MITRE - ATT&CKcon, profile picture
Uploaded byMITRE - ATT&CKcon
2,980 views

MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate Your Data Analytics; Roberto Rodriguez, AWS and Jose Rodriguez, NVCC

The document discusses the ATT&CK framework, highlighting the use of the ATT&CK data sources to improve security analytics and validation. It emphasizes various projects such as the ATT&CK Python client and the Mordor project, which simulate adversarial techniques with pre-recorded security events. Collaboration and opportunities for data source improvements are also explored, alongside recommendations for validating data analytics in security environments.

Embed presentation

Downloaded 144 times
1 / 132
2 / 132
3 / 132
4 / 132
5 / 132
6 / 132
7 / 132
8 / 132
9 / 132
10 / 132
11 / 132
12 / 132
13 / 132
14 / 132
15 / 132
16 / 132
17 / 132
18 / 132
19 / 132
20 / 132
21 / 132
22 / 132
23 / 132
24 / 132
25 / 132
26 / 132
27 / 132
28 / 132
29 / 132
30 / 132
31 / 132
32 / 132
33 / 132
34 / 132
35 / 132
36 / 132
37 / 132
38 / 132
39 / 132
40 / 132
41 / 132
42 / 132
43 / 132
44 / 132
45 / 132
46 / 132
47 / 132
48 / 132
49 / 132
50 / 132
51 / 132
52 / 132
53 / 132
54 / 132
55 / 132
56 / 132
57 / 132
58 / 132
59 / 132
60 / 132
61 / 132
62 / 132
63 / 132
64 / 132
65 / 132
66 / 132
67 / 132
68 / 132
69 / 132
70 / 132
71 / 132
72 / 132
73 / 132
74 / 132
75 / 132
76 / 132
77 / 132
78 / 132
79 / 132
80 / 132
81 / 132
82 / 132
83 / 132
84 / 132
85 / 132
86 / 132
87 / 132
88 / 132
89 / 132
90 / 132
91 / 132
92 / 132
93 / 132
94 / 132
95 / 132
96 / 132
97 / 132
98 / 132
99 / 132
100 / 132
101 / 132
102 / 132
103 / 132
104 / 132
105 / 132
106 / 132
107 / 132
108 / 132
109 / 132
110 / 132
111 / 132
112 / 132
113 / 132
114 / 132
115 / 132
116 / 132
117 / 132
118 / 132
119 / 132
120 / 132
121 / 132
122 / 132
123 / 132
124 / 132
125 / 132
126 / 132
127 / 132
128 / 132
129 / 132
130 / 132
131 / 132
132 / 132
Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate Your Data Analytics! 1
@Cyb3rWard0g & @Cyb3rPandaH ● Projects ○ @HunterPlaybook ○ @THE_HELK ○ ATTACK-Python-Client ○ @OSSEM_Project ○ @Mordor_Project ○ OpenHunt ○ Blacksmith & More ● Founders: ○ @HuntersForge 2https://github.com/hunters-forge
Agenda ● Explore ATT&CK ● 2018 -> 2019 ● ATT&CK Data Sources Opportunities ● Enter Mordor ● Mordor & CAR ● CAR & Threat Hunter Playbook (Notebooks) ● Hunters Forge! 3
Explore ATT&CK How do I query ATT&CK? 4
Exploring ATT&CK Metadata! 5
How do I access ATT&CK Metadata? 6
ATTACK-Python-Client Github Project ● A Python module to access up to date ATT&CK content available in STIX via public TAXII server. It leverages cti-python-stix2 and cti- taxii-client python libraries developed by MITRE. ● Goals ○ Allow the integration of ATT&CK content with other platforms ○ Allow security analysts to quickly explore ATT&CK content and apply it in their daily operations ○ Explore all available ATT&CK metadata at once ○ Learn STIX2 and TAXII Client Python libraries https://github.com/hunters-forge/ATTACK-Python-Client 7
ATTACK-Python-Client Installation ● Via PIP: pip install attackcti ● Or Straight from Source ○ git clone https://github.com/hunters- forge/ATTACK-Python-Client ○ cd ATTACK-Python-Client ○ pip install . ● Jupyter Notebooks Available ○ pip install -r requirements.txt ○ cd notebooks ○ jupyter lab https://github.com/hunters-forge/ATTACK-Python-Client 8
Some Available Functions 9https://attackcti.readthedocs.io/en/latest/attackcti_functions.html
ATT&CK Metadata - Jupyter Notebook https://github.com/hunters-forge/ATTACK-Python-Client/tree/master/notebooks 10
Explore ATT&CK Querying ATT&CK 101 11
12
13
Explore ATT&CK Any New Data Sources? 14
ATT&CK Techniques (519) and Data Sources ● Almost 51% of techniques have data sources defined ● Around 49% of techniques do NOT have data sources defined ● Pre-ATT&CK data sources maybe? ● Opportunities to collaborate and define those without data sources? https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb 15
ATT&CK Techniques (519) and Data Sources 16https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb
Looking for anything to do this weekend? 17https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb
ATT&CK Techniques with Data Sources (265) 18 Process Monitoring: 178 TechniquesFile Monitoring: 107 Techniques Process Command Line: 103 Techniques https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb
ATT&CKing with the right data ATT&CKcon 2018 Talk! 19
Credentials in Registry -> DS -> Sub-DS -> Events 20 T1214 Windows Registry Process Monitoring Process Command-Line Parameters Process Creation Process created Process Process Write To Process Process Process Process Access Process Process Security 4688 Sysmon 1 Security 4689 Sysmon 8 Sysmon 10 Process Termination User terminated Process wrote_to accessed https://www.youtube.com/watch?v=QCDBjFJ_C3g
ATT&CK Data (OSSEM-> attack_data_sources) https://github.com/hunters-forge/OSSEM 21
A lot more to do.. Going deeper! 22
API-To-Event Project (Windows Security) https://github.com/hunters-forge/API-To-Event 23
Security https://github.com/hunters-forge/API-To-Event 24
API-To-Event Project (Windows Sysmon) https://github.com/hunters-forge/API-To-Event 25
Sysmon https://github.com/hunters-forge/API-To-Event 26
A few opportunities! Exploring Data Sources 2.0! 27
A few opportunities.. ● ATT&CK Data sources covered by other data sources ● Windows Event Logs data source is too broad! ● ATT&CK data sources and the wrong platforms! ● Validation of ATT&CK data sources recommendations ○ What specific event logs per data source? 28
A few opportunities! ● ATT&CK Data sources covered by other data sources ● Windows Event Logs data source is too broad! 29
Credentials in Registry - Windows Registry 30https://www.youtube.com/watch?v=QCDBjFJ_C3g T1214 Windows Registry Process Monitoring Process Command-Line Parameters Registry Creation Process created Registry Registry Modification Process Registry Registry Access Process Registry Sysmon 12 Sysmon 12 Security 4663 Security 4657 Security 4663 Registry Deletion Process deleted Registry modified accessed Sysmon 13
Windows Registry & Windows Security Event Logs? 31https://www.youtube.com/watch?v=QCDBjFJ_C3g T1214 Windows Registry Process Monitoring Process Command-Line Parameters Registry Creation Process created Registry Registry Modification Process Registry Registry Access Process Registry Sysmon 12 Sysmon 12 Security 4663 Security 4657 Security 4663 Registry Deletion Process deleted Registry modified accessed Sysmon 13
ATT&CK Techniques with Data Sources (265) 32 Process Monitoring: 178 TechniquesFile Monitoring: 107 Techniques Process Command Line: 103 Techniques https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb
ATT&CK Techniques with Data Sources (265) 33 Process Monitoring: 178 TechniquesFile Monitoring: 107 Techniques Process Command Line: 103 Techniques https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb Windows Event Logs
Windows Event Logs … a Universe Behind? 34https://www.youtube.com/watch?v=QCDBjFJ_C3g Windows Event Logs 4656 4657 4658 4660 4670 4663 4741 4742 4743 4776 4768 4771 4769 4770 5144 5140 5143 5142
Windows Event Logs 35 Windows Event Logs 4656 https://www.youtube.com/watch?v=QCDBjFJ_C3g 4657 4658 4660 4670 4663 Audit Registry Win Registry Deletion Request Win Registry Key Value Modification Win Registry Access Request Win Registry Key Handle Closed Win Registry Key Deletion Win Registry Key Permissions Change Win Registry Key Access Win Registry Key Deletion Audit Computer Account Management 4741 4742 4743 Computer Account Creation Computer Account Change Computer Account Deletion
Windows Event Logs 36 Windows Event Logs 4656 https://www.youtube.com/watch?v=QCDBjFJ_C3g 4657 4658 4660 4670 4663 Audit Registry Win Registry Deletion Request Win Registry Key Value Modification Win Registry Access Request Win Registry Key Handle Closed Win Registry Key Deletion Win Registry Key Permissions Change Win Registry Key Access Win Registry Key Deletion Audit Computer Account Management 4741 4742 4743 Computer Account Creation Computer Account Change Computer Account Deletion
Windows Event Logs 37 Windows Event Logs 4656 https://www.youtube.com/watch?v=QCDBjFJ_C3g 4657 4658 4660 4670 4663 Audit Registry Win Registry Deletion Request Win Registry Key Value Modification Win Registry Access Request Win Registry Key Handle Closed Win Registry Key Deletion Win Registry Key Permissions Change Win Registry Key Access Win Registry Key Deletion
