Downloaded 195 times
Uploaded byKoen Van Impe
MISP EcoSystem - Threat Intelligence, VMRay, MISP
The document discusses the MISP (Malware Information Sharing Platform) ecosystem, focusing on threat intelligence, indicators of compromise (IOCs), and integration with security information event management (SIEM) systems. It emphasizes the importance of sharing threat information, methods to mitigate false positives, and various tools and modules available for enhancing threat analysis and collaboration. The document highlights the use case of analyzing malware samples and the role of platforms like VMRay in automating this process.
More Related Content
![Statistique descriptives s1 de bien www.learneconomie.blogspot.com]](https://cdn.slidesharecdn.com/ss_thumbnails/statistiquediscriptivess1debienwww-160808131817-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to MISP EcoSystem - Threat Intelligence, VMRay, MISP
![Number_Guessing_Game_Dsbsbssbzboc[1].pptx](https://cdn.slidesharecdn.com/ss_thumbnails/numberguessinggamedoc1-251206215042-a076fc05-thumbnail.jpg?width=640&height=640&fit=bounds)
MISP EcoSystem - Threat Intelligence, VMRay, MISP
- 1. MISP-ECOSYSTEM Threat Intelligence, VMRayand MISP 13-Dec-16 Koen Van Impe – koen.vanimpe@cudeso.be
- 2. Agenda • Threat Intelligence •IoCs • TLP • Integrate SIEM • MISP • Distribution model • False positives & Whitelists • Modules • VMRay • Use Case • E-mail with attachment 13-Dec-16 MISP EcoSystem 2
- 3. Threat • What isa Threat? • an expression of intent to do harm, i.e. deprive, weaken, damage or destroy; • an indication of imminent harm; • an agent that is regarded as harmful; • a harmful agent’s actions comprising of tactics, techniques and procedures (TTPs). 13-Dec-16 MISP EcoSystem 3 Cyber threat intelligence - Marketing hype or innovation? InfoSecurity Europe
- 4. Intelligence • What isIntelligence? • Information that provides relevant and sufficient understanding for mitigating the impact of a harmful event 13-Dec-16 MISP EcoSystem 4 Cyber threat intelligence - Marketing hype or innovation? InfoSecurity Europe
- 5. Threat Intelligence • Whatis Threat Intelligence? • Information about threats and threat actors that provides relevant and sufficient understanding for mitigating the impact of a harmful event 13-Dec-16 MISP EcoSystem 5 Cyber threat intelligence - Marketing hype or innovation? InfoSecurity Europe
- 6. Threat Intelligence • Whydo you need Threat Intelligence? • First step in protecting your business • Understand exposure to threats • Expanded attack surface • Weigh defenses towards threats • Actionable instead of noise • Get ahead of the game 13-Dec-16 MISP EcoSystem 6
- 7. Threat Intelligence &SIEMs • Insight on network, applications, servers and users • SIEMS without threat feeds • Difficult to remove the noise, needle in a haystack • Why consume threat data in a SIEM? • Faster, others do the research, you consume • Instead of "a" connection-> "the" connection • Fills the blind spots –correlate- things you didn't know • Not "auto-magic-correlation" • Additional context • Prioritize • Incidents • Vulnerability management 13-Dec-16 MISP EcoSystem 7
- 8. Indicator of Compromise- IoC • Threat intelligence is more (TTPs!) than just IoCs • But that's how it's most often used • Information to identify potentially malicious behavior • IPs • Careful with shared hosting • Domain names • URLs • File hashes • High confidence • Registry keys • Mutex 13-Dec-16 MISP EcoSystem 8 Context! Target Scope Attacker Sophistication Impact When Why Likelihood
