MA
Uploaded byMITRE ATT&CK
PDF, PPTX194 views

Every Cloud Has a Purple Lining - Arun Seelagan

The document discusses the importance of purple teaming in cyber security, particularly for detecting cloud breaches and improving defensive strategies. It outlines processes involving threat intelligence, adversary emulation, and incident response to enhance detection capabilities and reduce risks. Additionally, it provides case studies and technical details on cloud exploitation techniques and offers guidelines for securing cloud infrastructures.

Embed presentation

Download as PDF, PPTX
Arun Seelagan 23 October 2024 C I S A | C Y B E R S E C U R I T Y A N D I N F R A S T R U C T U R E S E C U R I T Y A G E N C Y EVERY CLOUD HAS A PURPLE LINING 1 23 October 2024 This Photo by Unknown Author is licensed under CC BY
Arun Seelagan 23 October 2024 CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services featured in this presentation. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply an endorsement by CISA. Disclaimer 2
Arun Seelagan 23 October 2024 Talking Points 3 The Why • Purple Teaming The Need • Detecting Cloud Breaches The Process • ATT&CK & D3FEND The Outcome • Reducing Risk
C Y B E R S E C U R I T Y & I N F R A S T R U C T U R E S E C U R I T Y A G E N C Y Cyber Security Division November 13, 2024 About CISA 4 Vision Secure and Resilient Critical Infrastructure for the American people What We Do • Engage Stakeholders in Industry and Government • Deliver resources to understand, manage, and reduce risk
C Y B E R S E C U R I T Y & I N F R A S T R U C T U R E S E C U R I T Y A G E N C Y Cyber Security Division November 13, 2024 Why Purple Team 5 This Photo by Unknown Author is licensed under CC BY-SA
Arun Seelagan 23 October 2024 Why Purple Team 6 Know the Enemy • Emulate Adversary Tools, Tactics, Procedures • Gain observables Know Yourself • Develop and test detections, mitigations, and prevention strategies • Identify tradecraft gaps, limitations
Arun Seelagan 23 October 2024 Why Purple Team 7 § Effective Adversary Insight Most Adversaries lack originality. § N-day CVEs* § Exploit POCs § “Security audit” tools This Photo by Unknown Author is licensed under CC BY
Arun Seelagan 23 October 2024 Why Purple Team 8 § Avoid Defender Complacency Defensive measures may fall short. § Missing essential forensic artifacts § Over-tuned analytic models, SIEMs § Variance in EDR / MSSP performance This Photo by Unknown Author is licensed under CC BY-SA
Cyber Security Division November 13, 2024 Why Purple Team 9
Arun Seelagan 23 October 2024 How We Purple Team 10 https://d3fend.mitre.org
Cyber Security Division November 13, 2024 The Need: Detect Cloud Breaches 11 § Rapid adoption, evolution of cloud services § Inadequate, complex security mechanisms § Advantage: Adversaries This Photo by Unknown Author is licensed under CC BY-SA-NC
Arun Seelagan 23 October 2024 The Need: Detect Cloud Breaches 12 https[:]//www.reuters.com/technology/chinese-hackers-breached-us-commerce- chiefs-emails-blinken-warns-chinese-2023-07-13/ 2023 Case Study § Storm-0558 § Techniques § Unsecure Credentials: Private Key (T1552.004) § Forge Web Credentials (T1606) § Cloud Accounts (T1078.004) § Application Access Token (T1550.001) § PowerShell (T1059.001) § Remote Email Collection (T1114.002) § Multi-hop Proxy (T1090.003) How to Detect?
Cyber Security Division November 13, 2024 The Need: Detect Cloud Breaches 13 2024 Case Study § NOBELIUM § Techniques § Password Spraying (T1110.003) § Cloud Accounts (T1078.004) § Application Access Token (T1550.001) § Remote Email Collection (T1114.002) § Network Devices (T1584.008) § Proxy (T1090) § Forge Web Credentials (T1606) https[:]//www.theverge.com/2024/7/4/24192159/micro soft-midnight-blizzard-hack-targets
Cyber Security Division November 13, 2024 The Purple Team Process 14 ATT&CK • Techniques • Forensic Data Sources • Detection Logic • Mitigation guidance D3FEND • Countermeasures • Hardening and Eviction Strategies
Arun Seelagan 23 October 2024 The Purple Team Process 15 ATT&CK Plans •Leverage threat intelligence, case studies, security research •Tactics & Techniques compose red team playbook Simulation Requirements •Network Infrastructure, User Roles, Apps, Services, CVEs, etc. •White noise activity Forensic Requirements •Host level, Network level, Application Level, Service Level, etc. Adversary Emulation •Red Team executes playbook •Track all activities and indicators of compromise Incident Response •Blue team hunts with existing tradecraft, processes The Purple Lining •ATT&CK Coverage Analysis •Identify D3FEND Defensive Actions taken/missed •Develop detections with "perfect" forensics and full knowledge of red team activities •Identify additional countermeasures
Cyber Security Division November 13, 2024 Cloud Breach Purple Team Case Study 16 16 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Draw from threat intelligence, case studies, security research, PoC exploits AZURE
Cyber Security Division November 13, 2024 Cloud Breach Purple Team Case Study 17 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Enumerate core ATT&CK tactics and techniques § Supplement and sequence techniques logically This Photo by Unknown Author is licensed under CC BY-NC-ND
