All right.
Now, in this one,
what we're going to be doing is looking for the attack
technique T1074 or the Shield technique DTE0030,
which is called pocket litter.
And so,
we're staging a variety of files with known hashes around the network and
creating detections for them moving or being collocated.
So,
we're going to be creating detections for them moving around or being copied
from one directory to another for potential staging purposes.
So, first, I'm going to go ahead and open up the osquery config again.
And, as you can see, we have file events turned on,
so the enable file events option is true.
We have our file events option here that's saying
select anything from the file events.
We're going to do a 10‑second interval,
and these are the events collected from the actual file
integrity monitor that osquery provides.
And osquery has a lot of documentation on how to
actually use the file integrity monitor.
So, if you wanted to check out the documentation,
you can and go a little bit more in detail about how it's
configured and what you can actually do with it.
And then finally,
we have the file paths here that are defined in our configuration file,
saying what paths to monitor.
So, we have our home directory, our /etc hosts and host name directory,
our bin and our temp directories.
So now, what do we do with the information that's coming in?
To start with, let's go over to my home directory for the globolab user.
And oops, that's the root user, not globolab.
So, let's go over to globolab.
As you can see, we have a couple files in here.
We have some files that we created that are going to be staged, for example.
So, we have a pii.csv file, a billing.csv file, and an acctsrcv.csv file.
And the point of these is to make something interesting for an attacker.
It's almost like file honeypots to make it enticing for
them to want to grab these files and move them around to
stage them so they can exfil them.
Now, as you can see, as I cat it, there's really nothing in here for us.
But they don't know that, and you can make files with fake data if you
want or loads of just jumbled garbage data in here if you want to just to
make it look like there's actually useful data.
So, let's stage those around.
Let's move the acctsrcv one over to the /bin directory, let's
move the billings one to the /temp directory, and let's move
the pii one to the /etc directory.
We'll copy it this time.
So, we just did three commands.
They're simple. And yes,
I am the root user, but this could apply to any of the other user accounts in
here. And we'll see in Kibana that we're actually seeing the user accounts that
are moving it, so this is the globolab user account.
We'll see all of this in our logs. And to validate it,
we can pull the logs again. And this time, we're going to look for
file events, and we won't jQ that this time.
As you can see, we have quite a few in here. I'm going to go ahead and stop that.
And now, let's go check out what we have going on in Kibana
and see how we can use this information.
So,
let's get rid of this other command, and let's do a search for just
the rule name, and we'll look for file events.
All right.
So, as you can see, we have quite a few hits just in the last 30 minutes. Wow,
that's a lot.
So, we need to narrow that down a little bit.
Let's do something like an and.
And so, since we both moved and copied those files,
we'll do move or copy. And as you can see,
we don't have anything here.
But if we remove the file events,
because these were actually command events, we have our hits. As you can
see, we have our copy commands and our move commands here.
So, this is one way that we can actually look at that.
But if we wanted to look at the file events specifically,
we can do a similar query. We can do the rule.name:
file_events and. And with this query the way it is,
what we're doing is we're looking for any file events that have to do
with anything that's named those specific files.
So, this will be if they were moved or created or anything like that.
And as you can see,
we have two events here, and they're both for the acctsrcv one.
Now, this is because I used the target path and not the source path.
And if we look at the information, we can see what exactly happened.
We have the file was moved from this target path. That's anything
/pii.csv, billlings.csv, or acctsrcv.csv. And here,
as you can see, the file was moved from this directory here.
How else can we generate other events for those other
two files? Action here was moved from.
So, we can either use moved from or moved to or create in there as well.
So, let's create a query for that specifically. And as you can
see, there are a lot of hits in this one.
Now this may be because we just installed osquery and Filebeat not too long
ago. But we can narrow that down a little bit and look at the file path here,
the time that it was created, when it was accessed,
so on and so forth if we wanted to narrow it down a little bit. We
can also narrow down the time range to the last 15 minutes to help us
out with that search. And what we're looking for is the file events
in this time range right here.
What's cool is we can do something like combine this information with the
other query that we made. And as you can see here, we have the detection for
moving the accounts received and the billing.
Now, the question comes to mind,
why don't we have something for the PII copy? That has to do
with the configuration that we have here.
So, if you remember, we copied the pii.csv to the /etc folder. In our file paths
for osquery, we're not monitoring all of the etc directory.
We're only monitoring two specific files in that directory.
The percentage signs are wildcards for the home,
the bin, and the temp, but we don't have those in the etc.
So, that's how you designate if you want it to
recursively look in that whole directory.
So, it's very important when you're setting up osquery to be able to identify
what folders or what specific file paths you want to monitor,
what's the most important to you to figure out what's changed or if
something was copied or moved, and then make sure that you have it
configured correctly in the osquery.conf file.
So, what we just did was we practiced moving some files around, and
we saw that we can detect them using custom queries in Kibana like
we have up here. Now, in the next demo,
we'll put all of this together and set up some alerts to validate the
activity and generate alerts based on that happening.