SlideShare a Scribd company logo

Attack Simulation and Hunting

•
•
N
nathi mogomotsi

This document provides greetings in 11 official languages of South Africa: Afrikaans, English, isiNdebele, isiXhosa, isiZulu, Sepedi, Sesotho, Setswana, SiSwati, Tshivenda, and Xitsonga. It lists each language along with the greeting used. At the end it thanks the reader in each of the 11 languages. The purpose is to showcase South Africa's multilingualism and celebrate its diversity of official languages.

Internet
1 of 46
South Africa – 11 Official Languages Greetings! Afrikaans – Goeie dag English – Hello isiNdebele – Lotjhani isiXhosa – Mholo isiZulu – Sanibona Sepedi – Thobela Sesotho – Dumela Setswana – Dumela SiSwati – Sawubona Tshivenda – Ndaa/Aa Xitsonga – Avuxeni Thank you! Afrikaans – Dankie English – Thanks isiNdebele – Ngiyathokoza isiXhosa – Enkosi isiZulu – Ngiyabonga Sepedi – Ke a leboga Sesotho – Ke a leboha Setswana – Ke a leboga SiSwati – Ngiyabonga Tshivenda –Ndi a livhuwa Xitsonga – ndzi khense
NO TO RACISM/SEXISM/XENOPHOBIA/ETC
Threat Attack Simulations & Hunting Made Easy
#whoami Nathi Mogomotsi @nathimog african, black, grand[son], brother, hacker, n00b, vegan, alcohol, not-french, suck-at-english, God fearing, not-a-saint, no tattoo, biker Sr. Red Teamer @sanlam Hacker @sensepost
How it all started • New job • More time to do research and 1337 hax But… • It wasn’t fun anymore • Now I get to receive pen test reports • I am on the receiving end • Needed to do something about this • Time to help the defenders https://twitter.com/s7ephen/status/925969930134024192
On an Unrelated Note: • I asked my previous boss (Charl) to buy me this book 4~ years I ago • I knew I had some “defensive” blood in me 
How it all started • Watched CG and CN talk • Was impressed, thanks guys • Go watch the talk • Will wait for you…
Why this talk • To share my experience • To share my learnings • Hopefully it will help you get started (you should) • I am not an expert, so this is really basic stuff • Ping me if you have any comments or ideas • nathi@protonmail.com
Why this talk – Pyramid of Pain http://detect-respond.blogspot.co.za/2013/03/the-pyramid-of-pain.html
What is attack simulation ? • Just like a pilot simulator, it is there to put you in the worst possible situation at a lowest level of risk - Chris Nickerson • Understanding attacks that might be used against an organisation in order to improve the organisation’s defence – me • Attack simulations should be done to learn how attackers are likely to achieve goals against your organization – Zane Lackey • Can we detect and/or stop a particular attack ? • Assume compromise – We can be compromised!
What is attack hunting ? • Proactive incident response • Are we hacked by this particular attack ? • Assume compromise – We might be compromised already!
High Level Process|Attack Oriented Defence Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
Attack Techniques Choose a technique you interested in: • Technique used in the wild • Technique from threat reports • Technique you found during your vuln research • Technique from software vendors security bulletins • Technique from hacker tools • Technique from pen testing report
Attack Techniques - MITRE “ATT&CK is useful for understanding security risk against known adversary behavior, for planning security improvements, and verifying defenses work as expected.” https://attack.mitre.org/wiki/Main_Page
Attack Techniques - MITRE
Attack Techniques - Tools Media and your CISO
Attack Techniques - Tools https://www.slideshare.net/JaredAtkinson/purpose-driven-hunt-derbycon-2017
Recap • We identified the technique we want to focus on. Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
Defensive Controls – Cyber Kill Chain
Weaponization Reconnaissance Delivery Exploitation Installation Command & Control Actions on Objectives Detect Deny Disrupt Degrade Deceive Contain Web Analytics Firewall ACL Firewall ACL NIDS NIPS NIPS Vigilant user Proxy filter Inline AV Email Queuing App-Aware Firewall HIDS Vendor Patch EMET, DEP Inter-Zone NIPS HIDS ‘chroot’ Jail AV EPP NIDS Firewall ACL NIPS Tar pit DNS Redirect Trust Zones Audit log Outbound ACL DLP QOS Throttle Honeypot Trust Zones
Recap • We identified the technique we want to focus on. • We understand our current defences. • We identified the technique we want to focus on Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
Simulations – The process Hack yourself first Hack the humans Attack analysis with the blue team Defence controls update Validate new defence controls Activity Tracker
Simulations – Hack yourself first • Test detection tools • Use a test machine identical to your environment • Collect Indicators of Compromise (IoCs) Network artefacts User Agent Strings Dynamic DNS visits Encrypted traffic MIME type downloads Host artefacts New files New services New registry Files that runs on reboot