Cyber Security Division November 13, 2024 Cloud Breach Purple Team Case Study 18 18 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Techniques inform Cyber Range / Simulation design § Network Infrastructure § User Roles & Privileges § Applications & Services § OS Configuration and Patch level § CVEs § Consider User & Network “white noise” activity § Helps discern the malicious from the benign § Identify Hardening Opportunities during build-out § Pose D3FEND opportunities later on!
Cyber Security Division November 13, 2024 Cloud Breach Purple Team Case Study 19 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Hybrid Cloud Victim Network
Cyber Security Division November 13, 2024 Cloud Breach Purple Team Case Study 20 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Enable optimal forensic visibility AuditLog InteractiveSignIns NonInteractiveSignIns AuthDetails AzureSubscriptionActivity Network Zeek Host App logs Sysmon Security.evtx Disk images Mem dumps Cloud
Cyber Security Division November 13, 2024 Cloud Breach Purple Team Case Study 21 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Red Team executes techniques § Track IOCs, C2, activities
Cyber Security Division November 13, 2024 Cloud Breach Purple Team Case Study 22 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Blue Team hunts with existing tradecraft § EDR, SIEM, Network Taps, IR SOPs § Red Team activities optionally persist § Track findings and detection methods
Cyber Security Division November 13, 2024 Cloud Breach Purple Team Case Study 23 23 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Analyze ATT&CK Coverage § Blue Team findings vs Red Team activities § Explore & Adopt D3FEND actions for missed techniques § Fill gaps in detection, capabilities, skills, & processes § Use Red team ”answer key” to illuminate defensive opportunities
Arun Seelagan 23 October 2024 Facilitating the Purple Team Process 24 Map Red Team Campaigns • Track tools, techniques, commands, and artifacts across ATT&CK tactics Log Blue Team Tradecraft • Log utilized detection sources and tools • Document Preventions, detection evidence, & D3FEND actions Analyze ATT&CK Coverage • Visualize strengths & weaknesses https://vectr.io
Arun Seelagan 23 October 2024 Outcome: Federal Cloud Threat Detection 25 § Identified key forensic artifacts to detect Azure/M365 exploitation § Promote collection of appropriate cloud logs to enable threat hunting § Implemented detection logic in ATT&CK-annotated detection rules Image Source: https[:]//www.cisa.gov/sites/default/files/2023-02/NCPS%20Cloud%20Interface%20RA%20Volume%20One%202021-05-14.pdf
Arun Seelagan 23 October 2024 Outcome: ATT&CK Contributions 26 § Software – Additional Techniques Used § dsregcmd § Mimikatz (S0002) § ROADTools (S0684) § Data Source – Enhanced Detection Guidance for Cloud Techniques § Active Directory (DS0026) § Cloud Service (DS0025) § Firewall (DS0018) § Instance (DS0030) § Logon Session (DS0028) § User Account (DS0002) Persistence • Additional Cloud Credentials (T1098.001) • Additional Cloud Roles (T1098.003) • Device Registration (T1098.005) • Create Cloud Account (T1136.003) • Modify MFA (T1556.006) Defense Evasion • Disable or Modify Cloud Logs (T1562.008) • Modify Cloud Firewall (T1562.007) • Create Cloud Instance (T1578.002) • Delete Cloud Instance (T1578.003) • Valid Cloud Accounts (T1078.004) Credential Access • Steal Application Access Token (T1528) • MFA Request Generation (T1621) Discovery • Cloud Service Discovery (T1526) Lateral Movement • Internal Spearphishing (T1534) Collection • Remote Email Collection (T1114.002) • Email Forwarding Rule (T1114.003) • Sharepoint (T1213.002) • Data from Cloud Storage (T1530) • Automated Collection (T1119) Impact • Account Access Removal (T1531)
Arun Seelagan 23 October 2024 Outcome: Secure Configuration Baselines 27 § Security Configuration Guidance for M365, Google, Identity Services § Configuration Audit Tools on GitHub!
Arun Seelagan 23 October 2024 Outcome: Making Cloud Secure by Design 28 § MFA by Default § Essential Logs by Default
Arun Seelagan 23 October 2024 Resources 29 § https://attack.mitre.org § https://d3fend.mitre.org § https://mitre-attack.github.io/attack-navigator/ § https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/ § https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/ § https://msrc.microsoft.com/blog/2024/03/update-on-microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/ § https://aadinternals.com/aadkillchain/ § https://github.com/BloodHoundAD/AzureHound § https://github.com/dirkjanm/ROADtools § https://github.com/AlteredSecurity/365-Stealer § https://www.cisa.gov/news-events/directives/ed-24-02-mitigating-significant-risk-nation-state-compromise-microsoft-corporate-email-system § https://www.cisa.gov/known-exploited-vulnerabilities-catalog § https://www.cisa.gov/resources-tools/groups/cyber-safety-review-board-csrb § https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project § https://www.cisa.gov/securebydesign § https://www.sandia.gov/minimega § https://github.com/cisagov/untitledgoosetool § https://vectr.io/
Arun Seelagan 23 October 2024 30 For more information: www.cisa.gov Questions?
Arun Seelagan 23 October 2024 31

