Download as PDF, PPTX
Uploaded byPriyanka Aash
Keeping Up with the Adversary: Creating a Threat-Based Cyber Team
The document discusses the importance of evolving cyber defense strategies to combat increasingly sophisticated adversaries, outlining the necessity for continuous monitoring and a proactive approach to threat identification and management. It emphasizes the value of building a skilled cyber threat team capable of adaptive response and collaboration, as well as the role of behavioral analysis and use case development. Additionally, it highlights key challenges in management, philosophy, and technical areas that need to be addressed for effective cyber operations.
More Related Content
Similar to Keeping Up with the Adversary: Creating a Threat-Based Cyber Team
![[cb22] Keynote: Underwhelmed: Making Sense of the Overwhelming Challenge of C...](https://cdn.slidesharecdn.com/ss_thumbnails/cb22keynoteunderwhelmedmakingsenseoftheoverwhelmingchallengeofcybersecurity-230101083039-ff0c756e-thumbnail.jpg?width=640&height=640&fit=bounds)
Keeping Up with the Adversary: Creating a Threat-Based Cyber Team
- 1. SESSION ID:SESSION ID: #RSAC AnthonyTalamantes Keeping Up with the Adversary: Creating a Threat-Based Cyber Team AIR-R03 Manager, Defensive Cyber Operations Johns Hopkins Applied Physics Laboratory Todd Kight Lead Analyst, Defensive Cyber Operations Johns Hopkins Applied Physics Laboratory
- 2. #RSAC Where We Were 2 GroundUp Approach Continuous Monitoring — Anti-Virus — IPS/IDS — Blackhole/Sinkhole — Sandboxes — Application Whitelisting Triaging — Alerts — Tickets — Initial IR Mitigation — Internal — USG Behavioral Threat Intel Hunting
- 3. #RSAC APL Targeted byNation State – Case Study 3 Malware evolution Persistence in Registry Enumerate running processes Anti-Analysis Techniques TASKKILL on malicious process Actor Consistencies Office themed emails Time stomping Used SSL for C2 Active development
- 4. #RSAC Peer Collaboration -Nation State Compromise 4 Never Let a Good Incident Go to Waste Extensive use of cloud and SSL — C2 — Exfiltration — Distributing malware PowerShell — Reflective injection — Lateral movement Persistence — WMI — Scheduled tasks — RunOnce Actor’s actions on network – more agile than incident responders
- 5. #RSAC How Would OurDefenses Perform? 5 Ground Up Approach Continuous Monitoring — Anti-Virus — IPS/IDS — Blackhole/Sinkhole — Sandboxes — Application Whitelisting Triaging — Alerts — Tickets — Initial IR Mitigation — Internal — OSInt — USG
- 6. #RSAC Philosophy Change 6 Red QueenHypothesis proposes that organisms must constantly adapt, evolve, and proliferate not merely to gain reproductive advantage, but also simply to survive while pitted against ever-evolving opposing organisms in an ever-changing environment
- 7. #RSAC New Philosophy 7 Top DownApproach Threat identification Target advanced tactics, techniques and procedures of adversary Operationalize Malware analysis Enlightenment Silver Bullet or Single Event Assumptions Threat Emulation, Actor Profiling, Tradecraft Analysis, Orchestration Malware Analysis, Hunting Behavioral Artifacts AV, Sinkhole, IPS, Firewall ThreatIntelligence
- 8. #RSAC Cyber Threat TeamConstruct 8 • Scripting • Content Creation • Compound Correlation • Enrichment • Orchestration • Hunting • Continuous monitoring • Gap analysis • Fidelity identification • Comparative analysis • Purple Team collaboration • Hybrid Threat Emulation • Proof of concept testing • External Adaptive RT • Blue sky threats • Research threat actors • Threat Intelligence • Tradecraft research • Profiling and Patterns Research Adaptive Red Team DevelopmentAnalytics
- 9. #RSAC Defensive Cyber ConOps 9 •Pivoting on artifacts • Procedural • Closing steps • Ad-hoc hunting • Behaviors of compromise • Artifacts of compromise Cyber Hunt Team Cyber Threat Team Analysis & Response • Research • Adaptive Red Team • DevOps • Analytics •Analysis & Response to alerts
- 10. #RSAC Putting it AllTogether Building the Team
- 11. #RSAC Overview 11 Adopt a frameworkfor addressing threats Gap Analysis Automate low hanging fruit Shift our focus Build content
- 12. #RSAC Framework – Threats/ Countermeasures 12 • Fully understand the threat and viability • Identify gaps and understand capabilities and competenciesPredict • Mitigations against known indicators • Rules to prevent known behaviorsPrevent • Mitigation is not feasible • Build context rich use cases with assigned confidence/severityDetect • Identify – Contain – RecoverRespond