Simulations – Hack yourself first (MITRE) • https://github.com/redcanaryco/atomic-red-team • https://www.youtube.com/watch?v=M4SHpDX8GTo
Simulation – hack the humans • Test processes • Test blue team response to alerts • Test IR procedure
Simulations – Attack Analysis with the blue • Show how you did your hack • Kill chain analysis and controls • Map logs to the attack • Handover Indicators of Compromise
https://www.demisto.com/phishing-incident-response-playbook/ Simulations – Kill Chain Analysis and Controls
Simulation – Defence update • To automate detection • Update • FW/IDS/IPS/AV/EDR/<your security product here> • Processes • Deploy Controls • Controls should not be expensive and complex • https://t2.fi/2017/02/05/haroon-meer-keynote-2016/
Simulation – Controls validation • Validate the new defence controls • Create a script to automate this • Should not be fancy • Mainly to help the blue team
Simulation – Activity Tracker
Recap • We identified the technique we want to focus on • We understand our current defences • We tested, updated and validated controls and incident procedures • We know which data sets to use for our hunts Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
Hunting – The process • Collect data sets • Process the data sets • Analyse collection • Malicious activity • Activity tracker
Hunting – Collect data sets • Proxy logs • Anti-Virus logs • Application logs • Sysmon logs • Bro IDS logs • DNS logs • Firewall logs • Netflow data
Hunting – Techniques to process the data sets Searching Stack Counting Grouping Clustering https://sqrrl.com/threat-hunting-reference-guide/ https://speakerdeck.com/davidjbianco/toppling-the-stack-practical-outlier-detection-for-threat-hunters
Hunting – Analyse collection • Search artefacts on the network data sets • Find suspicious hosts • Host threat hunting https://www.sans.org/summit-archives/file/summit-archive-1492556122.pdf
Hunting – Found suspicious activity • Call the forensicators • Execute the IR plan
Hunting – Activity Tracking
Recap • We identified the technique we want to focus on • We understand our current defences • We tested, updated and validated controls and incident procedures • We know which data sets to use for our hunts • We confirmed if we are under attack or not • Hopefully eradicated the threat Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
Measure Effectiveness • Effectiveness is a measure of the success of the operation, overall - Raphael Mudge. • Roberto Rodriguez (@cyb3rWard0g) • https://cyberwardog.blogspot.co.za/2017/07/how-hot-is-your-hunt-team.html
KEY TAKEAWAYS • You get to play part in defence • You get to find bad guys and pen testers • You get to learn other stuff i.e DFIR, network monitoring, rules writing • You get to do cool hacks that actually makes a difference in your org • You get to teach the blue team • You get to learn from them too.. https://medium.com/@sroberts/introduction-to-dfir-d35d5de4c180
More from CN and CG • If you didn’t watch their talk earlier • Go ahead and watch this one • Updated and more awesome • Thanks once again guys
Tools – because you want to automate • CALDERA: Automatic adversary emulation (to be released at BH17 EU) • DumpsterFire – Threat simulations • SQRLL VM – Threat hunting • CCF VM – Incident triage (DFIR) with ELK • Bro IDS – Network monitoring • Sysmon – System monitoring • ELK – Data visualisation • Chris Gates is also releasing something soon ;)
Credits / References / Thank you Credits & Thank you for your contributions • @indi303 • @carnal0wnage • @ jackcr • @DavidJBianco • @Sroberts • @RobertMLee • @Subtee • @Chrissanders88 • DR. Eric Cole • @Jaredcatkinson • @Robwinchester3 • @DAkacki • @cyb3rWard0g Resources • https://github.com/magoo/redteam-plan • http://soc.wa.gov/resources/exercises • https://github.com/redcanaryco/atomic-red-team • https://resources.redcanary.com/atomic-red-team-training-session- nov-2017 • https://github.com/demisto/content Training • Chris Sanders - http://chrissanders.org/training/ • @zanelackey • @haroonmeer • @M_haggis • @mattifestation • @AlanOrlikoski • @PyroTek3 • @SqrrlData • @redcanaryco • Bloodhound Gang
Special Thanks: When I do grow up one day I want to be like these guys • Willem Smit @slackerscoza • Kelvin Adams @nivlek007 • George Pranschke @cheorchie • Chris Gates @carnal0wnage • Awesome people I have ever met! • Keep rocking guys.
“Do whatever you want. Trust your guts, your humanly feelings, your very limited knowledge. This is best effort.” – Julio Auto
Thanks once again, do your best effort to try to be nice to one another & take care of your health!