Windows Event Log 4656: A handle to an object was requested 38https://www.youtube.com/watch?v=QCDBjFJ_C3g Windows Registry 4656 Audit Registry Audit File System Win Registry Deletion Request Win Registry Access Request File Monitoring File Deletion Request File Access Request
Windows Event Log 4657: A registry value was modified 39https://www.youtube.com/watch?v=QCDBjFJ_C3g Windows Registry 4656 Audit Registry Audit File System Win Registry Deletion Request Win Registry Access Request File Monitoring File Deletion Request File Access Request Windows Registry 4657 Audit Registry Win Registry Key Value Modification
Windows Event Log 4658: The handle to an object was closed 40https://www.youtube.com/watch?v=QCDBjFJ_C3g Windows Registry 4656 Audit Registry Audit File System Win Registry Deletion Request Win Registry Access Request File Monitoring File Deletion Request File Access Request File Monitoring4658 Audit File System File Handle Closed Windows Registry 4657 Audit Registry Win Registry Key Value Modification
Currently collaborating with ATT&CK team.. 41
A few opportunities! ATT&CK data sources and the wrong platforms! 42
ATT&CK Windows Data Sources & Platform (2019) 43https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb
A few opportunities! ● Validation of ATT&CK data sources recommendations ○ What specific event logs per data source? 44
Credentials in Registry - Windows Registry 45https://www.youtube.com/watch?v=QCDBjFJ_C3g T1214 Windows Registry Process Monitoring Process Command-Line Parameters Security 4656 Security 4657 Security 4658 Security 4660 Security 4670 Security 4663 Win Registry Deletion Request Win Registry Key Value Modification Win Registry Access Request Win Registry Key Handle Closed Win Registry Key Permissions Change Win Registry Key Deletion Win Registry Key Access Sysmon 12 Sysmon 13
Wait! Where is all this happening so far? 46
Data Analytics Development (Example) 47 Define a Research Goal Simulate Adversary Define Detection Model Validate Detection Model Document and Communicate Findings Model Data https://www.youtube.com/watch?v=DuUF-zXUzPs
Data Analytics Development (Example) 48 Define a Research Goal Simulate Adversary Define Detection Model Validate Detection Model Document and Communicate Findings Model Data https://www.youtube.com/watch?v=DuUF-zXUzPs
How do we validate our data recommendations? 49
Data Analytics Development (Example) 50 Define a Research Goal Simulate Adversary Define Detection Model Validate Detection Model Document and Communicate Findings Model Data https://www.youtube.com/watch?v=DuUF-zXUzPs
More than just testing security controls! 51 Simulate Adversary Test Security Controls Model Adversary Behavior ● Endpoint Agent Detection ● Analytics Platform Rules ● Can I see it in my environment? ● Learn adversary behavior ● Map data sources to adversary actions ● Study derived techniques
A basic adversary simulation flow! 52https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1571754303.pdf Plan Engagement Emulate Adversary Collect & Analyze Data Can I see it? Enable Telemetry No Document Results Yes
What do we need for Credentials in Registry? 53https://attack.mitre.org/techniques/T1214/
What do we need for Credentials in Registry? 54https://attack.mitre.org/techniques/T1214/
What else do we need for Credentials in Registry? 55 ● Windows Registry? ○ Enable Audit Object Access > Audit Registry ● Process Monitoring? ○ Enable Audit Detailed Tracking > Audit Process Creation ● Process Command-line Parameters? ○ Enable Administrative TemplatesSystemAudit Process Creation > Include command line in process creation events
What else do we need for Credentials in Registry? 56https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists ● Windows Registry? ○ Enable Audit Object Access > Audit Registry ○ Set Audit Rule to trigger event! ● Process Monitoring? ○ Enable Audit Detailed Tracking > Audit Process Creation ● Process Command-line Parameters? ○ Enable Administrative TemplatesSystemAudit Process Creation > Include command line in process creation events
What else do we need for Credentials in Registry? 57https://github.com/hunters-forge/Blacksmith/blob/master/aws/mordor/cfn-files/scripts/default/Join-Domain.ps1#L37-L49 ● What are we testing? ○ Available default automatic logon user Settings!! Set-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" - Name AutoAdminLogon -Value 1 Set-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" - Name DefaultUserName -Value pgustavo Set-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" - Name DefaultPassword -Value W1n1!2019
What else do we need for Credentials in Registry? 58https://github.com/hunters-forge/Set-AuditRule/blob/master/registry/default_logon_user.md ● Set Audit Rule! How? ○ Download https://github.com/hunters-forge/Set-AuditRule ○ Import-module Set-AuditRule.ps1 ○ Set-AuditRule -RegistryPath "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" -IdentityReference Everyone - Rights QueryValues -InheritanceFlags None -PropagationFlags None -AuditFlags Success
What else do we need for Credentials in Registry? 59 ● Testing Commands? ○ reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" /f password /t REG_SZ /s
What about technique variations? 60
What else do we need for Credentials in Registry? 61 ● Testing Commands? ○ reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" /f password /t REG_SZ /s ○ Get-ItemProperty -Path "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" -Name *password* ○ C#, Python, etc!
Are we ready? 62
We need an environment setup.. working! 63
Execute -> Collect -> Analyze -> Repeat 64 Model Adversary Behavior Test Security Controls Data produced Simulating Adversarial Technique
Same Technique + Some Variations 65 Model Adversary Behavior Test Security Controls Data produced
Credentials in Registry Data Mapping 66 Process Registry Key Value Queried
Credentials in Registry Data Mapping 67 Process Registry Key Value Queried EVENT ID TASK 4688 Process Creation 4673 Sensitive Privilege Use 4656 Registry (Request Handle) 4690 Handle Manipulation 4663 Registry (Access) 4658 Registry (Closing Handle) 4689 Process Termination
Credentials in Registry Data Mapping 68 Process Registry Key Value Queried EVENT ID TASK 4688 Process Creation 4673 Sensitive Privilege Use 4656 Registry (Request Handle) 4690 Handle Manipulation 4663 Registry (Access) 4658 Registry (Closing Handle) 4689 Process Termination Process Monitoring Process Command-Line Parameters Windows Registry Process Monitoring
Credentials in Registry - Windows Registry 69https://www.youtube.com/watch?v=QCDBjFJ_C3g T1214 Windows Registry Process Monitoring Process Command-Line Parameters Security 4656 Security 4657 Security 4658 Security 4660 Security 4670 Security 4663 Win Registry Deletion Request Win Registry Key Value Modification Win Registry Access Request Win Registry Key Handle Closed Win Registry Key Permissions Change Win Registry Key Deletion Win Registry Key Access Sysmon 12 Sysmon 13
Credentials in Registry - Windows Registry 70https://www.youtube.com/watch?v=QCDBjFJ_C3g T1214 Windows Registry Process Monitoring Process Command-Line Parameters Security 4656 Security 4657 Security 4658 Security 4660 Security 4670 Security 4663 Win Registry Deletion Request Win Registry Key Value Modification Win Registry Access Request Win Registry Key Handle Closed Win Registry Key Permissions Change Win Registry Key Deletion Win Registry Key Access Sysmon 12 Sysmon 13
Spending +time producing data & -time analyzing 71 Model Adversary Behavior Test Security Controls Data produced Takes Time! Similar Events?
Same Technique + Some Variations 72 Model Adversary Behavior Test Security ControlsEVENT ID TASK 4688 Process Creation 4673 Sensitive Privilege Use 4656 Registry (Request Handle) 4690 Handle Manipulation 4663 Registry (Access) 4658 Registry (Closing Handle) 4689 Process Termination
We might be all doing this.. 73
We might be doing this over and over.. 74
What if we share our datasets? 75
From Zero to Data Analytics Validation! 76
Enter Mordor 77
Mordor Project @Mordor_Project ● Pre-recorded security events generated by simulated adversarial techniques in the form of JavaScript Object Notation (JSON) ● Pre-recorded data categorized by platforms, adversary groups, tactics and techniques defined by the Mitre ATT&CK Framework. ● Data represents not only specific known malicious events but additional context/events that occur around it. 78https://github.com/Cyb3rWard0g/mordor
