Applied machine learning defeating modern malicious documents
•
1 like•343 views
A common tactic adopted by attackers for initial exploitation is the use of malicious code embedded in Microsoft Office documents. This attack vector is not new, but attackers are still having success. This session will dive into the details of these techniques, introduce some machine learning approaches to analyze and detect these attempts, and explore the output in Elasticsearch and Kibana. (Source : RSA Conference USA 2017)
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Applied machine learning defeating modern malicious documents
Similar to Applied machine learning defeating modern malicious documents (20)
More from Priyanka Aash
More from Priyanka Aash (20)
Recently uploaded
Recently uploaded (20)
Applied machine learning defeating modern malicious documents
- 1. SESSION ID:SESSION ID: #RSAC Evan Gaustad Applied Machine Learning: Defeating Modern Malicious Documents HT-W02 Sr. Manager CSIRT Target Corporation
- 2. #RSAC Agenda 2 Office Macro Use and Abuse Malicious documents in attack lifecycle Machine Learning for Malware Detection Demo Project: Malicious Macro Bot Conclusion
- 3. #RSAC Macro-enabled Microsoft Office Documents 3 An office macro is code that automates tasks in office documents Automatically fill out forms Update graphs and display data Make web requests Perform computations Written in Visual Basic for Applications (VBA) VBA Support built into MS Office 99.7% of documents used in attachment-based campaigns relied on social engineering and macros, rather than exploits. - Proofpoint1
- 4. #RSAC Attacker motivation for malicious office docs 4 Barrier of entry is very low Uses built in, cross-platform features “exploit” reliability is high Can implement sandbox evasion Easy to update to evade AV signatures
- 5. #RSAC Malicious Macro-enabled Office Documents 5 Used by an attacker to gain code execution on the targeted system(s) Common Attacker VBA Techniques: Download and execute malicious payload Drop and execute embedded payloads or scripts Obfuscation to hide intent Sandbox evasion techniques Payload targeting … “98% of Office-targeted threats use macros” - Microsoft2
- 6. #RSAC Example: Maldocs in Attack Lifecycle 1) Phishing email with attachment “Invoice Past Due” 6
- 7. #RSAC 7 1) Phishing email with attachment “Invoice Past Due” 2) Victim opens file, allows macros to run Example: Maldocs in Attack Lifecycle
- 8. #RSAC Example: Maldocs in Attack Lifecycle 8 1) Phishing email with attachment “Invoice Past Due” 2) Victim opens file, allows macros to run 3) Malicious macro executes
- 9. #RSAC Example: Maldocs in Attack Lifecycle 9 1) Phishing email with attachment “Invoice Past Due” 2) Victim opens file, allows macros to run 3) Malicious macro executes 4) Downloads / drops executables or powershell
- 10. #RSAC Example: Maldocs in Attack Lifecycle 10 1) Phishing email with attachment “Invoice Past Due” 2) Victim opens file, allows macros to run 3) Malicious macro executes 4) Downloads / drops executables or powershell 5) Install additional malware e.g. Pony, Hancitor, Vawtrak
- 11. #RSAC Example: Maldocs in Attack Lifecycle 11 1) Phishing email with attachment “Invoice Past Due” 2) Victim opens file, allows macros to run 3) Malicious macro executes 4) Downloads / drops executables or powershell 5) Install additional malware e.g. Pony, Hancitor, Vawtrak 6) Steal credentials, data, maintain persistence, command and control VictimAttacker http://.../gate.php