Recommended

Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
Arpan Raval
 
OSINT with Practical: Real Life Examples
OSINT with Practical: Real Life ExamplesOSINT with Practical: Real Life Examples
OSINT with Practical: Real Life Examples
SyedAmoz
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
mohamed nasri
 
The Diamond Model for Intrusion Analysis - Threat Intelligence
The Diamond Model for Intrusion Analysis - Threat IntelligenceThe Diamond Model for Intrusion Analysis - Threat Intelligence
The Diamond Model for Intrusion Analysis - Threat Intelligence
ThreatConnect
 
Role of Forensic Triage In Cyber Security Trends 2021
Role of Forensic Triage In Cyber Security Trends 2021Role of Forensic Triage In Cyber Security Trends 2021
Role of Forensic Triage In Cyber Security Trends 2021
Amrit Chhetri
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feeds
Iain Dickson
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
Honeypot
HoneypotHoneypot
Honeypot
Sajan Sahu
 

Recommended

Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
Arpan Raval
 
OSINT with Practical: Real Life Examples
OSINT with Practical: Real Life ExamplesOSINT with Practical: Real Life Examples
OSINT with Practical: Real Life Examples
SyedAmoz
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
mohamed nasri
 
The Diamond Model for Intrusion Analysis - Threat Intelligence
The Diamond Model for Intrusion Analysis - Threat IntelligenceThe Diamond Model for Intrusion Analysis - Threat Intelligence
The Diamond Model for Intrusion Analysis - Threat Intelligence
ThreatConnect
 
Role of Forensic Triage In Cyber Security Trends 2021
Role of Forensic Triage In Cyber Security Trends 2021Role of Forensic Triage In Cyber Security Trends 2021
Role of Forensic Triage In Cyber Security Trends 2021
Amrit Chhetri
 
Cyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feedsCyber Threat Intelligence - It's not just about the feeds
Cyber Threat Intelligence - It's not just about the feeds
Iain Dickson
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
Honeypot
HoneypotHoneypot
Honeypot
Sajan Sahu
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
Dhruv Majumdar
 
Cyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceCyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General Audience
Tom K
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
n|u - The Open Security Community
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metrics
Mark Arena
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
ZaiffiEhsan
 
Présentation rattrapage module Forensic
Présentation rattrapage module ForensicPrésentation rattrapage module Forensic
Présentation rattrapage module Forensic
ESD Cybersecurity Academy
 
Taking the Attacker Eviction Red Pill (v2.0)
Taking the Attacker Eviction Red Pill (v2.0)Taking the Attacker Eviction Red Pill (v2.0)
Taking the Attacker Eviction Red Pill (v2.0)
Frode Hommedal
 
Password cracking and brute force
Password cracking and brute forcePassword cracking and brute force
Password cracking and brute force
vishalgohel12195
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
Katie Nickels
 
Honeypot ss
Honeypot ssHoneypot ss
Honeypot ss
Kajal Mittal
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence
Sirius
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
Digit Oktavianto
 
Brute force attack
Brute force attackBrute force attack
Brute force attackjoycruiser
 
Introduction to Software Security and Best Practices
Introduction to Software Security and Best PracticesIntroduction to Software Security and Best Practices
Introduction to Software Security and Best Practices
Maxime ALAY-EDDINE
 
Ceh v5 module 04 enumeration
Ceh v5 module 04 enumerationCeh v5 module 04 enumeration
Ceh v5 module 04 enumeration
Vi Tính Hoàng Nam
 
Cyber security
Cyber securityCyber security
Cyber security
Aman Pradhan
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
MITRE - ATT&CKcon
 
Cyber security
Cyber securityCyber security
Cyber security
Manjushree Mashal
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
Andrew McNicol
 
Threat Hunting Professional Online Training Course
Threat Hunting Professional Online Training CourseThreat Hunting Professional Online Training Course
Threat Hunting Professional Online Training Course
ShivamSharma909
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
Spyglass Security
 

More Related Content

What's hot

Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
Dhruv Majumdar
 
Cyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceCyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General Audience
Tom K
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
n|u - The Open Security Community
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metrics
Mark Arena
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
ZaiffiEhsan
 
Présentation rattrapage module Forensic
Présentation rattrapage module ForensicPrésentation rattrapage module Forensic
Présentation rattrapage module Forensic
ESD Cybersecurity Academy
 
Taking the Attacker Eviction Red Pill (v2.0)
Taking the Attacker Eviction Red Pill (v2.0)Taking the Attacker Eviction Red Pill (v2.0)
Taking the Attacker Eviction Red Pill (v2.0)
Frode Hommedal
 
Password cracking and brute force
Password cracking and brute forcePassword cracking and brute force
Password cracking and brute force
vishalgohel12195
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
Katie Nickels
 
Honeypot ss
Honeypot ssHoneypot ss
Honeypot ss
Kajal Mittal
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence
Sirius
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
Digit Oktavianto
 
Brute force attack
Brute force attackBrute force attack
Brute force attackjoycruiser
 
