According to recent reports, nearly 1/3rd of all US Businesses experienced a cybersecurity related breach last year. With hackers increasingly targeting US businesses and insiders mishandling or misusing their privileges and access, its' imperative that all organizations have incident response (IR) capabilities at the ready. We're talking about real capabilities that include: threat visibility, centralized logging, root cause analysis, and assessment. While we can agree IR capabilities are important, most businesses do not and may never have on-staff responders or organized security operations - if you are one of these, this talk is for you. In this talk, Chris explores the processes, procedures, and best practices surrounding Incident Response (IR) as it relates to cybersecurity: Finding, containing, investigating, and eliminating attackers from within your network. Learn more about cyber threat hunting, incident response, and how a strong incident response process will help your organization stay better protected from cyber attackers. This presentation, reviewing Cybersecurity Incident Response (IR) Readiness, was originally shared during the 2019 DataConnectors Houston Cybersecurity Conference.

1. IR Readiness
How to Find and Respond to
Attackers in your Network
Chris Gerritz

2. Incident Response
Process & Procedures

3. 2019 – Incident Response Readiness
Detection: How it starts. You detect malicious activity via real-time monitoring,
proactive hunting, external reports, etc.
1. Triage Determine scope of breach, gather information for quick
decision making
2. Containment Active enumeration and mapping of network
3. Investigation Analyze evidence and determine root cause
4. Certification Triage network again to determine clean state
5. Learning Implement controls based on lessons learned
Incident Response Steps
Not
addressed in
today’s
standards

4. Triage

5. 2019 – Incident Response Readiness
Triage
Goal: Properly scope and understand the security incident to enable
initial decision making and containment actions
Speed is of utmost importance
• Gather data (logs, forensic data, memory, etc.)
• Inspect ALL systems with forensic triage tools (where else is the
infection?)
Decision Time: Wipe and Reload? Call in the experts?

6. 2019 – Incident Response Readiness
MITRE’s ATT&CK Model Applies to IR Triage
Used to characterize and describe post-compromise adversary
behavior.
Details the post-compromise tactics, techniques, and procedures
(TTPs) persistent threats use to execute their objectives while
operating inside a network.

7. 2019 – Incident Response Readiness
Triage: Data Collection Methods
• Centralized Logging
– Syslog/beats (servers), EDR/Sysmon (endpoints)  Splunk/ELK
• Query - Ask specific questions or look for a specific IOC
– Active: Reach down to the endpoint directly (i.e. OSQuery)
– Historical: Search pre-collected logs or data
• Forensic Collection & Inspection
– Collect artifacts and information related to system state (Forensic Triage)
– i.e. process lists, autoruns, shimcache entries, forensic artifacts, etc.

8. 2019 – Incident Response Readiness
Triage: Logs are not sufficient for triage
• Log analysis techniques challenges for rapid response:
– Logs often don’t go back far enough or have limited coverage
– Search queries can be expensive – requires searches which are overly specific
– Requires very experienced security personnel versed in both TTPs of attackers
and the network’s unique logging capabilities to do accurate behavior matching
• X type of attack produces Y behavior, which will be expressed in these logs as Z
• Deploying new monitoring tools has limited effect
– Looks forward at new activity, not backwards

9. Containment and
Investigation

10. 2019 – Incident Response Readiness
Containment
Goal: Stem the bleeding and restore operations.
The follow on investigation can be initiated in parallel with
getting back to business
• Neutralizing the threat’s access via:
– IP blocks
– Locking or resetting stolen accounts
– Removing infected systems from the network
– Updating antivirus / prevention signatures

11. 2019 – Incident Response Readiness
Investigation
Goal: Determine Root Cause and potentially who was
responsible for the incident/attack
In-depth forensics knowledge required!
• Many states, like Texas, require state certifications to act as an
investigator of computer crimes and attacks
• Internal resources with sufficient skill or time are generally not
available (Expensive!)

12. 2019 – Incident Response Readiness
Certification
Goal: Ensure containment and mitigations worked and no
infection or backdoors remain
Utilize same techniques as triage step
• Don’t just rely on alerting/behavior tools -- adversary might be
holding out on a dormant/inactive system;

13. 2019 – Incident Response Readiness
Learning
Goal: Prevent a similar attack from succeeding in the future or
help bring the perpetrator to justice
Utilize lessons learned from the investigation to implement new
controls
• Review logging and other telemetry collection
• Review security policies such as privileged user management
• Review security tooling

14. 2019 – Incident Response Readiness
Detection: How it starts. You detect malicious activity via real-time monitoring,
proactive hunting, external reports, etc.
1. Triage Determine scope of breach, gather information for quick
decision making
2. Containment Active enumeration and mapping of network
3. Investigation Analyze evidence and determine root cause
4. Certification Triage network again to determine clean state
5. Learning Implement controls based on lessons learned
Incident Response Steps

15. IR Triage
Threat Hunting w/ Forensic State Analysis

16. 2019 – Incident Response Readiness
Analysis Technique: Forensic State Analysis
Threat Hunting technique that applies phased levels of analysis to
collected data to reduce the data set to a manageable level:
1. Enrichment - Reputation & threat intel lookups
2. Triage – Algorithms & methods to categorize interesting things
a. Data Stacking
b. Anomaly/Outlier Identification
3. Advanced Analysis
a. Static/Dynamic Analysis of Interesting Samples
b. TTP Pattern Matching (dig into logs)

17. Infocyte HUNT™
The Leading Cloud-based Threat Hunting & Incident Response Solution
Waiting for an alert to tell you about a problem?
 Discover, Hunt, and Respond across networked
endpoints and servers.
 Agentless or Agent-based Deployment Models
The premier hunt platform for:
 Threat Hunting - Turn-key forensics-based threat
hunting and incident response
 Incident Response – Automates forensic triage and
artifact analysis
 Assessments – The most effective and comprehensive
threat assessment platform available

18. QUESTIONS
Chris Gerritz
Co-Founder, Infocyte
cgerritz@Infocyte.com
Twitter: @gerritzc
@InfocyteInc
Visit our Booth!
www.infocyte.com