Sunny Neo, profile picture
Uploaded bySunny Neo
PPTX, PDF1,428 views

Detection Rules Coverage

This document discusses improving detection rules coverage through infrastructure automation tools, testing frameworks, and metrics. It introduces tools like Packer, Vagrant, Terraform, and DetectionLab for building detection environments. Atomic Red Team and the MITRE ATT&CK framework are covered for testing detections. Metrics like the ATT&CK heatmap and KPIs are suggested for measuring coverage. Common pitfalls like assuming full coverage and not prioritizing are addressed.

Data & Analyticsโ—ฆ
Related topics:
MITRE ATT&CK Insightsโ€ข
In this document
Powered by AI

Presentation introduction covering detection rules, speaker's background, and objectives related to cybersecurity.

Discusses the evolution of cyberattacks, the importance of detection, and introduces the MITRE ATT&CK framework.

Overview of tools like Packer, Vagrant, and Terraform for automating security lab environments.Description and workflows of DetectionLab to facilitate effective cybersecurity detection capabilities.

Discussion on Atomic Red Team's role and usage for testing security postures via MITRE ATT&CK mappings.

Importance of measurement using MITRE ATT&CK Navigator and available resources for practical implementation.

How to start with detection rules including MITRE Cyber Analytics Repository and SIGMA format.

Explores frequent mistakes in detection coverage and emphasizes the importance of continuous improvement.

Discussion on SOC challenges such as alert fatigue and budget constraints, along with proposed solutions.

Key Performance Indicators for SOC effectiveness with resource suggestions for improving security monitoring.

