The Case for EDR: What's In Your Toolkit

© 2017 Cybereason Inc. All rights reserved.
What’s in your toolkit? The Case for EDR

Index
• This presentation:
• About Me
• About Cybereason
• My Job
• Disclaimers
• Products/Vendors
• Defense In Depth
• Examples
• Q/A

About me
• Hometown boy!
• CAL Alumni 2001
• Education
• USF (Double BA in Poly Sci and Finance)
• UofL (Post Bac Cert in Accounting)
• Boston University MET (MS in Comp Sci)
• Work
• American Well: Security Analyst (2015)
• PayPal: Security Engineer (2016-2018)
• Cybereason: Security/Malware Analyst (2019)
• Other
• Jit-Jitsu Whitebelt (Black belt in training)

About Cybereason
• Founded in 2012 by former
members of the elite Israeli
Defense force 8200
• Currently around 500 employees
with $100+ million dollars in
funding, most from Japanese
Softbank
• Offices in Boston, Tel Aviv,
Tokyo, London and Sydney
(more coming soon)

What’s my job?
• Identify the Malware before it spreads
• Drop unidentified Malware into sandbox
• Reverse Engineer Malware
• Triage and make recommendations based on the type of
Malware
• Quarantine vs Re-Image the machine

Disclaimer!
• I’m still learning!!!

Other Disclaimer
• EDR is not meant there is a be all end
all solution!

Which products? Who are the vendors?
Anti-virus
Firewall
WAF

New Generation Products
EDR

Defense in Depth
Recognize this?

Defense in Depth
The Layers

What is EDR?
Endpoint Detection and ResponseRemediation
• Gives a full story
• Shows behaviors and uses data and predictive
analytics to determine malicious behavior
• Addresses the need for continuous monitoring
• Combines many tools for a single purpose which
empowers the analyst as well as the party to
make sure the proper actions are taken
• In other words its helpful!

Attack Lifecycle

Different types of Malware

APT vs. Commodity Malware
WannaCry
• NSA Leak
• Eternal Blue & Double Pulsar

APT vs. Commodity Malware
Stuxnet

Types of Malware
• PUP (potentially unwanted program)
• Applications that would be considered unwanted
despite often having been downloaded by the user.
• Ransomware
• Threatens to publish the victim's data or perpetually
block access(encrypt) to it unless a ransom is paid.

Types of Malware
• Dropper
• Malicious code that exists only to download other malicious
code.
• Information-stealing malware
• Collects information from a victim’s computer and usually sends
it to the attacker.
• Rootkit
• Malicious code designed to conceal the existence of other
code.

Fileless Malware
• What is it?
• Legitimate process being ran in the background
• Data saved in Registry can be called by wscript
• Powershell process one liner process base64 etc pushses straight to
RAM
• Calling invoke expression can run via admin and collect and receive data
and go undetected to typical AV as this is a legitimate process
• Using Operating System against itself
• Cobalt kitty --------------------------

Fileless Malware
• Current Trends
• 42% of companies surveyed by the
Ponemon Institute reported experiencing at
least one fileless malware attack in 2017
and 77% of all successful attacks were
fileless. (https://digitalguardian.com/blog/what-fileless-malware-or-non-malware-attack-
definition-and-best-practices-fileless-malware)
• In the first half of 2018 there was a 94%
increase in fileless malware attacks and 5.2
Powershell attacks per 1000 endpoint
according to Threatpost (https://threatpost.com/threatlist-
ransomware-attacks-down-fileless-malware-up-in-2018/136962/)

Mimikatz
• What is it?
• Open source application (Used both
by Red team and malicious
individuals) to dump clear text
authentication credentials
• By default since windows 8.1 wont
spit out clear text passwords
(Wdigest)

Emotet/Trickbot/Ryuk

Tiny Banker

Tiny Banker
The process ran a DNS query to the following:
vqwgqnbtectr.pw > 216.218.185[.]162
sucjuv.in > 216.218.185[.]162
hbsnmsmlsvib.in > 216.218.185[.]162
ehhrupqrycm.pw > 216.218.185[.]162
uatuwc.pw > 216.218.185[.]162
fpexkrdtxpfs.in > 216.218.185[.]162
okzhyctznzft.pw > 216.218.185[.]162
zawmg.pw > 216.218.185[.]162
lxpcbahva.pw > 216.218.185[.]162
bifcp.in > 216.218.185[.]162
pojde.in > 216.218.185[.]162
And many many more….

Demo
https://www.youtube.com/watch?v=Hc7h-rIyd5A

Q/A
• Feedback
• Joshua.chou@cybereason.com
• jdudeoflife

you.Thank
www.cybereason.com

The Case for EDR: What's In Your Toolkit

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to The Case for EDR: What's In Your Toolkit

Similar to The Case for EDR: What's In Your Toolkit (20)

More from Dawn Yankeelov

More from Dawn Yankeelov (20)

Recently uploaded

Recently uploaded (20)

The Case for EDR: What's In Your Toolkit