- 9. Audience : TrafficLight Protocol - TLP • When and how (threat) information can be shared • Not a classification scheme • https://www.first.org/tlp 13-Dec-16 MISP EcoSystem 9 RED Strong limited Not for disclosure Participants only Mostly verbally or in person AMBER Limited, people that act on the information Restricted to participants'organizations Sources are at liberty to specify additional intended limits of the sharing GREEN Relaxed, known by the inner-circle The community Not via publicly accessible channels WHITE Open, known by everyone Disclosure is not limited Standard copyright rules
- 10. Threat Intelligence Platforms •Lots of buzz (fuss) • Marketing • Vendor driven <-> What you really need 13-Dec-16 MISP EcoSystem 10
- 11. Threat Intelligence Platforms •https://www.vanimpe.eu/pewpew/index.html?pew=1 13-Dec-16 MISP EcoSystem 11
- 12. MISP - MalwareInformation Sharing Platform & Threat Sharing • Started 2012 • Christophe Vandeplas • CERT for Belgian MoD • https://github.com/MISP/MISP • http://www.misp-project.org/ 13-Dec-16 MISP EcoSystem 12
- 13. MISP – InformationSharing • Distributed sharing model • Everyone can be a consumer or contributor • Based on practical user feedback • Quick benefit : no obligation to contribute • Different sharing groups 13-Dec-16 MISP EcoSystem 13
- 14. For whom? • Malwarereversers willing to share indicators of analysis with respective colleagues. • Security analysts searching, validating and using indicators in operational security. • Intelligence analysts gathering information about specific adversary groups. • Law-enforcement relying on indicators to support or bootstrap their DFIR cases. • Risk analysis teams willing to know about the new threats, likelihood and occurrences. • Fraud analysts willing to share financial indicators to detect financial frauds. 13-Dec-16 MISP EcoSystem 14
- 15. I can't share! •Be a consumer • MISP groups • Use OSINT • Legal restrictions • Sharing groups and communities • Convince management to share • Share without attribution ('ownership change') 13-Dec-16 MISP EcoSystem 15
- 16. OSINT Feeds • OpenSource Intelligence • Community feeds • Set filter (import) rules 13-Dec-16 MISP EcoSystem 16
- 17. MISP Events &Attributes • Events • "a threat", for example a new ransomware-run • Own events • From connected sites • Distribution level • Tagging (TLP, category, ...) • Attributes • What is the threat about? • Sightings • Network, File hashes, Financial info (CC, Bitcoin) • Context • Text • Correlation with other events • Seen in other events? • Proposals 13-Dec-16 MISP EcoSystem 17
- 18. MISP Events &Attributes 13-Dec-16 MISP EcoSystem 18 • Multiple attributes per event
- 19. False positives • Misconfiguredsandbox • OS Update traffic • Browsers fetch CRL • Routing issues 13-Dec-16 MISP EcoSystem 19 Real False Positive You need context Learn TTP Add "If Then"-logic ; infection check • 1st : Machine visits "evil.com" • 2nd : Traffic to "download.microsoft.com" • Only traffic to "evil.com" • Malware checks network connectivity • Malware changes resolution of important domains Not False Positive download.microsoft.com Incident Response Not sure compromised or resisted; dive deeper to evaluate situation https://soltra.com/en/articles/the-truth-about-false-positives-and-their-root-causes-in-cyber-threat-intelligence/
- 20. False positives -MISP • Recurring challenge in information sharing • MISP introduced warninglists • lists of well-known indicators that can be associated to potential false positives, errors or mistakes • Enable per list • https://github.com/MISP/misp-warninglists • Alexa Top 100 • Microsoft, Google domains • RFC 1918 • Alert when adding an attribute that is on the warninglist • You decide what to do! • You have to "known" the logic, MISP can not do that for you 13-Dec-16 MISP EcoSystem 20
- 21. False positives -MISP 13-Dec-16 MISP EcoSystem 21
- 22. Whitelists - MISP •Whitelist attributes from being added to signatures • Company assets 13-Dec-16 MISP EcoSystem 22
