Sunny Neo, profile picture
Uploaded bySunny Neo
PPTX, PDF1,452 views

Detection Rules Coverage

This document discusses improving detection rules coverage through infrastructure automation tools, testing frameworks, and metrics. It introduces tools like Packer, Vagrant, Terraform, and DetectionLab for building detection environments. Atomic Red Team and the MITRE ATT&CK framework are covered for testing detections. Metrics like the ATT&CK heatmap and KPIs are suggested for measuring coverage. Common pitfalls like assuming full coverage and not prioritizing are addressed.

Embed presentation

Downloaded 98 times
Detection Rules Coverage Sunny Neo sunny@live.com.sg 1
whoami • Perpetual Student • Red Team Lead @ Aon Cyber Solutions APAC • Specialise in Adversary Simulation • Red Teaming • Purple Teaming 2
Disclaimer Everything mentioned here is my personal opinion and does not represent my employer or any organisation that I am affiliated with. 3
Objective • Introduction • Infrastructure Automation Tools • Setup up your own lab (DetectionLab) • Atomic Red Team • Metrics • MITRE ATT&CK Framework Heatmap • SIGMA • Suggestions and Continuous Improvement 4
Introduction “COI chairman Richard Magnus also said in his closing remarks that cyberattacks are a reality today, and APTs are constantly evolving in their sophistication. This is why organisations need to adopt an “assume breached mindset”, and not only have a proactive defence strategy but also security systems and solutions that enable them to detect and respond to cyber threats early. In turn, these systems and solutions should be complemented with the right people and processes.” Source: https://www.channelnewsasia.com/news/singapore/singhealth-coi-ends-cybersecurity-recommendations-10985254 5
Detect and Respond Attacker to Objective Time < D&R Time 6
Detect and Respond Attacker to Objective Time < D&R Time 7
Question • What is actually being detected on? • What are the gaps in detection? • What should be prioritised on? 8
MITRE ATT&CK Framework • https://attack.mitre.org/ • Knowledge base of adversary tactics, techniques and procedures based on real-world observation • Tactics – Adversary’s Technical Objective • Techniques – How an Adversary achieves those objectives • Procedures – Specific Implementations of the Technique 9
MITRE ATT&CK Framework 10
Infrastructure Automation Tools 11
Packer • https://www.packer.io/ • A tool for creating identical machine images for multiple platforms from a single configuration • Local Hypervisors – VirtualBox/VMWare/Hyper-V etc • Cloud Providers – AWS/DigitalOcean/Azure etc • How it works? • Start VM • Configure OS • Install software • Create machine image from VM 12
Vagrant • https://www.vagrantup.com/ • A tool to build and manage virtual machine (VM) environment without having to learn specific VM provider’s commands • Usually used to spin up VirtualBox/VMware development environment locally 13
Terraform • https://www.terraform.io/ • A tool to create and manage cloud infrastructure across multiple cloud providers 14
Packer + Vagrant Workflow packer build template.json vagrant up Reference: https://stefanscherer.github.io/adding-hyper-v-support-to-2016-tp5-docker-vm/ Vagrant Box 15
Pre-built Image + Vagrant Workflow vagrant up Download pre- built box from VagrantCloud 16
Packer + Terraform Workflow terraform init terraform plan terraform apply Image packer build template.jso n Infrastructure main.tf 17
Why do I care? • “Single” source of truth • Describe the state of the machine/image explicitly • Scalable & Repeatable 18
Resource to learn more • Infrastructure As Code Tutorial - https://github.com/Artemmkin/infrastructure-as-code-tutorial • World class DevSecOps Training and Certifications- https://www.practical-devsecops.com/ 19
DetectionLab • https://github.com/clong/DetectionLab • Created by Chris Long (@Centurion) • Vagrant, Packer and Terraform scripts to build an Active Directory lab with detection capabilities 20
DetectionLab Workflow Source: https://github.com/clong/DetectionLab/blob/master/img/packer_wiki.png 21
DetectionLab Workflow Source: https://github.com/clong/DetectionLab/blob/master/img/vagrant_wiki.png 22
DetectionLab Overview Source: https://raw.githubusercontent.com/clong/DetectionLab/master/img/overview.jpeg 23
DetectionLab Demo 24
Resource to learn more • Windows Event Forwarding for Network Defense - https://medium.com/palantir/windows-event-forwarding-for-network-defense- cb208d5ff86f? • Endpoint detection superpowers on the cheap, Threat Hunting app - https://medium.com/@olafhartong/endpoint-detection-superpowers-on-the- cheap-threat-hunting-app-a92213f5e4b8 • osquery Across the Enterprise - https://medium.com/palantir/osquery-across- the-enterprise-3c3c9d13ec55? • sysmon-config | A Sysmon configuration file for everybody to fork - https://github.com/SwiftOnSecurity/sysmon-config 25