Embed presentation

Downloaded 94 times
Detection Rules Coverage Sunny Neo sunny@live.com.sg 1
whoami โ€ข Perpetual Student โ€ข Red Team Lead @ Aon Cyber Solutions APAC โ€ข Specialise in Adversary Simulation โ€ข Red Teaming โ€ข Purple Teaming 2
Disclaimer Everything mentioned here is my personal opinion and does not represent my employer or any organisation that I am affiliated with. 3
Objective โ€ข Introduction โ€ข Infrastructure Automation Tools โ€ข Setup up your own lab (DetectionLab) โ€ข Atomic Red Team โ€ข Metrics โ€ข MITRE ATT&CK Framework Heatmap โ€ข SIGMA โ€ข Suggestions and Continuous Improvement 4
Introduction โ€œCOI chairman Richard Magnus also said in his closing remarks that cyberattacks are a reality today, and APTs are constantly evolving in their sophistication. This is why organisations need to adopt an โ€œassume breached mindsetโ€, and not only have a proactive defence strategy but also security systems and solutions that enable them to detect and respond to cyber threats early. In turn, these systems and solutions should be complemented with the right people and processes.โ€ Source: https://www.channelnewsasia.com/news/singapore/singhealth-coi-ends-cybersecurity-recommendations-10985254 5
Detect and Respond Attacker to Objective Time < D&R Time 6
Detect and Respond Attacker to Objective Time < D&R Time 7
Question โ€ข What is actually being detected on? โ€ข What are the gaps in detection? โ€ข What should be prioritised on? 8
MITRE ATT&CK Framework โ€ข https://attack.mitre.org/ โ€ข Knowledge base of adversary tactics, techniques and procedures based on real-world observation โ€ข Tactics โ€“ Adversaryโ€™s Technical Objective โ€ข Techniques โ€“ How an Adversary achieves those objectives โ€ข Procedures โ€“ Specific Implementations of the Technique 9
MITRE ATT&CK Framework 10
Infrastructure Automation Tools 11
Packer โ€ข https://www.packer.io/ โ€ข A tool for creating identical machine images for multiple platforms from a single configuration โ€ข Local Hypervisors โ€“ VirtualBox/VMWare/Hyper-V etc โ€ข Cloud Providers โ€“ AWS/DigitalOcean/Azure etc โ€ข How it works? โ€ข Start VM โ€ข Configure OS โ€ข Install software โ€ข Create machine image from VM 12
Vagrant โ€ข https://www.vagrantup.com/ โ€ข A tool to build and manage virtual machine (VM) environment without having to learn specific VM providerโ€™s commands โ€ข Usually used to spin up VirtualBox/VMware development environment locally 13
Terraform โ€ข https://www.terraform.io/ โ€ข A tool to create and manage cloud infrastructure across multiple cloud providers 14
Packer + Vagrant Workflow packer build template.json vagrant up Reference: https://stefanscherer.github.io/adding-hyper-v-support-to-2016-tp5-docker-vm/ Vagrant Box 15
Pre-built Image + Vagrant Workflow vagrant up Download pre- built box from VagrantCloud 16
Packer + Terraform Workflow terraform init terraform plan terraform apply Image packer build template.jso n Infrastructure main.tf 17
Why do I care? โ€ข โ€œSingleโ€ source of truth โ€ข Describe the state of the machine/image explicitly โ€ข Scalable & Repeatable 18
Resource to learn more โ€ข Infrastructure As Code Tutorial - https://github.com/Artemmkin/infrastructure-as-code-tutorial โ€ข World class DevSecOps Training and Certifications- https://www.practical-devsecops.com/ 19
DetectionLab โ€ข https://github.com/clong/DetectionLab โ€ข Created by Chris Long (@Centurion) โ€ข Vagrant, Packer and Terraform scripts to build an Active Directory lab with detection capabilities 20
DetectionLab Workflow Source: https://github.com/clong/DetectionLab/blob/master/img/packer_wiki.png 21
DetectionLab Workflow Source: https://github.com/clong/DetectionLab/blob/master/img/vagrant_wiki.png 22
DetectionLab Overview Source: https://raw.githubusercontent.com/clong/DetectionLab/master/img/overview.jpeg 23
DetectionLab Demo 24
Resource to learn more โ€ข Windows Event Forwarding for Network Defense - https://medium.com/palantir/windows-event-forwarding-for-network-defense- cb208d5ff86f? โ€ข Endpoint detection superpowers on the cheap, Threat Hunting app - https://medium.com/@olafhartong/endpoint-detection-superpowers-on-the- cheap-threat-hunting-app-a92213f5e4b8 โ€ข osquery Across the Enterprise - https://medium.com/palantir/osquery-across- the-enterprise-3c3c9d13ec55? โ€ข sysmon-config | A Sysmon configuration file for everybody to fork - https://github.com/SwiftOnSecurity/sysmon-config 25
Testing Framework 26
Atomic Red Team โ€ข https://github.com/redcanaryco/atomic-red-team โ€ข Library of simple tests mapped to MITRE ATT&CK Framework 27
Atomic Red Team Source: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1033/T1033.md 28
Atomic Red Team Execution Framework โ€ข https://github.com/redcanaryco/atomic-red- team/tree/master/execution-frameworks โ€ข Automate the execution of Atomic Tests โ€ข Three versions โ€ข Invoke-AtomicRedTeam (Powershell) โ€ข Python โ€ข Ruby 29
Invoke-AtomicRedTeam Demo 30
Measurement and Results 31
MITRE ATT&CK Navigator โ€ข https://mitre-attack.github.io/attack-navigator/enterprise/ 32
MITRE ATT&CK Navigator Demo 33
Resource to learn more โ€ข Putting MITRE ATT&CK into Action with What You Have, Where You Are https://www.slideshare.net/KatieNickels/putting-mitre-attck-into-action-with-what-you- have-where-you-are โ€ข How to Be a Savvy ATT&CK Consumer https://medium.com/mitre-attack/how-to-be-a-savvy-attack-consumer-63e45b8e94c9 โ€ข GETTING STARTED WITH ATT&CK https://www.mitre.org/sites/default/files/publications/mitre-getting-started-with-attack- october-2019.pdf โ€ข Comparing Layers in ATT&CK Navigator https://attack.mitre.org/docs/Comparing_Layers_in_Navigator.pdf 34
Detection Rules How to start? 35
MITRE Cyber Analytics Repository (CAR) โ€ข https://car.mitre.org/ โ€ข Knowledge base of analytics developed by MITRE 36
MITRE Cyber Analytics Repository (CAR) โ€ข Hypothesis โ€ข Information Domain โ€ข Analytics Pseudocode โ€ข Analytics Unit Test Example: โ€ข https://car.mitre.org/analytics/CAR-2013-04-002/ โ€ข https://car.mitre.org/analytics/CAR-2013-02-003/ 37
MITRE Cyber Analytics Repository (CAR) 38 Source: https://car.mitre.org/analytics/CAR-2013-04-002/
MITRE Cyber Analytics Repository (CAR) 39 Source: https://car.mitre.org/analytics/CAR-2013-02-003/
MITRE Cyber Analytics Repository (CAR) 40 Source: https://car.mitre.org/analytics/CAR-2013-02-003/
SIGMA โ€ข https://github.com/Neo23x0/sigma โ€ข Generic and open signature format to describe log events โ€ข Standardised format to write and share detection rules 41
SIGMA Source: https://github.com/Neo23x0/sigma/raw/master/images/Sigma-description.png 42
SIGMA Demo 43
Tips for writing detection rules โ€ข Donโ€™t aim to write a perfect rule to cover all scenarios and evasions โ€ข Having rules implemented for different techniques is better than having one perfect rule for one technique โ€ข Make the rule as short and liberal as possible (Depending on your environment) โ€ข Run the rule against data from 7 / 30 / 60 days ago to determine if adjustment needs to be made 44
