And not to mention,
these aren't just tools that just happen to exist on the system.
They're tools that are actively used, not just by the OS,
but also by system admins and normal processes,
and GPO applications, and stuff like that.
So if you're looking at it from a traffic perspective,
how do you separate what is bad from what's good?
It can be very difficult.
You're right.
There's a lot of noise that's occurring on the system.
So even when you do turn on logging that you're going to have
all this other stuff being logged as well.
So at some point,
it almost becomes like you're looking for a needle in a stack of needles.
You need to go in there,
and you need to recognize what these techniques look like,
even when you turn on logging,
and you have to look for those specific indicators.
And there are some indicators that are easier to detect than others,
like what we saw in the demo.
We saw the encoded PowerShell command.
You're probably not going to see that used too often in legitimate code.
A systems administrator doing it, you may see that happen a couple times,
but for the most part, you're not going to see that.
So when you see an encoded PowerShell command,
that's something that you can focus in on.
If you see a, with WMI with the event subscriptions,
in an organization,
there should be a finite amount of event subscriptions
that you have installed on your systems.
So that behavior is known, and you make a baseline out of that.
Exactly.
You can make that baseline, and then when you go and you look at your systems,
if you see something outside that baseline,
then that's an indicator right there.
That's something that you can just focus in on right away and look at.
But that's not something I see a lot of organizations doing.
That's a pretty mature security operations center that's looking at
those types of things and doing that right now.
When you look at the maturity of Socks and the
defensive teams of an organization,
they typically start out with not being able to do all this stuff only
because they don't have the access into the systems and they don't have
the tools that allow them to see this.
But as the organization grows and matures,
they start to threat hunt more and start looking for these anomalies
and looking for these things that are really weird.
Before that, they're fighting fires constantly.
They're dealing with the commodity malware that is getting detected,
and so that even allows the attackers to hide even more.
If there is ransomware on a system over here,
then the attacker can easily be over here on another computer,
and the defenders are probably not even going to notice it
because they're fighting all these fires over here,
they're getting calls from the CIO asking when is
this going to be taken care of, when will our files get back,
and then so on.
And so it's very easy for the attackers using these
techniques to hide in the noise, not only that's on the system,
but also happening within the organization.
Yeah,
and that's something that I've seen before too is even the
same attacker will execute a noisy attack and then a
stealthy attack at the same time, and this is not the actual target.
This is just to get your guys spun up so they're only looking here,
like look at my left hand while my right hand--- Exactly.
That happens a lot.
That's a great technique for attackers to use.
And in fact, I've even seen attackers that have compromised systems,
and they put their backdoors to sleep for like 30 days.
So they compromise a system,
and their backdoor doesn't even contact them again for another 30 days.
So as a defender, if I,
and if they compromise another system and lose that system,
as a defender,
I may not go out and look for all of the other
systems that have been compromised.
And then all the attacker has to do is wait for that
backdoor to wake up in a couple of weeks,
and then they have access back into the system.
They have all the time in the world to wait.
Yeah.
And that's important awareness too for a security operation team
and CIOs who are implementing these teams.
And as your security operations guys are looking at the stuff
that's known and attackers leverage that information knowing that
you're using the signature analysis,
you're doing all you can putting out the normal fires to then go
ahead and use kind of these more and more prevalent attacks like
fileless malware and stuff that's hidden in the background that
isn't as well know.
And so that kind of speaks to hey,
not only do we need a security operations team,
we definitely need threat hunting guys.
You have to have your IR team who's kind of developing these new techniques,
and then you can integrate that back into security operations.
And I've actually seen a lot of organizations now,
when you look at incident response, there is a general framework that follows.
You do the investigation,
and then you do the eradication where you remove the compromise,
then you do the remediation, and so on, and then finally,
you do the lessons learned.
In that process,
a lot of organizations have started to include threat hunting in there.
So the incident does not get closed out until that threat hunt occurs.
And what you do in that threat hunt in that case is you start looking
on all your systems then for this adversary to see if maybe they
pivoted to something that you didn't see.
Because in an investigation, you're pretty laser focused.
You're looking at this one system,
and if you see that system pivoted to something else,
then you start looking at that system.
And maybe you're looking at networking traffic and you see these five
systems over here that have gotten compromised,
so you're laser focused on those,
but so you're not looking at anything else in your organization.
So there could be something that slips through the cracks,
and that's where this threat hunting comes in,
and that's where understanding how these techniques work really helps
to know for that threat hunter to go out and look for this as they're
looking through their organization.
Yeah, absolutely.
So thanks, NIST,
for providing great framework we could have used for instant response,
but absolutely, adding in the hey, this is kind of our initial indicator,
and then through analysis, we found,
and hopefully we find as this becomes more aware,
maybe we found some fileless malware techniques used because we were able
to pull memory in time or get the page file in time,
and then that's our kind of root cause,
and then we take our final indicator compromise and the loop
that back into threat hunt and look for anything that happened
in the rest of the organization,
and then probably add that back into the beginning of the detection.
Like when we add that rule,
something that helps us identify that whether it's a
behavioral analysis technique or something like that so that
we can identify that quicker next time.
And sometimes our tools can help us with doing that.
Antivirus, not as much.
Antivirus typically relies on signatures.
But EDR, the endpoint detection and response tools,
that are kind of coming out,
and I've seen a lot of organizations deploy these either in
addition to antivirus or in place of antivirus,
and these tools tend to work a little bit differently.
They tend to look for anomalies as opposed to static
signatures that a lot of the antivirus still do,
and so they'll look for things that are indicative of these fileless attacks.
So for example, you should really never see Word execute PowerShell.
So as your looking at the processors,
if you see PowerShell being executed and parent process of that is Word,
or WMI, the WMI processes, or Excel, or Adobe,
or something like that,
then that is a huge red flag that we're going to lock in on.
And that's kind of what EDR does is it looks for these anomalies.
And unfortunately, yeah, you do fall into cases,
there are all those edge cases where an administrator or a
programmer did write something legitimate where PowerShell
is being executed out of Word, but those are edge cases.
Those should be very far and few in between.
And you probably want to validate those things--- Yeah,
you want to validate them anyway.
Yeah.
So when we're talking about should PowerShell be coming out of Word or not,
and that's the kind of stuff that EDR is looking for,
that's more behavior analysis.
It is.
But that sounds really scary, but basically,
we're just saying is like yeah, if you see PowerShell executing from Word,
that's bad.
Exactly.
It's looking for what's the normal activity on your system
versus what is the malicious or the anomalies?
When I teach malware analysis,
one of the things that I always teach is you need to know what your
normal system activity is so that you can kind of whitelist that
and know what the malware is doing when you're executing malware
and watching what it's doing.
Same thing goes for your systems.
Get some clean images, your gold images,
install your EDR software on it,
and let it sit there for a week or so and see what gets alerted.
Those are probably, unless you have malware in your gold image,
which you have a whole host of problems beyond that then,
then you can go in there, and you can investigate what is this?
If it truly is benign, then you know to whitelist it going forward,
and if nothing else,
that's going to make the lives of your Sock analyst so much easier
because they don't have an extra two dozen alerts a day to go through
because you know that those are benign, and you can just ignore them.
Yeah, absolutely.
And with, security doesn't always make the company money,
but it does save them money.
And so with a limited team, you have to be able to limit what alerts you look at.
So it's part of the process.
Yeah, you have to limit the alerts that you look at.
You have to be,
you have to have to have that laser focus in order to
find the bad stuff in your environment,
and being able to know what's good versus bad,
really will help us do that.