Upload File

tracking threat actors through yara rules and … · tracking threat actors through yara rules and...

  • Home
  • Documents
  • Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation
28
Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

Upload: trinhdan

Post on 11-Sep-2018

240 views

Category:

Documents


3 download

Report

TRANSCRIPT

Page 1: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

Tracking Threat Actors through YARA

Rules and Virus Total

Kevin Perlow- Booz Allen HamiltonAllen Swackhamer- Target Corporation

Page 2: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

YARA Rule Notification

Elasticsearch Stack Indexing/Logging

Cuckoo

Additional APIs

1

2

3

24

Automation and Collection Workflow

Page 3: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

YARA Rules - Purpose• Track Campaigns

▫ Strings

▫ Static Indicators

▫ Compilation Artifacts

▫ Opcode signatures

• Categorize Malware

▫ Family / Variants Basic YARA rule for tracking a crimeware crypter

Page 4: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

YARA Rules- Examples

Page 5: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

YARA Rules- Examples

Page 6: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

YARA Rules- Examples

Page 7: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

YARA Rules- Case Study

Page 8: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

YARA Rules- Case Study

Left: the executable path being built.

Top right: Similar sample- the GET request being made inside a try/catch function

Page 9: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

YARA Rule Notification

Elasticsearch Stack Indexing/Logging

Cuckoo

Additional APIs

1

2

3

24

Automation and Collection Workflow

Page 10: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

Notifications API

• VirusTotal or proprietary database

▫ SMTP notifications

Pull via Python IMAP library

▫ JSON notifications

Pull from REST API via Python requests library

Delete the alerts from VT after you process them

• Index and Parse into Elasticsearch

Page 11: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

Sample VirusTotal Notification

Page 12: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

IOC Extraction and Logging• Static Extraction

▫ Configuration deobfuscation and parsing▫ Strings▫ Various obfuscation techniques (olevba)▫ FLOSS – Automated deobfuscation of strings

• Dynamic Extraction▫ Sandbox

Network File system

Page 13: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

YARA Rule Notification

Elasticsearch Stack Indexing/Logging

Cuckoo

Additional APIs

1

2

3

24

Automation and Collection Workflow

Page 14: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

Elasticsearch Stack• Elasticsearch & Kibana

▫ Visualize Notification Trends First Seen Last Seen Resubmissions

▫ Export Data (Hash, Rule Name, Rule Set) Pivot through additional API’s Export to CSV/JSON or other consumable formats

Page 15: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation
Page 16: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

Cuckoo Sandbox• Automated Submission

▫ Push notifications to Cuckoo on ingest from VT▫ Output IOCs (Domains, Files, Mutexs, etc…) back to

Elasticsearch• Customizable

▫ Custom Elasticsearch reporting module• Popular Sandboxes

▫ VirusTotal▫ Malwr▫ Hybrid Analysis

Page 17: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

• Sets shard count to 1

• Compression to “best”

• Strings to “not_analyzed”

• task_id is an indexed field

• report_time is the date/time field

Cuckoo Elasticsearch

Index Template

Page 18: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

Back to the Elasticsearch Stack

• Collect Cuckoo IOCs

▫ Track by Domain, IP, Country

▫ Files written to disk

▫ Command line called

▫ Normalization of A/V Data

Page 19: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation
Page 20: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation
Page 21: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

• Files• Registry• Mutex• Directory• Resolved Hosts• Connected Hosts• Command Line• DLL Loaded• WMI Query• Target File - Hash• Target File - Name• Target File - Type• VirusTotal Signatures

Cuckoo Summary

Page 22: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation
Page 23: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

Lucene Search Query Syntax

List of hosts and files written aggregated with count

Normalized AV signatures from VT

Command line called by malware

File size and hosts connected to

Page 24: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation
Page 25: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

YARA Rule Notification

Elasticsearch Stack Indexing/Logging

Cuckoo

Additional APIs

1

2

3

24

Automation and Collection Workflow

Page 26: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

Additional APIs• VirusTotal

▫ Parent objects Emails Zip Files

▫ Network Infrastructure• CentralOps

▫ Whois▫ Physical Address

• PassiveTotal▫ PassiveDNS▫ Historical Records

Page 27: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

Recap• Built YARA rule for one dropper

• Identified 700+ files

• Automated analysis via Cuckoo

• Logging via Elasticsearch and Visualization with Kibana

• Additional pivoting via API

• Source code: https://github.com/swackhamer

Page 28: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

Questions?