Mordor Standard Environments ● Environment designed to replicate a small research network ● Standardized and documented setup ● Platforms ○ Windows ○ Linux ● Endpoints Telemetry ○ Windows Security Auditing ○ Event Tracing for Windows (ETW) (NEW!!) ● Network Telemetry ○ Network Logs ● Environments Available: Shire and Erebor 79https://mordor.readthedocs.io/en/latest/index.html
Mordor Environments: The Shire 80
The Shire Design 81
The Shire Telemetry: Win Logs & Sysmon 82https://github.com/Cyb3rWard0g/OSSEM/tree/master/data_dictionaries/windows/sysmon
The Shire: Event Log -> WEC -> HELK 83https://mordor.readthedocs.io/en/latest/mordor_shire.html#
Mordor Environments: Erebor (Lonely Mountain) 84
Erebor Design 85
Erebor Telemetry: ETW Events via SilkETW 86https://medium.com/threat-hunters-forge/threat-hunting-with-etw-events-and-helk-part-1-installing-silketw-6eb74815e4a0
Erebor: ETW Events -> Event Log -> WEC -> HELK 87
How do you collect data? ● We use Kafkacat! ● kafkacat is a generic non-JVM producer and consumer for Apache Kafka >=0.8, think of it as a netcat for Kafka. ● In consumer mode ○ Kafkacat reads messages from a topic and prints them to standard output (stdout). You can also redirect it to a file (i.e. JSON) ● In producer mode ○ Kafkacat reads messages from standard input (stdin). You can also send data to kafkacat by adding data from a file. 88https://github.com/edenhill/kafkacat
Consuming Data (Taking a snapshot of data) 89https://mordor.readthedocs.io/en/latest/export_mordor.html $ kafkacat -b <Kafka-IP>:9092 -t <kafka-Topic> -C -o end > file.json ● -b : Kafka broker ● -t : Topic to consume from ● -C : Consumer Mode ● -o : Offset to start consuming from
Consuming Data -> Creating Mordor File (Video) 90https://mordor.readthedocs.io/en/latest/export_mordor.html
Consuming Data -> Creating Mordor File (Demo 02) 91https://mordor.readthedocs.io/en/latest/export_mordor.html
Producing Data (Injecting Adversary Dataset) 92
Producing Data (Injecting Adversary Dataset) 93https://mordor.readthedocs.io/en/latest/import_mordor.html $ kafkacat -b <Kafka-IP>:9092 -t <kafka-Topic> -P -l file.json ● -b : Kafka broker ● -t : Topic to produce to ● -P : Producer Mode ● -l : Send messages from a file
I just want to download all the datasets.. 94 $ git clone https://github.com/hunters- forge/mordor.git $ cd mordor/small_datasets/ $ find . -type f -name "*.tar.gz" -print0 | sudo xargs -0 -I{} tar xf {} -C .
Expedite Analytics Validation! 95https://github.com/hunters-forge/mordor Model Adversary Behavior Test Security Controls Data produced YOU CAN DO IT NOW!
Validate Analytics! 96 Mordor File Validate Analytics 2 + 2 = 4
Where do we get analytics from? 97
I have data with me and I am ready! 98
Mordor & CAR The MITRE Cyber Analytics Repository (CAR)! 99
CAR-2019-08-001: Credential Dumping via Windows Task Manager ● The Windows Task Manager may be used to dump the memory space of lsass.exe to disk for processing with a credential access tool such as Mimikatz. This is performed by launching Task Manager as a privileged user, selecting lsass.exe, and clicking “Create dump file”. This saves a dump file to disk with a deterministic name that includes the name of the process being dumped. ● This requires filesystem data to determine whether files have been created. ● Contributors: Tony Lambert/Red Canary 100https://car.mitre.org/analytics/CAR-2019-08-001/
But, How do I simulate that technique? 101
Interactive Task Manager Lsass dump (Demo 03) 102 https://github.com/hunters- forge/mordor/blob/master/small_datasets/windows/credential_access/credential_dumping_T1003/interactive_taskmngr_ls
Interactive Task Manager Lsass dump (Demo 03) 103 https://github.com/hunters- forge/mordor/blob/master/small_datasets/windows/credential_access/credential_dumping_T1003/interactive_taskmngr_ls
CAR-2019-08-001: Procdump - File Create (Pseudocode) files = search File:Create lsass_dump = filter files where ( file_name = "lsass*.dmp" and image_path = "C:Windows*taskmgr.exe") output lsass_dump 104https://car.mitre.org/analytics/CAR-2019-08-001/
But, where do I run that? 105
Enter Jupyter Notebooks 106
What are Jupyter Notebooks? ● Think of a notebook as a document that you can access via a web interface that allows you to save: ○ Input (live code) ○ Output (evaluated code output) ○ Visualizations and narrative text (Tell the story!) ● Uses include: ○ Data cleaning and transformation ○ Statistical modeling ○ Data visualization ○ Machine learning, and much more 107https://jupyter.org/
How Do Jupyter Notebooks Work? ● Jupyter Notebooks work with what is called a two-process model based on a kernel-client infrastructure. ● This model applies Read-Evaluate-Print Loop (REPL): ○ Takes a single user’s inputs ○ Evaluates them ○ Returns the result to the user 108https://jupyter.org/
Jupyter Notebooks Architecture 109https://jupyter.org/ WebSockets ZeroMQ Notebook File (json) Client KernelJupyter Server Jupyter Document
Mordor -> Jupyter Notebooks CAR-2019-08-001: Credential Dumping via Windows Task Manager 110
The ThreatHunter-Playbook @HunterPlaybook ● A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns by leveraging security event logs from diverse operating systems. ● It documents detection strategies in the form of interactive notebooks to provide an easy and flexible way to visualize the expected output and be able to run the analytics against pre- recorded mordor datasets 111https://github.com/hunters-forge/ThreatHunter-Playbook
OpenHunt Library ● Via PIP: pip install openhunt ● Or Straight from Source git clone https://github.com/Cyb3rPanda/openhunt cd OpenHunt && pip install . 112https://github.com/hunters-forge/openhunt
Is You Ready? haha 114
Hunt The Planet! 115
Threat Hunters Forge Community! 116
Threat Hunters Forge Slack Community! 117 https://launchpass.com/threathunting
Remember this initiative with Mordor? 118
What if everyone gets a notebook too? 119
Wait, Whaaat? 120
Wait, Whaaat? 121
The Binder Project 122 ● The Binder Project is an open community that makes it possible to create shareable, interactive, reproducible environments. ● The main technical product that the community creates is called BinderHub, and one deployment of a BinderHub exists at mybinder.org. ● Who is it for?: ○ Researchers, Educators, people analyzing data and people trying to communicate the data analysis to others!! https://mybinder.readthedocs.io/en/latest/introduction.html#what-is-the-binder-project
BinderHub 123 BinderHub connects several services together to provide on-the-fly creation and registry of Docker images. It utilizes the following tools: ● A cloud provider such Google Cloud, Microsoft Azure, Amazon EC2, and others ● Kubernetes to manage resources on the cloud ● Helm to configure and control Kubernetes ● Docker to use containers that standardize computing environments ● A BinderHub UI that users can access to specify Git repos they want built ● BinderHub to generate Docker images using the URL of a Git repository ● A Docker registry (such as gcr.io) that hosts container images ● JupyterHub to deploy temporary containers for users https://binderhub.readthedocs.io/en/latest/overview.html
Binder Design! 124 Repo2Docker Pod https://github.com/repo https://github.com/repo Docker Image Exists? No Push Image Up to date? Yes NoYes Kubernetes Cluster Jupyter Notebook Pod Docker Registry https://binderhub.readthedocs.io/en/latest/overview.html#a-diagram-of-the-binderhub-architecture Creates
Open Infrastructure for Open Hunts! 125https://github.com/hunters-forge/ThreatHunter-Playbook
Open Infrastructure for Open Hunts! (LIVE!) https://mybinder.org/v2/gh/ hunters-forge/ThreatHunter- Playbook/master 126
Threat Hunter Playbooks via Binder (Video) 127https://github.com/hunters-forge/ThreatHunter-Playbook
128
Goal: Share and Empower the Community! 129
Let’s do it together! 130
Threat Hunters Forge References ● GitHub: https://github.com/hunters-forge ● Python Library: https://github.com/Cyb3rPanda/openhunt ● Slack Invitation: https://launchpass.com/threathunting ● Official Blog: https://medium.com/threat-hunters-forge ● Founders: @Cyb3rWard0g & @Cyb3rPandaH ● Official Twitter: @HuntersForge ● @HunterPlaybook ● @THE_HELK ● @OSSEM_Project, @Mordor_Project & More
Thank You! Muchas Gracias! 132

