Upload File

threat hunting with splunk

80
Threat Hunting with Splunk Presenter: Ken Westin, M.Sc, OSCP Splunk, Security Market Specialist

Upload: splunk

Post on 08-Feb-2017

480 views

Category:

Technology


20 download

Report

TRANSCRIPT

Page 1: Threat Hunting with Splunk

ThreatHuntingwithSplunkPresenter:KenWestin,M.Sc,OSCPSplunk,SecurityMarketSpecialist

Page 2: Threat Hunting with Splunk

Agenda

• ThreatHuting Basics

• ThreatHuntingDataSources

• Sysmon EndpointData

• CyberKillChain

• WalkthroughofAttackScenarioUsingCoreSplunk (handson)

• EnterpriseSecurityWalkthrough

• ApplyingMachineLearningandDataSciencetoSecurity

Page 3: Threat Hunting with Splunk

LogInCredentialsJanuary,February&March https://od-how-calgary2.splunkoxygen.com

April,May&June https://od-how-calgary3.splunkoxygen.com

July,August&September https://od-how-calgary4.splunkoxygen.com

October,November&December https://od-how-calgary5.splunkoxygen.com

User:hunterPass:pr3dator

Page 4: Threat Hunting with Splunk

Thesewon’twork…

Page 5: Threat Hunting with Splunk

AmIintherightplace?

Somefamiliaritywith…

● CSIRT/SOCOperations

● GeneralunderstandingofThreatIntelligence

● GeneralunderstandingofDNS,Proxy,andEndpointtypesofdata

5

Page 6: Threat Hunting with Splunk

Thisisahands-onsession.

Theoverviewslidesareimportantforbuildingyour“hunt”methodology

10minutes- Seriously.

Page 7: Threat Hunting with Splunk

HowZeusCybercrimeWorks

Page 8: Threat Hunting with Splunk

ThreatHuntingwithSplunk

8

Vs.

Page 9: Threat Hunting with Splunk

SANSThreatHuntingMaturity

9

AdHocSearch

StatisticalAnalysis

VisualizationTechniques

Aggregation MachineLearning/DataScience

85%55%50%48%32%

Source:SANSIR&ThreatHuntingSummit2016

Page 10: Threat Hunting with Splunk

HuntingTools:InternalData

10

• IPAddresses:threatintelligence,blacklist,whitelist,reputationmonitoringTools:Firewalls,proxies,Splunk Stream,Bro,IDS

• NetworkArtifactsandPatterns:networkflow,packetcapture,activenetworkconnections,historicnetworkconnections,portsandservicesTools:Splunk Stream,BroIDS,FPC,Netflow

• DNS:activity,queriesandresponses,zonetransferactivityTools:Splunk Stream,BroIDS,OpenDNS

• Endpoint– HostArtifactsandPatterns:users,processes,services,drivers,files,registry,hardware,memory,diskactivity,filemonitoring:hashvalues,integritycheckingandalerts,creationordeletionTools:Windows/Linux,CarbonBlack,Tanium,Tripwire,ActiveDirectory

• VulnerabilityManagementDataTools:TripwireIP360,Qualys,Nessus

• UserBehaviorAnalytics:TTPs,usermonitoring,timeofdaylocation,HRwatchlistSplunk UBA,(Alloftheabove)

Page 11: Threat Hunting with Splunk

LogInCredentialsJanuary,February&March https://od-how-calgary2.splunkoxygen.com

April,May&June https://od-how-calgary3.splunkoxygen.com

July,August&September https://od-how-calgary4.splunkoxygen.com

October,November&December https://od-how-calgary5.splunkoxygen.com

User:hunterPass:pr3dator

Page 12: Threat Hunting with Splunk

Endpoint:MicrosoftSysmonPrimer

12

● TAAvailableontheAppStore

● GreatBlogPosttogetyoustarted

● IncreasesthefidelityofMicrosoftLogging

BlogPost:http://blogs.splunk.com/2014/11/24/monitoring-network-traffic-with-sysmon-and-splunk/

