Recommended
More Related Content
Similar to Blue Teaming On A Budget
Similar to Blue Teaming On A Budget (20)
Recently uploaded
Recently uploaded (20)
Blue Teaming On A Budget
- 1. Blue Teaming on a Budget Carl Fong – CTO cfong@ocde.us Nigel Green Cybersecurity Analyst ngreenjr@ocde.us Kevin Riley Cyber Security Architect kriley@ocde.us CITE Conference 2022
- 2. What is the Blue Team? • Defenders • Responders • SME
- 3. OSINT Tools
- 4. OSINT Tools Usernames Email Addresses Domain Name IP Address Images/Videos/Docs Social Networks Search Engines https://osintframework.com https://Id.crawl.com, https://whatsmyname.app, www.google.com , https://www.yandex.com/images https://thatsthem.com
- 5. OSINT Tools Blind Crawler And Cewl Find Email Addresses Find Subdomains Site Paths Generate Word Lists Find emails •Find Subdomains •Site Paths •Generate Word Lists https://github.com/AhmedConstant/BlindCrawler/R EADME.md, https://github.com/digininja/CeWL https://github.com/BillyV4/ID-entify https://haveibeenpwned.com https://dehased.com
- 6. OSINT Tools Mr. Holmes Whats My Name Sherlock Find emails •Find Subdomains •Site Paths •Generate Word Lists https://github.com/Lucksi/Mr.Holmes https://github.com/m4ll0k/Infoga https://github.com/sherlock-project/sherlock https://github.com/WebBreacher/WhatsMyName
- 7. OSINT Tools DNS Dumpster Find emails •Find Subdomains •Site Paths •Generate Word Lists https://dnsdumpster.com
- 8. OSINT Tools Have I been pwned? DeHashed Find emails •Find Subdomains •Site Paths •Generate Word Lists https://haveibeenpwned.com/ https://www.dehashed.com
- 9. OSINT Tools Image Search Sock Puppets Find emails •Find Subdomains •Site Paths •Generate Word Lists https://this-person-does-not-exist.com/en https://fauxid.com/ www.bing.com, https://cybervie.com/blog/what-is-sock-puppets-iin-osint-how-to-create-one/ Youtube video on how to search via images using bing.com https://www.youtube.com/watch?v=OsY32K1s51Y&ab_channel=DavidBombal
- 10. OSINT Tools Find emails •Find Subdomains •Site Paths •Generate Word Lists Heath Adams ( The Cyber Mentor) 5 hour video on OSINT: https://www.youtube.com/watch?v=qwA6MmbeGNo&ab_channel=TheCyberMentor
- 11. Sysinternals • Mark Russinovich -1996 • Microsoft • Free • Actively Developed Main Site https://learn.microsoft.com/en-us/sysinternals/ Live Download https://live.sysinternals.com/
- 12. Sysinternals Sysmon PS C:Program Filessysmon> .Sysmon64.exe -i .sysmon-config.xml System Monitor v14.12 - System activity monitor By Mark Russinovich and Thomas Garnier Copyright (C) 2014-2022 Microsoft Corporation Using libxml2. libxml2 is Copyright (C) 1998-2012 Daniel Veillard. All Rights Reserved. Sysinternals - www.sysinternals.com Loading configuration file with schema version 4.50 Sysmon schema version: 4.83 Configuration file validated. Sysmon64 installed. SysmonDrv installed. Starting SysmonDrv. SysmonDrv started. Starting Sysmon64.. Sysmon64 started. https://github.com/SwiftOnSecurity/sysmon-config
- 17. Sysinternals Autoruns Find all locations where persistence hides Create a Baseline
- 20. CyberChef Cyber Swiss Army Knife CyberChef Overview: https://www.youtube.com/watch?v=rT_CjwKN380&t=2s Decoding with CyberChef https://www.youtube.com/watch?v=l0ZCyfA75ZE
- 22. Wireshark
- 24. Greenbone OpenVAS Included in Kali Linux – Recommended https://openvas.org
- 25. Zeek (BRO) • A passive, open-source network traffic analyzer • Network Security Monitor (NSM) • performance measurement and troubleshooting • Real-time and offline analysis • File extraction • Extensible architecture Docmentation https://docs.zeek.org/en/master/ Cheatsheet https://github.com/corelight/zeek-cheatsheets/blob/master/Corelight-Zeek- Cheatsheets-3.0.4.pdf
- 26. Suricata / Snort IDS High performance - multi-threaded, scalable code base Multipurpose Engine - NIDS, NIPS, NSM, offline analysis, etc. Cross-platform support - Linux, Windows, macOS, OpenBSD, etc. Modern TCP/IP support including a scalable flow engine, full IPv4/IPv6, TCP streams, and IP packet defragmentation Protocol parsers - packet decoding, application layer decoding HTTP engine - HTTP parser, request logger, keyword match, etc. Autodetect services for portless configuration Lua scripting (LuaJIT) Application-layer logging and analysis, including TLS/SSL certs, HTTP requests, DNS requests, and more Built-in hardware acceleration (GPU for network sniffing) File extraction https://suricata.readthedocs.io/en/suricata-6.0.9/ Modular design: Multi-threading for packet processing Shared configuration and attribute table Use a simple, scriptable configuration Plugin framework, make key components pluggable (and 200+ plugins) Auto-detect services for portless configuration Auto-generate reference documentation Scalable memory profile Rule parser and syntax (support sticky buffers in rules) https://www.snort.org/documents
- 27. OSQuery OSQuery allows you to use SQL to access information about a system. Runs everywhere. Cross platform – Mac, Windows, Linux Small footprint OSQuery Site https://www.osquery.io/ OSQuery resources https://github.com/sttor/awesome-osquery https://fleetdm.com/
- 28. Wazuh OSSEC Fork • Intrusion detection • Log data analysis • File integrity monitoring • Vulnerability detection • Configuration assessment • Incident response • Regulatory compliance • Cloud security • Containers security https://github.com/wazuh/wazuh
- 29. Packet Fence Opensource NAC • BYOD - Let people bring their own devices • Role-based access control • Eliminate malware • WiFi offload / hotspot • Provide guest access • Perform compliance checks • Simplify network management https://www.packetfence.org/ https://github.com/inverse-inc/packetfence
- 30. ELK Stack • Elastic Search • LogStash • Kibana https://www.elastic.co/what-is/elk-stack https://github.com/dzharii/awesome-elasticsearch
- 31. Security Onion • Network Security Monitoring • Central Log Management • Threat Hunting • Enterprise Security • Full Packet Capture • Fully Supported https://securityonionsolutions.com/
Editor's Notes
- Osint is a compilation of publicly available resources to acquire knowledge about an individual, company, or subject matter. In this presentation, I will go over some of the tools I use to conduct OSINT research on the districts with which we conduct pentesting engagements. I will discuss how you can also use these tools to decrease your threat landscape to threat actors.