More Related Content

PDF
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
PDF
State of the ATT&CK
byMITRE ATT&CK
 
PDF
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
byMITRE - ATT&CKcon
 
PPTX
DSS RMF Training.pptx
byMuhammad Mazhar
 
PDF
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PDF
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
State of the ATT&CK
byMITRE ATT&CK
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
byMITRE - ATT&CKcon
 
DSS RMF Training.pptx
byMuhammad Mazhar
 
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 

What's hot

PDF
Threat Hunting with Splunk Hands-on
bySplunk
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PPTX
Cyber kill chain
byAnkita Ganguly
 
PDF
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
byMITRE - ATT&CKcon
 
PDF
Understanding the NIST Risk Management Framework: 800-37 Rev. 2
byDenise Tawwab
 
PDF
Empower Your Security Practitioners with Elastic SIEM
byElasticsearch
 
PPTX
Crowdstrike .pptx
byuthayakumar174828
 
PDF
Cyber Security For Organization Proposal PowerPoint Presentation Slides
bySlideTeam
 
PDF
From SIEM to SOC: Crossing the Cybersecurity Chasm
byPriyanka Aash
 
PPTX
NIST CyberSecurity Framework: An Overview
byTandhy Simanjuntak
 
PDF
Cybersecurity risk management 101
bySrinivasan Vanamali
 
PDF
Threat Hunting Report
byMorane Decriem
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
PPTX
IBM QRadar BB & Rules
byMuhammad Abdel Aal
 
PPTX
Roadmap to security operations excellence
byErik Taavila
 
PDF
Global Cyber Threat Intelligence
byNTT Innovation Institute Inc.
 
PPTX
Basic Malware Analysis
byAlbert Hui
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
PDF
A Big Picture of IEC 62443 - Cybersecurity Webinar (2) 2020
byJiunn-Jer Sun
 
Threat Hunting with Splunk Hands-on
bySplunk
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
Cyber kill chain
byAnkita Ganguly
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
byMITRE - ATT&CKcon
 
Understanding the NIST Risk Management Framework: 800-37 Rev. 2
byDenise Tawwab
 
Empower Your Security Practitioners with Elastic SIEM
byElasticsearch
 
Crowdstrike .pptx
byuthayakumar174828
 
Cyber Security For Organization Proposal PowerPoint Presentation Slides
bySlideTeam
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
byPriyanka Aash
 
NIST CyberSecurity Framework: An Overview
byTandhy Simanjuntak
 
Cybersecurity risk management 101
bySrinivasan Vanamali
 
Threat Hunting Report
byMorane Decriem
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
IBM QRadar BB & Rules
byMuhammad Abdel Aal
 
Roadmap to security operations excellence
byErik Taavila
 
Global Cyber Threat Intelligence
byNTT Innovation Institute Inc.
 
Basic Malware Analysis
byAlbert Hui
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
A Big Picture of IEC 62443 - Cybersecurity Webinar (2) 2020
byJiunn-Jer Sun
 

Similar to MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate Your Data Analytics; Roberto Rodriguez, AWS and Jose Rodriguez, NVCC

PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
PDF
Breach > ATT&CK > Osquery: Cross-platform Endpoint Monitoring with Osquery
byUptycs
 
PDF
FINDING FORENSIC ARTIFACTS FROM WINDOW REGISTRY
bynitinparashar786
 
PDF
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
byMITRE ATT&CK
 
PDF
Started from the Bottom: Exploiting Data Sources to Uncover ATT&CK Behaviors
byJamieWilliams130
 
PDF
MITRE-Module 4 Slides.pdf
byReZa AdineH
 
PDF
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
PDF
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
PDF
ISACA -Threat Hunting using Native Windows tools .pdf
byGurvinder Singh, CISSP, CISA, ITIL v3
 
PPTX
Windows Event Analysis - Correlation for Investigation
byMahendra Pratap Singh
 
PPTX
Adversary tactics config mgmt-&amp;-logs-oh-my
byJesse Moore
 
PDF
MITRE AttACK framework it is time you took notice_v1.0
byMichael Gough
 
PDF
State of the ATT&CK May 2023
byAdam Pennington
 
PDF
Hta f42
bySelectedPresentations
 
PDF
MITRE-Module 5 Slides.pdf
byReZa AdineH
 
PDF
williams-wwhf-20210617-eventlogs.pdf
byVinceVulpes
 
PDF
Update from the MITRE ATT&CK Team
byAdam Pennington
 
PPTX
Billions & Billions of Logs
byJack Crook
 
PDF
One Technique, Two Techniques, Red Technique, Blue Technique
byDaniel Weiss
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
Breach > ATT&CK > Osquery: Cross-platform Endpoint Monitoring with Osquery
byUptycs
 
FINDING FORENSIC ARTIFACTS FROM WINDOW REGISTRY
bynitinparashar786
 
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
byMITRE ATT&CK
 
Started from the Bottom: Exploiting Data Sources to Uncover ATT&CK Behaviors
byJamieWilliams130
 
MITRE-Module 4 Slides.pdf
byReZa AdineH
 
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
ISACA -Threat Hunting using Native Windows tools .pdf
byGurvinder Singh, CISSP, CISA, ITIL v3
 
Windows Event Analysis - Correlation for Investigation
byMahendra Pratap Singh
 
Adversary tactics config mgmt-&amp;-logs-oh-my
byJesse Moore
 
MITRE AttACK framework it is time you took notice_v1.0
byMichael Gough
 
State of the ATT&CK May 2023
byAdam Pennington
 
Hta f42
bySelectedPresentations
 
MITRE-Module 5 Slides.pdf
byReZa AdineH
 
williams-wwhf-20210617-eventlogs.pdf
byVinceVulpes
 
Update from the MITRE ATT&CK Team
byAdam Pennington
 
Billions & Billions of Logs
byJack Crook
 
One Technique, Two Techniques, Red Technique, Blue Technique
byDaniel Weiss
 

More from MITRE - ATT&CKcon

PDF
State of the ATTACK
byMITRE - ATT&CKcon
 
PDF
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
byMITRE - ATT&CKcon
 
PDF
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
byMITRE - ATT&CKcon
 
PDF
MITRE ATTACKcon Power Hour - January
byMITRE - ATT&CKcon
 
PDF
Using ATTACK to Create Cyber DBTS for Nuclear Power Plants
byMITRE - ATT&CKcon
 
