SlideShare a Scribd company logo

Avoiding the Pitfalls of Hunting - BSides Charm 2016

•
•
Tony Cook
Tony Cook

The document discusses various pitfalls that can be encountered when performing hunting activities. It provides tips on how to properly prepare for hunting by mapping your network and understanding available tools, ensuring tools are properly deployed and integrated, developing repeatable methodologies for analysis, avoiding getting overwhelmed by focusing on specific issues, using vulnerability intelligence to continuously improve, and testing capabilities through red team exercises. The overall goals are to conduct hunting in a systematic, risk-based manner focused on actionable outcomes.

1 of 34
Download to read offline
1 © Copyright 2015 EMC Corporation. All rights reserved. Avoiding the Pitfalls of Hunting The Art of Fail
2 © Copyright 2015 EMC Corporation. All rights reserved. Press Start if you’re ready You’re not ready…
3 © Copyright 2015 EMC Corporation. All rights reserved. •  Tony Cook •  RSA IR •  Just here for the Good Times… Your Supposed Guide… (Good Luck)
4 © Copyright 2015 EMC Corporation. All rights reserved. •  Where Hunting can go wrong •  How to avoid losing before starting •  Review old fails to make your fails “less badder” What’s the goal of this Talk?
5 © Copyright 2015 EMC Corporation. All rights reserved. Don’t be that guy
6 © Copyright 2015 EMC Corporation. All rights reserved. •  Empower enterprises to PROACTIVELY search for and discover threats within their networks. •  Assumes Breach has occurred •  One Component in a SOC To Keep in mind: What’s the goal of Hunting
7 © Copyright 2015 EMC Corporation. All rights reserved. •  Everyone’s _____ is different –  Environment –  Company Mission –  Staff –  Tools –  Policies •  Stop taking everyone’s advice –  Think Critically about your network •  Risk Based Analysis will give you your depth for each of these –  Maybe you don’t have the budget for Cream of the Crop •  Tools •  Staff –  Still need a way to look through your Jungle First things First
8 © Copyright 2015 EMC Corporation. All rights reserved. •  Where most Fails start •  Not knowing where your Jungle inside & out –  Borders & Internal •  Not understanding what’s in your environment •  You can’t defend what you don’t know •  Understand the Context of your Network •  Invisible Enemy’s are hard to fight Make a Map AKA Critical Top 20 - #1 & #2
9 © Copyright 2015 EMC Corporation. All rights reserved. •  Understand your trusted relationships •  Understand their Vulnerabilities/Threats •  Have complete Visibility/Control into traffic coming to and from your Jungle –  You have enough to deal with –  Most of the threats come from outside •  If you had to how would you segregate yourself from any/all other partners? Shared Jungles Who do you trust?
10 © Copyright 2015 EMC Corporation. All rights reserved. •  Review your current Tool Sets to see what you can you use •  Suggestions –  NetFlow Hunting •  Tracking Ingressing & Egressing Hosts –  Who’s talking to who? –  Prads/p0f –  Host Based Agents •  HBSS •  IR Tools •  Vulnerability Management •  NAC •  Network Discovery Tools Tools to Help this
11 © Copyright 2015 EMC Corporation. All rights reserved. •  # 1 way to fail is to trust a single dataset –  Coalesce ALL THE THINGS •  HBSS -> Vulnerability Scan -> NMAP -> Netflow –  Find the outliers •  Patch Management -> NMAP -> NetFlow •  Trust in One, Fail by One VALIDATE
12 © Copyright 2015 EMC Corporation. All rights reserved. •  Understand your tools •  Know their strengths and weaknesses •  Ensure their purposes –  Visibility –  Control –  Both? •  If both… Ensure a validating measure It’s dangerous out there… Take this
13 © Copyright 2015 EMC Corporation. All rights reserved. •  You wouldn’t go hunting without ever firing a gun at the range –  Don’t go into the Jungle without first knowing how to use your tool for various situations –  Misunderstanding tool outputs are some of the biggest pitfalls you’ll ever face. •  The biggest pit you’ll fall down is the one you keep digging •  TEST OUT YOUR TOOLS –  Virtual Network –  Guest Network –  Anything Train with your tools
14 © Copyright 2015 EMC Corporation. All rights reserved. •  How fast can you go from IOC to Confirmation to Remediation? –  Network Detection -> Exact Host •  X-Forwarded-For Enabled? •  DHCP Logs? •  DNS Logs? –  Exact Host -> Artifacts –  Host Detection -> Artifacts •  Compliment each other in such a way that you can seamlessly pivot from Network indicator <-> Host indicator •  How deep is your visibility on your Hosts/Network? –  Are you using them for a Hunting Dataset? –  Full Packet Capture || Netflow? –  Process Execution || AntiVirus •  How do you bring your datasets together? –  Do they benefit one another Pitfall - Does your Security Stack Blend?
15 © Copyright 2015 EMC Corporation. All rights reserved. •  Are you using Everything at your disposal? •  Do your tools let you grab everything you need? Host-Based –  SHIMCache –  Services –  CIM –  Scheduled Tasks –  Run Once Hives –  Much More Network-Based –  MetaData within PCAP •  UserAgents •  Referrals •  Session Size •  Flags •  Much Much Much more How Deep do your Datasets go?
16 © Copyright 2015 EMC Corporation. All rights reserved. •  If you don’t understand the tool… ASK WHO MADE IT!!! •  9/10 you’re not using it to it’s fullest potential •  Most Vendor’s will be more than happy to send PS out to make you a success story •  Assuming how a tool works will lead to misery Vendors… A Quick Fix...
17 © Copyright 2015 EMC Corporation. All rights reserved. 1.  Don’t Deploy them everywhere 2.  Don’t Include them in legacy plans 3.  Don’t size them appropriately 4.  Don’t Cross-Train Your Team 5.  Don’t Log them Centrally 6.  Don’t Use All of their Features 7.  Don’t correlate them with your other tools 8.  Check the Box How to Fail with your Tools
18 © Copyright 2015 EMC Corporation. All rights reserved. Got your Map & Your Tools? Let’s GO….
19 © Copyright 2015 EMC Corporation. All rights reserved. •  Gather Data •  Analyze Data –  Look for •  IOC’s •  Outliers •  Known Bad INTEL •  Modify IOCs –  Document •  Remediate any findings •  Repeat Remember Not Every Outcome of Hunting is Malicious - Policy Violations - Configuration Issues - Gaps in Coverage General Concept of Hunting Gather Data Analyze Data - IOC’s - Outliers - Bad Intel - Modify IOC’s Document Remediate
20 © Copyright 2015 EMC Corporation. All rights reserved. •  One of the biggest Pitfalls is running around aimlessly looking at all the things •  Pick or Develop a Repeatable Methodology for Analysis •  Can be different for each analyst, cell, or company •  Examples –  OODA Loop –  5 I’s Analysis Methodology Required
21 © Copyright 2015 EMC Corporation. All rights reserved. Example OODA Loop
22 © Copyright 2015 EMC Corporation. All rights reserved. •  Observe – Bring in Data! •  Orient – Analyze –  Synthesize it to work in your datasets –  Put in the proper context!!! –  Use prior validated knowledge –  Analyze •  Decide – Make a Proper Hypothesis REPEAT THESE THREE THINGS UNTIL YOU HAVE SOMETHING ACTIONABLE •  Act – Remediate or Document Quick WalkThrough
23 © Copyright 2015 EMC Corporation. All rights reserved. •  Seeing the same old thing over & over? •  Different Approaches –  Anomaly –  Intelligence –  Objective •  Try out various Data Analytics on different datasets –  Temporal –  Rare –  Variance –  New Analysis Bias
24 © Copyright 2015 EMC Corporation. All rights reserved. •  Don’t get so “HYPE” that you lose the forest for a tree •  Don’t mismanage your resources –  Have everyone work on the same thing –  Rely on one person •  Don’t let a fire get out of your control •  Take a breath & make sure you’re in context Slow Down
25 © Copyright 2015 EMC Corporation. All rights reserved. •  Don’t be afraid to use “RED” Tools •  There is a reason they’re using them •  Most of them are built-in OS Tools Thinking like the enemy…
26 © Copyright 2015 EMC Corporation. All rights reserved. A run through of more Pitfalls
27 © Copyright 2015 EMC Corporation. All rights reserved. •  1st My thoughts… –  That this is still a thing… –  Every major vendor has a free solution to do this... –  If you don’t have this already being done... –  0 days are always there but getting owned by a 5 year old vulnerability... Just... I can’t even… •  Simply PATCH •  2nd Are you using it in more ways than one? –  Context Value added to your Map –  Using it to further understand your critical hosts •  New Software Deployed My least favorite Pitfall… Vulnerability Management
28 © Copyright 2015 EMC Corporation. All rights reserved. •  Most Environments… It’s Black or White –  Don’t complicate it •  Snake = Bad •  Extra Life = Good •  Once you found a scorpion & know how it moves... Document it & Be Alert for it next time •  Failure to do so will get you bit… Over & Over •  Also... Sharing is caring. Threat Intelligence How not to use it
29 © Copyright 2015 EMC Corporation. All rights reserved. •  Putting IOCs into a ticket which never become actionable •  Not having NO context to IOCs •  Creating bad Signatures –  Strings –  Not deploying them properly –  No validation •  Deploying other’s signatures with 0 testing •  Diving too deep –  Making it Grey –  Getting too wrapped up in non-plausible attacks –  Make it relevant to your environment Pitfalls
30 © Copyright 2015 EMC Corporation. All rights reserved. •  The more you play the more you can see the slight differences in the snakes, scorpions, and pitfalls •  Same with Hunting –  IOC’s will become clear –  How attacks happen will become clearer Inherent Knowledge Same thing as a game
31 © Copyright 2015 EMC Corporation. All rights reserved. •  How are you tracking your users? •  Check your Authentication Mechanism –  Several New Tools –  Poor Man’s Way •  Pull your AD Tree with Powershell •  Diff it Daily –  Check for variances •  Check for new users logging into systems they never have before •  Check for user’s with new permission •  https://gallery.technet.microsoft.com/scriptcenter/Powershell-script-to-5edcdaea Masked Threats Identity / Account Management
32 © Copyright 2015 EMC Corporation. All rights reserved. •  Properly Use a Red Team –  Find your blind spots –  Use pre-determined Test cases •  Validate results •  Work with them Not Against them –  Don’t make it a competition –  Make it a value added training •  Understand the results of the test •  Continual Process – Not a One & Done Test yourself
33 © Copyright 2015 EMC Corporation. All rights reserved. Questions???
34 © Copyright 2015 EMC Corporation. All rights reserved. Fin

