception….
…..spelunk.com vs. splunk.com….
Typosquatting

15. © 2017 SPLUNK INC.
…..url hijacking is the practice of creating a url which contains a trusted value for
the purposes of deception….
…..splunk-pwny.com vs. splunk.com….
Url Hijacking

16. © 2017 SPLUNK INC.
▶ Typo-Generation Models given a target domain (e.g. www.splunk.com), the following five typo-generation models are commonly used (1):
• Missing-dot typos: this typo happens when the dot following “www” is forgotten, e.g., wwwsplunk.com
• Character-omission typos - e.g. www.splnk.com
• Character-permutation typos - e.g., www.spulnk.com
• Character-substitution typos - e.g., www.solunk.com
• Character-duplication typos - e.g., www.spllunk.com
▶
▶ Homograph Attacks: the homograph attack relies on the visual similarity of letters or strings that might be confused with one another
• For example splunk.com vs. spiunk.com
• Or in Sans Serif splunk.com vs. spIunk.com
▶ Keyword Similarity attacks: used to confuse customers into believing a site is legitimate by referencing the original site:
• For example - www.pwny-splunk.com
▶ TLD Manipulation / Subdomains
• www.splunk.om
• sp.lunk.com
Reference (1): Y. Wang, D. Beck, and J. Wang. Strider typo-patrol: discovery and analysis of systematic typo-squatting. USENIX SRUTI, 2006.
Typosquatting/URL Hijacking
Science

17. © 2017 SPLUNK INC.
▶ Against You!
•Typo opportunism for
employees
•Phishing or Spear-
phishing email sources
•Web Location employee
deception
▶ For profit!
•Domain Parking
•Click Fraud
•Extortion
•Spam Delivery
▶ Against your
Customers!
•Typo opportunism for
customers/consumers
•Phishing email sources
•Web Location for
customer deception
Uses of Typosquatting

18. © 2017 SPLUNK INC.
Why Typosquatting
• Gain Credentials
• Collect information
• Install malware
Attacker
Objective
• Phishing or Spear-phishing to
convince employees to interact with
fake system
• Link to interesting internal company
blog
Attacker
Methods
• Email Account Enumeration
• Credentials for an account
• Exploited Machine in your estate
• Gain financial information for fraud or resell
Attacker
has gained

19. © 2017 SPLUNK INC.
Paypal
Reference (2) https://umbrella.cisco.com/blog/2015/02/11/paypal-phishing-sophistication-growing/
Using Typosquatting and Url Hijacking Techniques an attack
creates the following domains:
URL Method
security-paypal-center[.]com Keyword
Similarity
paypai[.]com Character
Substitution
www[.]paypal[.]com-webapps-cgi-
bin-webscr-login-access[.]com
Subdomain
Fake Site
Real Site

20. © 2017 SPLUNK INC.
SAAS Attack Demo
What does an
attack look
like?
User ffff
User Receives
Email from
seemingly
trusted source
User
Email Contains
an embedded
link which the
user clicks
User visits fake site
on seemingly
trusted domain
User enters
credentials to login
to SAAS service
which are stored
User is redirected to
original site and
notices nothing

21. © 2017 SPLUNK INC.
SAAS Attack Demo
What does an
attack look
like?
User ffff
User Receives
Email from
seemingly
trusted source
User
Email Contains
an embedded
link which the
user clicks
User visits fake site
on seemingly
trusted domain
User enters
credentials to login
to SAAS service
which are stored
User is redirected to
original site and
notices nothing
DNS Traffic
Email Data
Web Traffic
Data Sources

22. © 2017 SPLUNK INC.
Exploitation Attack
Demo
What does an
attack look
like?
User ffff
User Receives
Email from
seemingly
trusted source
User
Email Contains
an embedded
link which the
user clicks
User visits site on
seemingly trusted
domain
Users system is
compromised and
attack gains access
Attack elevates
privilege or steals
data of choice

23. © 2017 SPLUNK INC.
Exploitation Attack
Demo
What does an
attack look
like?
User ffff
User Receives
Email from
seemingly
trusted source
User
Email Contains
an embedded
link which the
user clicks
User visits site on
seemingly trusted
domain
Users system is
compromised and
attack gains access
Attack elevates
privilege or steals
data of choice
Data Sources
Email Data
DNS Traffic
Web Traffic
Endpoint
Data