- 23. Taxonomies - MISP •Classification • JSON • ENISA, NATO, VERIS • Your classification • Machine tags • Machines can parse it • Still human-readable • Tags as filter for distribution 13-Dec-16 MISP EcoSystem 23
- 24. Use MISP • WebUI • Freetext import : large block of text ; MISP recognizes IoCs • API access • PyMISP • API'ish • MISP modules • Import, export, extension • MISP Galaxy • large object attached to a MISP event • Taxonomies • Workbench • export attributes • help on cases outside MISP 13-Dec-16 MISP EcoSystem 24
- 25. MISP modules • Expansionservice • Enrichment, Import, Export • Extend attributes with information from other service providers • Can also be your own internal provider • Extending MISP with expansion modules with zero customization in MISP • MISP modules can be run on the same system or on a remote server • https://github.com/MISP/misp-modules 13-Dec-16 MISP EcoSystem 25
- 26. MISP modules • ASNhistory • Passive DNS • Passive SSL • CVE • DNS • PassiveTotal • Shodan • Virustotal • STIX • VMRay 13-Dec-16 MISP EcoSystem 26
- 27. VMRay • Agentless • Hypervisorbased malware analysis • OEM Integration • Embedded into security appliances • Windows • 32b/64b • 64b kernel rootkits (Turla) • exe, pdf, docx, swf 13-Dec-16 MISP EcoSystem 27
- 28. VMRay • Analysis indifferent VMs • Windows • Popular office software • Custom • Extract IoCs • Hashes, Mutex • Network information • STIX • JSON-output • API • Submit, Retrieve results • Automation 13-Dec-16 MISP EcoSystem 28
- 29. VMRay - Process 13-Dec-16 MISPEcoSystem 29 Sample Job Submission Analysis
- 30. MISP EcoSystem 13-Dec-16 MISP EcoSystem30 Malware Network TTP Finance / Fraud Import/Export Threat Info Security devices Forensic data Enrichment IR Platforms API IoC
- 31. Use Case :E-mail with malware 13-Dec-16 MISP EcoSystem 31 Attachment: AG Wire payment confirmation.doc.z AG Wire payment confirmation.doc.z: RAR archive data, v1d, os: Win32 MD5 (AG Wire payment confirmation.doc.z) = 56c8abc137aea9e497bee0ebe61d7286 Extract : AG-wirepay-doc.exe
- 32. Use Case :E-mail with malware • We can use static analysis • limited • obfuscated • resource intensive • Use malware sandboxes • automated analysis • behavior • careful with malware that does sandbox evasion / detection 13-Dec-16 MISP EcoSystem 32
- 33. Use Case :MISP and Malware 13-Dec-16 MISP EcoSystem 33 Malware MISP Modules IoC NetworkForensic data Security devicesLOKI Attach malware sample Submit and import Export hashes and network info
- 34. Step 1: Attachmalware sample • Two types of attachment in MISP • "Regular" attachments • Payload Delivery • Antivirus Detection • IDS flag not set • Direct downloadable from UI • Malware samples • Artifacts Dropped • Payload Installation • IDS flag set • Download via password protected ZIP 13-Dec-16 MISP EcoSystem 34
- 35. Step 1: Attachmalware sample 13-Dec-16 MISP EcoSystem 35 AddAttachment_orig.move
- 36. Step 2: Submitsample to VMRay • Via MISP-modules Enrichment 13-Dec-16 MISP EcoSystem 36
- 37. Step 2: Submitsample to VMRay 13-Dec-16 MISP EcoSystem 37 Submit_orig.move
- 38. Step 3: Waitfor analysis • VMRay does its magic • Current MISP-VMRay connector is asynchronous • Submit • Wait for analysis to complete • Import • (work in progress) 13-Dec-16 MISP EcoSystem 38
- 39. Step 4: Importresults • Via MISP-modules Import • Based on VMRay sample ID • Do not forget to set IDS flag • (pending issue request) 13-Dec-16 MISP EcoSystem 39
- 40. Step 4: Importresults 13-Dec-16 MISP EcoSystem 40 Import_orig.move
- 41. Consume results inSIEM • API / PyMISP (Python access via API) • Import feed • Select tags • Type, priority, impact • Set categories • Based on tags • Post sightings back to MISP 13-Dec-16 MISP EcoSystem 41
- 42. Consume results inNIDS • Malware analysis revealed network IoCs • Low confidence when it concerns shared hosting IPs • Generate NIDS rules • automatic or manual • Set of SNORT rules 13-Dec-16 MISP EcoSystem 42