Recommended

Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
Spyglass Security
 
Hunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsHunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark Arts
Spyglass Security
 
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Danny Akacki
 
Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck
Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin FalckLuncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck
Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck
North Texas Chapter of the ISSA
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
Ben Boyd
 
Threat hunting and achieving security maturity
Threat hunting and achieving security maturityThreat hunting and achieving security maturity
Threat hunting and achieving security maturity
DNIF
 
TTPs for Threat hunting In Oil Refineries
TTPs for Threat hunting In Oil RefineriesTTPs for Threat hunting In Oil Refineries
TTPs for Threat hunting In Oil Refineries
Dragos, Inc.
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
Dhruv Majumdar
 

Recommended

Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
Spyglass Security
 
Hunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark ArtsHunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark Arts
Spyglass Security
 
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Danny Akacki
 
Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck
Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin FalckLuncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck
Luncheon 2016-07-16 - Topic 2 - Advanced Threat Hunting by Justin Falck
North Texas Chapter of the ISSA
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
Ben Boyd
 
Threat hunting and achieving security maturity
Threat hunting and achieving security maturityThreat hunting and achieving security maturity
Threat hunting and achieving security maturity
DNIF
 
TTPs for Threat hunting In Oil Refineries
TTPs for Threat hunting In Oil RefineriesTTPs for Threat hunting In Oil Refineries
TTPs for Threat hunting In Oil Refineries
Dragos, Inc.
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
Dhruv Majumdar
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
Raffael Marty
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
GIBIN JOHN
 
Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightCyber Threat Hunting with Phirelight
Cyber Threat Hunting with Phirelight
Hostway|HOSTING
 
Hunting on the Cheap
Hunting on the CheapHunting on the Cheap
Hunting on the Cheap
EndgameInc
 
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Chi En (Ashley) Shen
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Katie Nickels
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE - ATT&CKcon
 