Resource to learn more โ€ข Sharing is Caring: Improving Detection with Sigma https://www.sans.org/cyber-security-summit/archives/file/summit- archive-1544043890.pdf โ€ข How to Write Sigma Rules https://www.nextron-systems.com/2018/02/10/write-sigma-rules/ 45
Common Pitfalls โ€ข 100% MITRE ATT&CK Coverage โ€ข Thinking all Techniques are equal โ€ข Thinking you are done! โ€ข Forgetting the Fundamentals 46
Problem: 100% MITRE ATT&CK Coverage 47 Source: https://medium.com/mitre-attack/how-to-be-a-savvy-attack-consumer-63e45b8e94c9
Solution: Seek Complementary Sources โ€ข Ask about what parts of ATT&CK they cover and donโ€™t cover โ€ข Ask why they cover certain techniques and procedures and not others โ€ข Seek other complementary products/sources/services that fill the gaps 48
Problem: Thinking all Techniques are equal โ€ข Not all techniques have equal โ€ข Impact โ€ข Usage โ€ข Detection Difficulty โ€ข Data Source availability โ€ข Specific/Broad โ€ข Legitimate use in the organisation 49
Solution: Prioritise โ€ข Prioritise detection based on a combination of factors โ€ข Data sources availability โ€ข Value for techniques data sources โ€ข Relevant Threat Groupsโ€™ TTP โ€ข Top 20 Techniques based on Vendor Xโ€™s data or relevant Threat Groups โ€ข Caveat: *Subject to your environment, maturity and resource available* 50
Solution: Prioritise 51 Source: https://www.sans.org/cyber-security-summit/archives/file/summit-archive- 1548090281.pdf
Solution: Prioritise 52 Source: https://www.sans.org/cyber-security-summit/archives/file/summit-archive- 1548090281.pdf
Solution: Prioritise (My Personal Preference) 53 Source: https://upload.wikimedia.org/wikipedia/commons/c/c2/The_Unified_Kill_Chain.png
Solution: Prioritise (My Personal Preference) โ€ข If there is no constraint, I would place more weight on popular techniques for the following tactics: โ€ข Execution โ€“ Early stage in the kill chain and data source provides visibility through out the kill chain because execution is usually not standalone โ€ข Discovery โ€“ Early stage in the kill chain and high fidelity because commands unlikely to be executed by normal users in bulk in a short period of time (whoami/tasklist/arp/net users etc) โ€ข Persistence โ€“ Early stage in the kill chain and attackers usually do it for the ease of returning to the network โ€ข Credential Access โ€“ High Impact and limited techniques โ€ข Lateral Movement โ€“ High Impact and limited techniques (Require thorough understanding of where Administrators log in to) 54
Problem: Thinking you are done! โ€ข Endless variants for each techniques โ€“ itโ€™s impossible to have a perfect detection rule for the unknown โ€ข MITRE ATT&CK Matrix only includes techniques from real world observation โ€“ does not include the latest security research or attacks that are not reported yet 55
Solution: Thinking you are done! โ€ข Shift from a Binary Detection metric to a Detection Confidence Level metric for each technique after initial assessment 56 Source: https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1561390150.pdf
Solution: Thinking you are done! โ€ข Another example of Confidence Level 57 Source: https://medium.com/@visiblerisk/detection-confidence-a-framework-for-success-d6cf1aa1638
Solution: Thinking you are done! โ€ข Develop your own matrix โ€ข Look out for emerging techniques from latest security research or threat intelligence report โ€ข Map the techniques to either ATT&CK or your own matrix โ€ข Continuous Assurance & Improvement! 58
Forgetting the Fundamentals 59 โ€ข Improving your detection capability is greatโ€ฆ but donโ€™t forget โ€ข Primary security functions should still be reducing attack surface/risks: โ€ข Segmenting Network โ€ข Limiting Host to Host communication โ€ข Maintaining asset inventories โ€ข Installing patches โ€ข Managing user privileges
Resource to learn more โ€ข ATT&CKโ„ข Is Only as Good as Its Implementation: Avoiding Five Common Pitfalls https://redcanary.com/blog/avoiding-common-attack-pitfalls/ โ€ข Prioritizing the Remediation of Mitre ATT&CK Framework Gaps https://blog.netspi.com/prioritizing-the-remediation-of-mitre-attck-framework-gaps/ โ€ข ATT&CKโ„ข Your CTI with Lessons Learned from Four Years in the Trenches - https://www.sans.org/cyber-security-summit/archives/file/summit-archive- 1548090281.pdf โ€ข Lessons Learned Applying ATT&CKBased SOC Assessments - https://www.sans.org/cyber-security-summit/archives/file/summit-archive- 1561390150.pdf 60
Whatโ€™s Next? Continuous Improvements and Suggestions 61
SOC Challenges โ€ข Alert Fatigue โ€ข Budget 62
Problem: Alert Fatigue โ€ข High volume of alerts โ€ข Excessive number of false positive alerts 63
Solution: Alert Fatigue โ€ข Measure the number of true positive and false positive alerts โ€ข Determine the reason for each false positive alerts โ€ข Categorise the reason for false positive alerts and follow up accordingly 64
Solution: Alert Fatigue 65Source: https://github.com/d3sre/Use_Case_Applicability/blob/master/Hack.lu-FingerpointingPresentation.pdf
Problem: Budget โ€ข Budget for procuring tools โ€ข Budget for hiring โ€ข Budget for training 66
Solution: Budget โ€ข Demonstrate Return on Investment (ROI) via โ€ข Existing SOC heatmap coverage and confidence level โ€ข Effort to measure and improve efficiency of the SOC (KPI and metrics) โ€ข Justify additional resource are required โ€ข New tools/data source required to increase SOC heatmap coverage โ€ข Manpower/expertise required to handle alert volume after optimisation 67
KPI and Metrics 68 KPI Explanation Target Value Number of Log Management Rule Configuration Error events per month This value reflects the rules configured in the SIEM by the SOC Analysts. A high number suspects bad quality of rules, more training or experience needed. < 10 % Number of Announced Administrative/User Action events per month This value reflects suppressions that should be improved. < 10 % Number of Bad IOC/rule pattern value events per month If too many events were created by bad IOCs or rule pattern values, the source or the trust in it should be questioned. < 5 % Number of Confirmed Attack attempt without IR actions (best matched with Log Source Category) Number of events detected but prevented by measures in place or where the alert isnโ€™t viewed as a high risk. > 50 % Number of Confirmed Attack attempt with IR actions (best matched with Log Source Category) Very high numbers โ†’ Security Architecture should be updated Very low numbers โ†’ The rules arenโ€˜t detecting or you are safe :) Source: https://github.com/d3sre/Use_Case_Applicability/wiki/KPIs-and-Metrics
Resource to learn more โ€ข Use Case Applicability: How to better integrate Continuous Improvement into Security Monitoring https://github.com/d3sre/Use_Case_Applicability โ€ข Alerting and Detection Strategy Framework https://medium.com/palantir/alerting-and-detection-strategy- framework-52dc33722df2 69

