Threat hunting != Throwing arrow! Hunting for adversaries in your it environment
•
7 likes•877 views
Threat hunting involves proactively searching networks to detect advanced threats that evade existing security solutions. It is not a reactive process like alerting, but instead involves repeated searches through networks using various approaches like data-centric hunting, endpoint hunting, and deception techniques. The document provides examples of hunting techniques for lateral movement, command and control, data exfiltration, and malware on networks. It emphasizes that threat hunting is an ongoing process of iterative searches to continuously identify security threats.
![Md Nahidul Kibria
Co-Founder, Beetles
@nahidupa
[~] $ whoami](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Threat hunting != Throwing arrow! Hunting for adversaries in your it environment
Similar to Threat hunting != Throwing arrow! Hunting for adversaries in your it environment (20)
More from Nahidul Kibria
Recently uploaded
Recently uploaded (20)
Threat hunting != Throwing arrow! Hunting for adversaries in your it environment
- 1. Threat hunting != Throwing arrow! Hunting for adversaries in your IT environment Md Nahidul kibria Co-Founder, Beetles
- 2. Md Nahidul Kibria Co-Founder, Beetles @nahidupa [~] $ whoami
- 3. Threat hunting is a approach to answer that question. Am i compromised today?
- 4. What is hunting? Hunting as the process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security solutions. “You Can’t Hunt That With a Bow and Arrow!
- 5. What is Threat hunting is and is not. Threat hunting != Throwing arrow!
- 6. Threat landscape Cybercriminals Hacktivists Nation state Insiders
- 11. Sensors >> Data >> monitoring
- 13. Hunting vs. Alerting Alerting 1. Reactive 2. Detect/forget Hunting 1. Proactive 2. Repeated searches
- 14. Let's hunt... But from where?
- 15. Approaches to Threat Hunting 1. Data-centric Hunting 2. Hunting on the Endpoint(DFIR) 3. Deception
- 16. Adversary simulation 1. Attacking web application 2. OS Command execute 3. Download malicious files (powershell webclient) 4. Getting reverse shell 5. Privilege escape 6. Scan internal host 7. Lateral Movement
- 17. Data analysis
- 18. Hunt Lateral MovementAttackers quietly traverse your Network.
- 19. Lateral Movement - Techniques, Tactics & Procedures (TTPs) Psexec File shares Powershell Pass-the-hash Scheduled tasks WMI SMB SSH
- 20. Detect using windows event log /Sysmon
- 22. Psexec psexec.exe -i -s %SystemRoot%system32cmd.exe
- 23. Sysmon event - psexc.exe
- 24. Hunt other TTPs “net” Reconnaissance of Domain Admin Group Command C: > net group "Domain Admin" /domain Credential Harvesting with WMI and WCE net use 172.31.3.16 PASSWORD /user:SANDBOXAdministrator copy w.exe 172.31.3.16c$PerfLogs wmic /NODE:172.31.3.16 /USER:"SANDBOXAdministrator" /PASSWORD:"PASSWORD" process call create "cmd /c C:Perflogsw.exe -w > C:Perflogso.txt" Ref: http://www.crypsisgroup.com/images/site/CG_WhitePaper_Splunkmon_1216.pdf
- 26. Sysmon dashboard
- 28. Hunting Command and Control(c2) C2 via Dynamic DNS Finding the Unknown with HTTP URIs Beacon Detection via Intra-Request Time Deltas Finding C2 in Network Sessions
- 31. Hunt for Data Exfiltration
- 32. Producer-Consumer Ratio for Detecting Data Exfiltration Ref https://github.com/ThreatHuntingProject/ThreatHunting/blob/master/hunts/analyze_producer_consumer_ratio.md
- 33. Hunt for Malware
- 34. Unusual Windows Behavior https://www.sans.org/security-resources/posters/dfir-find-evil/35/download
- 35. Query (NewProcessName: "svchost.exe" AND NOT NewProcessName: "C:WindowsSystem32svchost.exe") OR (NewProcessName: "smss.exe" AND NOT NewProcessName: "C:WindowsSystem32smss.exe") OR (NewProcessName: "wininit.exe" AND NOT NewProcessName: "C:WindowsSystem32wininit.exe") OR (NewProcessName: "taskhost.exe" AND NOT NewProcessName: "C:WindowsSystem32taskhost.exe") OR (NewProcessName: "lsass.exe" AND NOT NewProcessName: "C:WindowsSystem32lsass.exe") OR (NewProcessName: "winlogon.exe" AND NOT NewProcessName: "C:WindowsSystem32winlogon.exe") OR (NewProcessName: "explorer.exe" AND NOT NewProcessName: "C:Windowsexplorer.exe") OR (NewProcessName: "lsm.exe" AND NOT NewProcessName: "C:WindowsSystem32lsm.exe") OR (NewProcessName: "services.exe" AND NOT NewProcessName: "C:WindowsSystem32services.exe") OR (NewProcessName: "csrss.exe" AND NOT NewProcessName: "C:WindowsSystem32csrss.exe")
- 36. Svchost.exe with no -k
- 38. Hunt in memory Malware become fileless- Kovter,Poweliks Volatility-/rekall https://github.com/google/rekall
- 39. DEMO
- 41. The Hunting Maturity Model
- 42. Machine Learning for Incident Detection
Editor's Notes
- New in this con Blue team activity Defense Anyone from incident response Hunting is assume that you are already compromised and now you want to know/verify it.
- Pentesting Web application Synack Owasp Sofo
- Not a new concept Not Alert Driven Not a tool or product Not standardized Not a silver bullet
- It take over month
- When everyone in bdnog your org is in under attack
- psexec.exe -i -s %SystemRoot%\system32\cmd.exe
- http://www.crypsisgroup.com/images/site/CG_WhitePaper_Splunkmon_1216.pdf
- http://blog.sqrrl.com/the-cyber-hunting-maturity-model