Page 13: Threat Hunting with Splunk

LogInCredentialsJanuary,February&March https://od-how-calgary2.splunkoxygen.com

April,May&June https://od-how-calgary3.splunkoxygen.com

July,August&September https://od-how-calgary4.splunkoxygen.com

October,November&December https://od-how-calgary5.splunkoxygen.com

User:hunterPass:pr3dator

Page 14: Threat Hunting with Splunk

SysmonEventTags

14

MapsNetworkCommtoprocess_id

Process_idcreationandmappingtoparentprocess_id

Page 15: Threat Hunting with Splunk

sourcetype=X*|searchtag=communicate

15

Page 16: Threat Hunting with Splunk

sourcetype=X*|deduptag|searchtag=process

16

Page 17: Threat Hunting with Splunk

DataSourceMapping

Page 18: Threat Hunting with Splunk

DemoStory- KillChainFrameworkSuccessfulbruteforce– downloadsensitivepdfdocument

WeaponizethepdffilewithZeusMalware

Convincingemailsentwithweaponizedpdf

Vulnerablepdfreaderexploitedbymalware.Droppercreatedonmachine

Dropperretrievesandinstallsthemalware

Persistenceviaregularoutboundcomm

DataExfiltration

Source:LockheedMartin

Page 19: Threat Hunting with Splunk

Servers

Storage

DesktopsEmail Web

TransactionRecords

NetworkFlows

DHCP/DNS

HypervisorCustomApps

PhysicalAccess

Badges

ThreatIntelligence

Mobile

CMDB

IntrusionDetection

Firewall

DataLossPrevention

Anti-Malware

VulnerabilityScans

Traditional

Authentication

StreamInvestigations– chooseyourdatawisely

19

Page 20: Threat Hunting with Splunk

20

Let’sdigin!

Please,raisethathandifyouneedustohitthepausebutton

Page 21: Threat Hunting with Splunk

APTTransactionFlowAcrossDataSources

21

http(proxy)sessiontocommand&controlserver

RemotecontrolStealdataPersistincompanyRentasbotnet

Proxy

ConductBusiness

Createadditionalenvironment

GainAccesstosystemTransaction

ThreatIntelligence

Endpoint

NetworkEmail,Proxy,DNS,andWeb

DataSources

.pdf

.pdf executes&unpacksmalwareoverwritingandrunning“allowed”programs

Svchost.exe(malware)

Calc.exe(dropper)

AttackerhackswebsiteSteals.pdf files

WebPortal

.pdf

Attackercreatesmalware,embed in.pdf,

emailstothetarget

MAIL

Reademail,openattachment

OurInvestigationbeginsbydetectinghighriskcommunicationsthroughtheproxy,attheendpoint,andevenaDNScall.

Page 22: Threat Hunting with Splunk

Tobeginourinvestigation,wewillstartwithaquicksearchtofamiliarizeourselveswiththedatasources.

Inthisdemoenvironment,wehaveavarietyofsecurityrelevantdataincluding…

WebDNSProxyFirewallEndpointEmail

Page 23: Threat Hunting with Splunk

Takealookattheendpointdatasource.WeareusingtheMicrosoftSysmon TA.

Wehaveendpointvisibilityintoallnetworkcommunicationandcanmapeachconnectionbacktoaprocess.

}Wealsohavedetailedinfooneachprocessandcanmapitbacktotheuserandparentprocess.}

Letsgetourdaystartedbylookingusingthreatintel toprioritizeoureffortsandfocusoncommunicationwithknown highriskentities.

Page 24: Threat Hunting with Splunk

WehavemultiplesourceIPscommunicatingtohighriskentitiesidentifiedbythese2threatsources.

Weareseeinghighriskcommunicationfrommultipledatasources.

Weseemultiplethreatintel relatedeventsacrossmultiplesourcetypesassociatedwiththeIPAddressofChrisGilbert.Let’stakecloserlookattheIPAddress.

Wecannowseetheownerofthesystem(ChrisGilbert)andthatitisn’taPIIorPCIrelatedasset,sotherearenoimmediatebusinessimplicationsthatwouldrequireinformingagenciesorexternalcustomerswithinacertaintimeframe.