- 12. #RSAC Detecting Malicious Macros How hard is it to create: a malicious macro… that runs an executable… on victim’s machine… and evades AV? Some easy to find tools: CrunchCode7 MacroShop8 Veil Framework9 Generate-Macro10 Criminals sell their own 12
- 13. #RSAC Detecting Malicious Macros How hard is it to create: a malicious macro… that runs an executable… on victim’s machine… and evades AV? Some easy to find tools: CrunchCode7 MacroShop8 Veil Framework9 Generate-Macro10 Criminals sell their own 13 Really easy
- 16. #RSAC Why Machine Learning? 16 Existing anti-virus and sandbox techniques can be subverted Automates extracting insight from file samples Can better generalize at identifying unknown variations Reduces human analysis time
- 17. #RSAC Project Approach 17 Goals: Triage: Determine whether a new Microsoft Office document contains a malicious or benign macro Detection: Provide useful detection when signature-based methods fail Threat Intelligence: identify phishing campaigns Guiding Principles: Supervised Machine Learning – Classification Well thought out features Generalized and interpretable model output
- 18. #RSAC Applied Machine Learning Steps 18 Benign Files Malicious Files Collect labeled data
- 19. #RSAC Applied Machine Learning Steps 19 Benign Files Malicious Files Feature Extraction 5.7 10 98 … 1.2 23 15 … 0.7 57 20 … … Collect labeled data Feature extraction
- 20. #RSAC “Feature Engineering” 20 DOCUMENT #1 … BHJASD = Chr(102 + 8) Set uHhdBhd = CreateObject("" & "W" & "" & "or" & "d." & "Applicatio" & BHJASD) uHhdBhd.Documents.Open (FFFNNNF) Module1.Tyryka (2) HYUASGD = Module1.Girow(WOIEW) Module1.Tyryka (3) uHhdBhd.Quit Set uHhdBhd = Nothing End Sub Public Function Girow(qqa As String) Dim jjz As Variant jjz = Shell(qqa, 0) … DOCUMENT #2 … '############################# '# Code to Add Total Value Formula # '############################## 'Go to the top of the Price column Range("H10").Select 'Find the bottom value - there are no values in the Non Stock Items Selection.End(xlDown).Select 'Check to see if still in the order form range - if not there were no Standard Items Selected If ActiveCell.Row > 1000 Then GoTo TidyUp … Which one is malicious? Why? How would you measure that?
- 21. #RSAC “Feature Engineering” 21 DOCUMENT #1 … BHJASD = Chr(102 + 8) Set uHhdBhd = CreateObject("" & "W" & "" & "or" & "d." & "Applicatio" & BHJASD) uHhdBhd.Documents.Open (FFFNNNF) Module1.Tyryka (2) HYUASGD = Module1.Girow(WOIEW) Module1.Tyryka (3) uHhdBhd.Quit Set uHhdBhd = Nothing End Sub Public Function Girow(qqa As String) Dim jjz As Variant jjz = Shell(qqa, 0) … DOCUMENT #2 … '############################# '# Code to Add Total Value Formula # '############################# 'Go to the top of the Price column Range("H10").Select 'Find the bottom value - there are no values in the Non Stock Items Selection.End(xlDown).Select 'Check to see if still in the order form range - if not there were no Standard Items Selected If ActiveCell.Row > 1000 Then GoTo TidyUp … Feature Doc1 Doc2 # Lines of Code 74 584 # Comments 8 161 # Functions 9 14 # Shell Instructions 1 0 Entropy 4.3 3.8
- 24. #RSAC Applied Machine Learning Steps 24 Benign Files Malicious Files Feature Extraction 5.7 10 98 … 1.2 23 15 … 0.7 57 20 … … Classification Model Collect labeled data Feature extraction Train and Test model Classification Models