More Related Content

PPTX
Cyber Threat Hunting Workshop
byDigit Oktavianto
ย 
PPTX
Bsides 2019 - Intelligent Threat Hunting
byDhruv Majumdar
ย 
PDF
PHDays 2018 Threat Hunting Hands-On Lab
byTeymur Kheirkhabarov
ย 
PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
ย 
PDF
How to Hunt for Lateral Movement on Your Network
bySqrrl
ย 
PPTX
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
ย 
PDF
Hunting for Privilege Escalation in Windows Environment
byTeymur Kheirkhabarov
ย 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
ย 
Cyber Threat Hunting Workshop
byDigit Oktavianto
ย 
Bsides 2019 - Intelligent Threat Hunting
byDhruv Majumdar
ย 
PHDays 2018 Threat Hunting Hands-On Lab
byTeymur Kheirkhabarov
ย 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
ย 
How to Hunt for Lateral Movement on Your Network
bySqrrl
ย 
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
ย 
Hunting for Privilege Escalation in Windows Environment
byTeymur Kheirkhabarov
ย 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
ย 

What's hot

PDF
A Threat Hunter Himself
bySergey Soldatov
ย 
PDF
Fantastic Red Team Attacks and How to Find Them
byRoss Wolf
ย 
PPTX
Threat hunting - Every day is hunting season
byBen Boyd
ย 
PDF
Threat Hunting with Splunk Hands-on
bySplunk
ย 
PDF
MITRE ATT&CK Framework
byn|u - The Open Security Community
ย 
PDF
The Hunter Games: How to Find the Adversary with Event Query Language
byRoss Wolf
ย 
PDF
Super Easy Memory Forensics
byIIJ
ย 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
ย 
PDF
Windows Threat Hunting
byGIBIN JOHN
ย 
PDF
Hunting for Credentials Dumping in Windows Environment
byTeymur Kheirkhabarov
ย 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
ย 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
ย 
PDF
Maturity Model of Security Disciplines
byFlorian Roth
ย 
PPTX
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
byChristopher Gerritz
ย 
PPTX
Catch Me If You Can: PowerShell Red vs Blue
byWill Schroeder
ย 
PPTX
PowerShell for Practical Purple Teaming
byNikhil Mittal
ย 
PDF
Introduction to red team operations
bySunny Neo
ย 
PDF
Threat hunting 101 by Sandeep Singh
byOWASP Delhi
ย 
PDF
Breach and attack simulation tools
byBangladesh Network Operators Group
ย 
PDF
State of the ATT&CK
byMITRE ATT&CK
ย 
A Threat Hunter Himself
bySergey Soldatov
ย 
Fantastic Red Team Attacks and How to Find Them
byRoss Wolf
ย 
Threat hunting - Every day is hunting season
byBen Boyd
ย 
Threat Hunting with Splunk Hands-on
bySplunk
ย 
MITRE ATT&CK Framework
byn|u - The Open Security Community
ย 
The Hunter Games: How to Find the Adversary with Event Query Language
byRoss Wolf
ย 
Super Easy Memory Forensics
byIIJ
ย 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
ย 
Windows Threat Hunting
byGIBIN JOHN
ย 
Hunting for Credentials Dumping in Windows Environment
byTeymur Kheirkhabarov
ย 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
ย 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
ย 
Maturity Model of Security Disciplines
byFlorian Roth
ย 
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
byChristopher Gerritz
ย 
Catch Me If You Can: PowerShell Red vs Blue
byWill Schroeder
ย 
PowerShell for Practical Purple Teaming
byNikhil Mittal
ย 
Introduction to red team operations
bySunny Neo
ย 
Threat hunting 101 by Sandeep Singh
byOWASP Delhi
ย 
Breach and attack simulation tools
byBangladesh Network Operators Group
ย 
State of the ATT&CK
byMITRE ATT&CK
ย 

Similar to Detection Rules Coverage

PDF
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
byMarcin Ludwiszewski
ย 
PDF
[Bucharest] Attack is easy, let's talk defence
byOWASP EEE
ย 
PDF
Telesoft Cyber Threat Hunting Infographic
bySarah Chandley
ย 
PDF
Threat Hunting Procedures and Measurement Matrice
byVishal Kumar
ย 
PDF
ScotSecure West Summit 2024 - Glasgow 11th Sept
byRay Bugg
ย 
PDF
[cb22] Keynote: Underwhelmed: Making Sense of the Overwhelming Challenge of C...
byCODE BLUE
ย 
PDF
The State of Threat Detection 2019
byFidelis Cybersecurity
ย 
PDF
MITRE-Module 5 Slides.pdf
byReZa AdineH
ย 
PPTX
How Data Analytics is Re-defining Modern Era in Cyber Security
bySaqib Chaudhry
ย 
PDF
Trustport - Roman Veleba
byJan Fried
ย 
PDF
Why_TG
byTOP GUN
ย 
PDF
Cyber Security
byNC Military Business Center
ย 
PPTX
Cyber Threat Intelligence, CTI Lifecycle and CTI Framework
bykundansaraf1
ย 
PDF
Finding the needle in the haystack: how Nestle is leveraging big data to defe...
byBig Data Spain
ย 
PDF
Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017
byChris Gates
ย 
PDF
Webinar - Feel Secure with revolutionary OTM Solution
byJK Tech
ย 
PDF
Detection of Spreading Process on many assets over the network
bySecurity Bootcamp
ย 
PDF
Top Threat Hunting Interview Questions.pdf
byinfosecTrain
ย 
PDF
Top Threat Hunting Interview Questions download white paper!
bypriyanshamadhwal2
ย 
PDF
๐“๐จ๐ฉ ๐“๐ก๐ซ๐ž๐š๐ญ ๐‡๐ฎ๐ง๐ญ๐ข๐ง๐  ๐ˆ๐ง๐ญ๐ž๐ซ๐ฏ๐ข๐ž๐ฐ ๐๐ฎ๐ž๐ฌ๐ญ๐ข๐จ๐ง๐ฌ: ๐ƒ๐จ๐ฐ๐ง๐ฅ๐จ๐š๐ ๐Ž๐ฎ๐ซ ๐–๐ก๐ข๐ญ๐ž ๐๐š๐ฉ๐ž๐ซ!
byMansi Kandari
ย 
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
byMarcin Ludwiszewski
ย 
[Bucharest] Attack is easy, let's talk defence
byOWASP EEE
ย 
Telesoft Cyber Threat Hunting Infographic
bySarah Chandley
ย 
Threat Hunting Procedures and Measurement Matrice
byVishal Kumar
ย 
ScotSecure West Summit 2024 - Glasgow 11th Sept
byRay Bugg
ย 
[cb22] Keynote: Underwhelmed: Making Sense of the Overwhelming Challenge of C...
byCODE BLUE
ย 
The State of Threat Detection 2019
byFidelis Cybersecurity
ย 
MITRE-Module 5 Slides.pdf
byReZa AdineH
ย 
How Data Analytics is Re-defining Modern Era in Cyber Security
bySaqib Chaudhry
ย 
Trustport - Roman Veleba
byJan Fried
ย 
Why_TG
byTOP GUN
ย 
Cyber Security
byNC Military Business Center
ย 
Cyber Threat Intelligence, CTI Lifecycle and CTI Framework
bykundansaraf1
ย 
Finding the needle in the haystack: how Nestle is leveraging big data to defe...
byBig Data Spain
ย 
Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017
byChris Gates
ย 
Webinar - Feel Secure with revolutionary OTM Solution
byJK Tech
ย 
Detection of Spreading Process on many assets over the network
bySecurity Bootcamp
ย 
Top Threat Hunting Interview Questions.pdf
byinfosecTrain
ย 
Top Threat Hunting Interview Questions download white paper!
bypriyanshamadhwal2
ย 
๐“๐จ๐ฉ ๐“๐ก๐ซ๐ž๐š๐ญ ๐‡๐ฎ๐ง๐ญ๐ข๐ง๐  ๐ˆ๐ง๐ญ๐ž๐ซ๐ฏ๐ข๐ž๐ฐ ๐๐ฎ๐ž๐ฌ๐ญ๐ข๐จ๐ง๐ฌ: ๐ƒ๐จ๐ฐ๐ง๐ฅ๐จ๐š๐ ๐Ž๐ฎ๐ซ ๐–๐ก๐ข๐ญ๐ž ๐๐š๐ฉ๐ž๐ซ!
byMansi Kandari
ย 