Introduction to Software Security and Best Practices
Introduction to Software Security and Best PracticesIntroduction to Software Security and Best Practices
Introduction to Software Security and Best Practices
Maxime ALAY-EDDINE
 
Ceh v5 module 04 enumeration
Ceh v5 module 04 enumerationCeh v5 module 04 enumeration
Ceh v5 module 04 enumeration
Vi Tính Hoàng Nam
 
Cyber security
Cyber securityCyber security
Cyber security
Aman Pradhan
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
MITRE - ATT&CKcon
 
Cyber security
Cyber securityCyber security
Cyber security
Manjushree Mashal
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
Andrew McNicol
 

What's hot (20)

Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
 
Cyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General AudienceCyber Kill Chain Deck for General Audience
Cyber Kill Chain Deck for General Audience
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metrics
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
Présentation rattrapage module Forensic
Présentation rattrapage module ForensicPrésentation rattrapage module Forensic
Présentation rattrapage module Forensic
 
Taking the Attacker Eviction Red Pill (v2.0)
Taking the Attacker Eviction Red Pill (v2.0)Taking the Attacker Eviction Red Pill (v2.0)
Taking the Attacker Eviction Red Pill (v2.0)
 
Password cracking and brute force
Password cracking and brute forcePassword cracking and brute force
Password cracking and brute force
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
 
Honeypot ss
Honeypot ssHoneypot ss
Honeypot ss
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
 
Brute force attack
Brute force attackBrute force attack
Brute force attack
 
Introduction to Software Security and Best Practices
Introduction to Software Security and Best PracticesIntroduction to Software Security and Best Practices
Introduction to Software Security and Best Practices
 
Ceh v5 module 04 enumeration
Ceh v5 module 04 enumerationCeh v5 module 04 enumeration
Ceh v5 module 04 enumeration
 
Cyber security
Cyber securityCyber security
Cyber security
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
 
Cyber security
Cyber securityCyber security
Cyber security
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
 

Similar to Attack Simulation and Hunting

Threat Hunting Professional Online Training Course
Threat Hunting Professional Online Training CourseThreat Hunting Professional Online Training Course
Threat Hunting Professional Online Training Course
ShivamSharma909
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
Spyglass Security
 
Hunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsHunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark Arts
Spyglass Security
 
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Danny Akacki
 
Incorporating Threat Intelligence into Your Enterprise Communications Systems...
Incorporating Threat Intelligence into Your Enterprise Communications Systems...Incorporating Threat Intelligence into Your Enterprise Communications Systems...
Incorporating Threat Intelligence into Your Enterprise Communications Systems...
EC-Council
 
Cyber Incident Response & Digital Forensics Lecture
Cyber Incident Response & Digital Forensics LectureCyber Incident Response & Digital Forensics Lecture
Cyber Incident Response & Digital Forensics Lecture
Ollie Whitehouse
 
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
EC-Council
 
Managing Next Generation Threats to Cyber Security
Managing Next Generation Threats to Cyber SecurityManaging Next Generation Threats to Cyber Security
Managing Next Generation Threats to Cyber Security
Priyanka Aash
 
Janitor vs cleaner
Janitor vs cleanerJanitor vs cleaner
Janitor vs cleaner
John Stauffacher
 
Threat Hunting by Falgun Rathod - Cyber Octet Private Limited
Threat Hunting by Falgun Rathod - Cyber Octet Private LimitedThreat Hunting by Falgun Rathod - Cyber Octet Private Limited
Threat Hunting by Falgun Rathod - Cyber Octet Private Limited
Falgun Rathod
 
501 ch 8 risk management tools
501 ch 8 risk management tools501 ch 8 risk management tools
501 ch 8 risk management tools
gocybersec
 
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
Gnanavi2
 
Applying Machine Learning to Network Security Monitoring - BayThreat 2013
Applying Machine Learning to Network Security Monitoring - BayThreat 2013Applying Machine Learning to Network Security Monitoring - BayThreat 2013
Applying Machine Learning to Network Security Monitoring - BayThreat 2013
Alex Pinto
 
Cause 11 im final
Cause 11 im finalCause 11 im final
Cause 11 im finalcavapyta
 
Cause 11 im final
Cause 11 im finalCause 11 im final
Cause 11 im finalcavapyta
 
2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion Detection2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion Detection
APNIC
 
Hunting before a Known Incident
Hunting before a Known IncidentHunting before a Known Incident
Hunting before a Known Incident
EndgameInc
 
Join the hunt: Threat hunting for proactive cyber defense.pptx
Join the hunt: Threat hunting for proactive cyber defense.pptxJoin the hunt: Threat hunting for proactive cyber defense.pptx
Join the hunt: Threat hunting for proactive cyber defense.pptx
Infosec
 
H@dfex 2015 malware analysis
H@dfex 2015 malware analysisH@dfex 2015 malware analysis
H@dfex 2015 malware analysis
Charles Lim
 

Similar to Attack Simulation and Hunting (20)

Threat Hunting Professional Online Training Course
Threat Hunting Professional Online Training CourseThreat Hunting Professional Online Training Course
Threat Hunting Professional Online Training Course
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
 
Hunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsHunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark Arts
 
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
 
Incorporating Threat Intelligence into Your Enterprise Communications Systems...
Incorporating Threat Intelligence into Your Enterprise Communications Systems...Incorporating Threat Intelligence into Your Enterprise Communications Systems...
Incorporating Threat Intelligence into Your Enterprise Communications Systems...
 