Testing Framework 26
Atomic Red Team • https://github.com/redcanaryco/atomic-red-team • Library of simple tests mapped to MITRE ATT&CK Framework 27
Atomic Red Team Source: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1033/T1033.md 28
Atomic Red Team Execution Framework • https://github.com/redcanaryco/atomic-red- team/tree/master/execution-frameworks • Automate the execution of Atomic Tests • Three versions • Invoke-AtomicRedTeam (Powershell) • Python • Ruby 29
Invoke-AtomicRedTeam Demo 30
Measurement and Results 31
MITRE ATT&CK Navigator • https://mitre-attack.github.io/attack-navigator/enterprise/ 32
MITRE ATT&CK Navigator Demo 33
Resource to learn more • Putting MITRE ATT&CK into Action with What You Have, Where You Are https://www.slideshare.net/KatieNickels/putting-mitre-attck-into-action-with-what-you- have-where-you-are • How to Be a Savvy ATT&CK Consumer https://medium.com/mitre-attack/how-to-be-a-savvy-attack-consumer-63e45b8e94c9 • GETTING STARTED WITH ATT&CK https://www.mitre.org/sites/default/files/publications/mitre-getting-started-with-attack- october-2019.pdf • Comparing Layers in ATT&CK Navigator https://attack.mitre.org/docs/Comparing_Layers_in_Navigator.pdf 34
Detection Rules How to start? 35
MITRE Cyber Analytics Repository (CAR) • https://car.mitre.org/ • Knowledge base of analytics developed by MITRE 36
MITRE Cyber Analytics Repository (CAR) • Hypothesis • Information Domain • Analytics Pseudocode • Analytics Unit Test Example: • https://car.mitre.org/analytics/CAR-2013-04-002/ • https://car.mitre.org/analytics/CAR-2013-02-003/ 37
MITRE Cyber Analytics Repository (CAR) 38 Source: https://car.mitre.org/analytics/CAR-2013-04-002/
MITRE Cyber Analytics Repository (CAR) 39 Source: https://car.mitre.org/analytics/CAR-2013-02-003/
MITRE Cyber Analytics Repository (CAR) 40 Source: https://car.mitre.org/analytics/CAR-2013-02-003/
SIGMA • https://github.com/Neo23x0/sigma • Generic and open signature format to describe log events • Standardised format to write and share detection rules 41
SIGMA Source: https://github.com/Neo23x0/sigma/raw/master/images/Sigma-description.png 42
SIGMA Demo 43
Tips for writing detection rules • Don’t aim to write a perfect rule to cover all scenarios and evasions • Having rules implemented for different techniques is better than having one perfect rule for one technique • Make the rule as short and liberal as possible (Depending on your environment) • Run the rule against data from 7 / 30 / 60 days ago to determine if adjustment needs to be made 44
Resource to learn more • Sharing is Caring: Improving Detection with Sigma https://www.sans.org/cyber-security-summit/archives/file/summit- archive-1544043890.pdf • How to Write Sigma Rules https://www.nextron-systems.com/2018/02/10/write-sigma-rules/ 45
Common Pitfalls • 100% MITRE ATT&CK Coverage • Thinking all Techniques are equal • Thinking you are done! • Forgetting the Fundamentals 46
Problem: 100% MITRE ATT&CK Coverage 47 Source: https://medium.com/mitre-attack/how-to-be-a-savvy-attack-consumer-63e45b8e94c9
Solution: Seek Complementary Sources • Ask about what parts of ATT&CK they cover and don’t cover • Ask why they cover certain techniques and procedures and not others • Seek other complementary products/sources/services that fill the gaps 48
Problem: Thinking all Techniques are equal • Not all techniques have equal • Impact • Usage • Detection Difficulty • Data Source availability • Specific/Broad • Legitimate use in the organisation 49
Solution: Prioritise • Prioritise detection based on a combination of factors • Data sources availability • Value for techniques data sources • Relevant Threat Groups’ TTP • Top 20 Techniques based on Vendor X’s data or relevant Threat Groups • Caveat: *Subject to your environment, maturity and resource available* 50
Solution: Prioritise 51 Source: https://www.sans.org/cyber-security-summit/archives/file/summit-archive- 1548090281.pdf
Solution: Prioritise 52 Source: https://www.sans.org/cyber-security-summit/archives/file/summit-archive- 1548090281.pdf
Solution: Prioritise (My Personal Preference) 53 Source: https://upload.wikimedia.org/wikipedia/commons/c/c2/The_Unified_Kill_Chain.png