Recently uploaded

PPTX
Orientation-on-ARAL-Check-in-Assessment.pptx
byJenTeruel1
ย 
PPT
Perceptron and Activation Function in deep learning
byShrideviS7
ย 
PPTX
Presentation 1-PUM Singapore 2015- 2D.pptx
byWilliamChong71
ย 
PPTX
Copy of First ENGR 100 Presentation.pptx
bygenshinds971
ย 
PPTX
Safe_Spaces_Act_Modern_Presentation.pptx
byairesmijares2003
ย 
PPTX
hindustan Unilever Limited Presentation - Sample
bymohitsawale3
ย 
PPTX
[DSC Europe 25] Bogdan Daniel Maruneac - AI - It starts with you.pptx
byDataScienceConferenc1
ย 
PPTX
[DSC Europe 25] Goran Obradovic - The Rise of Sovereign AI: Building the Regi...
byDataScienceConferenc1
ย 
PPTX
Time serise forcasting of non-durble consumer goods industry
byvkumaranand89
ย 
PPTX
[DSC Europe 25] Dusan Jovicic - AI Story: From on-prem to cloud and back agai...
byDataScienceConferenc1
ย 
PPTX
GRADE 8 MATH - Q3 - LESSON 1 -LINEAR EQUATION IN ONE VARIABLE.pptx
byEdlynMalangPanti
ย 
PPTX
284761009-Statistics-Quiz-Questions.pptx
bymarckevinsbarrida
ย 
PDF
OPPOTUS - Malaysians on Malaysia (MOM) Q3 2025
byOppotus
ย 
PDF
Data+Security+Masterclass Presentation.pdf
byckurt9676
ย 
PDF
BCS501 Module-05 Software Engineering and Project Management.pdf
byjaadu6918
ย 
PDF
Natal SM 2025 - Latihan Liturgi Kelas 0 - 3 SD.pdf
byWenny63
ย 
PPTX
Presentation (2).pptxbbnnnnnnnnnnnnnnnnnnn
byEshaEman27
ย 
PPTX
[DSC Europe 25] Boris Perkovic - Lost in performance.pptx
byDataScienceConferenc1
ย 
PPTX
essential in computer science structure and other
byhncseven7
ย 
PDF
Bicycle Project sostenible pllay book presentacion
byAlejoLevenstain1
ย 
Orientation-on-ARAL-Check-in-Assessment.pptx
byJenTeruel1
ย 
Perceptron and Activation Function in deep learning
byShrideviS7
ย 
Presentation 1-PUM Singapore 2015- 2D.pptx
byWilliamChong71
ย 
Copy of First ENGR 100 Presentation.pptx
bygenshinds971
ย 
Safe_Spaces_Act_Modern_Presentation.pptx
byairesmijares2003
ย 
hindustan Unilever Limited Presentation - Sample
bymohitsawale3
ย 
[DSC Europe 25] Bogdan Daniel Maruneac - AI - It starts with you.pptx
byDataScienceConferenc1
ย 
[DSC Europe 25] Goran Obradovic - The Rise of Sovereign AI: Building the Regi...
byDataScienceConferenc1
ย 
Time serise forcasting of non-durble consumer goods industry
byvkumaranand89
ย 
[DSC Europe 25] Dusan Jovicic - AI Story: From on-prem to cloud and back agai...
byDataScienceConferenc1
ย 
GRADE 8 MATH - Q3 - LESSON 1 -LINEAR EQUATION IN ONE VARIABLE.pptx
byEdlynMalangPanti
ย 
284761009-Statistics-Quiz-Questions.pptx
bymarckevinsbarrida
ย 
OPPOTUS - Malaysians on Malaysia (MOM) Q3 2025
byOppotus
ย 
Data+Security+Masterclass Presentation.pdf
byckurt9676
ย 
BCS501 Module-05 Software Engineering and Project Management.pdf
byjaadu6918
ย 
Natal SM 2025 - Latihan Liturgi Kelas 0 - 3 SD.pdf
byWenny63
ย 
Presentation (2).pptxbbnnnnnnnnnnnnnnnnnnn
byEshaEman27
ย 
[DSC Europe 25] Boris Perkovic - Lost in performance.pptx
byDataScienceConferenc1
ย 
essential in computer science structure and other
byhncseven7
ย 
Bicycle Project sostenible pllay book presentacion
byAlejoLevenstain1
ย 