Advanced Threats and Lateral Movement Detection
Advanced Threats and Lateral Movement DetectionAdvanced Threats and Lateral Movement Detection
Advanced Threats and Lateral Movement Detection
Greg Foss
 
My Keynote from BSidesTampa 2015 (video in description)
My Keynote from BSidesTampa 2015 (video in description)My Keynote from BSidesTampa 2015 (video in description)
My Keynote from BSidesTampa 2015 (video in description)
Andrew Case
 
SANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat IntelligenceSANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat Intelligence
Jason Trost
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016
Matthew Dunwoody
 
MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with A...
MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with A...MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with A...
MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with A...
MITRE - ATT&CKcon
 
How to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your NetworkHow to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your Network
Sqrrl
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE - ATT&CKcon
 
Threat Intelligence Field of Dreams
Threat Intelligence Field of DreamsThreat Intelligence Field of Dreams
Threat Intelligence Field of Dreams
Greg Foss
 
Threat hunting on the wire
Threat hunting on the wireThreat hunting on the wire
Threat hunting on the wire
InfoSec Addicts
 
Confusion and deception new tools for data protection
Confusion and deception new tools for data protectionConfusion and deception new tools for data protection
Confusion and deception new tools for data protection
Priyanka Aash
 
MITRE ATTACKCon Power Hour - December
MITRE ATTACKCon Power Hour - DecemberMITRE ATTACKCon Power Hour - December
MITRE ATTACKCon Power Hour - December
MITRE - ATT&CKcon
 
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - GerritzBSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
Christopher Gerritz
 
Hunting before a Known Incident
Hunting before a Known IncidentHunting before a Known Incident
Hunting before a Known Incident
EndgameInc
 
Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?
Brandon McCrillis
 
Boulder County December 2012 statistics
Boulder County December 2012 statisticsBoulder County December 2012 statistics
Boulder County December 2012 statistics
Neil Kearney
 

More Related Content

What's hot

Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
Raffael Marty
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
GIBIN JOHN
 
Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightCyber Threat Hunting with Phirelight
Cyber Threat Hunting with Phirelight
Hostway|HOSTING
 
Hunting on the Cheap
Hunting on the CheapHunting on the Cheap
Hunting on the Cheap
EndgameInc
 
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Chi En (Ashley) Shen
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Katie Nickels
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE - ATT&CKcon
 
Advanced Threats and Lateral Movement Detection
Advanced Threats and Lateral Movement DetectionAdvanced Threats and Lateral Movement Detection
Advanced Threats and Lateral Movement Detection
Greg Foss
 
My Keynote from BSidesTampa 2015 (video in description)
My Keynote from BSidesTampa 2015 (video in description)My Keynote from BSidesTampa 2015 (video in description)
My Keynote from BSidesTampa 2015 (video in description)
Andrew Case
 
SANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat IntelligenceSANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat Intelligence
Jason Trost
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016
Matthew Dunwoody
 
MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with A...
MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with A...MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with A...
MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with A...
MITRE - ATT&CKcon
 
How to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your NetworkHow to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your Network
Sqrrl
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE - ATT&CKcon
 
Threat Intelligence Field of Dreams
Threat Intelligence Field of DreamsThreat Intelligence Field of Dreams
Threat Intelligence Field of Dreams
Greg Foss
 
Threat hunting on the wire
Threat hunting on the wireThreat hunting on the wire
Threat hunting on the wire
InfoSec Addicts
 
Confusion and deception new tools for data protection
Confusion and deception new tools for data protectionConfusion and deception new tools for data protection
Confusion and deception new tools for data protection
Priyanka Aash
 
MITRE ATTACKCon Power Hour - December
MITRE ATTACKCon Power Hour - DecemberMITRE ATTACKCon Power Hour - December
MITRE ATTACKCon Power Hour - December
MITRE - ATT&CKcon
 
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - GerritzBSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
Christopher Gerritz
 
Hunting before a Known Incident
Hunting before a Known IncidentHunting before a Known Incident
Hunting before a Known Incident
EndgameInc
 

What's hot (20)

Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
 
Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightCyber Threat Hunting with Phirelight
Cyber Threat Hunting with Phirelight
 
Hunting on the Cheap
Hunting on the CheapHunting on the Cheap
Hunting on the Cheap
 
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
 
Advanced Threats and Lateral Movement Detection
Advanced Threats and Lateral Movement DetectionAdvanced Threats and Lateral Movement Detection
Advanced Threats and Lateral Movement Detection
 
My Keynote from BSidesTampa 2015 (video in description)
My Keynote from BSidesTampa 2015 (video in description)My Keynote from BSidesTampa 2015 (video in description)
My Keynote from BSidesTampa 2015 (video in description)
 
SANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat IntelligenceSANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat Intelligence
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016
 
MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with A...
MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with A...MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with A...
MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with A...
 
How to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your NetworkHow to Hunt for Lateral Movement on Your Network
How to Hunt for Lateral Movement on Your Network
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
 
Threat Intelligence Field of Dreams
Threat Intelligence Field of DreamsThreat Intelligence Field of Dreams
Threat Intelligence Field of Dreams
 
Threat hunting on the wire
Threat hunting on the wireThreat hunting on the wire
Threat hunting on the wire
 
Confusion and deception new tools for data protection
Confusion and deception new tools for data protectionConfusion and deception new tools for data protection
Confusion and deception new tools for data protection
 
MITRE ATTACKCon Power Hour - December
MITRE ATTACKCon Power Hour - DecemberMITRE ATTACKCon Power Hour - December
MITRE ATTACKCon Power Hour - December
 
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - GerritzBSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
 
Hunting before a Known Incident
Hunting before a Known IncidentHunting before a Known Incident
Hunting before a Known Incident
 

Viewers also liked

Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?
Brandon McCrillis
 
Boulder County December 2012 statistics
Boulder County December 2012 statisticsBoulder County December 2012 statistics
Boulder County December 2012 statistics
Neil Kearney
 
медицина времен древних славян и скифов A
медицина времен древних славян и скифов Aмедицина времен древних славян и скифов A
медицина времен древних славян и скифов A
Helao Silas
 
Aprendizaje
AprendizajeAprendizaje
Aprendizaje
Universidad Autónoma de Asunción
 
Boulder County Real Estate June 2011 statistics
Boulder County Real Estate June 2011 statisticsBoulder County Real Estate June 2011 statistics
Boulder County Real Estate June 2011 statistics
Neil Kearney
 