Cyber Incident Response & Digital Forensics Lecture
Cyber Incident Response & Digital Forensics LectureCyber Incident Response & Digital Forensics Lecture
Cyber Incident Response & Digital Forensics Lecture
 
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
 
Managing Next Generation Threats to Cyber Security
Managing Next Generation Threats to Cyber SecurityManaging Next Generation Threats to Cyber Security
Managing Next Generation Threats to Cyber Security
 
Janitor vs cleaner
Janitor vs cleanerJanitor vs cleaner
Janitor vs cleaner
 
Threat Hunting by Falgun Rathod - Cyber Octet Private Limited
Threat Hunting by Falgun Rathod - Cyber Octet Private LimitedThreat Hunting by Falgun Rathod - Cyber Octet Private Limited
Threat Hunting by Falgun Rathod - Cyber Octet Private Limited
 
501 ch 8 risk management tools
501 ch 8 risk management tools501 ch 8 risk management tools
501 ch 8 risk management tools
 
Computer Forensic
Computer ForensicComputer Forensic
Computer Forensic
 
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
644205e3-8f85-43da-95ac-e4cbb6a7a406-150917105917-lva1-app6892.pdf
 
Applying Machine Learning to Network Security Monitoring - BayThreat 2013
Applying Machine Learning to Network Security Monitoring - BayThreat 2013Applying Machine Learning to Network Security Monitoring - BayThreat 2013
Applying Machine Learning to Network Security Monitoring - BayThreat 2013
 
Cause 11 im final
Cause 11 im finalCause 11 im final
Cause 11 im final
 
Cause 11 im final
Cause 11 im finalCause 11 im final
Cause 11 im final
 
2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion Detection2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion Detection
 
Hunting before a Known Incident
Hunting before a Known IncidentHunting before a Known Incident
Hunting before a Known Incident
 
Join the hunt: Threat hunting for proactive cyber defense.pptx
Join the hunt: Threat hunting for proactive cyber defense.pptxJoin the hunt: Threat hunting for proactive cyber defense.pptx
Join the hunt: Threat hunting for proactive cyber defense.pptx
 
H@dfex 2015 malware analysis
H@dfex 2015 malware analysisH@dfex 2015 malware analysis
H@dfex 2015 malware analysis
 

Recently uploaded

APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024
APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024
APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024
APNIC
 
Latest trends in computer networking.pptx
Latest trends in computer networking.pptxLatest trends in computer networking.pptx
Latest trends in computer networking.pptx
JungkooksNonexistent
 
This 7-second Brain Wave Ritual Attracts Money To You.!
This 7-second Brain Wave Ritual Attracts Money To You.!This 7-second Brain Wave Ritual Attracts Money To You.!
This 7-second Brain Wave Ritual Attracts Money To You.!
nirahealhty
 
Italy Agriculture Equipment Market Outlook to 2027
Italy Agriculture Equipment Market Outlook to 2027Italy Agriculture Equipment Market Outlook to 2027
Italy Agriculture Equipment Market Outlook to 2027
harveenkaur52
 
JAVIER LASA-EXPERIENCIA digital 1986-2024.pdf
JAVIER LASA-EXPERIENCIA digital 1986-2024.pdfJAVIER LASA-EXPERIENCIA digital 1986-2024.pdf
JAVIER LASA-EXPERIENCIA digital 1986-2024.pdf
Javier Lasa
 
Comptia N+ Standard Networking lesson guide
Comptia N+ Standard Networking lesson guideComptia N+ Standard Networking lesson guide
Comptia N+ Standard Networking lesson guide
GTProductions1
 
History+of+E-commerce+Development+in+China-www.cfye-commerce.shop
History+of+E-commerce+Development+in+China-www.cfye-commerce.shopHistory+of+E-commerce+Development+in+China-www.cfye-commerce.shop
History+of+E-commerce+Development+in+China-www.cfye-commerce.shop
laozhuseo02
 
Bridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptx
Bridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptxBridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptx
Bridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptx
Brad Spiegel Macon GA
 
test test test test testtest test testtest test testtest test testtest test ...
test test test test testtest test testtest test testtest test testtest test ...test test test test testtest test testtest test testtest test testtest test ...
test test test test testtest test testtest test testtest test testtest test ...
Arif0071
 