Detection Rules Coverage

  • 1.
    Detection Rules Coverage SunnyNeo sunny@live.com.sg 1
  • 2.
    whoami โ€ข Perpetual Student โ€ขRed Team Lead @ Aon Cyber Solutions APAC โ€ข Specialise in Adversary Simulation โ€ข Red Teaming โ€ข Purple Teaming 2
  • 3.
    Disclaimer Everything mentioned hereis my personal opinion and does not represent my employer or any organisation that I am affiliated with. 3
  • 4.
    Objective โ€ข Introduction โ€ข InfrastructureAutomation Tools โ€ข Setup up your own lab (DetectionLab) โ€ข Atomic Red Team โ€ข Metrics โ€ข MITRE ATT&CK Framework Heatmap โ€ข SIGMA โ€ข Suggestions and Continuous Improvement 4
  • 5.
    Introduction โ€œCOI chairman RichardMagnus also said in his closing remarks that cyberattacks are a reality today, and APTs are constantly evolving in their sophistication. This is why organisations need to adopt an โ€œassume breached mindsetโ€, and not only have a proactive defence strategy but also security systems and solutions that enable them to detect and respond to cyber threats early. In turn, these systems and solutions should be complemented with the right people and processes.โ€ Source: https://www.channelnewsasia.com/news/singapore/singhealth-coi-ends-cybersecurity-recommendations-10985254 5
  • 6.
    Detect and Respond Attackerto Objective Time < D&R Time 6
  • 7.
    Detect and Respond Attackerto Objective Time < D&R Time 7
  • 8.
    Question โ€ข What isactually being detected on? โ€ข What are the gaps in detection? โ€ข What should be prioritised on? 8
  • 9.
    MITRE ATT&CK Framework โ€ขhttps://attack.mitre.org/ โ€ข Knowledge base of adversary tactics, techniques and procedures based on real-world observation โ€ข Tactics โ€“ Adversaryโ€™s Technical Objective โ€ข Techniques โ€“ How an Adversary achieves those objectives โ€ข Procedures โ€“ Specific Implementations of the Technique 9
  • 10.
  • 11.
  • 12.
    Packer โ€ข https://www.packer.io/ โ€ข Atool for creating identical machine images for multiple platforms from a single configuration โ€ข Local Hypervisors โ€“ VirtualBox/VMWare/Hyper-V etc โ€ข Cloud Providers โ€“ AWS/DigitalOcean/Azure etc โ€ข How it works? โ€ข Start VM โ€ข Configure OS โ€ข Install software โ€ข Create machine image from VM 12
  • 13.
    Vagrant โ€ข https://www.vagrantup.com/ โ€ข Atool to build and manage virtual machine (VM) environment without having to learn specific VM providerโ€™s commands โ€ข Usually used to spin up VirtualBox/VMware development environment locally 13
  • 14.
    Terraform โ€ข https://www.terraform.io/ โ€ข Atool to create and manage cloud infrastructure across multiple cloud providers 14
  • 15.
    Packer + VagrantWorkflow packer build template.json vagrant up Reference: https://stefanscherer.github.io/adding-hyper-v-support-to-2016-tp5-docker-vm/ Vagrant Box 15
  • 16.
    Pre-built Image +Vagrant Workflow vagrant up Download pre- built box from VagrantCloud 16
  • 17.
    Packer + TerraformWorkflow terraform init terraform plan terraform apply Image packer build template.jso n Infrastructure main.tf 17
  • 18.
    Why do Icare? โ€ข โ€œSingleโ€ source of truth โ€ข Describe the state of the machine/image explicitly โ€ข Scalable & Repeatable 18
  • 19.
    Resource to learnmore โ€ข Infrastructure As Code Tutorial - https://github.com/Artemmkin/infrastructure-as-code-tutorial โ€ข World class DevSecOps Training and Certifications- https://www.practical-devsecops.com/ 19
  • 20.
    DetectionLab โ€ข https://github.com/clong/DetectionLab โ€ข Createdby Chris Long (@Centurion) โ€ข Vagrant, Packer and Terraform scripts to build an Active Directory lab with detection capabilities 20
  • 21.
  • 22.
  • 23.
  • 24.
  • 25.
    Resource to learnmore โ€ข Windows Event Forwarding for Network Defense - https://medium.com/palantir/windows-event-forwarding-for-network-defense- cb208d5ff86f? โ€ข Endpoint detection superpowers on the cheap, Threat Hunting app - https://medium.com/@olafhartong/endpoint-detection-superpowers-on-the- cheap-threat-hunting-app-a92213f5e4b8 โ€ข osquery Across the Enterprise - https://medium.com/palantir/osquery-across- the-enterprise-3c3c9d13ec55? โ€ข sysmon-config | A Sysmon configuration file for everybody to fork - https://github.com/SwiftOnSecurity/sysmon-config 25
  • 26.
  • 27.
    Atomic Red Team โ€ขhttps://github.com/redcanaryco/atomic-red-team โ€ข Library of simple tests mapped to MITRE ATT&CK Framework 27
  • 28.
    Atomic Red Team Source:https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1033/T1033.md 28
  • 29.
    Atomic Red TeamExecution Framework โ€ข https://github.com/redcanaryco/atomic-red- team/tree/master/execution-frameworks โ€ข Automate the execution of Atomic Tests โ€ข Three versions โ€ข Invoke-AtomicRedTeam (Powershell) โ€ข Python โ€ข Ruby 29
  • 30.
  • 31.
  • 32.
    MITRE ATT&CK Navigator โ€ขhttps://mitre-attack.github.io/attack-navigator/enterprise/ 32