Thisdashboardisbasedoneventdatathatcontainsathreatintelbasedindicatormatch(IPAddress,domain,etc.).ThedataisfurtherenrichedwithCMDBbasedAsset/identityinformation.

Page 25: Threat Hunting with Splunk

Wearenowlookingatonlythreatintel relatedactivityfortheIPAddressassociatedwithChrisGilbertandseeactivityspanningendpoint,proxy,andDNSdatasources.

Thesetrendlinestellaveryinterestingvisualstory.ItappearsthattheassetmakesaDNSqueryinvolvingathreatintel relateddomainorIPAddress.

ScrollDo

wn

Scrolldownthedashboardtoexaminethesethreatintel eventsassociatedwiththeIPAddress.

Wethenseethreatintel relatedendpointandproxyeventsoccurringperiodicallyandlikelycommunicatingwithaknownZeusbotnetbasedonthethreatintelsource(zeus_c2s).

Page 26: Threat Hunting with Splunk

It’sworthmentioningthatatthispointyoucouldcreateatickettohavesomeonere-imagethemachinetopreventfurtherdamageaswecontinueourinvestigationwithinSplunk.

Withinthesamedashboard,wehaveaccesstoveryhighfidelityendpointdatathatallowsananalysttocontinuetheinvestigationinaveryefficientmanner.Itisimportanttonotethatnearreal-timeaccesstothistypeofendpointdataisnotnotcommonwithinthetraditionalSOC.

Theinitialgoaloftheinvestigationistodeterminewhetherthiscommunicationismaliciousorapotentialfalsepositive.Expandtheendpointeventtocontinuetheinvestigation.

Proxyrelatedthreatintel matchesareimportantforhelpingustoprioritizeoureffortstowardinitiatinganinvestigation.Furtherinvestigationintotheendpointisoftenverytimeconsumingandofteninvolvesmultipleinternalhand-offstootherteamsorneedingtoaccessadditionalsystems.Thisencryptedproxytrafficisconcerningbecauseofthelargeamountofdata(~1.5MB)beingtransferredwhichiscommonwhendataisbeingexfiltrated.

Page 27: Threat Hunting with Splunk

Exfiltrationofdataisaseriousconcernandoutboundcommunicationtoexternalentitythathasaknownthreatintelindicator,especiallywhenitisencryptedasinthiscase.

Letscontinuetheinvestigation.

Anotherclue.Wealsoseethatsvchost.exe shouldbelocatedinaWindowssystemdirectorybutthisisbeingrunintheuserspace.Notgood.

Weimmediatelyseetheoutboundcommunicationwith115.29.46.99viahttpsisassociatedwiththesvchost.exeprocessonthewindowsendpoint.Theprocessidis4768.ThereisagreatdealmoreinformationfromtheendpointasyouscrolldownsuchastheuserIDthatstartedtheprocessandtheassociatedCMDBenrichmentinformation.

Page 28: Threat Hunting with Splunk

WehaveaworkflowactionthatwilllinkustoaProcessExplorerdashboardandpopulateitwiththeprocessidextractedfromtheevent(4768).

Page 29: Threat Hunting with Splunk

ThisisastandardWindowsapp,butnotinitsusualdirectory,tellingusthatthemalwarehasagainspoofedacommonfilename.

Wealsocanseethattheparentprocessthatcreatedthissuspicuous svchost.exe processiscalledcalc.exe.

ThishasbroughtustotheProcessExplorerdashboardwhichletsusviewWindowsSysmon endpointdata.

SuspectedMalware

Letscontinuetheinvestigationbyexaminingtheparentprocessasthisisalmostcertainlyagenuinethreatandwearenowworkingtowardarootcause.

ThisisveryconsistentwithZeusbehavior.TheinitialexploitationgenerallycreatesadownloaderordropperthatwillthendownloadtheZeusmalware.Itseemslikecalc.exemaybethatdownloader/dropper.

SuspectedDownloader/Dropper

Thisprocesscallsitself“svchost.exe,”acommonWindowsprocess,butthepathisnotthenormalpathforsvchost.exe.