- 13. #RSAC Gap Analysis andActions 13 Staff Repurposed talent and expanded roles (DevOps, Purple Team) Visibility Email headers, embedded email links, command lines, process trees, registry modifications… Technology Support additional analytics – YARA custom signatures Support processing IOCs in a timely fashion SIEM – getting to data fast
- 14. #RSAC Automation / Orchestration 14 Ingest Reportscontain context for use case development (TTPs, strings for YARA, etc.) IOCs are low hanging fruit Enrich Use OSINT to your advantage Determine prevalence in your environment Consider your source Act Mitigate where feasible (API) Provide enriched ‘exception’ reports for review Ingest Enrich Act
- 15. #RSAC Focus Shift –Passive to Active Defense 15 Events Use Cases Passive: Appliance Generated Alerts Active: Context Rich Use Cases IOCs Behaviors Passive: Static IOCs and Signatures Active: Behaviors and Patterns Data Analysis Passive: Benign or Malicious Active: Objective, Uniqueness, Pivoting Theory Practice Passive: White Papers, Blog Posts, Vendor Reports Active: Countermeasures and Threat Emulation
- 16. #RSAC Use Case DevelopmentAreas 16 • Spoofed email • Email sender • X-headers • Email infra mismatch • Multiple sender infra Delivery • YARA alert • Bypass techniques • Second stage acquisition • Code execution • Persistence Exploit • Privilege escalation • Beacons to C2 infra • Living off the land • Lateral movement • Data gathering Internal Access/C2
- 17. #RSAC Use Case: WindowsPersistence (WMI) Permanent WMI WMI service polls for WMI queries WMI executes code (Consumer) when query (Filter) is satisfied Pros & Cons Very difficult to detect Specific knowledge is needed to remove payload Requires elevation Artifacts Get-WMIObject -Namespace rootSubscription -Class __EventFilter Get-WMIObject -Namespace rootSubscription -Class __EventConsumer Get-WMIObject -Namespace rootSubscription -Class __FilterToConsumerBinding 117
- 18. #RSAC Execution of ActiveScriptEventConsumer UseCase: VBScript being called (as defined in Consumer) when an action occurs (as defined in Filter) What to look for: process_name:scrcons.exe parent_name:svchost.exe username:SYSTEM cmdline:”c:windowssystem32wbemscrcons.exe –embedding” Use Case: Windows Persistence (WMI) 18
- 19. #RSAC Use Case: WindowsPersistence (WMI) Execution of CommandLineEventConsumer Use Case: Powershell being called (as defined in Consumer) when an action occurs (as defined in Filter) What to look for process_name:powershell.exe parent_name:wmiprvse.exe username:SYSTEM 19
- 20. #RSAC WMI Event Subscription– Artifacts 20 __CLASS : __EventFilter __RELPATH : __EventFilter.Name="DoBadOnScheduleFilter" Name : DoBadOnScheduleFilter Query : SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime' AND (TargetInstance.Minute = 45 OR TargetInstance.Minute = 55) GROUP WITHIN 60 __CLASS : CommandLineEventConsumer __RELPATH : CommandLineEventConsumer.Name="DoBadOnScheduleConsumer" CommandLine Template : C:WindowsSystem32WindowsPowerShellv1.0powershell.exe –E ZwB3AG0AaQAgAHcAaQBuADMAMgBfAGMAbwBtAHAAdQB0AGUAcgBzAHkAcwB0AGUAbQAgAHwAIABvAHUAdAAtAGYAaQBsAGUAI AAtAGYAbwByAGMAZQAgAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFQAaABhAG4AawBzAEYAbwByAEEAdAB0AGUAbgBk AGkAbgBnAFIAUwBBAC4AdAB4AHQA __CLASS : __FilterToConsumerBinding __RELPATH : __FilterToConsumerBinding.Consumer="CommandLineEventConsumer.Name="DoBadOnScheduleConsumer"",Filter="__EventFilter. Name="DoBadOnScheduleFilter""
- 21. #RSAC Success Stories 21 Heartbleed Legacy NTsysadmin tool usage Poweliks Mshta spawning processes DMZ Incident SQL injection Stacking the deck Peer Collaboration Validated Use Cases
- 22.
- 23. #RSAC Management Challenges 23 Where arewe getting these new teams? Leverage existing talent in Cyber Operations & IT Create Internal Cyber Programs Identify champions Drinking the Kool-Aid Senior Leadership support — Success stories — Communication Team support
- 24. #RSAC Philosophical Challenges What isbehavioral monitoring anyways? Mitigation and Detection Threat Intelligence False positive acceptance An imperfect start is better than a perfect unimplemented plan Progress is impossible without change and those who cannot change their minds cannot change anything. -George Bernard Shaw 24
- 25. #RSAC Technical Challenges We didn’thave the visibility we needed Host, Network, Process Managing larger data sets Skill development & agility Display new content Tracking Hunt activities 25
- 26. #RSAC Summary Adversary is evolving& we must mature and evolve The Analysts The Process Define threat and targeting Identify gaps in Cyber Operations Create visibility to identify threat Create and apply appropriate Use Cases Repeat… 26
- 27.