Upload File

hunting threat actors with tls certificates · hunting threat actors with tls certificates mark...

  • Home
  • Documents
  • Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION [email protected]. ... to put new
50
HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION [email protected]

Upload: others

Post on 28-May-2020

16 views

Category:

Documents


1 download

Report

TRANSCRIPT

Page 1: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

HUNTING THREAT ACTORS WITH TLS CERTIFICATES

MARK PARSONS

DEVELOPER/THREAT ANALYST

KING AND UNION

[email protected]

Page 2: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

WHO AM I ?

• Formerly - incident responder / network defender

• Currently – developer / threat analyst

Page 3: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

WHO I AM NOT?

Animator - Archer

Page 4: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

ONE DIRECTION FAN FICTION?

Page 5: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

QUICK REVIEW

Traditional methods of infrastructure hunting/pivoting using network related resources

Page 6: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

PASSIVE DNS (PDNS)

• Historical mappings of domains to IP addresses, and IP addresses to domains

• Some sources of PDNS

• Farsight

• Mnemonic

• RiskIQ/PassiveTotal

• OpenDNS

https://www.dnsdb.info/
http://passivedns.mnemonic.no/
https://www.passivetotal.org/
https://www.opendns.com/
Page 7: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

WHOIS TRACKING

• Using domain registrant information to look for other potentially related domains

• Sources of trackable WHOIS information

• DomainTools

• Whoisology

• RiskIQ/PassiveTotal

• DomainIQ

• Domain Big Data

https://whois.domaintools.com/
https://whoisology.com/
https://www.passivetotal.org/
https://www.domainiq.com/
http://domainbigdata.com/
Page 8: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

WHAT ELSE MIGHT PROVIDE TRACKABLE DATA THAT HELPS IN INFRASTRUCTURE HUNTING?

Page 9: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

THAT IS RIGHT TLS CERTIFICATES!!!

Page 10: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

QUICK CAVEAT

Code signing certificate != TLS certificate

Page 11: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

CODE SIGNING CERTIFICATE

Page 12: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TLS CERTIFICATE

Page 13: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TLS HUNTING BASICS

Quick tips to help you get started

Page 14: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

WHERE TO START

• IP to certificate

• Certificate to IP

Page 15: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

IP TO CERTIFICATE

What certificates have been seen on 185.12.44.51?

Page 16: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

CERTIFICATE TO IP

What IP addresses has a1833c32d5f61d6ef9d1bb0133585112069d770e

been seen on?

Page 17: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

BASIC THINGS TO CONSIDER

Page 18: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

BEGINNING CONSIDERATIONS

• Do you have malware using this TLS certificate?

• How many other IP addresses are seen using that certificate?

Page 19: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TIME FRAME CONSIDERATIONS

• What time frame was a certificate seen on a suspect IP address

• Expiration dates of the certificate

• Not Before

• Not After

Page 20: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

CERTIFICATE ISSUER CONSIDERATIONS

• Self Signed

• Free Certificate

• Paid Certificate

Page 21: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

NETWORK DEFENSE

Page 22: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

IDS MONITORING – TLS FINGERPRINTS

• Suricata

• Bro

• Snort 3 – external package needed

https://github.com/CERT-Polska/snort3-x509-reputation-plugin
Page 23: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

AUTOMATE TRACKING OF TLS CERTIFICATES

• PassiveTotal Monitoring

• Censys.io API script

• Your own local sonar or censys.io datastore

• Combination of all of these

• Create script(s) to put new IP addresses or certificates found into monitoring or blocks as needed for your environment

https://passivetotal.org/
https://censys.io/
Page 24: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TLS CERTIFICATES YOU SAY?WHERE DO YOU START?

Page 25: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

YOU NEED SOME DATA

Page 26: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

IF YOU DON’T WANT TO SCAN ALL THE THINGS

• You could do any of the following:

• Ingest scans.io sonar SSL scans

• Use censys.io

• Use PassiveTotal

https://scans.io/study/sonar.ssl
https://censys.io/
https://passivetotal.org/
Page 27: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

SCANS.IO SONAR SSL SCANS

• Only on TCP:443

• Raw data going back to 10/30/2013

• Easily consumable

• Updated weekly

• Incremental in nature

• certs.gz - Only new sha1s and base64 raw certificate seen that week

• hosts.gz - SHA1 and host for all hosts seen

• No public search interface

• Is weekly frequent enough ?

