Hunting in the Dark - UNC Cybersecurity Symposium 2016

"Hunting" is a key phase of the incident response lifecycle that aims to identify, on a proactive basis, unknown threats lurking in an environment. In practice, many hunting teams focus on searching for public or purchased IOCs­ often representing intelligence that has already been burned. Hunting without specific leads is difficult, and every environment (and incident) has its own unique characteristics. This presentation will provide analytic techniques that can identify generic evidence of post­-compromise activity, with focus on the contemporary approaches that targeted attackers employ for credential harvesting, persistence, and lateral movement in Windows environments. It will illustrate sources of evidence that are ideal for large­-scale anomaly analysis, and provide examples of how to effectively collect data, reduce noise, and minimize dependencies on external threat feeds.

Transcript

1. Hunting in the Dark Ryan Kazanciyan, Chief Security Architect October 5, 2016
2. whoami Copyright 2016 Tanium Inc. All rights reserved. 2
3. Examining an environment, on a proactive or reactive basis, for evidence of malicious activity – without specific investigative leads
4. Goals and success criteria Copyright 2016 Tanium Inc. All rights reserved. 4 • Functional at enterprise-scale • Complementary to IOC & threat feed detection • Repeatable over time
5. My focus for this presentation Copyright 2016 Tanium Inc. All rights reserved. 5 • Endpoint-centric • Widely-available data • Techniques, not specific tools
6. Common Pitfalls
7. Distinguishing normal, interesting, and bad
8. Analysts often radically underestimate the noise level of an enterprise environment
9. Your applications are noisy Copyright 2016 Tanium Inc. All rights reserved. 9 • Different OS versions and add-ons • User-installed applications • Random / GUID file names & paths • Temporary artifacts of software installers • Updates & patches “How many unique PE files (EXEs, DLLs, drivers) have been loaded across all my systems?”
10. Your users are noisy Copyright 2016 Tanium Inc. All rights reserved. 10 • Maintenance and administration scripts • Ad-hoc troubleshooting • Service and application accounts • Misunderstood native OS behavior “How often do my privileged accounts authenticate across the environment?
11. Overwhelming yourself with data, “just in case”…
12. You cannot capture everything, constantly Copyright 2016 Tanium Inc. All rights reserved. 12 • OS-level telemetry • Application-level telemetry • Data at-rest • Volatile memory
13. We’ve been through this already… Copyright 2016 Tanium Inc. All rights reserved. 13 Expectation Reality
14. Falling victim to tunnel vision on “important assets”
15. Defender bias Copyright 2016 Tanium Inc. All rights reserved. 15 “…what may be critical to you…may not be the ‘crown jewels’ from the perspective of the adversary...” “You'll find yourself hunkered down in your Maginot Line bunkers, awaiting that final assault, only to be mystified when it never seems to come.” – Harlan Carvey Source: http://windowsir.blogspot.com)
16. Hacking is graph traversal Copyright 2016 Tanium Inc. All rights reserved. 16
17. Practical example: BloodHound Copyright 2016 Tanium Inc. All rights reserved. 17 • Graph analysis of AD relationships • Identify pathways to privilege escalation https://github.com/adaptivethreat/BloodHound
18. Developing a sustainable hunting strategy
19. Structuring the process Copyright 2016 Tanium Inc. All rights reserved. 19 External IOCs & reputation data Homegrown IOCs & ad- hoc searches Targeted hunting workflows Continuous & automated analysis