Talk by Oksana Safronova at NoNameCon 2019. https://nonamecon.org https://cfp.nonamecon.org/nnc2019/talk/AXCDXU/ Before the real incident happens, security team must test their detection capabilities in different ways. An overview of MITRE ATT&CK Matrix, test environments and other friends of Blue Team. Obstacles, unexpected discoveries, lack of information, a flood of logs, new technologies - you will meet them all if you want to build an effective defense team. The talk will expend the next topics based on the experience we have: How to test the security team's detection and incident response processes Best practices for endpoint monitoring tools configuration Some problems, that defense team can encounter Additional resources that can help you detect threats

1. Will you detect it or not?
How to check if security team is ready before
incident happens

2. whoami
SOC Analyst with Underdefense

3. Agenda
Environments can be different, use cases can be different, scope can be different, but
detection basically remains the same.
Detection capabilities are based on:
1. Data sources
2. Toolset in use
3. Expertise
Some general assumptions and observations about what can be done better in real-time
monitoring.

4. Data Sources

5. What can it be? Nearly everything
● OS
● Cloud
● Network devices
● Web Servers
● IOT devices
...and many,many more

6. How the logs are formatted?
Examples:
●XML
●syslog
●JSON
●custom formats

7. How the logs can be expended?
Example: Windows Advanced logging

8. How the logs can be filtered?
Example: IIS web server logging

9. How the logs are collected?
Is the method fast/secure/reliable?
Example: Windows logging protection

10. Toolset in use

11. ● Adequate reporting timing
Example:
osquery data
logging by intervals
https://osquery.read
thedocs.io/en/stable
/

12. ● Customise configurations
Examples:
https://github.com/Neo23x0/auditd https://github.com/SwiftOnSecurity/sysmon-
config

13. ● Secure & monitor your security & monitoring tools
Example: Sysmon service configuration

14. Expertise

15. Analyse the known threats
● MITRE ATT&CK Matrix - reach number of use cases
(https://attack.mitre.org/matrices/enterprise/)

16. ● Reports about other security organisations/researchers detection testing
Example: “Detecting the lateral movement” research
https://www.jpcert.or.jp/english/pub/sr/ir_research.html

17. Simulate the threats and malicious actions
Some practices for test environment:
1) Better to have VM’s
2) Different OS versions
3) Patched/vulnerable machines
4) Isolated network
5) Popular products installed
6) Monitoring software on board

18. Example:

19. ● Attack simulations
Examples:
DumpsterFire (Windows,Linux,macOS)
Atomic-Red-Team (Windows,Linux,macOS)
Caldera (Windows)
APT-Simulator (Windows)

20. MITRE ATT&CK Evaluation (https://attackevals.mitre.org/)
The following modifications were made to the standard Azure images:
● Configured firewall to allow
SMB
● Configured firewall to allow
FTP
● Disabled Network Level
Authentication via the control
panel GUI to allow RDP
● Created a shared drive
● Registry changed to allow storage of
wdigest credentials
● Registry changed to disable Windows
Defender
● Execution policy set to “bypass”

21. Analyse the normal activity
● Perform some general actions on system
Examples:
Inbound /outbound connections
Accounts manipulations
Configurations changes
OR
● Do nothing & just observe
● what happens

22. Sum Up
● Understanding of out-of-the-box monitoring capabilities of the environment
● Filter data that is unrelated
● Know boundaries & features of the tools you use
● Analyse & simulate the threats
● Take a look on how device/system normally functions to create a solid “baseline”

23. THE END
Special thanks to the SOC team, who’ve made this
possible and is on real-time monitoring duty right now <3