- 25. #RSAC Choose and Test Model 25 DOCUMENT #1 … BHJASD = Chr(102 + 8) Set uHhdBhd = CreateObject("" & "W" & "" & "or" & "d." & "Applicatio" & BHJASD) uHhdBhd.Documents.Open (FFFNNNF) Module1.Tyryka (2) HYUASGD = Module1.Girow(WOIEW) Module1.Tyryka (3) uHhdBhd.Quit Set uHhdBhd = Nothing End Sub Public Function Girow(qqa As String) Dim jjz As Variant jjz = Shell(qqa, 0) … DOCUMENT #2 … '############################# '# Code to Add Total Value Formula # '############################## 'Go to the top of the Price column Range("H10").Select 'Find the bottom value - there are no values in the Non Stock Items Selection.End(xlDown).Select 'Check to see if still in the order form range - if not there were no Standard Items Selected If ActiveCell.Row > 1000 Then GoTo TidyUp … Feature Doc1 Doc2 # Lines of Code 74 584 # Comments 8 161 # Functions 9 14 # Shell Instructions 1 0 Entropy 4.3 3.8
- 26. #RSAC Simple Decision Tree Model 26 entropy <= 4.27 samples = 88 samples = 47 class = benign # comments <= 39.0 samples = 41 samples = 47 class = benign samples = 47 class = malicious True False True False
- 27. #RSAC Simple Decision Tree Model 27 entropy <= 4.27 samples = 88 samples = 47 class = benign # comments <= 39.0 samples = 41 samples = 47 class = benign samples = 47 class = malicious True False True False Doc #1 Feature Doc1 Doc2 Entropy 4.3 3.8 # Comments 8 161 Doc #2
- 28. #RSAC Applied Machine Learning Steps 28 Benign Files Malicious Files Feature Extraction 5.7 10 98 … 1.2 23 15 … 0.7 57 20 … … Classification Model Collect labeled data Feature extraction Train and Test model Classification Model Deploy Model New Files “Benign” “Malicious” Classification Models
- 29. #RSAC Malicious Macro Bot Project 29 Model factored in over 20,000 samples Analyzed over 121,000 samples from 7 months of VirusTotal samples Over a thousand features VBA built-in language semantics for base language e.g. Shell, Dim, If, … Code heuristics e.g. LOC, # functions, entropy, … Use Random Forest Classifier Fits many decision trees on many subsets of the dataset Picks best decision tree combinations “Ensemble”
- 30. #RSAC Demo: Malicious Macro Bot Project 30 Demonstrate classification Gaining insight from machine learning features Identifying phishing campaigns through featureprints Search and visualize in Elasticsearch / Kibana
- 31. #RSAC Conclusion 31 Project Uses: Threat Intelligence: Identify new phishing campaigns Detection: Fill traditional detection gaps Incident Response: Rapid triage of office documents Prevention would be best
- 33. #RSAC References 33 [1] Proofpoint “Human Factor Report”, 2016. https://www.proofpoint.com/sites/default/files/human-factor- report-2016.pdf [2] Microsoft, “New feature in Office 2016 can block macros and help prevent infection”, Mar 22, 2016. https://blogs.technet.microsoft.com/mmpc/2016/03/22/new-feature-in-office-2016-can-block-macros-and-help- prevent-infection/ [3] Proofpoint, “The Cybercrime Economics of Malicious Macros”, 2016. https://www.proofpoint.com/sites/default/files/documents/bnt_download/pp-macroeconomics-rr.pdf [4] Ankit Anubhav, Dileep Kumar Jallepalli. “Hancitor (aka Chanitor) Observed Using Multiple Attack Approaches”. FireEye. Sept 23, 2016. https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html [5] PonyUp: Tracing Pony’s Threat Cycle and Multi-Stage Infection Chain. Damballa. Aug. 2015. https://www.damballa.com/wp-content/uploads/2015/08/Damballa_PonyUp.pdf [6] New Hancitor: Pimp my Downloader. Minerva Labs Research Team. Aug 19, 2016. http://www.minerva- labs.com/post/new-hancitor-pimp-my-downloader [7] CrunchCode http://www.crunchcode.de/en/index.html [8] MacroShop https://github.com/khr0x40sh/MacroShop [9] Veil Evasion Framework https://github.com/Veil-Framework/Veil-Evasion [10] Generate-Macro https://github.com/enigma0x3/Generate-Macro [11] SciKit Learn Algorithm Cheat Sheet. http://scikit-learn.org/stable/tutorial/machine_learning_map/