Solution: Prioritise (My Personal Preference) • If there is no constraint, I would place more weight on popular techniques for the following tactics: • Execution – Early stage in the kill chain and data source provides visibility through out the kill chain because execution is usually not standalone • Discovery – Early stage in the kill chain and high fidelity because commands unlikely to be executed by normal users in bulk in a short period of time (whoami/tasklist/arp/net users etc) • Persistence – Early stage in the kill chain and attackers usually do it for the ease of returning to the network • Credential Access – High Impact and limited techniques • Lateral Movement – High Impact and limited techniques (Require thorough understanding of where Administrators log in to) 54
Problem: Thinking you are done! • Endless variants for each techniques – it’s impossible to have a perfect detection rule for the unknown • MITRE ATT&CK Matrix only includes techniques from real world observation – does not include the latest security research or attacks that are not reported yet 55
Solution: Thinking you are done! • Shift from a Binary Detection metric to a Detection Confidence Level metric for each technique after initial assessment 56 Source: https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1561390150.pdf
Solution: Thinking you are done! • Another example of Confidence Level 57 Source: https://medium.com/@visiblerisk/detection-confidence-a-framework-for-success-d6cf1aa1638
Solution: Thinking you are done! • Develop your own matrix • Look out for emerging techniques from latest security research or threat intelligence report • Map the techniques to either ATT&CK or your own matrix • Continuous Assurance & Improvement! 58
Forgetting the Fundamentals 59 • Improving your detection capability is great… but don’t forget • Primary security functions should still be reducing attack surface/risks: • Segmenting Network • Limiting Host to Host communication • Maintaining asset inventories • Installing patches • Managing user privileges
Resource to learn more • ATT&CK™ Is Only as Good as Its Implementation: Avoiding Five Common Pitfalls https://redcanary.com/blog/avoiding-common-attack-pitfalls/ • Prioritizing the Remediation of Mitre ATT&CK Framework Gaps https://blog.netspi.com/prioritizing-the-remediation-of-mitre-attck-framework-gaps/ • ATT&CK™ Your CTI with Lessons Learned from Four Years in the Trenches - https://www.sans.org/cyber-security-summit/archives/file/summit-archive- 1548090281.pdf • Lessons Learned Applying ATT&CKBased SOC Assessments - https://www.sans.org/cyber-security-summit/archives/file/summit-archive- 1561390150.pdf 60
What’s Next? Continuous Improvements and Suggestions 61
SOC Challenges • Alert Fatigue • Budget 62
Problem: Alert Fatigue • High volume of alerts • Excessive number of false positive alerts 63
Solution: Alert Fatigue • Measure the number of true positive and false positive alerts • Determine the reason for each false positive alerts • Categorise the reason for false positive alerts and follow up accordingly 64
Solution: Alert Fatigue 65Source: https://github.com/d3sre/Use_Case_Applicability/blob/master/Hack.lu-FingerpointingPresentation.pdf
Problem: Budget • Budget for procuring tools • Budget for hiring • Budget for training 66
Solution: Budget • Demonstrate Return on Investment (ROI) via • Existing SOC heatmap coverage and confidence level • Effort to measure and improve efficiency of the SOC (KPI and metrics) • Justify additional resource are required • New tools/data source required to increase SOC heatmap coverage • Manpower/expertise required to handle alert volume after optimisation 67
KPI and Metrics 68 KPI Explanation Target Value Number of Log Management Rule Configuration Error events per month This value reflects the rules configured in the SIEM by the SOC Analysts. A high number suspects bad quality of rules, more training or experience needed. < 10 % Number of Announced Administrative/User Action events per month This value reflects suppressions that should be improved. < 10 % Number of Bad IOC/rule pattern value events per month If too many events were created by bad IOCs or rule pattern values, the source or the trust in it should be questioned. < 5 % Number of Confirmed Attack attempt without IR actions (best matched with Log Source Category) Number of events detected but prevented by measures in place or where the alert isn’t viewed as a high risk. > 50 % Number of Confirmed Attack attempt with IR actions (best matched with Log Source Category) Very high numbers → Security Architecture should be updated Very low numbers → The rules aren‘t detecting or you are safe :) Source: https://github.com/d3sre/Use_Case_Applicability/wiki/KPIs-and-Metrics
Resource to learn more • Use Case Applicability: How to better integrate Continuous Improvement into Security Monitoring https://github.com/d3sre/Use_Case_Applicability • Alerting and Detection Strategy Framework https://medium.com/palantir/alerting-and-detection-strategy- framework-52dc33722df2 69

