A briefing that proposes ways to improve our cybersecurity defenses by sharing understanding and knowledge instead of just information.

1. How I Learned to Stop Information
Sharing and Love the DIKW*Withapologies toStanley Kubrick
SOUNIL YU

2. Alignment of Two Pyramids
What are we sharing now? What should we be sharing instead?
@sounilyu 2June 2016
Wisdom
Knowledge
Data
Information
Joining of
wholes
Formation of
a whole
Connection
of parts
Gathering
of parts
Explanation
Why
Instruction
How To
Descriptive
What
Raw sensor
information
Future
Past
Novelty
Experience
DIKW Pyramid
http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
David Bianco’s
Pyramid of Pain
(with color modifications)
TTPs
Network/Host
Artifacts
Hash Values
IP Addresses
Tools
Domain Names

3. Decoupled Security Stack
@sounilyu 3June 2016
Actions
Decisions
Analytics
Sensors
Sensing:
raw telemetry, netflow,
logs, external threat intel
Sense making:
correlation, machine
learning, heuristics
Decision making:
orchestration, courses of
action, recipes for action
Acting:
actuators, block, stop,
start, delete, quarantine
What we share
DIKW Pyramid
Wisdom
Knowledge
Data
Information
Joining of
wholes
Formation of
a whole
Connection
of parts
Gathering
of parts
Explanation
Why
Instruction
How To
Descriptive
What
Raw sensor
information
Future
Past
Novelty
Experience

4. Dangers of Sharing the Wrong Things and Automagically
Applying Them Incorrectly
@sounilyu 4June 2016
Originating
Organization
Receiving
Organization
Actions
Decisions
Analytics
Sensors
Actions
Decisions
Analytics
Sensors
Not
shared
Not
shared
Dangerous
CURRENT STATE
What we share

5. Dangers of Sharing the Wrong Things and Automagically
Applying Them Incorrectly
@sounilyu 5June 2016
Originating
Organization
Receiving
Organization
Actions
Decisions
Analytics
Sensors
Actions
Decisions
Analytics
Sensors
Optimal
Shared/Collective
Sensor Grid (e.g.,
Passive DNS)
FUTURE STATE
Originating
Organization
Receiving
Organization
Actions
Decisions
Analytics
Sensors
Actions
Decisions
Analytics
Sensors
Not
shared
Not
shared
Dangerous
CURRENT STATE
What we share

6. Analytics Sharing Example:
The ThreatHunting Project (www.threathunting.net,also byDavid Bianco)
@sounilyu 6June 2016
How we share
Procedures Indexed by Goal
0-day Exploits
• EMET Log Mining
Attacker tools in use
• Suspicious Process Creation
• Windows Service Analysis
• Psexec Windows Events
BIOS/Firmware tampering
• RAM Dumping
Command and Control (C2)
• C2 via Dynamic DNS
• Finding the Unknown with HTTP URIs
Compromise of Internet-Facing Service
• Internet-Facing HTTP Request Analysis
• Checking How Outsiders See You
• RDP External Access
• Finding Known-Bad in Antivirus Logs
• Finding Webshells
• Webshell Behavior
• . . .
Finding Web Shells
Purpose
• Identify web shells (stand-alone|injected)
Data Required
• Web server logs (apache, IIS, etc.)
Collection Considerations
• Collect from all webservers, and ensure that parameters are
collected.
• POST data should be collected.
• For apache consider using mod_security or mod_dumpio
• For IIS use Failed Request Tracing / Custom Logging
Analysis Techniques:
• Stack counting
• String matching
Description
• Stack by page hits -- pages with few hits are a typical sign
• Add more fidelity by combining views from below (none if the
above is giving higher fidelity, one, two or all):
• No referer from client
• Stack by unique visits per IP -- most only visit the webshell
(no other page hits, no js, no images, etc.)
• this isn't true of injected webshells (where they are
injected into an existing page)
• Stack by UA uniqueness. This is not always rock solid, but
good, because many webshells have client software that
sets the UA and many don't change the default
• Look for parameters passed to image files (e.g., /bad.png?zz=ls)
• More specific to inject webshells that inject into an existing page:
• Stack by parameter counts per page -- webshells that create
new params on an existing page
• Again, you can look if referer is missing, UA uniqueness
. . .
Procedures Indexed by Data
Anti-Virus Logs
• Finding Known-Bad in Antivirus Logs
Bro NSM Logs
• RDP External Access
• C2 via Dynamic DNS
• Finding the Unknown with HTTP URIs
DNS Query Logs
• C2 via Dynamic DNS
Host Dumps (RAM, Registry, Process, etc)
• NTFS Extended Attribute Analysis
• Search for Rogue Listeners
• Autoruns Analysis
• Windows Driver Analysis
• Windows Prefetch Cache Analysis
• Windows Service Analysis
HTTP Proxy Logs
• Beacon Detection
• User Agent Analysis
• . . .