More Related Content

PPTX
Building Cyber Resilience: No Safe Harbor
byAdvanced Technology Consulting (ATC)
 
PPTX
Detection Rules Coverage
bySunny Neo
 
PPTX
FUEL_USERS_GROUP
byWill Pearce
 
PDF
Secure 2019 - APT for Everyone - Adversary Simulations based on ATT&CK Framework
byLeszek Mi?
 
PPTX
Leverage Endpooint Visibilit with MITRE ATT&CK Framework
byDigit Oktavianto
 
PDF
Purple Team - Offensive and Defensive collaborative simulation
byAdam Nurudini
 
PDF
Mitre ATT&CK by Mattias Almeflo Nixu
byNixu Corporation
 
PPTX
Purple Teaming - The Collaborative Future of Penetration Testing
byFRSecure
 
Building Cyber Resilience: No Safe Harbor
byAdvanced Technology Consulting (ATC)
 
Detection Rules Coverage
bySunny Neo
 
FUEL_USERS_GROUP
byWill Pearce
 
Secure 2019 - APT for Everyone - Adversary Simulations based on ATT&CK Framework
byLeszek Mi?
 
Leverage Endpooint Visibilit with MITRE ATT&CK Framework
byDigit Oktavianto
 
Purple Team - Offensive and Defensive collaborative simulation
byAdam Nurudini
 
Mitre ATT&CK by Mattias Almeflo Nixu
byNixu Corporation
 
Purple Teaming - The Collaborative Future of Penetration Testing
byFRSecure
 

Similar to Every Cloud Has a Purple Lining - Arun Seelagan

PPTX
Cyber Security Case Studies
byMoksha Kalyan Ram Abhiramula
 
PPTX
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
PDF
SCYTHE Purple Team Workshop with Tim Schulz
byJorge Orchilles
 
PPTX
Cyber War, Cyber Peace, Stones, and Glass Houses
byCigital
 
PDF
RED-TEAM_Conclave
byNSConclave
 
PDF
Cyber Security and Cloud Computing
byKeet Sugathadasa
 
PDF
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
byMarcin Ludwiszewski
 
PPTX
CyberOps.pptx
byAhmedRobaid1
 
PPTX
Keynote at the Cyber Security Summit Prague 2015
byClaus Cramon Houmann
 
PDF
Information Security Risk Management
byipspat
 
PPTX
Purple Teaming with ATT&CK - x33fcon 2018
byChristopher Korban
 
DOCX
CLOUD COMPUTING -Risks, Countermeasures, Costs and Benefits-
byLillian Ekwosi-Egbulem
 