PDF
Sharpening your Threat-Hunting Program with ATTACK Framework
byMITRE - ATT&CKcon
 
PDF
Helping Small Companies Leverage CTI with an Open Source Threat Mapping
byMITRE - ATT&CKcon
 
PDF
What's New with ATTACK for ICS?
byMITRE - ATT&CKcon
 
PDF
From Theory to Practice: How My ATTACK Perspectives Have Changed
byMITRE - ATT&CKcon
 
PDF
Putting the PRE into ATTACK
byMITRE - ATT&CKcon
 
PDF
What's a MITRE with your Security?
byMITRE - ATT&CKcon
 
PDF
ATTACKing the Cloud: Hopping Between the Matrices
byMITRE - ATT&CKcon
 
PDF
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile
byMITRE - ATT&CKcon
 
PDF
Transforming Adversary Emulation Into a Data Analysis Question
byMITRE - ATT&CKcon
 
PDF
TA505: A Study of High End Big Game Hunting in 2020
byMITRE - ATT&CKcon
 
PDF
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
byMITRE - ATT&CKcon
 
PDF
What's New with ATTACK for Cloud?
byMITRE - ATT&CKcon
 
PDF
Starting Over with Sub-Techniques
byMITRE - ATT&CKcon
 
PDF
MITRE ATTACKCon Power Hour - December
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon Power Hour - November
byMITRE - ATT&CKcon
 
State of the ATTACK
byMITRE - ATT&CKcon
 
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
byMITRE - ATT&CKcon
 
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
byMITRE - ATT&CKcon
 
MITRE ATTACKcon Power Hour - January
byMITRE - ATT&CKcon
 
Using ATTACK to Create Cyber DBTS for Nuclear Power Plants
byMITRE - ATT&CKcon
 
Sharpening your Threat-Hunting Program with ATTACK Framework
byMITRE - ATT&CKcon
 
Helping Small Companies Leverage CTI with an Open Source Threat Mapping
byMITRE - ATT&CKcon
 
What's New with ATTACK for ICS?
byMITRE - ATT&CKcon
 
From Theory to Practice: How My ATTACK Perspectives Have Changed
byMITRE - ATT&CKcon
 
Putting the PRE into ATTACK
byMITRE - ATT&CKcon
 
What's a MITRE with your Security?
byMITRE - ATT&CKcon
 
ATTACKing the Cloud: Hopping Between the Matrices
byMITRE - ATT&CKcon
 
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile
byMITRE - ATT&CKcon
 
Transforming Adversary Emulation Into a Data Analysis Question
byMITRE - ATT&CKcon
 
TA505: A Study of High End Big Game Hunting in 2020
byMITRE - ATT&CKcon
 
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
byMITRE - ATT&CKcon
 
What's New with ATTACK for Cloud?
byMITRE - ATT&CKcon
 
Starting Over with Sub-Techniques
byMITRE - ATT&CKcon
 
MITRE ATTACKCon Power Hour - December
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon Power Hour - November
byMITRE - ATT&CKcon
 

Recently uploaded

PDF
Usage Control for Process Discovery through a Trusted Execution Environment
byValerioGoretti
 
PPTX
Chapter 3 Introduction to number system.pptx
byGetachewAbera9
 
PPTX
Cybersecurity Best Practices - Step by Step guidelines
byYasir Naveed Riaz
 
DOCX
Introduction to the World of Computers (Hardware & Software)
byALIABBAS ABASOV
 
PDF
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
PDF
The major tech developments for 2026 by Pluralsight, a research and training ...
byChris Skinner
 
PDF
DevFest El Jadida 2025 - Product Thinking
byElmehdi AMLOU
 
PDF
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
PDF
GPUS and How to Program Them by Manya Bansal
byScyllaDB
 
PPTX
From Backup to Resilience: How MSPs Are Preparing for 2026
byMSP360
 
PPTX
Cybercrime in the Digital Age: Risks, Impact & Protection
byYasir Naveed Riaz
 
PPTX
wob-report.pptxwob-report.pptxwob-report.pptx
byssuser0d171c
 
PPTX
Unit-4-ARTIFICIAL NEURAL NETWORKS.pptx ANN ppt Artificial neural network
byssuserd4481a
 
PPTX
Building Cyber Resilience for 2026: Best Practices for a Secure, AI-Driven Bu...
byYasir Naveed Riaz
 
PPTX
Conversational Agents – Building Intelligent Assistants [Virtual Hands-on Wor...
byUiPathCommunity
 
PDF
Digit Expo 2025 - EICC Edinburgh 27th November
byRay Bugg
 
PDF
Our Digital Tribe_ Cultivating Connection and Growth in Our Slack Community 🌿...
bysanjeetmishra30
 
PDF
Day 3 - Data and Application Security - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
PPT
software-security-intro in information security.ppt
byismaeelsahib032
 
PPTX
AI in Cybersecurity: Digital Defense by Yasir Naveed Riaz
byYasir Naveed Riaz
 
Usage Control for Process Discovery through a Trusted Execution Environment
byValerioGoretti
 
Chapter 3 Introduction to number system.pptx
byGetachewAbera9
 
Cybersecurity Best Practices - Step by Step guidelines
byYasir Naveed Riaz
 
Introduction to the World of Computers (Hardware & Software)
byALIABBAS ABASOV
 
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
The major tech developments for 2026 by Pluralsight, a research and training ...
byChris Skinner
 
DevFest El Jadida 2025 - Product Thinking
byElmehdi AMLOU
 
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
GPUS and How to Program Them by Manya Bansal
byScyllaDB
 
From Backup to Resilience: How MSPs Are Preparing for 2026
byMSP360
 
Cybercrime in the Digital Age: Risks, Impact & Protection
byYasir Naveed Riaz
 
wob-report.pptxwob-report.pptxwob-report.pptx
byssuser0d171c
 
Unit-4-ARTIFICIAL NEURAL NETWORKS.pptx ANN ppt Artificial neural network
byssuserd4481a
 
Building Cyber Resilience for 2026: Best Practices for a Secure, AI-Driven Bu...
byYasir Naveed Riaz
 
Conversational Agents – Building Intelligent Assistants [Virtual Hands-on Wor...
byUiPathCommunity
 
Digit Expo 2025 - EICC Edinburgh 27th November
byRay Bugg
 
Our Digital Tribe_ Cultivating Connection and Growth in Our Slack Community 🌿...
bysanjeetmishra30
 
Day 3 - Data and Application Security - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
software-security-intro in information security.ppt
byismaeelsahib032
 
AI in Cybersecurity: Digital Defense by Yasir Naveed Riaz
byYasir Naveed Riaz
 

MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate Your Data Analytics; Roberto Rodriguez, AWS and Jose Rodriguez, NVCC