More Related Content

PDF
A Threat Hunter Himself
bySergey Soldatov
 
PDF
Windows Threat Hunting
byGIBIN JOHN
 
PDF
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
PPTX
Threat hunting - Every day is hunting season
byBen Boyd
 
PDF
Hunting for Privilege Escalation in Windows Environment
byTeymur Kheirkhabarov
 
PDF
Threat Hunting Playbook.pdf
bylaibaarsyila
 
PDF
Threat Hunting with Splunk Hands-on
bySplunk
 
PPTX
Bsides 2019 - Intelligent Threat Hunting
byDhruv Majumdar
 
A Threat Hunter Himself
bySergey Soldatov
 
Windows Threat Hunting
byGIBIN JOHN
 
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
Threat hunting - Every day is hunting season
byBen Boyd
 
Hunting for Privilege Escalation in Windows Environment
byTeymur Kheirkhabarov
 
Threat Hunting Playbook.pdf
bylaibaarsyila
 
Threat Hunting with Splunk Hands-on
bySplunk
 
Bsides 2019 - Intelligent Threat Hunting
byDhruv Majumdar
 

What's hot

PPTX
Kheirkhabarov24052017_phdays7
byTeymur Kheirkhabarov
 
PDF
How to Hunt for Lateral Movement on Your Network
bySqrrl
 
PDF
Introduction to red team operations
bySunny Neo
 
PDF
PHDays 2018 Threat Hunting Hands-On Lab
byTeymur Kheirkhabarov
 
PDF
Threat Hunting Report
byMorane Decriem
 
PDF
A Threat Hunter Himself
byTeymur Kheirkhabarov
 
PPTX
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
PDF
Windows logging cheat sheet
byMichael Gough
 
PPTX
(Ab)Using GPOs for Active Directory Pwnage
byPetros Koutroumpis
 
PPTX
Threat Hunting with Splunk
bySplunk
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
PDF
No Easy Breach DerbyCon 2016
byMatthew Dunwoody
 
PPTX
Threat hunting for Beginners
bySKMohamedKasim
 
PDF
50 Shades of Sigma
byFlorian Roth
 
PPTX
Misp(malware information sharing platform)
byNadim Kadiwala
 
PPTX
Wazuh Security Platform
byPituphong Yavirach
 
PDF
Hunting for Credentials Dumping in Windows Environment
byTeymur Kheirkhabarov
 
PDF
Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021
byFlorian Roth
 
PDF
Red Team Framework
by👀 Joe Gray
 
PDF
Cyber Threat hunting workshop
byArpan Raval
 
Kheirkhabarov24052017_phdays7
byTeymur Kheirkhabarov
 
How to Hunt for Lateral Movement on Your Network
bySqrrl
 
Introduction to red team operations
bySunny Neo
 
PHDays 2018 Threat Hunting Hands-On Lab
byTeymur Kheirkhabarov
 
Threat Hunting Report
byMorane Decriem
 
A Threat Hunter Himself
byTeymur Kheirkhabarov
 
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
Windows logging cheat sheet
byMichael Gough
 
(Ab)Using GPOs for Active Directory Pwnage
byPetros Koutroumpis
 
Threat Hunting with Splunk
bySplunk
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
No Easy Breach DerbyCon 2016
byMatthew Dunwoody
 
Threat hunting for Beginners
bySKMohamedKasim
 
50 Shades of Sigma
byFlorian Roth
 
Misp(malware information sharing platform)
byNadim Kadiwala
 
Wazuh Security Platform
byPituphong Yavirach
 
Hunting for Credentials Dumping in Windows Environment
byTeymur Kheirkhabarov
 
Sigma Hall of Fame - EU ATT&CK User Workshop, October 2021
byFlorian Roth
 
Red Team Framework
by👀 Joe Gray
 
Cyber Threat hunting workshop
byArpan Raval
 

Similar to Detection Rules Coverage

PDF
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
byMarcin Ludwiszewski
 
PDF
[Bucharest] Attack is easy, let's talk defence
byOWASP EEE
 
PDF
Telesoft Cyber Threat Hunting Infographic
bySarah Chandley
 
PDF
Threat Hunting Procedures and Measurement Matrice
byVishal Kumar
 
PDF
ScotSecure West Summit 2024 - Glasgow 11th Sept
byRay Bugg
 
PDF
[cb22] Keynote: Underwhelmed: Making Sense of the Overwhelming Challenge of C...
byCODE BLUE
 
PDF
The State of Threat Detection 2019
byFidelis Cybersecurity
 
PDF
MITRE-Module 5 Slides.pdf
byReZa AdineH
 
PPTX
How Data Analytics is Re-defining Modern Era in Cyber Security
bySaqib Chaudhry
 
PDF
Trustport - Roman Veleba
byJan Fried
 
PDF
Why_TG
byTOP GUN
 
PDF
Cyber Security
byNC Military Business Center
 
PPTX
Cyber Threat Intelligence, CTI Lifecycle and CTI Framework
bykundansaraf1
 
PDF
Finding the needle in the haystack: how Nestle is leveraging big data to defe...
byBig Data Spain
 
PDF
Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017
byChris Gates
 
PDF
Webinar - Feel Secure with revolutionary OTM Solution
byJK Tech
 
PDF
Detection of Spreading Process on many assets over the network
bySecurity Bootcamp
 
PDF
Top Threat Hunting Interview Questions.pdf
byinfosec train
 
PDF
Top Threat Hunting Interview Questions.pdf
byinfosecTrain
 
PDF
Top Threat Hunting Interview Questions download white paper!
bypriyanshamadhwal2
 
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
byMarcin Ludwiszewski
 
[Bucharest] Attack is easy, let's talk defence
byOWASP EEE
 
Telesoft Cyber Threat Hunting Infographic
bySarah Chandley
 
Threat Hunting Procedures and Measurement Matrice
byVishal Kumar
 
ScotSecure West Summit 2024 - Glasgow 11th Sept
byRay Bugg
 
[cb22] Keynote: Underwhelmed: Making Sense of the Overwhelming Challenge of C...
byCODE BLUE
 