Russuan History of Medicine
Russuan History of Medicine Russuan History of Medicine
Russuan History of Medicine
Helao Silas
 
Arquitetura da Informação e Avaliação de Websites, considerando critérios de ...
Arquitetura da Informação e Avaliação de Websites, considerando critérios de ...Arquitetura da Informação e Avaliação de Websites, considerando critérios de ...
Arquitetura da Informação e Avaliação de Websites, considerando critérios de ...
Maiara Zenatti
 
Network Reliability Monitoring for ICS: Going Beyond NSM and SIEM
Network Reliability Monitoring for ICS: Going Beyond NSM and SIEMNetwork Reliability Monitoring for ICS: Going Beyond NSM and SIEM
Network Reliability Monitoring for ICS: Going Beyond NSM and SIEM
Jim Gilsinn
 
Inca preston hellermann tyton
Inca preston hellermann tytonInca preston hellermann tyton
Inca preston hellermann tyton
Independent Networks Co-operative Association
 
Is there an EFI monster inside your apple? by Pedro Vilaça - CODE BLUE 2015
Is there an EFI monster inside your apple? by Pedro Vilaça - CODE BLUE 2015Is there an EFI monster inside your apple? by Pedro Vilaça - CODE BLUE 2015
Is there an EFI monster inside your apple? by Pedro Vilaça - CODE BLUE 2015
CODE BLUE
 
Misión en Xai Xai
Misión en Xai XaiMisión en Xai Xai
Misión en Xai Xai
Auxiliares Santa Maria
 
Cell injury
Cell injury Cell injury
Cell injury
Helao Silas
 
Introduction to data_structure
Introduction to data_structureIntroduction to data_structure
Introduction to data_structure
Ashim Lamichhane
 
Unit 6. Arrays
Unit 6. ArraysUnit 6. Arrays
Unit 6. Arrays
Ashim Lamichhane
 
Linked List
Linked ListLinked List
Linked List
Ashim Lamichhane
 

Viewers also liked (16)

Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?
 
Boulder County December 2012 statistics
Boulder County December 2012 statisticsBoulder County December 2012 statistics
Boulder County December 2012 statistics
 
медицина времен древних славян и скифов A
медицина времен древних славян и скифов Aмедицина времен древних славян и скифов A
медицина времен древних славян и скифов A
 
Aprendizaje
AprendizajeAprendizaje
Aprendizaje
 
Boulder County Real Estate June 2011 statistics
Boulder County Real Estate June 2011 statisticsBoulder County Real Estate June 2011 statistics
Boulder County Real Estate June 2011 statistics
 
Russuan History of Medicine
Russuan History of Medicine Russuan History of Medicine
Russuan History of Medicine
 
Arquitetura da Informação e Avaliação de Websites, considerando critérios de ...
Arquitetura da Informação e Avaliação de Websites, considerando critérios de ...Arquitetura da Informação e Avaliação de Websites, considerando critérios de ...
Arquitetura da Informação e Avaliação de Websites, considerando critérios de ...
 
Network Reliability Monitoring for ICS: Going Beyond NSM and SIEM
Network Reliability Monitoring for ICS: Going Beyond NSM and SIEMNetwork Reliability Monitoring for ICS: Going Beyond NSM and SIEM
Network Reliability Monitoring for ICS: Going Beyond NSM and SIEM
 
Inca preston hellermann tyton
Inca preston hellermann tytonInca preston hellermann tyton
Inca preston hellermann tyton
 
Is there an EFI monster inside your apple? by Pedro Vilaça - CODE BLUE 2015
Is there an EFI monster inside your apple? by Pedro Vilaça - CODE BLUE 2015Is there an EFI monster inside your apple? by Pedro Vilaça - CODE BLUE 2015
Is there an EFI monster inside your apple? by Pedro Vilaça - CODE BLUE 2015
 
Misión en Xai Xai
Misión en Xai XaiMisión en Xai Xai
Misión en Xai Xai
 
Cell injury
Cell injury Cell injury
Cell injury
 
Introduction to data_structure
Introduction to data_structureIntroduction to data_structure
Introduction to data_structure
 
Unit 6. Arrays
Unit 6. ArraysUnit 6. Arrays
Unit 6. Arrays
 
Linked List
Linked ListLinked List
Linked List
 
COAGULANTS
COAGULANTSCOAGULANTS
COAGULANTS
 

Similar to Avoiding the Pitfalls of Hunting - BSides Charm 2016

The Seven Deadly Sins of Incident Response
The Seven Deadly Sins of Incident ResponseThe Seven Deadly Sins of Incident Response
The Seven Deadly Sins of Incident Response
Lancope, Inc.
 
Networking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin Dunn
Networking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin DunnNetworking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin Dunn
Networking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin Dunn
North Texas Chapter of the ISSA
 
Benchmarking Web Application Scanners for YOUR Organization
Benchmarking Web Application Scanners for YOUR OrganizationBenchmarking Web Application Scanners for YOUR Organization
Benchmarking Web Application Scanners for YOUR Organization
Denim Group
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)
Sqrrl
 
Rolling Out An Enterprise Source Code Review Program
Rolling Out An Enterprise Source Code Review ProgramRolling Out An Enterprise Source Code Review Program
Rolling Out An Enterprise Source Code Review Program
Denim Group
 
Jax Devops 2017 Succeeding in the Cloud – the guidebook of Fail
Jax Devops 2017 Succeeding in the Cloud – the guidebook of FailJax Devops 2017 Succeeding in the Cloud – the guidebook of Fail
Jax Devops 2017 Succeeding in the Cloud – the guidebook of Fail
Steve Poole
 
Owning windows 8 with human interface devices
Owning windows 8 with human interface devicesOwning windows 8 with human interface devices
Owning windows 8 with human interface devices
Nikhil Mittal
 
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
EC-Council
 
A Profile of the Backoff PoS Malware that Hit 1000+ Retail Businesses
A Profile of the Backoff PoS Malware that Hit 1000+ Retail BusinessesA Profile of the Backoff PoS Malware that Hit 1000+ Retail Businesses
A Profile of the Backoff PoS Malware that Hit 1000+ Retail Businesses
Lastline, Inc.
 