PPTX
Presentation infra and_datacentrre_dialogue_v2
byClaus Cramon Houmann
 
PDF
Cyber Security
byNC Military Business Center
 
PDF
Computer security companies, It security
byscalecloud52
 
DOCX
Global Cybersecurity Environment ReportAbstractCMP 620
byMatthewTennant613
 
PDF
Adversary Emulation - Red Team Village - Mayhem 2020
byJorge Orchilles
 
PDF
cybersecurity_alert_feb_12_2015
byPaul Ferrillo
 
PDF
Cloudcamp Chicago Nov 2104 Fintech - Dwight Koop "East / West Chalkboard Talk"
byCloudCamp Chicago
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
Cyber Security Case Studies
byMoksha Kalyan Ram Abhiramula
 
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
SCYTHE Purple Team Workshop with Tim Schulz
byJorge Orchilles
 
Cyber War, Cyber Peace, Stones, and Glass Houses
byCigital
 
RED-TEAM_Conclave
byNSConclave
 
Cyber Security and Cloud Computing
byKeet Sugathadasa
 
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
byMarcin Ludwiszewski
 
CyberOps.pptx
byAhmedRobaid1
 
Keynote at the Cyber Security Summit Prague 2015
byClaus Cramon Houmann
 
Information Security Risk Management
byipspat
 
Purple Teaming with ATT&CK - x33fcon 2018
byChristopher Korban
 
CLOUD COMPUTING -Risks, Countermeasures, Costs and Benefits-
byLillian Ekwosi-Egbulem
 
Presentation infra and_datacentrre_dialogue_v2
byClaus Cramon Houmann
 
Cyber Security
byNC Military Business Center
 
Computer security companies, It security
byscalecloud52
 
Global Cybersecurity Environment ReportAbstractCMP 620
byMatthewTennant613
 
Adversary Emulation - Red Team Village - Mayhem 2020
byJorge Orchilles
 
cybersecurity_alert_feb_12_2015
byPaul Ferrillo
 
Cloudcamp Chicago Nov 2104 Fintech - Dwight Koop "East / West Chalkboard Talk"
byCloudCamp Chicago
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 

More from MITRE ATT&CK

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
PDF
ATT&CK From Basic Principles - Tareq AlKhatib
byMITRE ATT&CK
 
PDF
Lifecycle-Aware Power Side-Channel Malware Detection - Alexander Cathis
byMITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
ATT&CK From Basic Principles - Tareq AlKhatib
byMITRE ATT&CK
 
Lifecycle-Aware Power Side-Channel Malware Detection - Alexander Cathis
byMITRE ATT&CK
 

Recently uploaded

PPTX
TechSprint Inauguration at SJB Institute of Technology held on 18 December 2025
bysuhasspgdg
 
PDF
Supercharge Your Copilot-Driven Collaboration with Microsoft 365 Agents SDK
byAntti Koskela
 
PDF
What Is the Azure AI Foundry and Why Does It Matter for Enterprises?
byjohncarterjn
 
PDF
ICT500 - CRITICAL AND CREATIVE THINKING FOR INFORMATION TECHNOLOGY SOLUTIONS:...
by2024432452
 
PPTX
Beyond the Algorithm: Designing Human-Centric Public Service with AI
byAlan Dix
 
PPTX
TechSprint WinterHack — Top 10 Teams Pitching Session we are excited for pit...
bybajpaitusharoffon678
 
PDF
AI and Zero Trust: What it takes to do it right
byMark Simos
 
PDF
Poročilo odbora CIS (CH08873) za leto 2025 na letni skupščini IEEE Slovenija ...
byUniversity of Maribor
 
PDF
How to build hackthon projects from ZERO!
byishantyadav1111
 
PDF
Post-Hackathon-Learnings-Maximizing-Impact-Beyond-the-Event.pdf
byishantyadav1111
 
PDF
Track Phone Location via Number (2026)_ What Actually Works, What’s a Scam, a...
byEmily Woods
 
PDF
Configure and Manage Systemd Timers- RHCSA (RH134).pdf
byLinuxCert Guru
 
PDF
Computer-Based Training (CBT) The Backbone of Modern Technical & Defence Trai...
bycomputerbasedtrainin1
 
PDF
Designing a Blog Using Wordpress
bymarkzubi50
 
PDF
Advanced SELinux Management - RHCSA (RH134).pdf
byLinuxCert Guru
 
PDF
The Emergence of Empathic XR: AWE Asia 2026 keynote
byMark Billinghurst
 
PPTX
Working Session — Build a Document Understanding Automation Using an OOTB ML ...
byDianaGray10
 
