Learn how Symantec Endpoint Protection & Response (EDR) and the MITRE ATT&CK framework can expose and thwart persistent adversaries like APT28 otherwise known as Fancy Bear. Watch Webinar here: https://symc.ly/2WyPD8I

1. Using Advanced Detection and
MITRE ATT&CK™ to Cage Fancy
Bear
Adam Glick
Effectiveness Team Lead
Symantec

2. Detection of Advanced
Attack Techniques

3. Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Detect Advanced Attacks in progress
by observing suspicious behavior patterns
3

4. Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
• Microsoft Office attempted to launch C#
compiler
• Script attempted injection into a system
process
• Suspicious process attempted to lower
security warnings
• Credential theft: untrusted process attempted
to load crytography DLLs and to access lsass
memory
• Suspicious PowerShell command: script piped
to powershell.exe
• Untrusted process attempted to write memory
in a Microsoft process
• Script attempted to launch psexec to run a
remote process in the System account
• Attempted write of file masquerading as
operating system file
• Process launch attempted from recycle bin
• Regsvr32 launch attempted with evasive
command line
• Service used to attempt new user creation
• Suspected UAC bypass via registry attempted
• Suspected credential theft attempted by
accessing the registry's Security Accounts
Manager area
• Untrusted process attempted to get Domain
Controller information
• Suspicious attempt to enumerate network
shares
4
For example
And tons more

5. Mitre ATT&CK

6. Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Source: attack.mitre.org 6

7. Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Combined they tell a clear story about
what’s happening and why
7

8. Advanced Attack
APT28 aka Fancy Bear

9. Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only 9
Spear phishing
email
Excel doc
with macro
One time
loader exe
Hidden
DLL
Batch
file
Registry load
point
Living off the land
information gathering,
credential theft,
covering tracks

10. Slides are boring
Show me instead

11. Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
Incident and event information that is simple enough
to be rapidly understood,
with enough detail to be quickly determined to be
credible, important, and actionable.
11

12. Questions ?
Adam Glick
Effectiveness Team Lead
Symantec

13. Copyright © 2018 Symantec Corporation SYMANTEC PROPRIETARY– Limited Use Only
THANK YOU !
13