Reacting to Advanced, Unknown Attacks in Real-Time with Lastline
Reacting to Advanced, Unknown Attacks in Real-Time with LastlineReacting to Advanced, Unknown Attacks in Real-Time with Lastline
Reacting to Advanced, Unknown Attacks in Real-Time with LastlineLastline, Inc.
 
Honeypot
HoneypotHoneypot
Honeypot
KirtiGoyal25
 
Info sec is not daunting v1.0
Info sec is not daunting v1.0 Info sec is not daunting v1.0
Info sec is not daunting v1.0
Michael Gough
 
DevOps is a ReOrg
DevOps is a ReOrgDevOps is a ReOrg
DevOps is a ReOrg
Patrick Butler Monterde
 
Information Security: Advanced SIEM Techniques
Information Security: Advanced SIEM TechniquesInformation Security: Advanced SIEM Techniques
Information Security: Advanced SIEM Techniques
ReliaQuest
 
Incident Response Fails
Incident Response FailsIncident Response Fails
Incident Response Fails
Michael Gough
 
Malware in the Wild: Evolving to Evade Detection
Malware in the Wild: Evolving to Evade DetectionMalware in the Wild: Evolving to Evade Detection
Malware in the Wild: Evolving to Evade Detection
Lastline, Inc.
 
Scaling a Web Site - OSCON Tutorial
Scaling a Web Site - OSCON TutorialScaling a Web Site - OSCON Tutorial
Scaling a Web Site - OSCON Tutorial
duleepa
 
Cyber security - It starts with the embedded system
Cyber security - It starts with the embedded systemCyber security - It starts with the embedded system
Cyber security - It starts with the embedded system
Rogue Wave Software
 
Vulnerability Management In An Application Security World
Vulnerability Management In An Application Security WorldVulnerability Management In An Application Security World
Vulnerability Management In An Application Security World
Denim Group
 

Similar to Avoiding the Pitfalls of Hunting - BSides Charm 2016 (20)

The Seven Deadly Sins of Incident Response
The Seven Deadly Sins of Incident ResponseThe Seven Deadly Sins of Incident Response
The Seven Deadly Sins of Incident Response
 
Networking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin Dunn
Networking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin DunnNetworking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin Dunn
Networking 2016-06-14 - The Dirty Secrets of Enterprise Security by Kevin Dunn
 
Benchmarking Web Application Scanners for YOUR Organization
Benchmarking Web Application Scanners for YOUR OrganizationBenchmarking Web Application Scanners for YOUR Organization
Benchmarking Web Application Scanners for YOUR Organization
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)
 
Rolling Out An Enterprise Source Code Review Program
Rolling Out An Enterprise Source Code Review ProgramRolling Out An Enterprise Source Code Review Program
Rolling Out An Enterprise Source Code Review Program
 
Jax Devops 2017 Succeeding in the Cloud – the guidebook of Fail
Jax Devops 2017 Succeeding in the Cloud – the guidebook of FailJax Devops 2017 Succeeding in the Cloud – the guidebook of Fail
Jax Devops 2017 Succeeding in the Cloud – the guidebook of Fail
 
Owning windows 8 with human interface devices
Owning windows 8 with human interface devicesOwning windows 8 with human interface devices
Owning windows 8 with human interface devices
 
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
Finding the Sweet Spot: Counter Honeypot Operations (CHOps) by Jonathan Creek...
 
A Profile of the Backoff PoS Malware that Hit 1000+ Retail Businesses
A Profile of the Backoff PoS Malware that Hit 1000+ Retail BusinessesA Profile of the Backoff PoS Malware that Hit 1000+ Retail Businesses
A Profile of the Backoff PoS Malware that Hit 1000+ Retail Businesses
 
Reacting to Advanced, Unknown Attacks in Real-Time with Lastline
Reacting to Advanced, Unknown Attacks in Real-Time with LastlineReacting to Advanced, Unknown Attacks in Real-Time with Lastline
Reacting to Advanced, Unknown Attacks in Real-Time with Lastline
 
Honeypot
HoneypotHoneypot
Honeypot
 
Info sec is not daunting v1.0
Info sec is not daunting v1.0 Info sec is not daunting v1.0
Info sec is not daunting v1.0
 
Honeypot
Honeypot Honeypot
Honeypot
 
DevOps is a ReOrg
DevOps is a ReOrgDevOps is a ReOrg
DevOps is a ReOrg
 
Information Security: Advanced SIEM Techniques
Information Security: Advanced SIEM TechniquesInformation Security: Advanced SIEM Techniques
Information Security: Advanced SIEM Techniques
 
Incident Response Fails
Incident Response FailsIncident Response Fails
Incident Response Fails
 
Malware in the Wild: Evolving to Evade Detection
Malware in the Wild: Evolving to Evade DetectionMalware in the Wild: Evolving to Evade Detection
Malware in the Wild: Evolving to Evade Detection
 
Scaling a Web Site - OSCON Tutorial
Scaling a Web Site - OSCON TutorialScaling a Web Site - OSCON Tutorial
Scaling a Web Site - OSCON Tutorial
 
Cyber security - It starts with the embedded system
Cyber security - It starts with the embedded systemCyber security - It starts with the embedded system
Cyber security - It starts with the embedded system
 
Vulnerability Management In An Application Security World
Vulnerability Management In An Application Security WorldVulnerability Management In An Application Security World
Vulnerability Management In An Application Security World
 

Recently uploaded

Competition and Regulation in Professional Services – KLEINER – June 2024 OEC...
Competition and Regulation in Professional Services – KLEINER – June 2024 OEC...Competition and Regulation in Professional Services – KLEINER – June 2024 OEC...
Competition and Regulation in Professional Services – KLEINER – June 2024 OEC...
OECD Directorate for Financial and Enterprise Affairs
 
Sharpen existing tools or get a new toolbox? Contemporary cluster initiatives...
Sharpen existing tools or get a new toolbox? Contemporary cluster initiatives...Sharpen existing tools or get a new toolbox? Contemporary cluster initiatives...
Sharpen existing tools or get a new toolbox? Contemporary cluster initiatives...
Orkestra
 
Supercharge your AI - SSP Industry Breakout Session 2024-v2_1.pdf
Supercharge your AI - SSP Industry Breakout Session 2024-v2_1.pdfSupercharge your AI - SSP Industry Breakout Session 2024-v2_1.pdf
Supercharge your AI - SSP Industry Breakout Session 2024-v2_1.pdf
Access Innovations, Inc.
 