7. Analytics Sharing Example:
Cyber Analytic Repository (MITRE)
@sounilyu 7June 2016
CAR-2014-07-001: Search Path Interception
Hypothesis:
As described in ATT&CK, one method of escalation
is intercepting the search path for services, so that
legitimate services point to the binary inserted at
an intercepted location. This can be done where
there are spaces in the path and it is unquoted.
Instantiation:
Eventtype=process_start parent_image_path="*system32services.exe" command_line!="
"*" command_line="* *"
| rex field=image_path ".(?<img_exe>.*)
| rex field=img_exe "(?<img_base>.*)..*"
| where NOT like(lower(command_line ), lower("%"+img_exe+"%")) AND
like(lower(command_line),lower("%"+img_base+"%"))
| table _time hostname ppid pid parent_image_path image_path command_line img_exe
ATT&CK Framework
How we share

8. A community for sharing sense-making
@sounilyu 8June 2016
Organization A
I can find intrusions
by looking for search
path interception in
XYZ way
Eventtype=process_start
parent_image_path="*system32ser
vices.exe" command_line!=""*"
command_line="**"| rex
field=image_path".(?<img_exe>.*)|
rex field=img_exe
"(?<img_base>.*)..*"
Organization A
Cyber Analytic
Repository
Existing
Sharing
Communities
5444ff573794d853d24fbce00548227b
module.832.13cc55060.9a0000.dll
hxxp://speedtest[.]netcologne[.]de/test_100mb.bin
Byproducts
and Indicators
Shared Cyber
Analytic Repository
A. Analytic Method
Eventtype=process_start
parent_image_path="*system32services.exe" command_line!="
"*" command_line="* *"| rex field=image_path ".(?<img_exe>.*)|
rex field=img_exe "(?<img_base>.*)..*"
B. Efficacy of Analytic Method
Regression Test Results: 1 TP, 0 FPs over 50K transactions over 1 month
C. Cost/Toxicity of Analytic Method
Low cost query completing in 25 msec
D. Context of True Positives
True Positives found in Human Resource systems
E. Resilient Security Design Patterns
Containment and malware detonation solutions in use
Organization B
Eventtype=process_start
parent_image_path="*system32ser
vices.exe" command_line!="
"*" command_line="**"| rex
field=image_path".(?<img_exe>.*)|
rex field=img_exe
"(?<img_base>.*)..*"
Organization B
Cyber Analytic
Repository
Byproducts
and Indicators
436b772438826e2410ef2a45015bc936
costura.aforge.video.dll
hxxp://speedtest[.]reliableservers[.]com/100MBtest.bin
①
②
③ ④
⑤
⑥
⑦
⑧
⑨
STEPS
1. Someone discovers a new
method for finding badness
2. The new method for discovering
that badness is captured as a
machine consumable query
3. The byproducts of that method
are discovered as indicators
4. Indicators are shared through
existing sharing channels
5. The analytic method is stored in
the local Cyber Analytic
Repository
6. The new method is offered to
community. Included with that
new method are four other
pieces of information:
b. Regression tests showing
efficacy of this new method in
terms of true positives and
false positives against
historical data
c. The cost or toxicity of running
the new method
d. The functional context of the
systems where the new
method is effective
e. The security design for the
relevant systems
7. Members consume new method
8. Based on risk tolerance for
efficacy and toxicity, members
run new method to discover their
own indicators, which may also
be shared through existing
channels
9. Results and improved methods
are shared back to community
A. Improved Analytic Method
Eventtype=process_start parent_image_path="*system32services.exe"
command_line!=" "*" command_line="* *"| rex field=image_path
".(?<img_exe>.*)| rex field=img_exe "(?<img_base>.*)..*" | where NOT
like(lower(command_line ), lower("%"+img_exe+"%")) AND
lower("%"+img_base+"%"))
B. Efficacy of Analytic Method
Regression Test Results: 1 TP, 1 FPs over 100K transactions over 2 weeks
C. Cost/Toxicity of Analytic Method
Medium cost query completing in 34 sec
D. Context of True Positives
True Positives found in Human Resource systems
E. Resilient Security Design Patterns
Antivirus and IDS/IPS in use
Putting It All Together