一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理
一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理
一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理
ufdana
 
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
3ipehhoa
 
The+Prospects+of+E-Commerce+in+China.pptx
The+Prospects+of+E-Commerce+in+China.pptxThe+Prospects+of+E-Commerce+in+China.pptx
The+Prospects+of+E-Commerce+in+China.pptx
laozhuseo02
 
一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理
一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理
一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理
eutxy
 
How to Use Contact Form 7 Like a Pro.pptx
How to Use Contact Form 7 Like a Pro.pptxHow to Use Contact Form 7 Like a Pro.pptx
How to Use Contact Form 7 Like a Pro.pptx
Gal Baras
 
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
3ipehhoa
 
Bài tập unit 1 English in the world.docx
Bài tập unit 1 English in the world.docxBài tập unit 1 English in the world.docx
Bài tập unit 1 English in the world.docx
nhiyenphan2005
 
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
3ipehhoa
 
Internet of Things in Manufacturing: Revolutionizing Efficiency & Quality | C...
Internet of Things in Manufacturing: Revolutionizing Efficiency & Quality | C...Internet of Things in Manufacturing: Revolutionizing Efficiency & Quality | C...
Internet of Things in Manufacturing: Revolutionizing Efficiency & Quality | C...
CIOWomenMagazine
 
Meet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdf
Meet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdfMeet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdf
Meet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdf
Florence Consulting
 
guildmasters guide to ravnica Dungeons & Dragons 5...
guildmasters guide to ravnica Dungeons & Dragons 5...guildmasters guide to ravnica Dungeons & Dragons 5...
guildmasters guide to ravnica Dungeons & Dragons 5...
Rogerio Filho
 

Recently uploaded (20)

APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024
APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024
APNIC Foundation, presented by Ellisha Heppner at the PNG DNS Forum 2024
 
Latest trends in computer networking.pptx
Latest trends in computer networking.pptxLatest trends in computer networking.pptx
Latest trends in computer networking.pptx
 
This 7-second Brain Wave Ritual Attracts Money To You.!
This 7-second Brain Wave Ritual Attracts Money To You.!This 7-second Brain Wave Ritual Attracts Money To You.!
This 7-second Brain Wave Ritual Attracts Money To You.!
 
Italy Agriculture Equipment Market Outlook to 2027
Italy Agriculture Equipment Market Outlook to 2027Italy Agriculture Equipment Market Outlook to 2027
Italy Agriculture Equipment Market Outlook to 2027
 
JAVIER LASA-EXPERIENCIA digital 1986-2024.pdf
JAVIER LASA-EXPERIENCIA digital 1986-2024.pdfJAVIER LASA-EXPERIENCIA digital 1986-2024.pdf
JAVIER LASA-EXPERIENCIA digital 1986-2024.pdf
 
Comptia N+ Standard Networking lesson guide
Comptia N+ Standard Networking lesson guideComptia N+ Standard Networking lesson guide
Comptia N+ Standard Networking lesson guide
 
History+of+E-commerce+Development+in+China-www.cfye-commerce.shop
History+of+E-commerce+Development+in+China-www.cfye-commerce.shopHistory+of+E-commerce+Development+in+China-www.cfye-commerce.shop
History+of+E-commerce+Development+in+China-www.cfye-commerce.shop
 
Bridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptx
Bridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptxBridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptx
Bridging the Digital Gap Brad Spiegel Macon, GA Initiative.pptx
 
test test test test testtest test testtest test testtest test testtest test ...
test test test test testtest test testtest test testtest test testtest test ...test test test test testtest test testtest test testtest test testtest test ...
test test test test testtest test testtest test testtest test testtest test ...
 
一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理
一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理
一比一原版(CSU毕业证)加利福尼亚州立大学毕业证成绩单专业办理
 
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
 
The+Prospects+of+E-Commerce+in+China.pptx
The+Prospects+of+E-Commerce+in+China.pptxThe+Prospects+of+E-Commerce+in+China.pptx
The+Prospects+of+E-Commerce+in+China.pptx
 
一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理
一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理
一比一原版(LBS毕业证)伦敦商学院毕业证成绩单专业办理
 
How to Use Contact Form 7 Like a Pro.pptx
How to Use Contact Form 7 Like a Pro.pptxHow to Use Contact Form 7 Like a Pro.pptx
How to Use Contact Form 7 Like a Pro.pptx
 
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
 
Bài tập unit 1 English in the world.docx
Bài tập unit 1 English in the world.docxBài tập unit 1 English in the world.docx
Bài tập unit 1 English in the world.docx
 
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
 
Internet of Things in Manufacturing: Revolutionizing Efficiency & Quality | C...
Internet of Things in Manufacturing: Revolutionizing Efficiency & Quality | C...Internet of Things in Manufacturing: Revolutionizing Efficiency & Quality | C...
Internet of Things in Manufacturing: Revolutionizing Efficiency & Quality | C...
 