The State of Threat Detection 2019
byFidelis Cybersecurity
 
MITRE-Module 5 Slides.pdf
byReZa AdineH
 
How Data Analytics is Re-defining Modern Era in Cyber Security
bySaqib Chaudhry
 
Trustport - Roman Veleba
byJan Fried
 
Why_TG
byTOP GUN
 
Cyber Security
byNC Military Business Center
 
Cyber Threat Intelligence, CTI Lifecycle and CTI Framework
bykundansaraf1
 
Finding the needle in the haystack: how Nestle is leveraging big data to defe...
byBig Data Spain
 
Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017
byChris Gates
 
Webinar - Feel Secure with revolutionary OTM Solution
byJK Tech
 
Detection of Spreading Process on many assets over the network
bySecurity Bootcamp
 
Top Threat Hunting Interview Questions.pdf
byinfosec train
 
Top Threat Hunting Interview Questions.pdf
byinfosecTrain
 
Top Threat Hunting Interview Questions download white paper!
bypriyanshamadhwal2
 

Recently uploaded

PDF
T1 DPB20042 Management Information System.pdf
by68gr55d8f9
 
PPTX
Audit_of_Construction_Companies (1).pptx
bykylezambale
 
PDF
TOS in History.pdf ENGLISH macro.pdf mnbv
bykristinegorre7
 
PDF
"Essential Excel Tips for Beginners & Professionals – 50+ Techniques to Maste...
byCA Suvidha Chaplot
 
PPTX
Quartiles_Ungrouped_Data_Grade_10-1.pptx
byxiandexter21
 
PDF
What is Context Engineering for Agentforce Developer and Architect
byParis Salesforce Developer Group
 
PDF
LECTURE - Overcoming the AI Failure Rate - AIG, DQM.pdf
bySami Laine
 
PDF
Data Science vs Machine Learning vs AI | Industry Skills Explained
bymuhsinam9074
 
PPTX
Autism types, forms and everything we need to know
byfuzertamas
 
PPTX
Smart Crop prediction presentation for final year
bySurya386647
 
PPTX
Basic-Strategies-for-Developing-Literacy_021301.pptx
byMarkAnthonyMLotivio
 
PPTX
Reading and Writing Skills - Critical Reading ppt.pptx
byMargieJavier2
 
PDF
Plainte française dans le cadre de l'affaire Epstein
bySociété Tripalio
 
PPTX
GENPHYSICS-2.pptx this about general physics. Grade 11 lesson
byGwynMorata
 
PPTX
ppt for thesis for machine learning lung cancer.pptx
byinam97
 
PDF
SF User Group - Account-Contact Relationship Feb 2026
byLukas Lunow
 
PPTX
Internship ppt about multiple disease prediction
byGOUTHAMTr2
 
PDF
"Master Excel with CA Suvidha Chaplot: 40 Must-Know Tips for Efficiency"
byCA Suvidha Chaplot
 
PDF
Khan Traders Fish Meal – MSDS Material Safety Data Sheet
byKhan Traders Karachi
 
DOCX
CBLM SETUP COMPUTER NETWORK (2).docxMKKKKKKKKKKKKKKKKKKKKK
byCathyrineLazona
 
T1 DPB20042 Management Information System.pdf
by68gr55d8f9
 
Audit_of_Construction_Companies (1).pptx
bykylezambale
 
TOS in History.pdf ENGLISH macro.pdf mnbv
bykristinegorre7
 
"Essential Excel Tips for Beginners & Professionals – 50+ Techniques to Maste...
byCA Suvidha Chaplot
 
Quartiles_Ungrouped_Data_Grade_10-1.pptx
byxiandexter21
 
What is Context Engineering for Agentforce Developer and Architect
byParis Salesforce Developer Group
 
LECTURE - Overcoming the AI Failure Rate - AIG, DQM.pdf
bySami Laine
 
Data Science vs Machine Learning vs AI | Industry Skills Explained
bymuhsinam9074
 
Autism types, forms and everything we need to know
byfuzertamas
 
Smart Crop prediction presentation for final year
bySurya386647
 
Basic-Strategies-for-Developing-Literacy_021301.pptx
byMarkAnthonyMLotivio
 
Reading and Writing Skills - Critical Reading ppt.pptx
byMargieJavier2
 
Plainte française dans le cadre de l'affaire Epstein
bySociété Tripalio
 
GENPHYSICS-2.pptx this about general physics. Grade 11 lesson
byGwynMorata
 
ppt for thesis for machine learning lung cancer.pptx
byinam97
 
SF User Group - Account-Contact Relationship Feb 2026
byLukas Lunow
 
Internship ppt about multiple disease prediction
byGOUTHAMTr2
 
"Master Excel with CA Suvidha Chaplot: 40 Must-Know Tips for Efficiency"
byCA Suvidha Chaplot
 