PDF
Parental Control App for Phones_ The Complete 2026 Guide for Safer, Smarter P...
byRyan Cooper
 
PDF
Mount File Systems using UUID and Label - RHCSA (RH134).pdf
byLinuxCert Guru
 
PDF
Chapter 4 Network Security in computer security
byGetnet Tigabie Askale -(GM)
 
TechSprint Inauguration at SJB Institute of Technology held on 18 December 2025
bysuhasspgdg
 
Supercharge Your Copilot-Driven Collaboration with Microsoft 365 Agents SDK
byAntti Koskela
 
What Is the Azure AI Foundry and Why Does It Matter for Enterprises?
byjohncarterjn
 
ICT500 - CRITICAL AND CREATIVE THINKING FOR INFORMATION TECHNOLOGY SOLUTIONS:...
by2024432452
 
Beyond the Algorithm: Designing Human-Centric Public Service with AI
byAlan Dix
 
TechSprint WinterHack — Top 10 Teams Pitching Session we are excited for pit...
bybajpaitusharoffon678
 
AI and Zero Trust: What it takes to do it right
byMark Simos
 
Poročilo odbora CIS (CH08873) za leto 2025 na letni skupščini IEEE Slovenija ...
byUniversity of Maribor
 
How to build hackthon projects from ZERO!
byishantyadav1111
 
Post-Hackathon-Learnings-Maximizing-Impact-Beyond-the-Event.pdf
byishantyadav1111
 
Track Phone Location via Number (2026)_ What Actually Works, What’s a Scam, a...
byEmily Woods
 
Configure and Manage Systemd Timers- RHCSA (RH134).pdf
byLinuxCert Guru
 
Computer-Based Training (CBT) The Backbone of Modern Technical & Defence Trai...
bycomputerbasedtrainin1
 
Designing a Blog Using Wordpress
bymarkzubi50
 
Advanced SELinux Management - RHCSA (RH134).pdf
byLinuxCert Guru
 
The Emergence of Empathic XR: AWE Asia 2026 keynote
byMark Billinghurst
 
Working Session — Build a Document Understanding Automation Using an OOTB ML ...
byDianaGray10
 
Parental Control App for Phones_ The Complete 2026 Guide for Safer, Smarter P...
byRyan Cooper
 
Mount File Systems using UUID and Label - RHCSA (RH134).pdf
byLinuxCert Guru
 
Chapter 4 Network Security in computer security
byGetnet Tigabie Askale -(GM)
 