  • 1.
    Ready to ATT&CK? BringYour Own Data (BYOD) and Validate Your Data Analytics! 1
  • 2.
    @Cyb3rWard0g & @Cyb3rPandaH ●Projects ○ @HunterPlaybook ○ @THE_HELK ○ ATTACK-Python-Client ○ @OSSEM_Project ○ @Mordor_Project ○ OpenHunt ○ Blacksmith & More ● Founders: ○ @HuntersForge 2https://github.com/hunters-forge
  • 3.
    Agenda ● Explore ATT&CK ●2018 -> 2019 ● ATT&CK Data Sources Opportunities ● Enter Mordor ● Mordor & CAR ● CAR & Threat Hunter Playbook (Notebooks) ● Hunters Forge! 3
  • 4.
    Explore ATT&CK How doI query ATT&CK? 4
  • 5.
  • 6.
    How do Iaccess ATT&CK Metadata? 6
  • 7.
    ATTACK-Python-Client Github Project ●A Python module to access up to date ATT&CK content available in STIX via public TAXII server. It leverages cti-python-stix2 and cti- taxii-client python libraries developed by MITRE. ● Goals ○ Allow the integration of ATT&CK content with other platforms ○ Allow security analysts to quickly explore ATT&CK content and apply it in their daily operations ○ Explore all available ATT&CK metadata at once ○ Learn STIX2 and TAXII Client Python libraries https://github.com/hunters-forge/ATTACK-Python-Client 7
  • 8.
    ATTACK-Python-Client Installation ● ViaPIP: pip install attackcti ● Or Straight from Source ○ git clone https://github.com/hunters- forge/ATTACK-Python-Client ○ cd ATTACK-Python-Client ○ pip install . ● Jupyter Notebooks Available ○ pip install -r requirements.txt ○ cd notebooks ○ jupyter lab https://github.com/hunters-forge/ATTACK-Python-Client 8
  • 9.
  • 10.
    ATT&CK Metadata -Jupyter Notebook https://github.com/hunters-forge/ATTACK-Python-Client/tree/master/notebooks 10
  • 11.
  • 12.
  • 13.
  • 14.
    Explore ATT&CK Any NewData Sources? 14
  • 15.
    ATT&CK Techniques (519)and Data Sources ● Almost 51% of techniques have data sources defined ● Around 49% of techniques do NOT have data sources defined ● Pre-ATT&CK data sources maybe? ● Opportunities to collaborate and define those without data sources? https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb 15
  • 16.
    ATT&CK Techniques (519)and Data Sources 16https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb
  • 17.
    Looking for anythingto do this weekend? 17https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb
  • 18.
    ATT&CK Techniques withData Sources (265) 18 Process Monitoring: 178 TechniquesFile Monitoring: 107 Techniques Process Command Line: 103 Techniques https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb
  • 19.
    ATT&CKing with theright data ATT&CKcon 2018 Talk! 19
  • 20.
    Credentials in Registry-> DS -> Sub-DS -> Events 20 T1214 Windows Registry Process Monitoring Process Command-Line Parameters Process Creation Process created Process Process Write To Process Process Process Process Access Process Process Security 4688 Sysmon 1 Security 4689 Sysmon 8 Sysmon 10 Process Termination User terminated Process wrote_to accessed https://www.youtube.com/watch?v=QCDBjFJ_C3g
  • 21.
    ATT&CK Data (OSSEM->attack_data_sources) https://github.com/hunters-forge/OSSEM 21
  • 22.
    A lot moreto do.. Going deeper! 22
  • 23.
    API-To-Event Project (WindowsSecurity) https://github.com/hunters-forge/API-To-Event 23
  • 24.
  • 25.
    API-To-Event Project (WindowsSysmon) https://github.com/hunters-forge/API-To-Event 25
  • 26.
  • 27.
    A few opportunities! ExploringData Sources 2.0! 27
  • 28.
    A few opportunities.. ●ATT&CK Data sources covered by other data sources ● Windows Event Logs data source is too broad! ● ATT&CK data sources and the wrong platforms! ● Validation of ATT&CK data sources recommendations ○ What specific event logs per data source? 28
  • 29.
    A few opportunities! ●ATT&CK Data sources covered by other data sources ● Windows Event Logs data source is too broad! 29
  • 30.
    Credentials in Registry- Windows Registry 30https://www.youtube.com/watch?v=QCDBjFJ_C3g T1214 Windows Registry Process Monitoring Process Command-Line Parameters Registry Creation Process created Registry Registry Modification Process Registry Registry Access Process Registry Sysmon 12 Sysmon 12 Security 4663 Security 4657 Security 4663 Registry Deletion Process deleted Registry modified accessed Sysmon 13
  • 31.
    Windows Registry &Windows Security Event Logs? 31https://www.youtube.com/watch?v=QCDBjFJ_C3g T1214 Windows Registry Process Monitoring Process Command-Line Parameters Registry Creation Process created Registry Registry Modification Process Registry Registry Access Process Registry Sysmon 12 Sysmon 12 Security 4663 Security 4657 Security 4663 Registry Deletion Process deleted Registry modified accessed Sysmon 13
  • 32.
    ATT&CK Techniques withData Sources (265) 32 Process Monitoring: 178 TechniquesFile Monitoring: 107 Techniques Process Command Line: 103 Techniques https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb
  • 33.
    ATT&CK Techniques withData Sources (265) 33 Process Monitoring: 178 TechniquesFile Monitoring: 107 Techniques Process Command Line: 103 Techniques https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb Windows Event Logs
  • 34.
    Windows Event Logs… a Universe Behind? 34https://www.youtube.com/watch?v=QCDBjFJ_C3g Windows Event Logs 4656 4657 4658 4660 4670 4663 4741 4742 4743 4776 4768 4771 4769 4770 5144 5140 5143 5142
  • 35.
    Windows Event Logs 35 Windows EventLogs 4656 https://www.youtube.com/watch?v=QCDBjFJ_C3g 4657 4658 4660 4670 4663 Audit Registry Win Registry Deletion Request Win Registry Key Value Modification Win Registry Access Request Win Registry Key Handle Closed Win Registry Key Deletion Win Registry Key Permissions Change Win Registry Key Access Win Registry Key Deletion Audit Computer Account Management 4741 4742 4743 Computer Account Creation Computer Account Change Computer Account Deletion
  • 36.
    Windows Event Logs 36 Windows EventLogs 4656 https://www.youtube.com/watch?v=QCDBjFJ_C3g 4657 4658 4660 4670 4663 Audit Registry Win Registry Deletion Request Win Registry Key Value Modification Win Registry Access Request Win Registry Key Handle Closed Win Registry Key Deletion Win Registry Key Permissions Change Win Registry Key Access Win Registry Key Deletion Audit Computer Account Management 4741 4742 4743 Computer Account Creation Computer Account Change Computer Account Deletion
  • 37.
    Windows Event Logs 37 Windows EventLogs 4656 https://www.youtube.com/watch?v=QCDBjFJ_C3g 4657 4658 4660 4670 4663 Audit Registry Win Registry Deletion Request Win Registry Key Value Modification Win Registry Access Request Win Registry Key Handle Closed Win Registry Key Deletion Win Registry Key Permissions Change Win Registry Key Access Win Registry Key Deletion
  • 38.
    Windows Event Log4656: A handle to an object was requested 38https://www.youtube.com/watch?v=QCDBjFJ_C3g Windows Registry 4656 Audit Registry Audit File System Win Registry Deletion Request Win Registry Access Request File Monitoring File Deletion Request File Access Request
  • 39.
    Windows Event Log4657: A registry value was modified 39https://www.youtube.com/watch?v=QCDBjFJ_C3g Windows Registry 4656 Audit Registry Audit File System Win Registry Deletion Request Win Registry Access Request File Monitoring File Deletion Request File Access Request Windows Registry 4657 Audit Registry Win Registry Key Value Modification
  • 40.
    Windows Event Log4658: The handle to an object was closed 40https://www.youtube.com/watch?v=QCDBjFJ_C3g Windows Registry 4656 Audit Registry Audit File System Win Registry Deletion Request Win Registry Access Request File Monitoring File Deletion Request File Access Request File Monitoring4658 Audit File System File Handle Closed Windows Registry 4657 Audit Registry Win Registry Key Value Modification
  • 41.
  • 42.
    A few opportunities! ATT&CKdata sources and the wrong platforms! 42
  • 43.
    ATT&CK Windows DataSources & Platform (2019) 43https://github.com/hunters-forge/ATTACK-Python-Client/blob/master/notebooks/ATT%26CK_DataSources.ipynb
  • 44.
    A few opportunities! ●Validation of ATT&CK data sources recommendations ○ What specific event logs per data source? 44