…whichisacommontraitofmalwareattemptingtoevadedetection.WealsoseeitmakingaDNSquery(port53)thencommunicatingviaport443.

Page 30: Threat Hunting with Splunk

TheParentProcessofoursuspecteddownloader/dropperisthelegitimatePDFReaderprogram.Thiswilllikelyturnouttobethevulnerableappthatwasexploitedinthisattack.

SuspectedDownloader/Dropper

SuspectedVulnerableAppWehaveveryquicklymovedfromthreatintel relatednetworkandendpointactivitytothelikelyexploitationofavulnerableapp.Clickontheparentprocesstokeepinvestigating.

Page 31: Threat Hunting with Splunk

WecanseethatthePDFReaderprocesshasnoidentifiedparentandistherootoftheinfection.

ScrollDo

wn

ScrolldownthedashboardtoexamineactivityrelatedtothePDFreaderprocess.

Page 32: Threat Hunting with Splunk

Chrisopened2nd_qtr_2014_report.pdfwhichwasanattachmenttoanemail!

Wehaveourrootcause!Chrisopenedaweaponized .pdf filewhichcontainedtheZeusmalware.Itappearstohavebeendeliveredviaemailandwehaveaccesstoouremaillogsasoneofourimportantdatasources.Letscopythefilename2nd_qtr_2014_report.pdfandsearchabitfurthertodeterminethescopeofthiscompromise.

Page 33: Threat Hunting with Splunk

Letsdigalittlefurtherinto2nd_qtr_2014_report.pdftodeterminethescopeofthiscompromise.

Page 34: Threat Hunting with Splunk

Letssearchthoughmultipledatasourcestoquicklygetasenseforwhoelsemayhavehavebeenexposedtothisfile.

Wewillcomebacktothewebactivitythatcontainsreferencetothepdf filebutletsfirstlookattheemaileventtodeterminethescopeofthisapparentphishingattack.

Page 35: Threat Hunting with Splunk

Wehaveaccesstotheemailbodyandcanseewhythiswassuchaconvincingattack.Thesenderapparentlyhadaccesstosensitiveinsiderknowledgeandhintedatquarterlyresults.

Thereisourattachment.

HoldOn!That’snotourDomainName!Thespellingisclosebutit’smissinga“t”.TheattackerlikelyregisteredadomainnamethatisveryclosetothecompanydomainhopingChriswouldnotnotice.

Thislookstobeaverytargetedspearphishingattackasitwassenttoonlyoneemployee(Chris).

Page 36: Threat Hunting with Splunk

RootCauseRecap

36

DataSources

.pdf executes&unpacksmalwareoverwritingandrunning“allowed”programs

http(proxy)sessiontocommand&controlserver

RemotecontrolStealdataPersistincompanyRentasbotnet

Proxy

ConductBusiness

Createadditionalenvironment

GainAccesstosystemTransaction

ThreatIntelligence

Endpoint

NetworkEmail,Proxy,DNS,andWeb

.pdfSvchost.exe(malware)

Calc.exe(dropper)

AttackerhackswebsiteSteals.pdf files

WebPortal

.pdf

Attackercreatesmalware,embed in.pdf,

emailstothetarget

MAIL

Reademail,openattachment

Weutilizedthreatintel todetectcommunicationwithknownhighriskindicatorsandkickoffourinvestigationthenworkedbackwardthroughthekillchaintowardarootcause.

Keytothisinvestigativeprocessistheabilitytoassociatenetworkcommunicationswithendpointprocessdata.

ThishighvalueandveryrelevantabilitytoworkamalwarerelatedinvestigationthroughtorootcausetranslatesintoaverystreamlinedinvestigativeprocesscomparedtothelegacySIEMbasedapproach.

Page 37: Threat Hunting with Splunk

37

Letsrevisitthesearchforadditionalinformationonthe2nd_qtr_2014-_report.pdffile.

Weunderstandthatthefilewasdeliveredviaemailandopenedattheendpoint.Whydoweseeareferencetothefileintheaccess_combined (webserver)logs?

Selecttheaccess_combinedsourcetype toinvestigatefurther.