Bonzo subscription_hjjjjjjjj5hhhhhhh_2024.pdf
Bonzo subscription_hjjjjjjjj5hhhhhhh_2024.pdfBonzo subscription_hjjjjjjjj5hhhhhhh_2024.pdf
Bonzo subscription_hjjjjjjjj5hhhhhhh_2024.pdf
khadija278284
 
0x01 - Newton's Third Law: Static vs. Dynamic Abusers
0x01 - Newton's Third Law: Static vs. Dynamic Abusers0x01 - Newton's Third Law: Static vs. Dynamic Abusers
0x01 - Newton's Third Law: Static vs. Dynamic Abusers
OWASP Beja
 
Eureka, I found it! - Special Libraries Association 2021 Presentation
Eureka, I found it! - Special Libraries Association 2021 PresentationEureka, I found it! - Special Libraries Association 2021 Presentation
Eureka, I found it! - Special Libraries Association 2021 Presentation
Access Innovations, Inc.
 
Bitcoin Lightning wallet and tic-tac-toe game XOXO
Bitcoin Lightning wallet and tic-tac-toe game XOXOBitcoin Lightning wallet and tic-tac-toe game XOXO
Bitcoin Lightning wallet and tic-tac-toe game XOXO
Matjaž Lipuš
 
Obesity causes and management and associated medical conditions
Obesity causes and management and associated medical conditionsObesity causes and management and associated medical conditions
Obesity causes and management and associated medical conditions
Faculty of Medicine And Health Sciences
 
Announcement of 18th IEEE International Conference on Software Testing, Verif...
Announcement of 18th IEEE International Conference on Software Testing, Verif...Announcement of 18th IEEE International Conference on Software Testing, Verif...
Announcement of 18th IEEE International Conference on Software Testing, Verif...
Sebastiano Panichella
 
Acorn Recovery: Restore IT infra within minutes
Acorn Recovery: Restore IT infra within minutesAcorn Recovery: Restore IT infra within minutes
Acorn Recovery: Restore IT infra within minutes
IP ServerOne
 
Doctoral Symposium at the 17th IEEE International Conference on Software Test...
Doctoral Symposium at the 17th IEEE International Conference on Software Test...Doctoral Symposium at the 17th IEEE International Conference on Software Test...
Doctoral Symposium at the 17th IEEE International Conference on Software Test...
Sebastiano Panichella
 
somanykidsbutsofewfathers-140705000023-phpapp02.pptx
somanykidsbutsofewfathers-140705000023-phpapp02.pptxsomanykidsbutsofewfathers-140705000023-phpapp02.pptx
somanykidsbutsofewfathers-140705000023-phpapp02.pptx
Howard Spence
 
International Workshop on Artificial Intelligence in Software Testing
International Workshop on Artificial Intelligence in Software TestingInternational Workshop on Artificial Intelligence in Software Testing
International Workshop on Artificial Intelligence in Software Testing
Sebastiano Panichella
 
Getting started with Amazon Bedrock Studio and Control Tower
Getting started with Amazon Bedrock Studio and Control TowerGetting started with Amazon Bedrock Studio and Control Tower
Getting started with Amazon Bedrock Studio and Control Tower
Vladimir Samoylov
 
Media as a Mind Controlling Strategy In Old and Modern Era
Media as a Mind Controlling Strategy In Old and Modern EraMedia as a Mind Controlling Strategy In Old and Modern Era
Media as a Mind Controlling Strategy In Old and Modern Era
faizulhassanfaiz1670
 
María Carolina Martínez - eCommerce Day Colombia 2024
María Carolina Martínez - eCommerce Day Colombia 2024María Carolina Martínez - eCommerce Day Colombia 2024
María Carolina Martínez - eCommerce Day Colombia 2024
eCommerce Institute
 

Recently uploaded (16)

Competition and Regulation in Professional Services – KLEINER – June 2024 OEC...
Competition and Regulation in Professional Services – KLEINER – June 2024 OEC...Competition and Regulation in Professional Services – KLEINER – June 2024 OEC...
Competition and Regulation in Professional Services – KLEINER – June 2024 OEC...
 
Sharpen existing tools or get a new toolbox? Contemporary cluster initiatives...
Sharpen existing tools or get a new toolbox? Contemporary cluster initiatives...Sharpen existing tools or get a new toolbox? Contemporary cluster initiatives...
Sharpen existing tools or get a new toolbox? Contemporary cluster initiatives...
 
Supercharge your AI - SSP Industry Breakout Session 2024-v2_1.pdf
Supercharge your AI - SSP Industry Breakout Session 2024-v2_1.pdfSupercharge your AI - SSP Industry Breakout Session 2024-v2_1.pdf
Supercharge your AI - SSP Industry Breakout Session 2024-v2_1.pdf
 
Bonzo subscription_hjjjjjjjj5hhhhhhh_2024.pdf
Bonzo subscription_hjjjjjjjj5hhhhhhh_2024.pdfBonzo subscription_hjjjjjjjj5hhhhhhh_2024.pdf
Bonzo subscription_hjjjjjjjj5hhhhhhh_2024.pdf
 
0x01 - Newton's Third Law: Static vs. Dynamic Abusers
0x01 - Newton's Third Law: Static vs. Dynamic Abusers0x01 - Newton's Third Law: Static vs. Dynamic Abusers
0x01 - Newton's Third Law: Static vs. Dynamic Abusers
 
Eureka, I found it! - Special Libraries Association 2021 Presentation
Eureka, I found it! - Special Libraries Association 2021 PresentationEureka, I found it! - Special Libraries Association 2021 Presentation
Eureka, I found it! - Special Libraries Association 2021 Presentation
 
Bitcoin Lightning wallet and tic-tac-toe game XOXO
Bitcoin Lightning wallet and tic-tac-toe game XOXOBitcoin Lightning wallet and tic-tac-toe game XOXO
Bitcoin Lightning wallet and tic-tac-toe game XOXO
 
Obesity causes and management and associated medical conditions
Obesity causes and management and associated medical conditionsObesity causes and management and associated medical conditions
Obesity causes and management and associated medical conditions
 
Announcement of 18th IEEE International Conference on Software Testing, Verif...
Announcement of 18th IEEE International Conference on Software Testing, Verif...Announcement of 18th IEEE International Conference on Software Testing, Verif...
Announcement of 18th IEEE International Conference on Software Testing, Verif...
 