Meet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdf
Meet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdfMeet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdf
Meet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdf
 
guildmasters guide to ravnica Dungeons & Dragons 5...
guildmasters guide to ravnica Dungeons & Dragons 5...guildmasters guide to ravnica Dungeons & Dragons 5...
guildmasters guide to ravnica Dungeons & Dragons 5...
 

Attack Simulation and Hunting

  • 1. South Africa – 11 Official Languages Greetings! Afrikaans – Goeie dag English – Hello isiNdebele – Lotjhani isiXhosa – Mholo isiZulu – Sanibona Sepedi – Thobela Sesotho – Dumela Setswana – Dumela SiSwati – Sawubona Tshivenda – Ndaa/Aa Xitsonga – Avuxeni Thank you! Afrikaans – Dankie English – Thanks isiNdebele – Ngiyathokoza isiXhosa – Enkosi isiZulu – Ngiyabonga Sepedi – Ke a leboga Sesotho – Ke a leboha Setswana – Ke a leboga SiSwati – Ngiyabonga Tshivenda –Ndi a livhuwa Xitsonga – ndzi khense
  • 4. #whoami Nathi Mogomotsi @nathimog african, black, grand[son], brother, hacker, n00b, vegan, alcohol, not-french, suck-at-english, God fearing, not-a-saint, no tattoo, biker Sr. Red Teamer @sanlam Hacker @sensepost
  • 5. How it all started • New job • More time to do research and 1337 hax But… • It wasn’t fun anymore • Now I get to receive pen test reports • I am on the receiving end • Needed to do something about this • Time to help the defenders https://twitter.com/s7ephen/status/925969930134024192
  • 6. On an Unrelated Note: • I asked my previous boss (Charl) to buy me this book 4~ years I ago • I knew I had some “defensive” blood in me 
  • 7. How it all started • Watched CG and CN talk • Was impressed, thanks guys • Go watch the talk • Will wait for you…
  • 8. Why this talk • To share my experience • To share my learnings • Hopefully it will help you get started (you should) • I am not an expert, so this is really basic stuff • Ping me if you have any comments or ideas • nathi@protonmail.com
  • 9. Why this talk – Pyramid of Pain http://detect-respond.blogspot.co.za/2013/03/the-pyramid-of-pain.html
  • 10. What is attack simulation ? • Just like a pilot simulator, it is there to put you in the worst possible situation at a lowest level of risk - Chris Nickerson • Understanding attacks that might be used against an organisation in order to improve the organisation’s defence – me • Attack simulations should be done to learn how attackers are likely to achieve goals against your organization – Zane Lackey • Can we detect and/or stop a particular attack ? • Assume compromise – We can be compromised!
  • 11. What is attack hunting ? • Proactive incident response • Are we hacked by this particular attack ? • Assume compromise – We might be compromised already!
  • 12. High Level Process|Attack Oriented Defence Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
  • 13. Attack Techniques Choose a technique you interested in: • Technique used in the wild • Technique from threat reports • Technique you found during your vuln research • Technique from software vendors security bulletins • Technique from hacker tools • Technique from pen testing report
  • 14. Attack Techniques - MITRE “ATT&CK is useful for understanding security risk against known adversary behavior, for planning security improvements, and verifying defenses work as expected.” https://attack.mitre.org/wiki/Main_Page
  • 16. Attack Techniques - Tools Media and your CISO
  • 17. Attack Techniques - Tools https://www.slideshare.net/JaredAtkinson/purpose-driven-hunt-derbycon-2017
  • 18. Recap • We identified the technique we want to focus on. Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
  • 19. Defensive Controls – Cyber Kill Chain
  • 20. Weaponization Reconnaissance Delivery Exploitation Installation Command & Control Actions on Objectives Detect Deny Disrupt Degrade Deceive Contain Web Analytics Firewall ACL Firewall ACL NIDS NIPS NIPS Vigilant user Proxy filter Inline AV Email Queuing App-Aware Firewall HIDS Vendor Patch EMET, DEP Inter-Zone NIPS HIDS ‘chroot’ Jail AV EPP NIDS Firewall ACL NIPS Tar pit DNS Redirect Trust Zones Audit log Outbound ACL DLP QOS Throttle Honeypot Trust Zones
  • 21. Recap • We identified the technique we want to focus on. • We understand our current defences. • We identified the technique we want to focus on Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
  • 22. Simulations – The process Hack yourself first Hack the humans Attack analysis with the blue team Defence controls update Validate new defence controls Activity Tracker
  • 23. Simulations – Hack yourself first • Test detection tools • Use a test machine identical to your environment • Collect Indicators of Compromise (IoCs) Network artefacts User Agent Strings Dynamic DNS visits Encrypted traffic MIME type downloads Host artefacts New files New services New registry Files that runs on reboot