- The picture above is an OSINT framework that outlines various tools you can use to gather information on people and organizations. The bullet points to the left outline the typical things the OCDE cybersecurity department would focus on during a pen testing engagement. We would include these things in the OSINT section of our report to the district.
- BlindCrawler is a really helpful tool that helps to enumerate a target organization’s website. Blindcrawler will find emails and websites paths and save them in a text file. Finding emails in the environment is important when identifying company personnel to target with different attack vectors to penetrate the organization. Cewl is a tool that generates a wordlist from a website for password cracking of NTLM hashes. These would expedite password cracking if users in the environment use passwords that are related to where they work i.e. OCDE123!! Creating unique passwords reducing the security risk for your organization. It only takes one account with the correct access to get into an organization.
- Mr. Holmes is my OSINT search tool of choice. It provides several options to utilize when researching someone. It searches popular social media sites for the username you input. It is also able to validate an email. Mr. Holmes can be installed on Kali Linux/Ubuntu. Mr. Holmes will also save a report of everything found in a folder with a file in different file formats. Review the security section of your social media accounts. There are options to keep people who aren’t your friends from viewing your profile and friends. A threat actor can use your social media accounts to gain valuable information about you and use that to comprise the organization that you work for.
- DNS Dumpster help to provide a security overview of your organization. DNSdumpster does this by discovering hosts related to a domain. This is valuable for assessing whether hosts are visible to a threat actor because DNS dumpster is a free tool.
- HaveIbeenpwned is a valuable tool because it lets you know if an email has been leaked in any breaches. This can be a great tool to check to see if any of your staff members’ work email has been found in a breach. This way you can inform them to change their passwords as passwords are usually leaked with email information. Dhashed takes HaveIbeenpwned to the next level and allows you to search for leaked passwords and hashes of email/username account.
- This is Kristy Boyer she lives in San Rafael New Mexico. Her email address k.boyer@gmail.com. We can use the OSINT tools that we have previously discussed to find out what accounts she has only. She is not a real person. This picture is not real and there is no Kristy Boyer. This is an AI generated photo. If you look real closely on her face by her cheek the hair blends in with the skin. These are they types of profiles you need to be aware of. What I created was a sock puppet. Threat actors can create fake people and profiles to steal your information or catfish you.
- Your users are your first line of defense. Educating them on best practices for password use, safe browsing, data protection, and avoiding password reuse is imperative in keeping your environment safe. Users should know that their data is valuable for threat actors who wish to use it for financial gain. Threat actors use social engineering, phishing, vishing, and smishing to extract vital information from users. Know what these threats look and sound like and be careful what links you click. What can you do to protect your users? Invest in phishing simulation software to educate your user bases such as Knowbe4 or Proofpoint Phishing Education. Encourage your users to use a password manager. If using a password manager please sign out of your password manager daily.
- osquery is an operating system instrumentation framework for Windows, OS X (macOS), and Linux. The tools make low-level operating system analytics and monitoring both performant and intuitive. osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.
- osquery is an operating system instrumentation framework for Windows, OS X (macOS), and Linux. The tools make low-level operating system analytics and monitoring both performant and intuitive. osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.
- osquery is an operating system instrumentation framework for Windows, OS X (macOS), and Linux. The tools make low-level operating system analytics and monitoring both performant and intuitive. osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.
- osquery is an operating system instrumentation framework for Windows, OS X (macOS), and Linux. The tools make low-level operating system analytics and monitoring both performant and intuitive. osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.
- osquery is an operating system instrumentation framework for Windows, OS X (macOS), and Linux. The tools make low-level operating system analytics and monitoring both performant and intuitive. osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.
- osquery is an operating system instrumentation framework for Windows, OS X (macOS), and Linux. The tools make low-level operating system analytics and monitoring both performant and intuitive. osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.
- osquery is an operating system instrumentation framework for Windows, OS X (macOS), and Linux. The tools make low-level operating system analytics and monitoring both performant and intuitive. osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.