24. © 2017 SPLUNK INC.
▶ Using Typosquatting and Url Hijacking Techniques an attack creates the
following domains:
Google Drive Attack
Reference (3) https://researchcenter[.]paloaltonetworks[.]com/2016/07/unit-42-attack-delivers-9002-trojan-through-google-drive/
URL Method
microsoftserve[.]com Character
Omission
gooledriveservice[.]com Character
Omission
logitechwkgame[.]com
Keyword
Similarity

25. © 2017 SPLUNK INC.
Online Storage
Attack Demo
What does an
attack look
like?
User ffff
User Receives
Email from
seemingly
trusted source
User
Email Contains an
embedded link
which points to
online document
store
User visits site on
seemingly trusted
domain
Users system is
compromised and
attack gains access
Command and
Control uses
Typosquatting
Domains/URL
Hijacking
Techniques

26. © 2017 SPLUNK INC.
Online Storage
Attack Demo
What does an
attack look
like?
User ffff
User Receives
Email from
seemingly
trusted source
User
Email Contains an
embedded link
which points to
online document
store
User visits site on
seemingly trusted
domain
Users system is
compromised and
attack gains access
Command and
Control uses
Typosquatting
Domains/URL
Hijacking
Techniques
Data Sources
Email Data
DNS Traffic
Web Traffic
Endpoint
Data

27. © 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2016 SPLUNK INC. CONFIDENTIAL. INTERNAL USE ONLY.
Getting started with
analytics driven security
Fool your employees or customers

28. © 2017 SPLUNK INC.
It’s not just detection….

29. © 2017 SPLUNK INC.
….nowadays
it’s about
understanding

30. © 2017 SPLUNK INC.
Where to start?
What tactics are attackers using?
How to detect them without constant pattern
updates?
What machine data is needed?
What context might be required for better judgement?
What questions raise for investigations of a triggered
alert?
How does this effort map into my existing security
strategy?
Guidance

31. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Walking Guide

32. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
That knowledge is put into
what we call a
Analytics Story

33. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
ES CONTENT
UPDATE
Form factor: Splunk App
Updates: Bi-Weekly
Your Influence: Communicate with the team to get your
Ideas in the productionised back
Compatible: Splunk Enterprise & Cloud, Data in CIM
Format + operationalize with ES
Cost: Free in the first year

34. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Demo
“Brand Monitoring”
Analytic Story
How to implement and operationalize

35. © 2017 SPLUNK INC.
Investigation Story Line
Probability of being an incident
“Totally Scoped”
• Alert
• ... need more info ...25%
• "Ah ok! Very Interesting"
• ... need more info ...
50%
• "Right. This is an issue."
• ... need more info ...75%
• Totally Scoped100%

36. © 2017 SPLUNK INC.
Investigation Story Line
Probability of being an incident
“Totally Scoped”
• Detection Search
• ... need more info ...25%
• Investigation Search
• Contextualization
Search
50%
• Supporting Search
• Contextualization Search75%
• Automated Action100%

37. © 2017 SPLUNK INC.
▶ DNS Twist your SAAS providers
and monitor for access of them
•Googledrive
•Box
•Dropbox
•Office 365
•Cloud Providers
▶ Use DNS Twist domains to get
Whois info if they are registered for
more context
Future Actions

38. © 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2016 SPLUNK INC. CONFIDENTIAL. INTERNAL USE ONLY.
Next Steps
Q&A

39. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
▶ Download ES
Content Update
▶ https://splunkbase.splunk.co
m/app/3449/
▶ Select and
Implement the first
use case
▶ Provide Feedback
Try now!

40. © 2017 SPLUNK INC.
Hear:
How Travis Perkins built
a SOC in the Cloud
blogs.splunk.com
Hear:
Three Tips from Cisco’s
CSIRT using Splunk
isc2.org
Read:
Incident Response
and Computer
Forensics
amazon.com
Learn:
Operationalizing
Machine Learning
to Detect
Malicious Domain
Names
splunk.com

41. © 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2016 SPLUNK INC. CONFIDENTIAL. INTERNAL USE ONLY.
Thank You
Q&A
Please help us to improve our webinars and give us
feedback in the survey monkey which pops up when you
leave.