Every Cloud Has a Purple Lining - Arun Seelagan

  • 1.
    Arun Seelagan 23 October2024 C I S A | C Y B E R S E C U R I T Y A N D I N F R A S T R U C T U R E S E C U R I T Y A G E N C Y EVERY CLOUD HAS A PURPLE LINING 1 23 October 2024 This Photo by Unknown Author is licensed under CC BY
  • 2.
    Arun Seelagan 23 October2024 CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services featured in this presentation. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply an endorsement by CISA. Disclaimer 2
  • 3.
    Arun Seelagan 23 October2024 Talking Points 3 The Why • Purple Teaming The Need • Detecting Cloud Breaches The Process • ATT&CK & D3FEND The Outcome • Reducing Risk
  • 4.
    C Y BE R S E C U R I T Y & I N F R A S T R U C T U R E S E C U R I T Y A G E N C Y Cyber Security Division November 13, 2024 About CISA 4 Vision Secure and Resilient Critical Infrastructure for the American people What We Do • Engage Stakeholders in Industry and Government • Deliver resources to understand, manage, and reduce risk
  • 5.
    C Y BE R S E C U R I T Y & I N F R A S T R U C T U R E S E C U R I T Y A G E N C Y Cyber Security Division November 13, 2024 Why Purple Team 5 This Photo by Unknown Author is licensed under CC BY-SA
  • 6.
    Arun Seelagan 23 October2024 Why Purple Team 6 Know the Enemy • Emulate Adversary Tools, Tactics, Procedures • Gain observables Know Yourself • Develop and test detections, mitigations, and prevention strategies • Identify tradecraft gaps, limitations
  • 7.
    Arun Seelagan 23 October2024 Why Purple Team 7 § Effective Adversary Insight Most Adversaries lack originality. § N-day CVEs* § Exploit POCs § “Security audit” tools This Photo by Unknown Author is licensed under CC BY
  • 8.
    Arun Seelagan 23 October2024 Why Purple Team 8 § Avoid Defender Complacency Defensive measures may fall short. § Missing essential forensic artifacts § Over-tuned analytic models, SIEMs § Variance in EDR / MSSP performance This Photo by Unknown Author is licensed under CC BY-SA
  • 9.
    Cyber Security Division November13, 2024 Why Purple Team 9
  • 10.
    Arun Seelagan 23 October2024 How We Purple Team 10 https://d3fend.mitre.org
  • 11.
    Cyber Security Division November13, 2024 The Need: Detect Cloud Breaches 11 § Rapid adoption, evolution of cloud services § Inadequate, complex security mechanisms § Advantage: Adversaries This Photo by Unknown Author is licensed under CC BY-SA-NC
  • 12.
    Arun Seelagan 23 October2024 The Need: Detect Cloud Breaches 12 https[:]//www.reuters.com/technology/chinese-hackers-breached-us-commerce- chiefs-emails-blinken-warns-chinese-2023-07-13/ 2023 Case Study § Storm-0558 § Techniques § Unsecure Credentials: Private Key (T1552.004) § Forge Web Credentials (T1606) § Cloud Accounts (T1078.004) § Application Access Token (T1550.001) § PowerShell (T1059.001) § Remote Email Collection (T1114.002) § Multi-hop Proxy (T1090.003) How to Detect?
  • 13.
    Cyber Security Division November13, 2024 The Need: Detect Cloud Breaches 13 2024 Case Study § NOBELIUM § Techniques § Password Spraying (T1110.003) § Cloud Accounts (T1078.004) § Application Access Token (T1550.001) § Remote Email Collection (T1114.002) § Network Devices (T1584.008) § Proxy (T1090) § Forge Web Credentials (T1606) https[:]//www.theverge.com/2024/7/4/24192159/micro soft-midnight-blizzard-hack-targets
  • 14.
    Cyber Security Division November13, 2024 The Purple Team Process 14 ATT&CK • Techniques • Forensic Data Sources • Detection Logic • Mitigation guidance D3FEND • Countermeasures • Hardening and Eviction Strategies
  • 15.
    Arun Seelagan 23 October2024 The Purple Team Process 15 ATT&CK Plans •Leverage threat intelligence, case studies, security research •Tactics & Techniques compose red team playbook Simulation Requirements •Network Infrastructure, User Roles, Apps, Services, CVEs, etc. •White noise activity Forensic Requirements •Host level, Network level, Application Level, Service Level, etc. Adversary Emulation •Red Team executes playbook •Track all activities and indicators of compromise Incident Response •Blue team hunts with existing tradecraft, processes The Purple Lining •ATT&CK Coverage Analysis •Identify D3FEND Defensive Actions taken/missed •Develop detections with "perfect" forensics and full knowledge of red team activities •Identify additional countermeasures
  • 16.
    Cyber Security Division November13, 2024 Cloud Breach Purple Team Case Study 16 16 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Draw from threat intelligence, case studies, security research, PoC exploits AZURE
  • 17.
    Cyber Security Division November13, 2024 Cloud Breach Purple Team Case Study 17 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Enumerate core ATT&CK tactics and techniques § Supplement and sequence techniques logically This Photo by Unknown Author is licensed under CC BY-NC-ND
  • 18.
    Cyber Security Division November13, 2024 Cloud Breach Purple Team Case Study 18 18 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Techniques inform Cyber Range / Simulation design § Network Infrastructure § User Roles & Privileges § Applications & Services § OS Configuration and Patch level § CVEs § Consider User & Network “white noise” activity § Helps discern the malicious from the benign § Identify Hardening Opportunities during build-out § Pose D3FEND opportunities later on!