Khan Traders Fish Meal – MSDS Material Safety Data Sheet
byKhan Traders Karachi
 
CBLM SETUP COMPUTER NETWORK (2).docxMKKKKKKKKKKKKKKKKKKKKK
byCathyrineLazona
 

Detection Rules Coverage

  • 1.
    Detection Rules Coverage SunnyNeo sunny@live.com.sg 1
  • 2.
    whoami • Perpetual Student •Red Team Lead @ Aon Cyber Solutions APAC • Specialise in Adversary Simulation • Red Teaming • Purple Teaming 2
  • 3.
    Disclaimer Everything mentioned hereis my personal opinion and does not represent my employer or any organisation that I am affiliated with. 3
  • 4.
    Objective • Introduction • InfrastructureAutomation Tools • Setup up your own lab (DetectionLab) • Atomic Red Team • Metrics • MITRE ATT&CK Framework Heatmap • SIGMA • Suggestions and Continuous Improvement 4
  • 5.
    Introduction “COI chairman RichardMagnus also said in his closing remarks that cyberattacks are a reality today, and APTs are constantly evolving in their sophistication. This is why organisations need to adopt an “assume breached mindset”, and not only have a proactive defence strategy but also security systems and solutions that enable them to detect and respond to cyber threats early. In turn, these systems and solutions should be complemented with the right people and processes.” Source: https://www.channelnewsasia.com/news/singapore/singhealth-coi-ends-cybersecurity-recommendations-10985254 5
  • 6.
    Detect and Respond Attackerto Objective Time < D&R Time 6
  • 7.
    Detect and Respond Attackerto Objective Time < D&R Time 7
  • 8.
    Question • What isactually being detected on? • What are the gaps in detection? • What should be prioritised on? 8
  • 9.
    MITRE ATT&CK Framework •https://attack.mitre.org/ • Knowledge base of adversary tactics, techniques and procedures based on real-world observation • Tactics – Adversary’s Technical Objective • Techniques – How an Adversary achieves those objectives • Procedures – Specific Implementations of the Technique 9
  • 10.
  • 11.
  • 12.
    Packer • https://www.packer.io/ • Atool for creating identical machine images for multiple platforms from a single configuration • Local Hypervisors – VirtualBox/VMWare/Hyper-V etc • Cloud Providers – AWS/DigitalOcean/Azure etc • How it works? • Start VM • Configure OS • Install software • Create machine image from VM 12
  • 13.
    Vagrant • https://www.vagrantup.com/ • Atool to build and manage virtual machine (VM) environment without having to learn specific VM provider’s commands • Usually used to spin up VirtualBox/VMware development environment locally 13
  • 14.
    Terraform • https://www.terraform.io/ • Atool to create and manage cloud infrastructure across multiple cloud providers 14
  • 15.
    Packer + VagrantWorkflow packer build template.json vagrant up Reference: https://stefanscherer.github.io/adding-hyper-v-support-to-2016-tp5-docker-vm/ Vagrant Box 15
  • 16.
    Pre-built Image +Vagrant Workflow vagrant up Download pre- built box from VagrantCloud 16
  • 17.
    Packer + TerraformWorkflow terraform init terraform plan terraform apply Image packer build template.jso n Infrastructure main.tf 17
  • 18.
    Why do Icare? • “Single” source of truth • Describe the state of the machine/image explicitly • Scalable & Repeatable 18
  • 19.
    Resource to learnmore • Infrastructure As Code Tutorial - https://github.com/Artemmkin/infrastructure-as-code-tutorial • World class DevSecOps Training and Certifications- https://www.practical-devsecops.com/ 19
  • 20.
    DetectionLab • https://github.com/clong/DetectionLab • Createdby Chris Long (@Centurion) • Vagrant, Packer and Terraform scripts to build an Active Directory lab with detection capabilities 20
  • 21.
  • 22.
  • 23.
  • 24.
  • 25.
    Resource to learnmore • Windows Event Forwarding for Network Defense - https://medium.com/palantir/windows-event-forwarding-for-network-defense- cb208d5ff86f? • Endpoint detection superpowers on the cheap, Threat Hunting app - https://medium.com/@olafhartong/endpoint-detection-superpowers-on-the- cheap-threat-hunting-app-a92213f5e4b8 • osquery Across the Enterprise - https://medium.com/palantir/osquery-across- the-enterprise-3c3c9d13ec55? • sysmon-config | A Sysmon configuration file for everybody to fork - https://github.com/SwiftOnSecurity/sysmon-config 25
  • 26.
  • 27.
    Atomic Red Team •https://github.com/redcanaryco/atomic-red-team • Library of simple tests mapped to MITRE ATT&CK Framework 27
  • 28.
    Atomic Red Team Source:https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1033/T1033.md 28
  • 29.
    Atomic Red TeamExecution Framework • https://github.com/redcanaryco/atomic-red- team/tree/master/execution-frameworks • Automate the execution of Atomic Tests • Three versions • Invoke-AtomicRedTeam (Powershell) • Python • Ruby 29
  • 30.
  • 31.
  • 32.
