Mastering Next Gen SIEM Use Cases (Part 2)
•Download as PPTX, PDF•
0 likes•317 views
Part 2 of 3 part series of "Mastering Next Gen SIEM Use Cases" The following presentation talks about building use cases to detect anomalies pertaining to endpoints. Discover use cases for Credential Theft and Endpoint compromise.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Mastering Next Gen SIEM Use Cases (Part 2)
Similar to Mastering Next Gen SIEM Use Cases (Part 2) (20)
More from DNIF
More from DNIF (14)
Recently uploaded
Recently uploaded (20)
Mastering Next Gen SIEM Use Cases (Part 2)
- 1. © Copyright 2017 NETMONASTERY Inc Mastering NextGen SIEM Use Cases 1 Shomiron DAS GUPTA, Founder, CEO NETMONASTERY Inc. BUILDING LOGIC FOR HUNTING ADVANCED THREATS CAT SERIES
- 2. © Copyright 2017 NETMONASTERY Inc Who is this speaking? 2 Founder of NETMONASTERY, we built DNIF - An Integrated Threat Hunting Platform for the CSOC Research on Detection, Hunting and …. ML One of the few guys that does defense for a living GCIA 2000 - 18Yrs of Intrusion Detection, Handling WHAT I DO FOR A LIVING @shomiron
- 3. © Copyright 2017 NETMONASTERY Inc What can we expect to learn 3 1. Change the we think about detection 2. More about Objectives, Strategies and Tools 3. Use Case Workshop - Threat Hunting Process 4. Thinking SWIFT 5. How to setup your threat hunting workshop THIS THREE PART SERIES
- 4. © Copyright 2017 NETMONASTERY Inc Attack Surfaces 4 TARGET THREAT LANDSCAPE USER ENDPOINT APPLICATIONCREDENTIALS Insider Attack Credential Theft Endpoint Compromise Application Attack Building Use Cases to Detect Anomalies to Each Attack Surface
- 5. © Copyright 2017 NETMONASTERY Inc This Session 5 USE CASE WORKSHOP USER ENDPOINT APPLICATIONCREDENTIALS Insider Attack Credential Theft Endpoint Compromise Application Attack Building Use Cases to Detect Anomalies to Each Attack Surface
- 6. © Copyright 2017 NETMONASTERY Inc Agenda Items 1. Credential theft - how it is done 2. Detection strategies 3. Next Gen SIEM Use Cases 4. Endpoint compromise - how it is done 5. Detection strategies 6. Next Gen SIEM Use Cases 6 THIS SESSION - PART 2
- 7. © Copyright 2017 NETMONASTERY Inc 7 Rewire the kill chain - Credential Theft ATTACK.MITRE.ORG Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Command and Control
- 8. Account manipulation Bash history Brute force Credential dumping Creds in files Creds in registry Exploitation of cred access Forced auth 8 ATTACK.MITRE.ORG Hooking Input capture Input prompt Kerberoasting Keychain LLMNR/NBT-NS Poisoning Network sniffing Password filter dll Private keys Replication through removable media Secured memory 2FA Auth interception Closer look at Credential Access
- 9. © Copyright 2017 NETMONASTERY Inc Defensive structure 1. Harden and prevent a. Account Manipulation b. Bash history 2. Detect and defend a. Brute force b. Credential dumping - later in the day! c. Lateral movement 9 BATTLES WE MUST FIGHT
- 10. © Copyright 2017 NETMONASTERY Inc Brute force CHALLENGE Large number of corner cases Always needs a SOC Analyst to investigate 10 AND FALSE POSITIVES THE FIX Profile user failures per user, using Analytics Understand failure conditions eg - system, service, user, auth mode HOW IT WORKS Features - user, system, service, auth mode and outcome (for auth failure events) Mature model over time, feedforward from analysts investigation Build a baseline, detect aberrations using real-time evaluations using the learnt model.
- 11. © Copyright 2017 NETMONASTERY Inc THE FIX (MOST EFFECTIVE) Profile - user, auth count, destinations Learn normalcy - raise buffer individual auth profiles by user Lateral movement CHALLENGE Rules create false positives, need analysts Need custom rules for every environment 11 USE OF STOLEN CREDS HOW IT WORKS Features - user, system, auth count, destination [entity] (for auth failure events) Mature model using history back in time, reduce risk of overfitting, normalize Accurately detect use of concurrent auth requests for a user, benchmark risk to identify certainty of lateral movement for threat actors.
- 12. © Copyright 2017 NETMONASTERY Inc 12 Rewire the kill chain - Endpoint Compromise ATTACK.MITRE.ORG Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Command and Control
- 13. © Copyright 2017 NETMONASTERY Inc THE FIX (SIMPLE) Profile - OS version, process, valid hash Learn normalcy - documenting each process name, version and hash Process baseline CHALLENGE Detecting a process that is altered Investigating takes analysts 13 ID ROGUE PROCESSES HOW IT WORKS Features - OS version, process, valid hash Validate from third party intel provider Hold unvalidated processes, hunt them and validate, add to profile Identify abnormalities against baseline Auto remediate using end point software
- 14. © Copyright 2017 NETMONASTERY Inc 14 Hunting Bad Processes END POINT PLAYBOOK - PRELIMINARY Extract Process NAME, HASH NO NAME, HASH is GOOD GOOD List NAME, HASH is BAD YES NO BAD List ALERT! X Extract Process NAME, HASH VT Lookup NAME, HASH NAME, HASH is BAD Update BAD List ALERT! YES NAME, HASH is GOOD Update GOOD List YES NO Threat Hunt NAME, HASH NO X
- 15. © Copyright 2017 NETMONASTERY Inc Concluding Understanding the attack surfaces Mapping the surfaces to the kill-chain Diving deep into the kill-chain layers Understanding key use cases for defense Attaching a playbook to a use case 15 FINALLY
- 16. © Copyright 2017 NETMONASTERY Inc Next Session 16 USE CASE WORKSHOP USER ENDPOINT APPLICATIONCREDENTIALS Insider Attack Credential Theft Endpoint Compromise Application Attack Building Use Cases to Detect Anomalies to Each Attack Surface