Signal The ATT&CK

Security orchestration and automation and its use in enhancing an Endpoint Detection and Response (EDR) capability built around Tanium.

Transcript

1. Signal The ATT&CK Paul Bottomley, PwC Aniket Bhardwaj, PwC Chris Donovan, PwC
3. PwC PwC Signal The ATT&CK EDR Architecture GitHub Docker NiFi Elastic Clusters Pull master branch master branch dev branch Tanium Server 1 Tanium Server 2 Tanium Server n Slack API calls Caldera Attacker Simulation Alerting Orchestration JIRA Ticketing
5. PwC PwC Signal The ATT&CK Recon Weaponize Deliver Exploit Install C2 Actions Anatomy of a Cyber Attack Cyber kill chain methodology Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Execution Collection Exfiltration Network Forensics Network Forensics Target an organization or industry Craft malicious payload Payload sent to Target Compromise System Installation of malware/post exploitation tools Command and Control Ultimate goals achieved Host Forensics
6. PwC PwC Signal The ATT&CK
7. PwC PwC Signal The ATT&CK
8. Signal The ATT&CK
9. Signal The ATT&CK
10. Signal The ATT&CK
12. PwC PwC PwC 12 Signal The ATT&CK
13. PwC PwC PwC 13 Signal The ATT&CK Process Tree
14. PwC PwC PwC 14 Signal The ATT&CK Trace Data
15. 15 Signal The ATT&CK
17. PwC Signal The ATT&CK Host A Discovery Enumerate Computers Enumerate Windows/DNS Enumerate Administrators Initial Access Malicious Excel Macro Spear phishing Persis tence Create HKLM Run Key Execution Download Netcat via Powershell Launch Netcat via Advpack.dll Listen for commands in shell Host B Initial Access Remote execution of RAT Discovery Enumerate Computers Enumerate Windows/DNS Enumerate Administrators etc. Dump passwords with Mimikatz
18. PwC PwC Signal The ATT&CK Future • Machine learning – signals per endpoint, comparisons across estate • Automatic Tanium Signal suppression from the platform • Real-time lookup and correlation with other data sources: • Network: Iceberg, SonarShock • Endpoint: Tanium, Winlogbeat, Auditbeat
19. 19 Signal The ATT&CK Paul Bottomley, paul.m.bottomley [ AT ] pwc.com / @fromCharCode Aniket Bhardwaj, bhardwaj.aniket [ AT ] pwc.com / @anittude Chris Donovan, chris.donovan [ AT ] pwc.com / @Fmtscanf