Page 38: Threat Hunting with Splunk

38

Theresultsshow54.211.114.134hasaccessedthisfilefromthewebportalofbuttergames.com.

ThereisalsoaknownthreatintelassociationwiththesourceIPAddressdownloading(HTTPGET)thefile.

Page 39: Threat Hunting with Splunk

39

SelecttheIPAddress,left-click,thenselect“Newsearch”.WewouldliketounderstandwhatelsethisIPAddresshasaccessedintheenvironment.

Page 40: Threat Hunting with Splunk

40

That’sanabnormallylargenumberofrequestssourcedfromasingleIPAddressina~90minutewindow.

Thislookslikeascriptedactiongiventheconstanthighrateofrequestsoverthebelowwindow.

ScrollDo

wn

Scrolldownthedashboardtoexamineotherinterestingfieldstofurtherinvestigate.

NoticetheGooglebotuseragent string whichisanotherattempttoavoidraisingattention..

Page 41: Threat Hunting with Splunk

41

Therequestsfrom52.211.114.134aredominatedbyrequeststotheloginpage(wp-login.php).It’sclearlynotpossibletoattemptaloginthismanytimesinashortperiodoftime– thisisclearlyascriptedbruteforceattack.

Aftersuccessfullygainingaccesstoourwebsite,theattackerdownloadedthepdf file,weaponized itwiththezeusmalware,thendeliveredittoChrisGilbertasaphishingemail.

Theattackerisalsoaccessingadminpageswhichmaybeanattempttoestablishpersistenceviaabackdoorintothewebsite.

Page 42: Threat Hunting with Splunk

KillChainAnalysisAcrossDataSources

42

http(proxy)sessiontocommand&controlserver

RemotecontrolStealdataPersistincompanyRentasbotnet

Proxy

ConductBusiness

Createadditionalenvironment

GainAccesstosystemTransaction

ThreatIntelligence

Endpoint

NetworkEmail,Proxy,DNS,andWeb

DataSources

.pdf

.pdf executes&unpacksmalwareoverwritingandrunning“allowed”programs

Svchost.exe(malware)

Calc.exe(dropper)

AttackerhackswebsiteSteals.pdf files

WebPortal

.pdf

Attackercreatesmalware,embed in.pdf,

emailstothetarget

MAIL

Reademail,openattachment

Wecontinuedtheinvestigationbypivotingintotheendpointdatasourceandusedaworkflowactiontodeterminewhichprocessontheendpointwasresponsiblefortheoutboundcommunication.

WeBeganbyreviewingthreatintel relatedeventsforaparticularIPaddressandobservedDNS,Proxy,andEndpointeventsforauserinSales.

Investigationcomplete!LetsgetthisturnedovertoIncidentReponse team.

Wetracedthesvchost.exeZeusmalwarebacktoit’sparentprocessIDwhichwasthecalc.exedownloader/dropper.

Onceourrootcauseanalysiswascomplete,weshiftedoutfocusintotheweblogstodeterminethatthesensitivepdffilewasobtainedviaabruteforceattackagainstthecompanywebsite.

Wewereabletoseewhichfilewasopenedbythevulnerableappanddeterminedthatthemaliciousfilewasdeliveredtotheuserviaemail.

Aquicksearchintothemaillogsrevealedthedetailsbehindthephishingattackandrevealedthatthescopeofthecompromisewaslimitedtojusttheoneuser.

Wetracedcalc.exe backtothevulnerableapplicationPDFReader.

Page 43: Threat Hunting with Splunk

WanttoFollowAlong?Optional– ForMachineLearningComponent

● DownloadSplunkhttp://www.splunk.com/en_us/download-21.html

● InstalltheMachineLearningToolkithttp://tiny.cc/splunkmlapp

● InstallthePythonforScientificComputingapphttps://splunkbase.splunk.com/app/2881/ (Mac)https://splunkbase.splunk.com/app/2883/ (Windows)

Page 44: Threat Hunting with Splunk

Break!