    MITRE ATT&CK Navigator •https://mitre-attack.github.io/attack-navigator/enterprise/ 32
  • 33.
  • 34.
    Resource to learnmore • Putting MITRE ATT&CK into Action with What You Have, Where You Are https://www.slideshare.net/KatieNickels/putting-mitre-attck-into-action-with-what-you- have-where-you-are • How to Be a Savvy ATT&CK Consumer https://medium.com/mitre-attack/how-to-be-a-savvy-attack-consumer-63e45b8e94c9 • GETTING STARTED WITH ATT&CK https://www.mitre.org/sites/default/files/publications/mitre-getting-started-with-attack- october-2019.pdf • Comparing Layers in ATT&CK Navigator https://attack.mitre.org/docs/Comparing_Layers_in_Navigator.pdf 34
  • 35.
  • 36.
    MITRE Cyber AnalyticsRepository (CAR) • https://car.mitre.org/ • Knowledge base of analytics developed by MITRE 36
  • 37.
    MITRE Cyber AnalyticsRepository (CAR) • Hypothesis • Information Domain • Analytics Pseudocode • Analytics Unit Test Example: • https://car.mitre.org/analytics/CAR-2013-04-002/ • https://car.mitre.org/analytics/CAR-2013-02-003/ 37
  • 38.
    MITRE Cyber AnalyticsRepository (CAR) 38 Source: https://car.mitre.org/analytics/CAR-2013-04-002/
  • 39.
    MITRE Cyber AnalyticsRepository (CAR) 39 Source: https://car.mitre.org/analytics/CAR-2013-02-003/
  • 40.
    MITRE Cyber AnalyticsRepository (CAR) 40 Source: https://car.mitre.org/analytics/CAR-2013-02-003/
  • 41.
    SIGMA • https://github.com/Neo23x0/sigma • Genericand open signature format to describe log events • Standardised format to write and share detection rules 41
  • 42.
  • 43.
  • 44.
    Tips for writingdetection rules • Don’t aim to write a perfect rule to cover all scenarios and evasions • Having rules implemented for different techniques is better than having one perfect rule for one technique • Make the rule as short and liberal as possible (Depending on your environment) • Run the rule against data from 7 / 30 / 60 days ago to determine if adjustment needs to be made 44
  • 45.
    Resource to learnmore • Sharing is Caring: Improving Detection with Sigma https://www.sans.org/cyber-security-summit/archives/file/summit- archive-1544043890.pdf • How to Write Sigma Rules https://www.nextron-systems.com/2018/02/10/write-sigma-rules/ 45
  • 46.
    Common Pitfalls • 100%MITRE ATT&CK Coverage • Thinking all Techniques are equal • Thinking you are done! • Forgetting the Fundamentals 46
  • 47.
    Problem: 100% MITREATT&CK Coverage 47 Source: https://medium.com/mitre-attack/how-to-be-a-savvy-attack-consumer-63e45b8e94c9
  • 48.
    Solution: Seek ComplementarySources • Ask about what parts of ATT&CK they cover and don’t cover • Ask why they cover certain techniques and procedures and not others • Seek other complementary products/sources/services that fill the gaps 48
  • 49.
    Problem: Thinking allTechniques are equal • Not all techniques have equal • Impact • Usage • Detection Difficulty • Data Source availability • Specific/Broad • Legitimate use in the organisation 49
  • 50.
    Solution: Prioritise • Prioritisedetection based on a combination of factors • Data sources availability • Value for techniques data sources • Relevant Threat Groups’ TTP • Top 20 Techniques based on Vendor X’s data or relevant Threat Groups • Caveat: *Subject to your environment, maturity and resource available* 50
  • 51.
  • 52.
  • 53.
    Solution: Prioritise (MyPersonal Preference) 53 Source: https://upload.wikimedia.org/wikipedia/commons/c/c2/The_Unified_Kill_Chain.png
  • 54.
    Solution: Prioritise (MyPersonal Preference) • If there is no constraint, I would place more weight on popular techniques for the following tactics: • Execution – Early stage in the kill chain and data source provides visibility through out the kill chain because execution is usually not standalone • Discovery – Early stage in the kill chain and high fidelity because commands unlikely to be executed by normal users in bulk in a short period of time (whoami/tasklist/arp/net users etc) • Persistence – Early stage in the kill chain and attackers usually do it for the ease of returning to the network • Credential Access – High Impact and limited techniques • Lateral Movement – High Impact and limited techniques (Require thorough understanding of where Administrators log in to) 54
  • 55.
    Problem: Thinking youare done! • Endless variants for each techniques – it’s impossible to have a perfect detection rule for the unknown • MITRE ATT&CK Matrix only includes techniques from real world observation – does not include the latest security research or attacks that are not reported yet 55
  • 56.
    Solution: Thinking youare done! • Shift from a Binary Detection metric to a Detection Confidence Level metric for each technique after initial assessment 56 Source: https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1561390150.pdf