  • 33.
  • 34.
    Resource to learnmore โ€ข Putting MITRE ATT&CK into Action with What You Have, Where You Are https://www.slideshare.net/KatieNickels/putting-mitre-attck-into-action-with-what-you- have-where-you-are โ€ข How to Be a Savvy ATT&CK Consumer https://medium.com/mitre-attack/how-to-be-a-savvy-attack-consumer-63e45b8e94c9 โ€ข GETTING STARTED WITH ATT&CK https://www.mitre.org/sites/default/files/publications/mitre-getting-started-with-attack- october-2019.pdf โ€ข Comparing Layers in ATT&CK Navigator https://attack.mitre.org/docs/Comparing_Layers_in_Navigator.pdf 34
  • 35.
  • 36.
    MITRE Cyber AnalyticsRepository (CAR) โ€ข https://car.mitre.org/ โ€ข Knowledge base of analytics developed by MITRE 36
  • 37.
    MITRE Cyber AnalyticsRepository (CAR) โ€ข Hypothesis โ€ข Information Domain โ€ข Analytics Pseudocode โ€ข Analytics Unit Test Example: โ€ข https://car.mitre.org/analytics/CAR-2013-04-002/ โ€ข https://car.mitre.org/analytics/CAR-2013-02-003/ 37
  • 38.
    MITRE Cyber AnalyticsRepository (CAR) 38 Source: https://car.mitre.org/analytics/CAR-2013-04-002/
  • 39.
    MITRE Cyber AnalyticsRepository (CAR) 39 Source: https://car.mitre.org/analytics/CAR-2013-02-003/
  • 40.
    MITRE Cyber AnalyticsRepository (CAR) 40 Source: https://car.mitre.org/analytics/CAR-2013-02-003/
  • 41.
    SIGMA โ€ข https://github.com/Neo23x0/sigma โ€ข Genericand open signature format to describe log events โ€ข Standardised format to write and share detection rules 41
  • 42.
  • 43.
  • 44.
    Tips for writingdetection rules โ€ข Donโ€™t aim to write a perfect rule to cover all scenarios and evasions โ€ข Having rules implemented for different techniques is better than having one perfect rule for one technique โ€ข Make the rule as short and liberal as possible (Depending on your environment) โ€ข Run the rule against data from 7 / 30 / 60 days ago to determine if adjustment needs to be made 44
  • 45.
    Resource to learnmore โ€ข Sharing is Caring: Improving Detection with Sigma https://www.sans.org/cyber-security-summit/archives/file/summit- archive-1544043890.pdf โ€ข How to Write Sigma Rules https://www.nextron-systems.com/2018/02/10/write-sigma-rules/ 45
  • 46.
    Common Pitfalls โ€ข 100%MITRE ATT&CK Coverage โ€ข Thinking all Techniques are equal โ€ข Thinking you are done! โ€ข Forgetting the Fundamentals 46
  • 47.
    Problem: 100% MITREATT&CK Coverage 47 Source: https://medium.com/mitre-attack/how-to-be-a-savvy-attack-consumer-63e45b8e94c9
  • 48.
    Solution: Seek ComplementarySources โ€ข Ask about what parts of ATT&CK they cover and donโ€™t cover โ€ข Ask why they cover certain techniques and procedures and not others โ€ข Seek other complementary products/sources/services that fill the gaps 48
  • 49.
    Problem: Thinking allTechniques are equal โ€ข Not all techniques have equal โ€ข Impact โ€ข Usage โ€ข Detection Difficulty โ€ข Data Source availability โ€ข Specific/Broad โ€ข Legitimate use in the organisation 49
  • 50.
    Solution: Prioritise โ€ข Prioritisedetection based on a combination of factors โ€ข Data sources availability โ€ข Value for techniques data sources โ€ข Relevant Threat Groupsโ€™ TTP โ€ข Top 20 Techniques based on Vendor Xโ€™s data or relevant Threat Groups โ€ข Caveat: *Subject to your environment, maturity and resource available* 50
  • 51.
  • 52.
  • 53.
    Solution: Prioritise (MyPersonal Preference) 53 Source: https://upload.wikimedia.org/wikipedia/commons/c/c2/The_Unified_Kill_Chain.png
  • 54.
    Solution: Prioritise (MyPersonal Preference) โ€ข If there is no constraint, I would place more weight on popular techniques for the following tactics: โ€ข Execution โ€“ Early stage in the kill chain and data source provides visibility through out the kill chain because execution is usually not standalone โ€ข Discovery โ€“ Early stage in the kill chain and high fidelity because commands unlikely to be executed by normal users in bulk in a short period of time (whoami/tasklist/arp/net users etc) โ€ข Persistence โ€“ Early stage in the kill chain and attackers usually do it for the ease of returning to the network โ€ข Credential Access โ€“ High Impact and limited techniques โ€ข Lateral Movement โ€“ High Impact and limited techniques (Require thorough understanding of where Administrators log in to) 54
  • 55.
    Problem: Thinking youare done! โ€ข Endless variants for each techniques โ€“ itโ€™s impossible to have a perfect detection rule for the unknown โ€ข MITRE ATT&CK Matrix only includes techniques from real world observation โ€“ does not include the latest security research or attacks that are not reported yet 55
  • 56.
    Solution: Thinking youare done! โ€ข Shift from a Binary Detection metric to a Detection Confidence Level metric for each technique after initial assessment 56 Source: https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1561390150.pdf
  • 57.