- 43. End-point investigation • YARArules • Signature based detection • File hashes • High confidence • Slow • Get files • Investigate • High reward • Use perimeter sandbox • Before delivery • Queued 13-Dec-16 MISP EcoSystem 43
- 44. End-point investigation • Loki •https://github.com/Neo23x0/Loki • Fetch YARA rules from MISP • File hashes 13-Dec-16 MISP EcoSystem 44
- 45. End-point investigation • FireEye– Redline • Memory acquisition • Drive acquisition • Per image • Dedicated • You known the hosts in scope 13-Dec-16 MISP EcoSystem 45
- 46. End-point investigation • Nessus •Plugin 65548 • Search custom file hashes 13-Dec-16 MISP EcoSystem 46
- 47. MISP – TheFuture • MISP Modules • via MISP Hackaton • MISP Objects • Semi dynamic data model • Share the object design along with the events shared • MISP Galaxy • Large object -> cluster • Threat actors, campaigns • MISP Workbench • Use attributes outside MISP for further investigation 13-Dec-16 MISP EcoSystem 47
Editor's Notes
- #4 Expression of intent to do harm Contains tactics, techniques and procedures
- #5 Intelligence is the information that adds the context
- #6 Combining threat and intelligence allows you to evaluate if a certain threat is a problem for your environment
- #7 Why do you need threat intelligence? To evaluate if a certain new attack pattern is a threat to your environment Change your defenses for this new threat And get ahead of the game, instead of allowing an attacker to get a strong foothold in your organisation detect the attack in the early stages of the intrusion
- #8 Threat intelligence often used in combination with SIEMs SIEM : connection to an IP, no context Threat : IP is marked as possibly malicious ; investigate other actions done by the host that started the connection
- #9 IoCs are how we most often consume threat intelligence The most visible part; but there's more
- #10 Notes about with whom you share information You don't want to share with the whole world, otherwise attackers get informed that their actions have been discovered Color scheme to describe with whom and how you share ; from RED restricted to WHITE open
- #13 Started in 2012 by Belgian Ministry of Defense as a malware information sharing platform evolved to threat sharing platform since a couple of years taken over by CIRCL, the LU private CERT
- #14 Distributed sharing model Everyone can contribute or consume Everyone adds their own bits & pieces found to the threat data, they then describe with whom and how it can be shared -> through the distributed nature of MISP
- #18 Correlation Attributes added to an event If they already exist MISP will connect them together Proposal If you don't agree with an attribute you can propose a "change" Or add your own attribute The owner of the threat event can then decided to accept the proposal Exchange of proposals happens the same way as distribution of threat event data in MISP
- #20 When adding events or attributes you'll have to deal with false positives ; as always "context" is important Looking at an attribute without the context you can not decide if something is false positive or not Add the context; the logic (different attributes) to evaluate if something is really a problem Example : connection to evil.com ; malware gets downloaded and installed and then does network connectivity test
- #23 Protect your own assets from ending up in signatures
- #24 Are a classification scheme to describe what a threat is about Provided by for example enisa, veris, nato, etc. Human : visually to know what the threat is about Machine : used for distribution and import/export security devices
- #42 Sightings allow you to vouch that an attribute is "valuable"