  • 57.
    Solution: Thinking youare done! • Another example of Confidence Level 57 Source: https://medium.com/@visiblerisk/detection-confidence-a-framework-for-success-d6cf1aa1638
  • 58.
    Solution: Thinking youare done! • Develop your own matrix • Look out for emerging techniques from latest security research or threat intelligence report • Map the techniques to either ATT&CK or your own matrix • Continuous Assurance & Improvement! 58
  • 59.
    Forgetting the Fundamentals 59 •Improving your detection capability is great… but don’t forget • Primary security functions should still be reducing attack surface/risks: • Segmenting Network • Limiting Host to Host communication • Maintaining asset inventories • Installing patches • Managing user privileges
  • 60.
    Resource to learnmore • ATT&CK™ Is Only as Good as Its Implementation: Avoiding Five Common Pitfalls https://redcanary.com/blog/avoiding-common-attack-pitfalls/ • Prioritizing the Remediation of Mitre ATT&CK Framework Gaps https://blog.netspi.com/prioritizing-the-remediation-of-mitre-attck-framework-gaps/ • ATT&CK™ Your CTI with Lessons Learned from Four Years in the Trenches - https://www.sans.org/cyber-security-summit/archives/file/summit-archive- 1548090281.pdf • Lessons Learned Applying ATT&CKBased SOC Assessments - https://www.sans.org/cyber-security-summit/archives/file/summit-archive- 1561390150.pdf 60
  • 61.
  • 62.
    SOC Challenges • AlertFatigue • Budget 62
  • 63.
    Problem: Alert Fatigue •High volume of alerts • Excessive number of false positive alerts 63
  • 64.
    Solution: Alert Fatigue •Measure the number of true positive and false positive alerts • Determine the reason for each false positive alerts • Categorise the reason for false positive alerts and follow up accordingly 64
  • 65.
    Solution: Alert Fatigue 65Source:https://github.com/d3sre/Use_Case_Applicability/blob/master/Hack.lu-FingerpointingPresentation.pdf
  • 66.
    Problem: Budget • Budgetfor procuring tools • Budget for hiring • Budget for training 66
  • 67.
    Solution: Budget • DemonstrateReturn on Investment (ROI) via • Existing SOC heatmap coverage and confidence level • Effort to measure and improve efficiency of the SOC (KPI and metrics) • Justify additional resource are required • New tools/data source required to increase SOC heatmap coverage • Manpower/expertise required to handle alert volume after optimisation 67
  • 68.
    KPI and Metrics 68 KPIExplanation Target Value Number of Log Management Rule Configuration Error events per month This value reflects the rules configured in the SIEM by the SOC Analysts. A high number suspects bad quality of rules, more training or experience needed. < 10 % Number of Announced Administrative/User Action events per month This value reflects suppressions that should be improved. < 10 % Number of Bad IOC/rule pattern value events per month If too many events were created by bad IOCs or rule pattern values, the source or the trust in it should be questioned. < 5 % Number of Confirmed Attack attempt without IR actions (best matched with Log Source Category) Number of events detected but prevented by measures in place or where the alert isn’t viewed as a high risk. > 50 % Number of Confirmed Attack attempt with IR actions (best matched with Log Source Category) Very high numbers → Security Architecture should be updated Very low numbers → The rules aren‘t detecting or you are safe :) Source: https://github.com/d3sre/Use_Case_Applicability/wiki/KPIs-and-Metrics
  • 69.
    Resource to learnmore • Use Case Applicability: How to better integrate Continuous Improvement into Security Monitoring https://github.com/d3sre/Use_Case_Applicability • Alerting and Detection Strategy Framework https://medium.com/palantir/alerting-and-detection-strategy- framework-52dc33722df2 69

Editor's Notes

  • #5 To update
  • #10 https://medium.com/mitre-attack/how-to-be-a-savvy-attack-consumer-63e45b8e94c9 https://www.mitre.org/sites/default/files/publications/mitre-getting-started-with-attack-october-2019.pdf https://medium.com/mitre-attack/using-att-ck-to-advance-cyber-threat-intelligence-part-2-6f21fdba80c
  • #11 https://medium.com/mitre-attack/how-to-be-a-savvy-attack-consumer-63e45b8e94c9 https://www.mitre.org/sites/default/files/publications/mitre-getting-started-with-attack-october-2019.pdf https://medium.com/mitre-attack/using-att-ck-to-advance-cyber-threat-intelligence-part-2-6f21fdba80c
  • #16 REf
  • #17 REf
  • #19 No optics on the state of the machines/images when configured manually
  • #24  splunk stop splunk clean eventdata -index yourindex splunk start
  • #36 https://car.mitre.org/analytics/CAR-2013-04-002/ Sigma Rules
  • #37 https://car.mitre.org/analytics/CAR-2013-04-002/
  • #48 Some techniques do not need alerts as well