https://scans.io
Page 28: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

CENSYS.IO

• TLS on TCP:25, 110, 143, 443, 993, 995

• Easy to use search interface

• API Access

• Frequent Updates

• All or nothing in nature

• If there is a delta between scans

• Old scan data is not in main search interface

• Old scan data is available in json format

• Old scan data is available via query interface

https://censys.io/
Page 29: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

PASSIVETOTAL

• Merge traditional hunting with new methods

• Aggregates multiple passive DNS sources

• Provides WHOIS data

• Provides references to OpenSource reporting

• Also has TLS certificates

https://passivetotal.org/
Page 30: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

NOW THAT WE HAVE COVERED THE BASICS LETS GO HUNTING

Page 31: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new
Page 32: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

APT 28 / XTUNNEL

• Netzpolotik - Digital Attack on German Parliament

• CrowdStrike – Bears in the Midst

• ESET – Lifting the lid on Sednit

https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/
https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
http://www.welivesecurity.com/2016/10/25/lifting-lid-sednit-closer-look-software-uses/
Page 33: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

STARTING WITH NETZPOLOTIK REPORT

https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/
Page 34: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TRADITIONAL PASSIVE DNS PIVOTS

Page 35: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TLS CERTIFICATE PIVOT ON INITIAL

IP

Page 36: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

LET’S TAKE A CLOSER LOOK AT THE CERTIFICATES

Page 37: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

PIVOT ON 454-CROOKSERVER

CERTIFICATE

Page 38: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new
Page 39: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TIMELINE

Page 40: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

APT 28 XTUNNEL SUMMARY

• Initial report 2 domains, 2 IPs, 1 TLS cert

• Traditional pivots reveal 5 interesting domains

• Now have 38 IPs, 7 domains, 3 TLS certs

Page 41: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TRICKBOT

• ThreatGeek – Blog post

http://www.threatgeek.com/2016/10/trickbot-the-dyre-connection.html
Page 42: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

POST HAS SEVERAL ADDRESSES WITH CONNECTIONS TO 443

Page 43: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

INITIAL INDICATORS

Page 44: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TLS CERTIFICATE PIVOT

Page 45: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

MALICIOUS SAMPLES

Page 46: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TRICKBOT SUMMARY

• Initial indicators 13 IP addresses

• All have common TLS certificate

• 22 new IP addresses

• Malware samples show linkages between IP addresses

Page 47: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

CONCLUSION

• Continue to look for new ways to monitor and track infrastructure

• Tracking TLS certificates should be added as part of normal infrastructure hunting

• Processing the data can be an initial steep hill but afterwards it is a green pasture

Page 48: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

THANKS TO THE FOLLOWING PEOPLE

• Ben Koehl

• James Elliott

• David Westcott

Page 49: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

CONTACT INFO

@markpars0nsgithub.com/mpars0ns

[email protected]

Page 50: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

QUESTIONS?


Threat Landscape Snapshot Landscape Snapshot Re… · access trojans and password stealers, nationstate threat actors have been linked to attacks against - government, health and

2020 CYBERSECURITY THREAT TRENDS OUTLOOK2020 CYBERSECURITY THREAT TRENDS OUTLOOK Nine ways threat actors will make waves in 2020 1This report is for informational purposes only, and

Threat Visibility for Cyber Hunters - Kite Distribution · WHITE PAPER Threat Visibility for Cyber Hunters 3 Introduction The challenge of hunting bad actors, insider threats, and

TLS-450/TLS-450PLUS Consoles - Veeder

Threat Compass - Blueliv · Today’s threat landscape is becoming more and more volatile. Malicious actors use ever-more sophisticated techniques to attack organizations large and

Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

Monitoring The Evolving Threat Landscape...2019/04/03  · 4 Emerging Threat Landscape More Active Threat Actors More Interconnectivity More Standards More Automated Attacks/ Artificial

MAY 2019 – ISSUE 2 Newsletter - Threat-Arrest … · MAY 2019 – ISSUE 2 Newsletter Cyber-Security Threats and Threat Actors Training Assurance Driven Multi-Layer, end-to-end Simulation

TLS-450/TLS-450PLUS Consoles

Invisible actors - implicit bias & stereotype threat€¦ · ©Partners in Equity & Inclusion, 2016 Seeing&and&Addressing&Invisible&Actors:& Unconscious&Bias&and&Identity&Threat Sharonne(Hayes,(MD(Medical(Director