  • 45.
    Credentials in Registry- Windows Registry 45https://www.youtube.com/watch?v=QCDBjFJ_C3g T1214 Windows Registry Process Monitoring Process Command-Line Parameters Security 4656 Security 4657 Security 4658 Security 4660 Security 4670 Security 4663 Win Registry Deletion Request Win Registry Key Value Modification Win Registry Access Request Win Registry Key Handle Closed Win Registry Key Permissions Change Win Registry Key Deletion Win Registry Key Access Sysmon 12 Sysmon 13
  • 46.
    Wait! Where isall this happening so far? 46
  • 47.
    Data Analytics Development(Example) 47 Define a Research Goal Simulate Adversary Define Detection Model Validate Detection Model Document and Communicate Findings Model Data https://www.youtube.com/watch?v=DuUF-zXUzPs
  • 48.
    Data Analytics Development(Example) 48 Define a Research Goal Simulate Adversary Define Detection Model Validate Detection Model Document and Communicate Findings Model Data https://www.youtube.com/watch?v=DuUF-zXUzPs
  • 49.
    How do wevalidate our data recommendations? 49
  • 50.
    Data Analytics Development(Example) 50 Define a Research Goal Simulate Adversary Define Detection Model Validate Detection Model Document and Communicate Findings Model Data https://www.youtube.com/watch?v=DuUF-zXUzPs
  • 51.
    More than justtesting security controls! 51 Simulate Adversary Test Security Controls Model Adversary Behavior ● Endpoint Agent Detection ● Analytics Platform Rules ● Can I see it in my environment? ● Learn adversary behavior ● Map data sources to adversary actions ● Study derived techniques
  • 52.
    A basic adversarysimulation flow! 52https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1571754303.pdf Plan Engagement Emulate Adversary Collect & Analyze Data Can I see it? Enable Telemetry No Document Results Yes
  • 53.
    What do weneed for Credentials in Registry? 53https://attack.mitre.org/techniques/T1214/
  • 54.
    What do weneed for Credentials in Registry? 54https://attack.mitre.org/techniques/T1214/
  • 55.
    What else dowe need for Credentials in Registry? 55 ● Windows Registry? ○ Enable Audit Object Access > Audit Registry ● Process Monitoring? ○ Enable Audit Detailed Tracking > Audit Process Creation ● Process Command-line Parameters? ○ Enable Administrative TemplatesSystemAudit Process Creation > Include command line in process creation events
  • 56.
    What else dowe need for Credentials in Registry? 56https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists ● Windows Registry? ○ Enable Audit Object Access > Audit Registry ○ Set Audit Rule to trigger event! ● Process Monitoring? ○ Enable Audit Detailed Tracking > Audit Process Creation ● Process Command-line Parameters? ○ Enable Administrative TemplatesSystemAudit Process Creation > Include command line in process creation events
  • 57.
    What else dowe need for Credentials in Registry? 57https://github.com/hunters-forge/Blacksmith/blob/master/aws/mordor/cfn-files/scripts/default/Join-Domain.ps1#L37-L49 ● What are we testing? ○ Available default automatic logon user Settings!! Set-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" - Name AutoAdminLogon -Value 1 Set-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" - Name DefaultUserName -Value pgustavo Set-ItemProperty "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" - Name DefaultPassword -Value W1n1!2019
  • 58.
    What else dowe need for Credentials in Registry? 58https://github.com/hunters-forge/Set-AuditRule/blob/master/registry/default_logon_user.md ● Set Audit Rule! How? ○ Download https://github.com/hunters-forge/Set-AuditRule ○ Import-module Set-AuditRule.ps1 ○ Set-AuditRule -RegistryPath "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" -IdentityReference Everyone - Rights QueryValues -InheritanceFlags None -PropagationFlags None -AuditFlags Success
  • 59.
    What else dowe need for Credentials in Registry? 59 ● Testing Commands? ○ reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" /f password /t REG_SZ /s
  • 60.
    What about techniquevariations? 60
  • 61.
    What else dowe need for Credentials in Registry? 61 ● Testing Commands? ○ reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" /f password /t REG_SZ /s ○ Get-ItemProperty -Path "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" -Name *password* ○ C#, Python, etc!
  • 62.
  • 63.
    We need anenvironment setup.. working! 63
  • 64.
    Execute -> Collect-> Analyze -> Repeat 64 Model Adversary Behavior Test Security Controls Data produced Simulating Adversarial Technique
  • 65.
    Same Technique +Some Variations 65 Model Adversary Behavior Test Security Controls Data produced
  • 66.
    Credentials in RegistryData Mapping 66 Process Registry Key Value Queried
  • 67.
    Credentials in RegistryData Mapping 67 Process Registry Key Value Queried EVENT ID TASK 4688 Process Creation 4673 Sensitive Privilege Use 4656 Registry (Request Handle) 4690 Handle Manipulation 4663 Registry (Access) 4658 Registry (Closing Handle) 4689 Process Termination
  • 68.
    Credentials in RegistryData Mapping 68 Process Registry Key Value Queried EVENT ID TASK 4688 Process Creation 4673 Sensitive Privilege Use 4656 Registry (Request Handle) 4690 Handle Manipulation 4663 Registry (Access) 4658 Registry (Closing Handle) 4689 Process Termination Process Monitoring Process Command-Line Parameters Windows Registry Process Monitoring
  • 69.
    Credentials in Registry- Windows Registry 69https://www.youtube.com/watch?v=QCDBjFJ_C3g T1214 Windows Registry Process Monitoring Process Command-Line Parameters Security 4656 Security 4657 Security 4658 Security 4660 Security 4670 Security 4663 Win Registry Deletion Request Win Registry Key Value Modification Win Registry Access Request Win Registry Key Handle Closed Win Registry Key Permissions Change Win Registry Key Deletion Win Registry Key Access Sysmon 12 Sysmon 13
  • 70.
    Credentials in Registry- Windows Registry 70https://www.youtube.com/watch?v=QCDBjFJ_C3g T1214 Windows Registry Process Monitoring Process Command-Line Parameters Security 4656 Security 4657 Security 4658 Security 4660 Security 4670 Security 4663 Win Registry Deletion Request Win Registry Key Value Modification Win Registry Access Request Win Registry Key Handle Closed Win Registry Key Permissions Change Win Registry Key Deletion Win Registry Key Access Sysmon 12 Sysmon 13
  • 71.
    Spending +time producingdata & -time analyzing 71 Model Adversary Behavior Test Security Controls Data produced Takes Time! Similar Events?
  • 72.
    Same Technique +Some Variations 72 Model Adversary Behavior Test Security ControlsEVENT ID TASK 4688 Process Creation 4673 Sensitive Privilege Use 4656 Registry (Request Handle) 4690 Handle Manipulation 4663 Registry (Access) 4658 Registry (Closing Handle) 4689 Process Termination
  • 73.
    We might beall doing this.. 73
  • 74.
    We might bedoing this over and over.. 74
  • 75.
    What if weshare our datasets? 75
  • 76.
    From Zero toData Analytics Validation! 76
  • 77.
  • 78.
    Mordor Project @Mordor_Project ●Pre-recorded security events generated by simulated adversarial techniques in the form of JavaScript Object Notation (JSON) ● Pre-recorded data categorized by platforms, adversary groups, tactics and techniques defined by the Mitre ATT&CK Framework. ● Data represents not only specific known malicious events but additional context/events that occur around it. 78https://github.com/Cyb3rWard0g/mordor
  • 79.
    Mordor Standard Environments ●Environment designed to replicate a small research network ● Standardized and documented setup ● Platforms ○ Windows ○ Linux ● Endpoints Telemetry ○ Windows Security Auditing ○ Event Tracing for Windows (ETW) (NEW!!) ● Network Telemetry ○ Network Logs ● Environments Available: Shire and Erebor 79https://mordor.readthedocs.io/en/latest/index.html
  • 80.
  • 81.
  • 82.
    The Shire Telemetry:Win Logs & Sysmon 82https://github.com/Cyb3rWard0g/OSSEM/tree/master/data_dictionaries/windows/sysmon
  • 83.