Acorn Recovery: Restore IT infra within minutes
Acorn Recovery: Restore IT infra within minutesAcorn Recovery: Restore IT infra within minutes
Acorn Recovery: Restore IT infra within minutes
 
Doctoral Symposium at the 17th IEEE International Conference on Software Test...
Doctoral Symposium at the 17th IEEE International Conference on Software Test...Doctoral Symposium at the 17th IEEE International Conference on Software Test...
Doctoral Symposium at the 17th IEEE International Conference on Software Test...
 
somanykidsbutsofewfathers-140705000023-phpapp02.pptx
somanykidsbutsofewfathers-140705000023-phpapp02.pptxsomanykidsbutsofewfathers-140705000023-phpapp02.pptx
somanykidsbutsofewfathers-140705000023-phpapp02.pptx
 
International Workshop on Artificial Intelligence in Software Testing
International Workshop on Artificial Intelligence in Software TestingInternational Workshop on Artificial Intelligence in Software Testing
International Workshop on Artificial Intelligence in Software Testing
 
Getting started with Amazon Bedrock Studio and Control Tower
Getting started with Amazon Bedrock Studio and Control TowerGetting started with Amazon Bedrock Studio and Control Tower
Getting started with Amazon Bedrock Studio and Control Tower
 
Media as a Mind Controlling Strategy In Old and Modern Era
Media as a Mind Controlling Strategy In Old and Modern EraMedia as a Mind Controlling Strategy In Old and Modern Era
Media as a Mind Controlling Strategy In Old and Modern Era
 
María Carolina Martínez - eCommerce Day Colombia 2024
María Carolina Martínez - eCommerce Day Colombia 2024María Carolina Martínez - eCommerce Day Colombia 2024
María Carolina Martínez - eCommerce Day Colombia 2024
 

