ABOUT ME
• Oneof the CISO’s for MRK Technologies
• 20 Years experience
• Career focused on defense and response (blue team)
• Father, husband, Marine, and gamer
• @b0dach
3.
AGENDA
• Overview ofhow a Raspberry Pi can be used in Threat Hunting
• Tools installed and Sensor placement in the Network
• Automation of tools Integration with threat intel feeds
• Utilizing custom IoC’s
• Summary
4.
RASPBERRY PI INTHREAT HUNTING
• Since building a sensor is (relatively) cheap and easy, this is a great way
to get more visibility into your network
• It’s a great way to start threat hunting without expensive products
• Utilizing the Pi as a sensor, you can place multiple sensors that report
back to a server
• This is intended to be used in conjunction with your skillset, not the
entire hunt
5.
RASPBERRY PI INTHREAT HUNTING
•Inexpensive
•Can be deployed quickly (plug and play)
•Automation and integration with threat feeds
•Sensor offloads the data to an ELK cluster
Pros:
•It’s a Raspberry Pi
•It could be used in a large enterprise, but not recommended
•ARM architecture
Cons:
6.
THE HARDWARE
• RaspberryPi 3 model B
• 32GB micro SD card
• Smraza Raspberry Pi 3 B+ Case
• HausBell H7 keyboard
• Total investment: $84.00
7.
KREEPY PI
• Thereare a number of Raspian ports that
have been compiled that can be utilized
• Sweet Security – Threat hunting tools with
ELK
• BriarIDS – A Raspberry Pi IDS
• RaspberryPi NSM – Network Secutity
Monitor
• OTX API – Alienvault threat intelligence feed
• All utilize open source IDS tools like Bro
and Suricata
• (I chose a hybrid of these three)
8.
BASIC CONFIGURATION: KREEPYPI
• Raspbian (Built off NOOBS 2.8.2)
• Setup to run in command line mode
• Set video memory to 0
• Configure tools per instructions
• Be prepared to work!
• Install Filebeats, configure to ship logs to your ELK instance
9.
DEPLOYMENT
• Kreepy Pisensor
• eth0 in promisc mode
• USB Ethernet dongle – eth1 management interface
• (Or use the WLAN chip and an off network router)
• Security Onion/ELK Server on a different system (VM/Server/Etc.)
10.
HUNTING
• Monitoring andbaselining
• If possible
• Bro and OTX
• Suricata for additional analysis
12.
CUSTOM IOC’S
• Broand Suricata have the capability to have custom IoC’s
• Export from MISP
• Created by you
13.
SUMMARY
• Easy(ish) andinexpensive way to utilize bro, suricata, and ELK to
automate network threat hunting
• PoC of Kreppy Pi will be uploaded to github
• This is the beginning, more tool integration and tuning will follow
• Contribute!!