    The Shire: EventLog -> WEC -> HELK 83https://mordor.readthedocs.io/en/latest/mordor_shire.html#
  • 84.
    Mordor Environments: Erebor(Lonely Mountain) 84
  • 85.
  • 86.
    Erebor Telemetry: ETWEvents via SilkETW 86https://medium.com/threat-hunters-forge/threat-hunting-with-etw-events-and-helk-part-1-installing-silketw-6eb74815e4a0
  • 87.
    Erebor: ETW Events-> Event Log -> WEC -> HELK 87
  • 88.
    How do youcollect data? ● We use Kafkacat! ● kafkacat is a generic non-JVM producer and consumer for Apache Kafka >=0.8, think of it as a netcat for Kafka. ● In consumer mode ○ Kafkacat reads messages from a topic and prints them to standard output (stdout). You can also redirect it to a file (i.e. JSON) ● In producer mode ○ Kafkacat reads messages from standard input (stdin). You can also send data to kafkacat by adding data from a file. 88https://github.com/edenhill/kafkacat
  • 89.
    Consuming Data (Takinga snapshot of data) 89https://mordor.readthedocs.io/en/latest/export_mordor.html $ kafkacat -b <Kafka-IP>:9092 -t <kafka-Topic> -C -o end > file.json ● -b : Kafka broker ● -t : Topic to consume from ● -C : Consumer Mode ● -o : Offset to start consuming from
  • 90.
    Consuming Data ->Creating Mordor File (Video) 90https://mordor.readthedocs.io/en/latest/export_mordor.html
  • 91.
    Consuming Data ->Creating Mordor File (Demo 02) 91https://mordor.readthedocs.io/en/latest/export_mordor.html
  • 92.
    Producing Data (InjectingAdversary Dataset) 92
  • 93.
    Producing Data (InjectingAdversary Dataset) 93https://mordor.readthedocs.io/en/latest/import_mordor.html $ kafkacat -b <Kafka-IP>:9092 -t <kafka-Topic> -P -l file.json ● -b : Kafka broker ● -t : Topic to produce to ● -P : Producer Mode ● -l : Send messages from a file
  • 94.
    I just wantto download all the datasets.. 94 $ git clone https://github.com/hunters- forge/mordor.git $ cd mordor/small_datasets/ $ find . -type f -name "*.tar.gz" -print0 | sudo xargs -0 -I{} tar xf {} -C .
  • 95.
    Expedite Analytics Validation! 95https://github.com/hunters-forge/mordor ModelAdversary Behavior Test Security Controls Data produced YOU CAN DO IT NOW!
  • 96.
  • 97.
    Where do weget analytics from? 97
  • 98.
    I have datawith me and I am ready! 98
  • 99.
    Mordor & CAR TheMITRE Cyber Analytics Repository (CAR)! 99
  • 100.
    CAR-2019-08-001: Credential Dumpingvia Windows Task Manager ● The Windows Task Manager may be used to dump the memory space of lsass.exe to disk for processing with a credential access tool such as Mimikatz. This is performed by launching Task Manager as a privileged user, selecting lsass.exe, and clicking “Create dump file”. This saves a dump file to disk with a deterministic name that includes the name of the process being dumped. ● This requires filesystem data to determine whether files have been created. ● Contributors: Tony Lambert/Red Canary 100https://car.mitre.org/analytics/CAR-2019-08-001/
  • 101.
    But, How doI simulate that technique? 101
  • 102.
    Interactive Task ManagerLsass dump (Demo 03) 102 https://github.com/hunters- forge/mordor/blob/master/small_datasets/windows/credential_access/credential_dumping_T1003/interactive_taskmngr_ls
  • 103.
    Interactive Task ManagerLsass dump (Demo 03) 103 https://github.com/hunters- forge/mordor/blob/master/small_datasets/windows/credential_access/credential_dumping_T1003/interactive_taskmngr_ls
  • 104.
    CAR-2019-08-001: Procdump -File Create (Pseudocode) files = search File:Create lsass_dump = filter files where ( file_name = "lsass*.dmp" and image_path = "C:Windows*taskmgr.exe") output lsass_dump 104https://car.mitre.org/analytics/CAR-2019-08-001/
  • 105.
    But, where doI run that? 105
  • 106.
  • 107.
    What are JupyterNotebooks? ● Think of a notebook as a document that you can access via a web interface that allows you to save: ○ Input (live code) ○ Output (evaluated code output) ○ Visualizations and narrative text (Tell the story!) ● Uses include: ○ Data cleaning and transformation ○ Statistical modeling ○ Data visualization ○ Machine learning, and much more 107https://jupyter.org/
  • 108.
    How Do JupyterNotebooks Work? ● Jupyter Notebooks work with what is called a two-process model based on a kernel-client infrastructure. ● This model applies Read-Evaluate-Print Loop (REPL): ○ Takes a single user’s inputs ○ Evaluates them ○ Returns the result to the user 108https://jupyter.org/
  • 109.
    Jupyter Notebooks Architecture 109https://jupyter.org/ WebSocketsZeroMQ Notebook File (json) Client KernelJupyter Server Jupyter Document
  • 110.
    Mordor -> JupyterNotebooks CAR-2019-08-001: Credential Dumping via Windows Task Manager 110
  • 111.
    The ThreatHunter-Playbook @HunterPlaybook ●A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns by leveraging security event logs from diverse operating systems. ● It documents detection strategies in the form of interactive notebooks to provide an easy and flexible way to visualize the expected output and be able to run the analytics against pre- recorded mordor datasets 111https://github.com/hunters-forge/ThreatHunter-Playbook
  • 112.
    OpenHunt Library ● ViaPIP: pip install openhunt ● Or Straight from Source git clone https://github.com/Cyb3rPanda/openhunt cd OpenHunt && pip install . 112https://github.com/hunters-forge/openhunt
  • 114.
    Is You Ready?haha 114
  • 115.
  • 116.
    Threat Hunters ForgeCommunity! 116
  • 117.
    Threat Hunters ForgeSlack Community! 117 https://launchpass.com/threathunting
  • 118.
    Remember this initiativewith Mordor? 118
  • 119.
    What if everyonegets a notebook too? 119
  • 120.
  • 121.
  • 122.
    The Binder Project 122 ●The Binder Project is an open community that makes it possible to create shareable, interactive, reproducible environments. ● The main technical product that the community creates is called BinderHub, and one deployment of a BinderHub exists at mybinder.org. ● Who is it for?: ○ Researchers, Educators, people analyzing data and people trying to communicate the data analysis to others!! https://mybinder.readthedocs.io/en/latest/introduction.html#what-is-the-binder-project
  • 123.
    BinderHub 123 BinderHub connects severalservices together to provide on-the-fly creation and registry of Docker images. It utilizes the following tools: ● A cloud provider such Google Cloud, Microsoft Azure, Amazon EC2, and others ● Kubernetes to manage resources on the cloud ● Helm to configure and control Kubernetes ● Docker to use containers that standardize computing environments ● A BinderHub UI that users can access to specify Git repos they want built ● BinderHub to generate Docker images using the URL of a Git repository ● A Docker registry (such as gcr.io) that hosts container images ● JupyterHub to deploy temporary containers for users https://binderhub.readthedocs.io/en/latest/overview.html
  • 124.
    Binder Design! 124 Repo2Docker Pod https://github.com/repo https://github.com/repo Docker Image Exists? No Push Image Upto date? Yes NoYes Kubernetes Cluster Jupyter Notebook Pod Docker Registry https://binderhub.readthedocs.io/en/latest/overview.html#a-diagram-of-the-binderhub-architecture Creates
  • 125.
    Open Infrastructure forOpen Hunts! 125https://github.com/hunters-forge/ThreatHunter-Playbook
  • 126.
    Open Infrastructure forOpen Hunts! (LIVE!) https://mybinder.org/v2/gh/ hunters-forge/ThreatHunter- Playbook/master 126
  • 127.
    Threat Hunter Playbooksvia Binder (Video) 127https://github.com/hunters-forge/ThreatHunter-Playbook
  • 128.
  • 129.
    Goal: Share andEmpower the Community! 129
  • 130.
    Let’s do ittogether! 130
  • 131.
    Threat Hunters ForgeReferences ● GitHub: https://github.com/hunters-forge ● Python Library: https://github.com/Cyb3rPanda/openhunt ● Slack Invitation: https://launchpass.com/threathunting ● Official Blog: https://medium.com/threat-hunters-forge ● Founders: @Cyb3rWard0g & @Cyb3rPandaH ● Official Twitter: @HuntersForge ● @HunterPlaybook ● @THE_HELK ● @OSSEM_Project, @Mordor_Project & More
  • 132.
    Thank You! MuchasGracias! 132