Page 45: Threat Hunting with Splunk

Splunk EnterpriseSecurity

Page 46: Threat Hunting with Splunk

SANSThreatHuntingMaturity

46

AdHocSearch

StatisticalAnalysis

VisualizationTechniques

Aggregation MachineLearning/DataScience

85%55%50%48%32%

Source:SANSIR&ThreatHuntingSummit2016

Page 47: Threat Hunting with Splunk

SplunkistheSecurityNerveCenter

AppServers

Network

ThreatIntelligence

Firewall

WebProxy

InternalNetworkSecurity

Identity

Endpoints

Page 48: Threat Hunting with Splunk

GartnerMagicQuadrantforSIEM

48

IncidentResponse

UserMonitoring

Data&AppMonitoring

AdvancedAnalytics

BasicSecurityMonitoring

AdvancedThreatDetection

Forensic&IncidentResponse

Real-TimeMonitoring

AdvancedThreatDefense

BusinessContext&SecurityIntelligence

Deployment&SupportSimplicity

Page 49: Threat Hunting with Splunk

Homework

Page 50: Threat Hunting with Splunk

OtherItemsToNote

ItemstoNote

Navigation- HowtoGetHere

Descriptionofwhattoclickon

Click

Page 51: Threat Hunting with Splunk

KeySecurityIndicators(buildyourown!)

Sparklines

Editable

Page 52: Threat Hunting with Splunk

Variouswaystofilterdata

Malware-SpecificKSIsandReports

SecurityDomains->Endpoint->MalwareCenter

Page 53: Threat Hunting with Splunk

Filterable

KSIsspecifictoRisk

Riskassignedtosystem,userorother

UnderAdvancedThreat,selectRiskAnalysis

Page 54: Threat Hunting with Splunk

(ScrollDown)

RecentRiskActivity

UnderAdvancedThreat,selectRiskAnalysis

Page 55: Threat Hunting with Splunk

Filterable,downtoIoC

KSIsspecifictoThreat

Mostactivethreatsource

Scrolldown… Scroll

UnderAdvancedThreat,selectThreatActivity

Page 56: Threat Hunting with Splunk

Specificsaboutrecentthreatmatches

UnderAdvancedThreat,selectThreatActivity

Page 57: Threat Hunting with Splunk

Toaddthreatintelgoto:Configure->DataEnrichment->ThreatIntelligenceDownloads

Click

Page 58: Threat Hunting with Splunk

Click“ThreatArtifacts”Under“AdvancedThreat”

Click

Page 59: Threat Hunting with Splunk

ArtifactCategories–clickdifferenttabs…

STIXfeed

Customfeed

UnderAdvancedThreat,selectThreatArtifacts

Page 60: Threat Hunting with Splunk

ReviewtheAdvancedThreatcontent

Click

Page 61: Threat Hunting with Splunk

DatafromassetframeworkConfigurableSwimlanes

Darker=moreevents

AllhappenedaroundsametimeChangeto“Today”ifneeded

AssetInvestigator,enter“192.168.56.102”

Page 62: Threat Hunting with Splunk

DataScience&MachineLearningInSecurity

62

Page 63: Threat Hunting with Splunk

EvolutionofSecurityCorrelationtoAdvancedAnalytics

63

Two-Dimensional- Correlation:Useofregexandpatternmatchingforstrings.Usedinanti-malware,IDS/IPS,DLPandbasicSIEM.Useofstringmatchingtosearchabinaryfiletoidentifytypeofthreat.Enhancedcapabilitytoidentifypreviouslyknownthreatsandhostenumerationwithinanenvironment.Multi-Dimensional- Analytics:Hybridmodeldevelopedasadversarieslearnedtocircumventbasiccorrelationandtoreducefalsepositives.Thresholdsandcombinationsofrulesdeveloped.Startingtocreatebehavioralmodels,statisticalanalysisandpatternidentificationnotjustbasedonsignatures.

One-Dimensional- Correlation:Fastandefficientbasicmatchingofdomains,IPaddresses,user-agent,MD5filehashes.UseofBooleanoperatorstoidentifyifsignatureisonablack/whitelist.CommonusageinmostfirewallandIDStools.