  • 19.
    Cyber Security Division November13, 2024 Cloud Breach Purple Team Case Study 19 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Hybrid Cloud Victim Network
  • 20.
    Cyber Security Division November13, 2024 Cloud Breach Purple Team Case Study 20 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Enable optimal forensic visibility AuditLog InteractiveSignIns NonInteractiveSignIns AuthDetails AzureSubscriptionActivity Network Zeek Host App logs Sysmon Security.evtx Disk images Mem dumps Cloud
  • 21.
    Cyber Security Division November13, 2024 Cloud Breach Purple Team Case Study 21 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Red Team executes techniques § Track IOCs, C2, activities
  • 22.
    Cyber Security Division November13, 2024 Cloud Breach Purple Team Case Study 22 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Blue Team hunts with existing tradecraft § EDR, SIEM, Network Taps, IR SOPs § Red Team activities optionally persist § Track findings and detection methods
  • 23.
    Cyber Security Division November13, 2024 Cloud Breach Purple Team Case Study 23 23 ATT&CK Plans Simulation Requirements Forensic Requirements Adversary Emulation Incident Response The Purple Lining § Analyze ATT&CK Coverage § Blue Team findings vs Red Team activities § Explore & Adopt D3FEND actions for missed techniques § Fill gaps in detection, capabilities, skills, & processes § Use Red team ”answer key” to illuminate defensive opportunities
  • 24.
    Arun Seelagan 23 October2024 Facilitating the Purple Team Process 24 Map Red Team Campaigns • Track tools, techniques, commands, and artifacts across ATT&CK tactics Log Blue Team Tradecraft • Log utilized detection sources and tools • Document Preventions, detection evidence, & D3FEND actions Analyze ATT&CK Coverage • Visualize strengths & weaknesses https://vectr.io
  • 25.
    Arun Seelagan 23 October2024 Outcome: Federal Cloud Threat Detection 25 § Identified key forensic artifacts to detect Azure/M365 exploitation § Promote collection of appropriate cloud logs to enable threat hunting § Implemented detection logic in ATT&CK-annotated detection rules Image Source: https[:]//www.cisa.gov/sites/default/files/2023-02/NCPS%20Cloud%20Interface%20RA%20Volume%20One%202021-05-14.pdf
  • 26.
    Arun Seelagan 23 October2024 Outcome: ATT&CK Contributions 26 § Software – Additional Techniques Used § dsregcmd § Mimikatz (S0002) § ROADTools (S0684) § Data Source – Enhanced Detection Guidance for Cloud Techniques § Active Directory (DS0026) § Cloud Service (DS0025) § Firewall (DS0018) § Instance (DS0030) § Logon Session (DS0028) § User Account (DS0002) Persistence • Additional Cloud Credentials (T1098.001) • Additional Cloud Roles (T1098.003) • Device Registration (T1098.005) • Create Cloud Account (T1136.003) • Modify MFA (T1556.006) Defense Evasion • Disable or Modify Cloud Logs (T1562.008) • Modify Cloud Firewall (T1562.007) • Create Cloud Instance (T1578.002) • Delete Cloud Instance (T1578.003) • Valid Cloud Accounts (T1078.004) Credential Access • Steal Application Access Token (T1528) • MFA Request Generation (T1621) Discovery • Cloud Service Discovery (T1526) Lateral Movement • Internal Spearphishing (T1534) Collection • Remote Email Collection (T1114.002) • Email Forwarding Rule (T1114.003) • Sharepoint (T1213.002) • Data from Cloud Storage (T1530) • Automated Collection (T1119) Impact • Account Access Removal (T1531)
  • 27.
    Arun Seelagan 23 October2024 Outcome: Secure Configuration Baselines 27 § Security Configuration Guidance for M365, Google, Identity Services § Configuration Audit Tools on GitHub!
  • 28.
    Arun Seelagan 23 October2024 Outcome: Making Cloud Secure by Design 28 § MFA by Default § Essential Logs by Default
  • 29.
    Arun Seelagan 23 October2024 Resources 29 § https://attack.mitre.org § https://d3fend.mitre.org § https://mitre-attack.github.io/attack-navigator/ § https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/ § https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/ § https://msrc.microsoft.com/blog/2024/03/update-on-microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/ § https://aadinternals.com/aadkillchain/ § https://github.com/BloodHoundAD/AzureHound § https://github.com/dirkjanm/ROADtools § https://github.com/AlteredSecurity/365-Stealer § https://www.cisa.gov/news-events/directives/ed-24-02-mitigating-significant-risk-nation-state-compromise-microsoft-corporate-email-system § https://www.cisa.gov/known-exploited-vulnerabilities-catalog § https://www.cisa.gov/resources-tools/groups/cyber-safety-review-board-csrb § https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project § https://www.cisa.gov/securebydesign § https://www.sandia.gov/minimega § https://github.com/cisagov/untitledgoosetool § https://vectr.io/
  • 30.
    Arun Seelagan 23 October2024 30 For more information: www.cisa.gov Questions?
  • 31.