F5 LABS THREAT ANALYSIS REPORT The 2016 TLS Telemetry Report - REPORT - The 2016 TLS... · F5 LABS 2016 TLS Telemetry Report ... social media sites, ... exactly how much more secure

Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

9 Imagerie - canceropole-gso.orgcanceropole-gso.org/download/fichiers/2999/chap9.4.pdf · Mtp Bdx Tls Mtp Lim Mtp Mtp Mtp Tls ls Tls Tls Tls Tls Tls Bdx Lim Tls tp im Tls Bdx Bdx

CYBER THREAT ACTORS: HACKONOMICS · 2020. 8. 12. · ‘Hackonomics’ Economic perspective of hacking Profile cyber threat actors behaviour: - Case study approach to profiling Create

How Do Threat Actors Move Deeper Into Your Network?

Threat Hunting y simulación de ataques · 2020. 4. 21. · Energy . Possible actors . APT32, APT33, APT34, Dragonfly, Magic Hound, Threat Group- 3390 APT32 is a threat group that

Lateral Movement: How Do Threat Actors Move Deeper Into Your Network?

THREAT COMPASS - Blueliv...Threat Compass Threat Context provides security teams with continuously updated and intuitive information around threat actors, campaigns, IOCs, malware,

Cyber Security Threats and Threat Actors Training ... · Cyber Security Threats and Threat Actors Training - Assurance ... (shipping), using real operational cyber systems within

DEPARTMENT OF D S€¦ · aspects of the cyber threat; these include external threat actors, insider threats, supply chain vulnerabilities, and threats to DoD‘s operational ability

Data Breach 2020 Investigations Report · VERIS resources The terms “threat actions,” “threat actors” and “varieties” will be referenced a lot. These are part of the Vocabulary

How Zscaler Disrupts the Cyber Kill Chain | Solution Brief · The threat landscape has evolved over the years and threat actors are constantly changing their Techniques, Tools, and

Assessing Targeted Attacks in Incident Response Threat ... · PDF fileAssessing Targeted Attacks in Incident Response Threat Correlation ... Indicators, Actors • Ensure ... Assessing

Insider Threat Nation States Cyber Crime Hactivist Cyber Terrorist IndustrializedHackers Dynamic Cyber Security Landscape Cyber Actors ThreatsThreats

MORPISEC AS TREAT REPORT | 2018 Q1 Endpoint Threat ... Threat Prevention Platform.pdfEndpoint Threat Prevention Platform Closing the Security Gap Malicious actors are more clever,

Threat Perception, Non-State Actors, and U.S. Military

F5 LABS THREAT ANALYSIS REPORT The 2016 TLS Telemetry Report · F5 LABS 2016 TLS Telemetry Report In the fall of 2016, the number of hosts in the Alexa Top 1 million list that responded

SSL/TLS Interception Proxies and Transitive Trust · 2013. 4. 2. · SSL/TLS Interception Proxies and Transitive Trust Jeff Jarmoc Dell SecureWorks Counter Threat Unit℠ Threat Intelligence

Advanced Threat Protection For the Healthcare Industry€¦ · Advanced Threat Protection For Healthcare. 3. Introduction. Motivated Actors, Emerging Threats The healthcare industry

2019-06-26 -Final Risk assessment guidelines and template ... · the capabilities and intent of the threat actors: 3.2.1. Main threat actors • non adversary/accidental threat actor,

STIX Version 1.2.1. Part 7: Threat Actordocs.oasis-open.org/.../stix-v1.2.1-part7-threat-actor.docx · Web viewIn a structured sense, Threat Actors consist of a characterization of

CYBER THREAT ACTORS: HACKONOMICS · 2020. 8. 12. · Extensive literature exists on cyber threat actors. Applying economic analysis to threat actor modelling. – Cost-benefit framework:

SonicWall 2017 Annual Threat Report FINAL2 · 2 2017 SonicWall Annual Threat Report Introduction 3 Threat Findings from 2016 4 POS Malware Decline 6 SSL/TLS Encryption 7 Exploit Kit

Identifying Mobile Malware and Key Threat Actors … Proactive Cyber Threat Intelligence By ... current CTI processes reactively look at malware in cyberspace, ... trends and evolution

SEMI-AUTOMATED CYBER THREAT INTELLIGENCE … · MongoDB, Hadoop, Cassandra, SMTP, POP3, etc. ACT Core Action/triggers Backend REST API @ ATT&CK Worker ... How many Threat Actors are