N-DimensionalAdvanced- Analytics:Shiftawayfromheavymanualtaggingandrulebuildingalone,leveragesadvancedandpredictiveanalytics,machinelearning,graphanalysisandelementsofdatasciencetoenhancetheanalysttoidentifypreviouslyunknownthreats,shiftfromcorrelationtocausation.

Page 64: Threat Hunting with Splunk

SANSThreatHuntingMaturity

64

AdHocSearch

StatisticalAnalysis

VisualizationTechniques

Aggregation MachineLearning/DataScience

85%55%50%48%32%

Source:SANSIR&ThreatHuntingSummit2016

Page 65: Threat Hunting with Splunk

Disclaimer:Iamnotadatascientist

Page 66: Threat Hunting with Splunk

TypesofMachineLearningSupervised Learning:generalizingfromlabeled data

Page 67: Threat Hunting with Splunk

SupervisedMachineLearning

67

DomainName TotalCnt RiskFactor AGD SessionTime RefEntropy NullUa Outcome

yyfaimjmocdu.com 144 6.05 1 1 0 0 Maliciousjjeyd2u37an30.com 6192 5.05 0 1 0 0 Maliciouscdn4s.steelhousemedia.com 107 3 0 0 0 0 Benignlog.tagcade.com 111 2 0 1 0 0 Benigngo.vidprocess.com 170 2 0 0 0 0 Benignstatse.webtrendslive.com 310 2 0 1 0 0 Benigncdn4s.steelhousemedia.com 107 1 0 0 0 0 Benignlog.tagcade.com 111 1 0 1 0 0 Benign

Page 68: Threat Hunting with Splunk

Unsupervised Learning:generalizingfromunlabeled data

Page 69: Threat Hunting with Splunk

UnsupervisedMachineLearning

• Notuning

• Programmaticallyfindstrends

• UBAisprimarilyunsupervised

• Rigorouslytestedforfit

69

AlgorithmRawSecurityData AutomatedClustering

Page 70: Threat Hunting with Splunk

70

Page 71: Threat Hunting with Splunk

MLToolkit&Showcase• SplunkSupportedframeworkforbuildingMLApps

– Getitforfree:http://tiny.cc/splunkmlapp

• LeveragesPythonforScientificComputing (PSC)add-on:– Open-sourcePythondatascienceecosystem– NumPy,SciPy,scitkit-learn,pandas,statsmodels

• Showcaseusecases:PredictHardDriveFailure,ServerPowerConsumption,ApplicationUsage,CustomerChurn&more

• Standardalgorithms outofthebox:– Supervised:LogisticRegression,SVM,LinearRegression,RandomForest,etc.– Unsupervised: KMeans,DBSCAN,SpectralClustering,PCA,KernelPCA,etc.

• Implementoneof300+algorithmsbyeditingPythonscripts

Page 72: Threat Hunting with Splunk

MachineLearningToolkitDemo

72

Page 73: Threat Hunting with Splunk
Page 74: Threat Hunting with Splunk

Splunk UBA

Page 75: Threat Hunting with Splunk

Splunk UBAUseCases

ACCOUNTTAKEOVER• Privilegedaccountcompromise• Dataexfiltration

LATERALMOVEMENT• Pass-the-hashkillchain• Privilegeescalation

SUSPICIOUSACTIVITY• Misuseofcredentials• Geo-locationanomalies

MALWAREATTACKS• Hiddenmalwareactivity

BOTNET,COMMAND&CONTROL• Malwarebeaconing• Dataleakage

USER&ENTITYBEHAVIORANALYTICS• Suspiciousbehaviorbyaccountsor

devices

EXTERNALTHREATSINSIDERTHREATS

Page 76: Threat Hunting with Splunk

SplunkUserBehaviorAnalytics(UBA)• ~100%ofbreachesinvolvevalidcredentials(Mandiant Report)• Needtounderstandnormal&anomalousbehaviorsforALLusers• UBAdetectsAdvancedCyberattacks andMaliciousInsiderThreats• LotsofMLunderthehood:

– BehaviorBaselining&Modeling– AnomalyDetection(30+models)– AdvancedThreatDetection