    Solution: Thinking youare done! โ€ข Another example of Confidence Level 57 Source: https://medium.com/@visiblerisk/detection-confidence-a-framework-for-success-d6cf1aa1638
  • 58.
    Solution: Thinking youare done! โ€ข Develop your own matrix โ€ข Look out for emerging techniques from latest security research or threat intelligence report โ€ข Map the techniques to either ATT&CK or your own matrix โ€ข Continuous Assurance & Improvement! 58
  • 59.
    Forgetting the Fundamentals 59 โ€ขImproving your detection capability is greatโ€ฆ but donโ€™t forget โ€ข Primary security functions should still be reducing attack surface/risks: โ€ข Segmenting Network โ€ข Limiting Host to Host communication โ€ข Maintaining asset inventories โ€ข Installing patches โ€ข Managing user privileges
  • 60.
    Resource to learnmore โ€ข ATT&CKโ„ข Is Only as Good as Its Implementation: Avoiding Five Common Pitfalls https://redcanary.com/blog/avoiding-common-attack-pitfalls/ โ€ข Prioritizing the Remediation of Mitre ATT&CK Framework Gaps https://blog.netspi.com/prioritizing-the-remediation-of-mitre-attck-framework-gaps/ โ€ข ATT&CKโ„ข Your CTI with Lessons Learned from Four Years in the Trenches - https://www.sans.org/cyber-security-summit/archives/file/summit-archive- 1548090281.pdf โ€ข Lessons Learned Applying ATT&CKBased SOC Assessments - https://www.sans.org/cyber-security-summit/archives/file/summit-archive- 1561390150.pdf 60
  • 61.
  • 62.
    SOC Challenges โ€ข AlertFatigue โ€ข Budget 62
  • 63.
    Problem: Alert Fatigue โ€ขHigh volume of alerts โ€ข Excessive number of false positive alerts 63
  • 64.
    Solution: Alert Fatigue โ€ขMeasure the number of true positive and false positive alerts โ€ข Determine the reason for each false positive alerts โ€ข Categorise the reason for false positive alerts and follow up accordingly 64
  • 65.
    Solution: Alert Fatigue 65Source:https://github.com/d3sre/Use_Case_Applicability/blob/master/Hack.lu-FingerpointingPresentation.pdf
  • 66.
    Problem: Budget โ€ข Budgetfor procuring tools โ€ข Budget for hiring โ€ข Budget for training 66
  • 67.
    Solution: Budget โ€ข DemonstrateReturn on Investment (ROI) via โ€ข Existing SOC heatmap coverage and confidence level โ€ข Effort to measure and improve efficiency of the SOC (KPI and metrics) โ€ข Justify additional resource are required โ€ข New tools/data source required to increase SOC heatmap coverage โ€ข Manpower/expertise required to handle alert volume after optimisation 67
  • 68.
    KPI and Metrics 68 KPIExplanation Target Value Number of Log Management Rule Configuration Error events per month This value reflects the rules configured in the SIEM by the SOC Analysts. A high number suspects bad quality of rules, more training or experience needed. < 10 % Number of Announced Administrative/User Action events per month This value reflects suppressions that should be improved. < 10 % Number of Bad IOC/rule pattern value events per month If too many events were created by bad IOCs or rule pattern values, the source or the trust in it should be questioned. < 5 % Number of Confirmed Attack attempt without IR actions (best matched with Log Source Category) Number of events detected but prevented by measures in place or where the alert isnโ€™t viewed as a high risk. > 50 % Number of Confirmed Attack attempt with IR actions (best matched with Log Source Category) Very high numbers โ†’ Security Architecture should be updated Very low numbers โ†’ The rules arenโ€˜t detecting or you are safe :) Source: https://github.com/d3sre/Use_Case_Applicability/wiki/KPIs-and-Metrics
  • 69.
    Resource to learnmore โ€ข Use Case Applicability: How to better integrate Continuous Improvement into Security Monitoring https://github.com/d3sre/Use_Case_Applicability โ€ข Alerting and Detection Strategy Framework https://medium.com/palantir/alerting-and-detection-strategy- framework-52dc33722df2 69

Editor's Notes

  • #5ย To update
  • #10ย https://medium.com/mitre-attack/how-to-be-a-savvy-attack-consumer-63e45b8e94c9 https://www.mitre.org/sites/default/files/publications/mitre-getting-started-with-attack-october-2019.pdf https://medium.com/mitre-attack/using-att-ck-to-advance-cyber-threat-intelligence-part-2-6f21fdba80c
  • #11ย https://medium.com/mitre-attack/how-to-be-a-savvy-attack-consumer-63e45b8e94c9 https://www.mitre.org/sites/default/files/publications/mitre-getting-started-with-attack-october-2019.pdf https://medium.com/mitre-attack/using-att-ck-to-advance-cyber-threat-intelligence-part-2-6f21fdba80c
  • #16ย REf
  • #17ย REf
  • #19ย No optics on the state of the machines/images when configured manually
  • #24ย  splunk stop splunk clean eventdata -index yourindex splunk start
  • #36ย https://car.mitre.org/analytics/CAR-2013-04-002/ Sigma Rules
  • #37ย https://car.mitre.org/analytics/CAR-2013-04-002/
  • #48ย Some techniques do not need alerts as well