  • 24. Simulations – Hack yourself first (MITRE) • https://github.com/redcanaryco/atomic-red-team • https://www.youtube.com/watch?v=M4SHpDX8GTo
  • 25. Simulation – hack the humans • Test processes • Test blue team response to alerts • Test IR procedure
  • 26. Simulations – Attack Analysis with the blue • Show how you did your hack • Kill chain analysis and controls • Map logs to the attack • Handover Indicators of Compromise
  • 28. Simulation – Defence update • To automate detection • Update • FW/IDS/IPS/AV/EDR/<your security product here> • Processes • Deploy Controls • Controls should not be expensive and complex • https://t2.fi/2017/02/05/haroon-meer-keynote-2016/
  • 29. Simulation – Controls validation • Validate the new defence controls • Create a script to automate this • Should not be fancy • Mainly to help the blue team
  • 31. Recap • We identified the technique we want to focus on • We understand our current defences • We tested, updated and validated controls and incident procedures • We know which data sets to use for our hunts Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
  • 32. Hunting – The process • Collect data sets • Process the data sets • Analyse collection • Malicious activity • Activity tracker
  • 33. Hunting – Collect data sets • Proxy logs • Anti-Virus logs • Application logs • Sysmon logs • Bro IDS logs • DNS logs • Firewall logs • Netflow data
  • 34. Hunting – Techniques to process the data sets Searching Stack Counting Grouping Clustering https://sqrrl.com/threat-hunting-reference-guide/ https://speakerdeck.com/davidjbianco/toppling-the-stack-practical-outlier-detection-for-threat-hunters
  • 35. Hunting – Analyse collection • Search artefacts on the network data sets • Find suspicious hosts • Host threat hunting https://www.sans.org/summit-archives/file/summit-archive-1492556122.pdf
  • 36. Hunting – Found suspicious activity • Call the forensicators • Execute the IR plan
  • 38. Recap • We identified the technique we want to focus on • We understand our current defences • We tested, updated and validated controls and incident procedures • We know which data sets to use for our hunts • We confirmed if we are under attack or not • Hopefully eradicated the threat Attack Technique Defensive Controls Simulation Hunting Measure Effectiveness
  • 39. Measure Effectiveness • Effectiveness is a measure of the success of the operation, overall - Raphael Mudge. • Roberto Rodriguez (@cyb3rWard0g) • https://cyberwardog.blogspot.co.za/2017/07/how-hot-is-your-hunt-team.html
  • 40. KEY TAKEAWAYS • You get to play part in defence • You get to find bad guys and pen testers • You get to learn other stuff i.e DFIR, network monitoring, rules writing • You get to do cool hacks that actually makes a difference in your org • You get to teach the blue team • You get to learn from them too.. https://medium.com/@sroberts/introduction-to-dfir-d35d5de4c180
  • 41. More from CN and CG • If you didn’t watch their talk earlier • Go ahead and watch this one • Updated and more awesome • Thanks once again guys
  • 42. Tools – because you want to automate • CALDERA: Automatic adversary emulation (to be released at BH17 EU) • DumpsterFire – Threat simulations • SQRLL VM – Threat hunting • CCF VM – Incident triage (DFIR) with ELK • Bro IDS – Network monitoring • Sysmon – System monitoring • ELK – Data visualisation • Chris Gates is also releasing something soon ;)
  • 43. Credits / References / Thank you Credits & Thank you for your contributions • @indi303 • @carnal0wnage • @ jackcr • @DavidJBianco • @Sroberts • @RobertMLee • @Subtee • @Chrissanders88 • DR. Eric Cole • @Jaredcatkinson • @Robwinchester3 • @DAkacki • @cyb3rWard0g Resources • https://github.com/magoo/redteam-plan • http://soc.wa.gov/resources/exercises • https://github.com/redcanaryco/atomic-red-team • https://resources.redcanary.com/atomic-red-team-training-session- nov-2017 • https://github.com/demisto/content Training • Chris Sanders - http://chrissanders.org/training/ • @zanelackey • @haroonmeer • @M_haggis • @mattifestation • @AlanOrlikoski • @PyroTek3 • @SqrrlData • @redcanaryco • Bloodhound Gang
  • 44. Special Thanks: When I do grow up one day I want to be like these guys • Willem Smit @slackerscoza • Kelvin Adams @nivlek007 • George Pranschke @cheorchie • Chris Gates @carnal0wnage • Awesome people I have ever met! • Keep rocking guys.
  • 45. “Do whatever you want. Trust your guts, your humanly feelings, your very limited knowledge. This is best effort.” – Julio Auto
  • 46. Thanks once again, do your best effort to try to be nice to one another & take care of your health!