• E.g.,DataExfil Threat:– “Sawthisstrangelogin&datatransferfor userkwestin

at3aminChina…”– SurfacethreattoSOCAnalysts

Page 77: Threat Hunting with Splunk

Workflow

Raw Events

1

Statistical methods

Security semantics

2Threat Models

Lateralmovement

ML

Patterns

Sequences

Beaconing

Land-speedviolation

Threats

Kill chain sequence

5

Supporting evidence

Threat scoring

Graph Mining

4

Con

tinuo

us s

elf-l

earn

ing

Anomalies graph

Entity relationship graph

3

Anomalies

Page 78: Threat Hunting with Splunk

Splunk UBADemo

78

Page 79: Threat Hunting with Splunk

SecurityWorkshops

● SecurityReadinessAssessments(CSC20)● Splunk UBADataScienceWorkshop● EnterpriseSecurityBenchmarkAssessment● InsiderThreat

Page 80: Threat Hunting with Splunk

SecurityWorkshopSurvey

https://www.surveymonkey.com/r/KFVLF37


2020 THREAT HUNTING REPORT - ExtraHop

Kaspersky Threat Hunting · • Immediate protection against any detected threat through automatic antivirus database updates. • Retrospective analysis of incidents and threat hunting,

Threat Hunting 102: Beyond the Basics

BrightCloud Threat Intelligence App for Splunkdownload.webroot.com/Webroot_BrightCloudThreat... · The Webroot BrightCloud Threat Intelligence App for Splunk is a predictive threat

Threat Hunting - csirt.jabarprov.go.id

Building a Successful Threat Hunting Program

Abstract Tools for Effective Threat Hunting

Threat Hunting with Splunk Hands-on

Cyber Threat Hunting with Phirelight

Workshop threat-hunting

Splunk conf2014 - Operationalizing Advanced Threat Defense

Threat hunting with MITRE ATT&CK

ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

Threat Hunting Report can be viewed here - News · THREAT HUNTING REPORT 3. THRET HNTING REPORT 4 KEY SURVEY FINDINGS ... Among the respondents to the threat hunting survey, six in

Completing the Full OODA Loop - RainFocus · 2019-06-27 · Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, ... ︎Proactive Threat Hunting • Automating enrichment

FALCON OVERWATCH MANAGED THREAT HUNTING · Director of Information Technology, TransPak. CrowdStrike Products FALCON OVERWATCH MANAGED THREAT HUNTING CROWDSTRIKE MANAGED THREAT HUNTING

Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Industrial Control System Cyber Threat Hunting

“Threat Hunting in Active Directory Environment”

Enabling Efficient Cyber Threat Hunting with Cyber Threat

(CMC THREAT HUNTING SERVICE)

Towards a Threat Hunting Automation Maturity Model

DEMYSTIFYING THREAT HUNTING · 2021. 1. 26. · We wanted to clear up the confusion. Demystifying Threat Hunting will explain: • What threat hunting is – and what it isn’t

IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION [email protected]. ... to put new

Proactive Threat Hunting Combining the use of …Proactive Threat Hunting Combining the use of threat intelligence, analytics and automated security tools with human smarts Benefits

TTPs for Threat Hunting in Refineries · TTPs for Threat Hunting in Refineries Dan Gunter | Twitter: @dan_gunter Principal Threat Analyst @ Dragos October 2018. ... •Not Red Teaming

Mapping the Enterprise Threat, Risk, and Security Control Landscape with Splunk

Threat hunting as SOC process

Threat Hunting

Operationalizing Threat Intelligence Using Splunk

SQRRL threat hunting platform

Endgame SANS - Threat Hunting Before the Incident

CYBERX IIoT & ICS HIGHLIGHTS THREAT MONITORING APP FOR SPLUNK · CYBERX IIoT & ICS . HIGHLIGHTS. THREAT MONITORING APP FOR SPLUNK. Deliver OT Network Visibility and . ... The Splunk

Hands-on Learning Experiences for Cyber Threat Hunting Education · Cyber Hunting • Cyber threat hunting has emerged as a critical part of cyber security practice. However, –