Threat Perception, Non-State Actors, and U.S. Military

yara Documentation

Jeff Schilling/Chief Security Officer · THREAT TYPES, FOCUS ON THE SCALE IN NUMBERS OF ACTORS ... Threat detection • External Penetration testing/red team SECURITY OPERATIONS FUNCTIONS

Cinderella yara pensa

YARA MODA PERU

Threat Compass - Blueliv · Today’s threat landscape is becoming more and more volatile. Malicious actors use ever-more sophisticated techniques to attack organizations large and

YARA cases .pdf

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

CYBER THREAT ACTORS: HACKONOMICS · 2020. 8. 12. · Extensive literature exists on cyber threat actors. Applying economic analysis to threat actor modelling. – Cost-benefit framework:

Voices from AfricA - Oakland Institute · The Oakland Institute Voices from AfricA | 2 Several actors, including the Yara Foundation, Millennium Villages, and the New Partnership

Journey to Threat Intelligence Analysis and Management · Threat Intelligence Analysis and Management offers a universal ... of threats, including actors, tactics, techniques, procedures,

Operationalizing Threat Intelligence to Battle Persistent Actors

Calcinit YARA

Monitoring The Evolving Threat Landscape...2019/04/03  · 4 Emerging Threat Landscape More Active Threat Actors More Interconnectivity More Standards More Automated Attacks/ Artificial

Threat Landscape Snapshot Landscape Snapshot Re… · access trojans and password stealers, nationstate threat actors have been linked to attacks against - government, health and

YARA BRASIL.pdf

2019-06-26 -Final Risk assessment guidelines and template ... · the capabilities and intent of the threat actors: 3.2.1. Main threat actors • non adversary/accidental threat actor,

Hide and Seek: How Threat Actors Respond in the … ID: #RSAC Kristen Dennesen Hide and Seek: How Threat Actors Respond in the Face of Public Exposure CRWD-T11 Senior Intelligence

Presentation of Yara and Yara Porsgrunn. Yara is the world’s leading provider of both nitrogen-based fertilizer and industrial products Revenues (2008)

Introduction - cyber.gc.ca · baseline knowledge about the cyber threat environment, including cyber threat actors and their motivations, sophistication, techniques, tools, and the

YARA INTERNATIONAL SCHOOL

Identifying Mobile Malware and Key Threat Actors … Proactive Cyber Threat Intelligence By ... current CTI processes reactively look at malware in cyberspace, ... trends and evolution

Violent Non-state Actors: Emerging threat to economic ...... Issue Brief No. 08 Violent Non-state Actors: Emerging threat to economic infrastructure climate change scarcity power shifts

CYBER THREAT ACTORS: HACKONOMICS · 2020. 8. 12. · ‘Hackonomics’ Economic perspective of hacking Profile cyber threat actors behaviour: - Case study approach to profiling Create

Cyber Threat Intelligence: What Vendors are NOT telling you!•“Details of the motivations, intent, and capabilities of internal and external threat actors. Threat intelligence includes

Cyber Security Threats and Threat Actors Training ... · Cyber Security Threats and Threat Actors Training - Assurance ... (shipping), using real operational cyber systems within

STIX Version 1.2.1. Part 7: Threat Actordocs.oasis-open.org/.../stix-v1.2.1-part7-threat-actor.docx · Web viewIn a structured sense, Threat Actors consist of a characterization of

YARA presentation

CYBER THREATSCAPE REPORT 2018 - Accenture...6 > CYBER THREATSCAPE REPORT 2018 IRANIAN THREAT IS A GROWING FORCE TO BE RECKONED WITH Iran-based threat actors and threat groups are likely

Lateral Movement: How Do Threat Actors Move Deeper Into Your Network?

Bst Yara Dr.jeff

Threat Hunting y simulación de ataques · 2020. 4. 21. · Energy . Possible actors . APT32, APT33, APT34, Dragonfly, Magic Hound, Threat Group- 3390 APT32 is a threat group that

CYBER THREAT ACTORS: HACKONOMICS...‘Hackonomics’ Economic perspective of hacking Profile cyber threat actors behaviour: - Case study approach to profiling Create threat actor matrix

Yara International ASA

Yara Fertilizers