Avoiding the Pitfalls of Hunting - BSides Charm 2016

  • 1. 1 © Copyright 2015 EMC Corporation. All rights reserved. Avoiding the Pitfalls of Hunting The Art of Fail
  • 2. 2 © Copyright 2015 EMC Corporation. All rights reserved. Press Start if you’re ready You’re not ready…
  • 3. 3 © Copyright 2015 EMC Corporation. All rights reserved. •  Tony Cook •  RSA IR •  Just here for the Good Times… Your Supposed Guide… (Good Luck)
  • 4. 4 © Copyright 2015 EMC Corporation. All rights reserved. •  Where Hunting can go wrong •  How to avoid losing before starting •  Review old fails to make your fails “less badder” What’s the goal of this Talk?
  • 5. 5 © Copyright 2015 EMC Corporation. All rights reserved. Don’t be that guy
  • 6. 6 © Copyright 2015 EMC Corporation. All rights reserved. •  Empower enterprises to PROACTIVELY search for and discover threats within their networks. •  Assumes Breach has occurred •  One Component in a SOC To Keep in mind: What’s the goal of Hunting
  • 7. 7 © Copyright 2015 EMC Corporation. All rights reserved. •  Everyone’s _____ is different –  Environment –  Company Mission –  Staff –  Tools –  Policies •  Stop taking everyone’s advice –  Think Critically about your network •  Risk Based Analysis will give you your depth for each of these –  Maybe you don’t have the budget for Cream of the Crop •  Tools •  Staff –  Still need a way to look through your Jungle First things First
  • 8. 8 © Copyright 2015 EMC Corporation. All rights reserved. •  Where most Fails start •  Not knowing where your Jungle inside & out –  Borders & Internal •  Not understanding what’s in your environment •  You can’t defend what you don’t know •  Understand the Context of your Network •  Invisible Enemy’s are hard to fight Make a Map AKA Critical Top 20 - #1 & #2
  • 9. 9 © Copyright 2015 EMC Corporation. All rights reserved. •  Understand your trusted relationships •  Understand their Vulnerabilities/Threats •  Have complete Visibility/Control into traffic coming to and from your Jungle –  You have enough to deal with –  Most of the threats come from outside •  If you had to how would you segregate yourself from any/all other partners? Shared Jungles Who do you trust?
  • 10. 10 © Copyright 2015 EMC Corporation. All rights reserved. •  Review your current Tool Sets to see what you can you use •  Suggestions –  NetFlow Hunting •  Tracking Ingressing & Egressing Hosts –  Who’s talking to who? –  Prads/p0f –  Host Based Agents •  HBSS •  IR Tools •  Vulnerability Management •  NAC •  Network Discovery Tools Tools to Help this
  • 11. 11 © Copyright 2015 EMC Corporation. All rights reserved. •  # 1 way to fail is to trust a single dataset –  Coalesce ALL THE THINGS •  HBSS -> Vulnerability Scan -> NMAP -> Netflow –  Find the outliers •  Patch Management -> NMAP -> NetFlow •  Trust in One, Fail by One VALIDATE
  • 12. 12 © Copyright 2015 EMC Corporation. All rights reserved. •  Understand your tools •  Know their strengths and weaknesses •  Ensure their purposes –  Visibility –  Control –  Both? •  If both… Ensure a validating measure It’s dangerous out there… Take this
  • 13. 13 © Copyright 2015 EMC Corporation. All rights reserved. •  You wouldn’t go hunting without ever firing a gun at the range –  Don’t go into the Jungle without first knowing how to use your tool for various situations –  Misunderstanding tool outputs are some of the biggest pitfalls you’ll ever face. •  The biggest pit you’ll fall down is the one you keep digging •  TEST OUT YOUR TOOLS –  Virtual Network –  Guest Network –  Anything Train with your tools
  • 14. 14 © Copyright 2015 EMC Corporation. All rights reserved. •  How fast can you go from IOC to Confirmation to Remediation? –  Network Detection -> Exact Host •  X-Forwarded-For Enabled? •  DHCP Logs? •  DNS Logs? –  Exact Host -> Artifacts –  Host Detection -> Artifacts •  Compliment each other in such a way that you can seamlessly pivot from Network indicator <-> Host indicator •  How deep is your visibility on your Hosts/Network? –  Are you using them for a Hunting Dataset? –  Full Packet Capture || Netflow? –  Process Execution || AntiVirus •  How do you bring your datasets together? –  Do they benefit one another Pitfall - Does your Security Stack Blend?
  • 15. 15 © Copyright 2015 EMC Corporation. All rights reserved. •  Are you using Everything at your disposal? •  Do your tools let you grab everything you need? Host-Based –  SHIMCache –  Services –  CIM –  Scheduled Tasks –  Run Once Hives –  Much More Network-Based –  MetaData within PCAP •  UserAgents •  Referrals •  Session Size •  Flags •  Much Much Much more How Deep do your Datasets go?
  • 16. 16 © Copyright 2015 EMC Corporation. All rights reserved. •  If you don’t understand the tool… ASK WHO MADE IT!!! •  9/10 you’re not using it to it’s fullest potential •  Most Vendor’s will be more than happy to send PS out to make you a success story •  Assuming how a tool works will lead to misery Vendors… A Quick Fix...
  • 17. 17 © Copyright 2015 EMC Corporation. All rights reserved. 1.  Don’t Deploy them everywhere 2.  Don’t Include them in legacy plans 3.  Don’t size them appropriately 4.  Don’t Cross-Train Your Team 5.  Don’t Log them Centrally 6.  Don’t Use All of their Features 7.  Don’t correlate them with your other tools 8.  Check the Box How to Fail with your Tools
  • 18. 18 © Copyright 2015 EMC Corporation. All rights reserved. Got your Map & Your Tools? Let’s GO….
  • 19. 19 © Copyright 2015 EMC Corporation. All rights reserved. •  Gather Data •  Analyze Data –  Look for •  IOC’s •  Outliers •  Known Bad INTEL •  Modify IOCs –  Document •  Remediate any findings •  Repeat Remember Not Every Outcome of Hunting is Malicious - Policy Violations - Configuration Issues - Gaps in Coverage General Concept of Hunting Gather Data Analyze Data - IOC’s - Outliers - Bad Intel - Modify IOC’s Document Remediate
  • 20. 20 © Copyright 2015 EMC Corporation. All rights reserved. •  One of the biggest Pitfalls is running around aimlessly looking at all the things •  Pick or Develop a Repeatable Methodology for Analysis •  Can be different for each analyst, cell, or company •  Examples –  OODA Loop –  5 I’s Analysis Methodology Required
  • 21. 21 © Copyright 2015 EMC Corporation. All rights reserved. Example OODA Loop
  • 22. 22 © Copyright 2015 EMC Corporation. All rights reserved. •  Observe – Bring in Data! •  Orient – Analyze –  Synthesize it to work in your datasets –  Put in the proper context!!! –  Use prior validated knowledge –  Analyze •  Decide – Make a Proper Hypothesis REPEAT THESE THREE THINGS UNTIL YOU HAVE SOMETHING ACTIONABLE •  Act – Remediate or Document Quick WalkThrough
  • 23. 23 © Copyright 2015 EMC Corporation. All rights reserved. •  Seeing the same old thing over & over? •  Different Approaches –  Anomaly –  Intelligence –  Objective •  Try out various Data Analytics on different datasets –  Temporal –  Rare –  Variance –  New Analysis Bias
  • 24. 24 © Copyright 2015 EMC Corporation. All rights reserved. •  Don’t get so “HYPE” that you lose the forest for a tree •  Don’t mismanage your resources –  Have everyone work on the same thing –  Rely on one person •  Don’t let a fire get out of your control •  Take a breath & make sure you’re in context Slow Down
  • 25. 25 © Copyright 2015 EMC Corporation. All rights reserved. •  Don’t be afraid to use “RED” Tools •  There is a reason they’re using them •  Most of them are built-in OS Tools Thinking like the enemy…
  • 26. 26 © Copyright 2015 EMC Corporation. All rights reserved. A run through of more Pitfalls
  • 27. 27 © Copyright 2015 EMC Corporation. All rights reserved. •  1st My thoughts… –  That this is still a thing… –  Every major vendor has a free solution to do this... –  If you don’t have this already being done... –  0 days are always there but getting owned by a 5 year old vulnerability... Just... I can’t even… •  Simply PATCH •  2nd Are you using it in more ways than one? –  Context Value added to your Map –  Using it to further understand your critical hosts •  New Software Deployed My least favorite Pitfall… Vulnerability Management
  • 28. 28 © Copyright 2015 EMC Corporation. All rights reserved. •  Most Environments… It’s Black or White –  Don’t complicate it •  Snake = Bad •  Extra Life = Good •  Once you found a scorpion & know how it moves... Document it & Be Alert for it next time •  Failure to do so will get you bit… Over & Over •  Also... Sharing is caring. Threat Intelligence How not to use it
  • 29. 29 © Copyright 2015 EMC Corporation. All rights reserved. •  Putting IOCs into a ticket which never become actionable •  Not having NO context to IOCs •  Creating bad Signatures –  Strings –  Not deploying them properly –  No validation •  Deploying other’s signatures with 0 testing •  Diving too deep –  Making it Grey –  Getting too wrapped up in non-plausible attacks –  Make it relevant to your environment Pitfalls
  • 30. 30 © Copyright 2015 EMC Corporation. All rights reserved. •  The more you play the more you can see the slight differences in the snakes, scorpions, and pitfalls •  Same with Hunting –  IOC’s will become clear –  How attacks happen will become clearer Inherent Knowledge Same thing as a game
  • 31. 31 © Copyright 2015 EMC Corporation. All rights reserved. •  How are you tracking your users? •  Check your Authentication Mechanism –  Several New Tools –  Poor Man’s Way •  Pull your AD Tree with Powershell •  Diff it Daily –  Check for variances •  Check for new users logging into systems they never have before •  Check for user’s with new permission •  https://gallery.technet.microsoft.com/scriptcenter/Powershell-script-to-5edcdaea Masked Threats Identity / Account Management
  • 32. 32 © Copyright 2015 EMC Corporation. All rights reserved. •  Properly Use a Red Team –  Find your blind spots –  Use pre-determined Test cases •  Validate results •  Work with them Not Against them –  Don’t make it a competition –  Make it a value added training •  Understand the results of the test •  Continual Process – Not a One & Done Test yourself
  • 33. 33 © Copyright 2015 EMC Corporation. All rights reserved. Questions???
  • 34. 34 © Copyright 2015 EMC Corporation. All rights reserved. Fin