Presentation: Detecting the Adversary Post-Compromise with Threat

Detecting the Adversary Post- Compromise with Threat Models and Behavioral Analytics

Recon Deliver Control Maintain

Weaponize Exploit Execute

Traditional CND

146 days - The median time an adversary is in a network before ATT&CK™ being detected -Mandiant, M-Trends 2016

Cyber Attack Lifecycle: The MITRE Corporation https://www.mitre.org/capabilities/cybersecurity/threat-based-defense

ATT&CK • Cyber threat • Data sources analysis • Adversary model • Analytics • Research • Post- • Prioritization • Industry reports compromise techniques Adversary Enterprise Behavior Defense

Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Execution Collection Threat data informed adversary model Exfiltration Command and Control

Higher fidelity on right-of-exploit, post-access phases

Describes behavior sans adversary tools

Working with world-class researchers to improve and expand

Privilege Lateral Command and Persistence Credential Access Host Enumeration Defense Evasion Exfiltration Escalation Movement Control Exploitation of Credential Process Common protocol, Normal C&C New service Software packing RDP vulnerability dumping enumeration follows standard channel Service file Windows admin Modify existing Service Common protocol, Alternate data permissions User interaction Masquerading shares (C$, service enumeration non-standard channel weakness ADMIN$) Service registry Commonly used Exfiltration over Local network Windows shared DLL Proxying permissions Network sniffing DLL Injection protocol on non- other network config webroot weakness standard port medium Local network Remote Communications Exfiltration over Hypervisor Rookit DLL path hijacking Stored file DLL loading connections vulnerability encrypted physical medium Winlogon Helper Window Standard Communications Encrypted Path interception Logon scripts DLL enumeration protocols are obfuscated separately Application Modification of Account Obfuscated Distributed Compressed Path Interception deployment shortcuts enumeration payload communications separately software Registry run keys / Editing of default Group Taint shared Multiple protocols Startup folder Indicator removal Data staged handlers enumeration content combined addition Access to remote Automated or Modification of Owner/user Scheduled task Indicator blocking services with scripted data shortcuts enumeration valid credentials exfiltration Legitimate Operating system MBR / BIOS rootkit Pass the hash Size limits Credentials enumeration Editing of default Security software Scheduled handlers enumeration transfer File system Scheduled task enumeration

Privilege Defense Credential Host Lateral Persistence Execution C2 Exfiltration Escalation Evasion Access Enumeration Movement

Legitimate Credentials Credential Account Application Command Commonly Automated Accessibility Features Binary Dumping enumeration deployment Line used port or scripted Padding software Comm exfiltration AddMonitor DLL Side- Credentials File system Exploitation File Access through Data DLL Search Order Hijack Loading in Files enumeration of PowerShell removable compressed Edit Default File Handlers Disabling Network Group Vulnerability Process media Data Security Logon Custom encrypted New Service Sniffing permission Hollowing Data size Tools enumeration scripts application Path Interception User Pass the Registry limits File System layer Scheduled Task Logical Interaction Local hash Rundll32 Data staged Pass the protocol Service File Permission Offsets Credential network Scheduled Custom Exfil over C2 Weakness ticket Process manipulation connection Peer Task encryption channel Shortcut Modification Hollowing enumeration connections Service cipher Exfil over Web shell Rootkit Local Remote Manipulation Data alternate Bypass UAC networking Desktop Third Party obfuscation channel to BIOS Fallback C2 network DLL Injection enumeration Protocol Software channels Exfil over Hypervisor Indicator Multiband Rootkit Exploitation Operating Windows management other blocking on comm of system instrumentation Multilayer network Logon Scripts Vulnerability host enumeration Indicator Windows remote encryption medium Peer Master Boot removal from Owner/User management Exfil over Record enumeration Remote connections tools Standard app physical Indicator Services medium Mod. Exist’g Process Replication layer Service removal from enumeration through protocol From local host Standard Registry Run Masquerad- Security removable system non-app Keys ing software media From layer Serv. Reg. Perm. NTFS enumeration Shared network protocol Weakness Extended Service webroot resource Attributes Taint shared Standard Windows Mgmt Obfuscated enumeration content encryption From Instr. Event Window Windows removable Subsc. Payload cipher Rundll32 enumeration admin Uncommonly media Winlogon Helper shares DLL Scripting used port Scheduled Software transfer Packing Timestomp © 2016 The MITRE Corporation. All rights reserved. | 7 | ATT&CK MatrixTactics and Techniques (2016)

Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Execution Collection Exfiltration Command and Control DLL Search Order Hijacking Brute Force Account Discovery Windows Remote Management Automated Collection Automated Exfiltration Commonly Used Port Legitimate Credentials Application Window Third-party Software Clipboard Data Data Compressed Communication Through Credential Dumping Accessibility Features Binary Padding Discovery Application Deployment Command-Line Data Staged Data Encrypted Removable Media AppInit DLLs Code Signing Software Execution through API Data from Local System Data Transfer Size Limits Custom Command and Credential Manipulation File and Directory Discovery Local Port Monitor Component Firmware Graphical User Interface Data from Network Shared Exfiltration Over Alternative Control Protocol Exploitation of Vulnerability New Service DLL Side-Loading Credentials in Files Local Network Configuration InstallUtil Drive Protocol Custom Cryptographic Path Interception Disabling Security Tools Input Capture Discovery Logon Scripts PowerShell Protocol Data from Removable Media Exfiltration Over Command Scheduled Task File Deletion Network Sniffing Pass the Hash Process Hollowing Data Obfuscation Local Network Connections and Control Channel Service File Permissions Weakness Discovery Pass the Ticket Regsvcs/Regasm Email Collection Fallback Channels File System Logical Offsets Two-Factor Authentication Service Registry Permissions Weakness Network Service Scanning Remote Desktop Protocol Regsvr32 Input Capture Multi-Stage Channels Interception Exfiltration Over Other Web Shell Indicator Blocking Remote File Copy Rundll32 Screen Capture Network Medium Peripheral Device Discovery Multiband Communication Exploitation of Vulnerability Remote Services Scheduled Task Exfiltration Over Physical Basic Input/Output System Bypass User Account Control Replication Through Scripting Medium Multilayer Encryption Permission Groups Discovery Bootkit DLL Injection Removable Media Service Execution Scheduled Transfer Peer Connections Change Default File Indicator Removal from Process Discovery Shared Webroot Windows Management Remote File Copy Association Tools Query Registry Taint Shared Content Instrumentation Standard Application Layer Component Firmware Remote System Discovery Windows Admin Shares Protocol Indicator Removal on Host Hypervisor Standard Cryptographic Security Software Discovery Logon Scripts InstallUtil Protocol Modify Existing Service Masquerading System Information Standard Non-Application Redundant Access Modify Registry Discovery Layer Protocol Registry Run Keys / Start NTFS Extended Attributes System Owner/User Uncommonly Used Port Folder Obfuscated Files or Discovery Web Service Security Support Provider Information System Service Discovery Shortcut Modification Process Hollowing

Windows Management Redundant Access Instrumentation Event Regsvcs/Regasm Subscription Regsvr32 Winlogon Helper DLL Rootkit Rundll32 Scripting Software Packing Timestomp

. Consists of: 1. Tactic phases derived from Cyber Attack Lifecycle 2. List of techniques available to adversaries for each phase 3. Possible methods of detection and mitigation 4. Documented adversary use of techniques and software 5. Disambiguation of adversary names

. Publically available adversary information is a problem – Not granular enough Image source: US Army – Insufficient volume http://www.flickr.com/photos/35703177@N00/3102597630/ Mr. Potato Head is a registered trademark of Hasbro Inc.

– Description: When operating systems boot up, they can start programs or applications called services that perform background system functions. … Adversaries may install a new service which will be executed at startup by directly modifying the registry or by using tools. – Platform: Windows – Permissions required: Administrator, SYSTEM – Effective permissions: SYSTEM – Detection: . Monitor service creation through changes in the Registry and common utilities using command-line invocation . Tools such as Sysinternals Autoruns may be used to detect system changes that could be attempts at persistence . Monitor processes and command-line arguments for actions that could create services – Mitigation: . Limit privileges of user accounts and remediate Privilege Escalation vectors . Identify and block unnecessary system utilities or potentially malicious software that may be used to create services – Data Sources: Windows Registry, process monitoring, command-line parameters – Examples: Carbanak, Lazarus Group, TinyZBot, Duqu, CozyCar, CosmicDuke, hcdLoader, … – CAPEC ID: CAPEC-550

– Description: Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications1. The intrusion into healthcare company Anthem has been attributed to Deep Panda2. – Aliases: Deep Panda, Shell Crew, WebMasters, KungFu Kittens, PinkPanther, Black Vine – Techniques: • PowerShell • Scripting • Windows Management Instrumentation • Indicator Removal from Tools • Web Shell • Regsvr32 • Windows Admin Shares • Accessibility Features • Process Discovery – Software: Net, Tasklist, Sakula, Mivast, Derusbi – References: 1. Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014. 2. ThreatConnect Research Team. (2015, February 27). The Anthem Hack: All Roads Lead to China. Retrieved January 26, 2016.

– Description: The Tasklist utility displays a list of applications and services with its Process ID (PID) for all tasks running on either a local or a remote computer. It is packaged with Windows operating systems and can be executed from the command line1. – Aliases: Tasklist – Type: Tool – Windows builtin software: Yes – Techniques Used: . Process Discovery: Tasklist can be used to discover processes running on a system. . Security Software Discovery: Tasklist can be used to enumerate security software currently running on a system by process name of known products. . System Service Discovery: Tasklist can be used to discover services running on a system. – Groups: Deep Panda, Turla, Naikon – References: 1. Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015.

. Gap analysis with current defenses – How do we improve our security posture? . Prioritize detection/mitigation of heavily used techniques – Given our architecture, what is our level of exposure to specific techniques and groups ? . Information sharing – How can we share observed behaviors on our network among our analysts and partners ? . Track a specific adversary’s set of techniques – If there is a breach by a known group , how do we report on it and track TTP changes ? . Simulations, exercises – How can we effectively test our defenses and analytics against threat behaviors ? . New technologies, research – How do we find gaps in current defensive technology ?

Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Execution Collection Exfiltration Command and Control DLL Search Order Hijacking Brute Force Account Discovery Windows Remote Management Automated Collection Automated Exfiltration Commonly Used Port Legitimate Credentials Application Window Third-party Software Clipboard Data Data Compressed Communication Through Credential Dumping Accessibility Features Binary Padding Discovery Application Deployment Command-Line Data Staged Data Encrypted Removable Media AppInit DLLs Code Signing File and Directory Software Execution through API Data from Local System Data Transfer Size Limits Custom Command and Credential Manipulation Local Port Monitor Component Firmware Discovery Exploitation of Graphical User Interface Data from Network Exfiltration Over Control Protocol New Service DLL Side-Loading Credentials in Files Local Network Vulnerability InstallUtil Shared Drive Alternative Protocol Custom Cryptographic Path Interception Disabling Security Tools Input Capture Configuration Discovery Logon Scripts PowerShell Data from Removable Exfiltration Over Protocol Scheduled Task File Deletion Network Sniffing Local Network Pass the Hash Process Hollowing Media Command and Control Data Obfuscation Service File Permissions Weakness File System Logical Two-Factor Connections Discovery Pass the Ticket Regsvcs/Regasm Email Collection Channel Fallback Channels Service Registry Permissions Weakness Offsets Authentication Network Service Scanning Remote Desktop Protocol Regsvr32 Input Capture Exfiltration Over Other Multi-Stage Channels Web Shell Indicator Blocking Interception Peripheral Device Remote File Copy Rundll32 Screen Capture Network Medium Multiband Basic Input/Output Exploitation of Vulnerability Discovery Remote Services Scheduled Task Exfiltration Over Physical Communication System Bypass User Account Control Permission Groups Replication Through Scripting Medium Multilayer Encryption Bootkit DLL Injection Discovery Removable Media Service Execution Scheduled Transfer Peer Connections Change Default File Indicator Removal from Process Discovery Shared Webroot Windows Management Remote File Copy Association Tools Query Registry Taint Shared Content Instrumentation Standard Application Component Firmware Indicator Removal on Remote System Discovery Windows Admin Shares Layer Protocol Hypervisor Host Security Software Standard Cryptographic Logon Scripts InstallUtil Discovery Protocol Modify Existing Service Masquerading System Information Standard Non-Application Redundant Access Modify Registry Discovery Layer Protocol Registry Run Keys / Start NTFS Extended Attributes System Owner/User Uncommonly Used Port Folder Obfuscated Files or Discovery Web Service Security Support Provider Information System Service Discovery Shortcut Modification Process Hollowing Windows Management Redundant Access Instrumentation Event Regsvcs/Regasm Subscription Regsvr32 Winlogon Helper DLL Rootkit Rundll32 Scripting High Confidence Med Confidence No Confidence Software Packing Timestomp

Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Execution Collection Exfiltration Command and Control DLL Search Order Hijacking Brute Force Account Discovery Windows Remote Management Automated Collection Automated Exfiltration Commonly Used Port Legitimate Credentials Application Window Third-party Software Clipboard Data Data Compressed Communication Through Credential Dumping Accessibility Features Binary Padding Discovery Application Deployment Command-Line Data Staged Data Encrypted Removable Media AppInit DLLs Code Signing File and Directory Software Execution through API Data from Local System Data Transfer Size Limits Custom Command and Credential Manipulation Local Port Monitor Component Firmware Discovery Exploitation of Graphical User Interface Data from Network Exfiltration Over Control Protocol New Service DLL Side-Loading Credentials in Files Local Network Vulnerability InstallUtil Shared Drive Alternative Protocol Custom Cryptographic Path Interception Disabling Security Tools Input Capture Configuration Discovery Logon Scripts PowerShell Data from Removable Exfiltration Over Protocol Scheduled Task File Deletion Network Sniffing Local Network Pass the Hash Process Hollowing Media Command and Control Data Obfuscation Service File Permissions Weakness File System Logical Two-Factor Connections Discovery Pass the Ticket Regsvcs/Regasm Email Collection Channel Fallback Channels Service Registry Permissions Weakness Offsets Authentication Network Service Scanning Remote Desktop Protocol Regsvr32 Input Capture Exfiltration Over Other Multi-Stage Channels Web Shell Indicator Blocking Interception Peripheral Device Remote File Copy Rundll32 Screen Capture Network Medium Multiband Basic Input/Output Exploitation of Vulnerability Discovery Remote Services Scheduled Task Exfiltration Over Physical Communication System Bypass User Account Control Permission Groups Replication Through Scripting Medium Multilayer Encryption Bootkit DLL Injection Discovery Removable Media Service Execution Scheduled Transfer Peer Connections Change Default File Indicator Removal from Process Discovery Shared Webroot Windows Management Remote File Copy Association Tools Query Registry Taint Shared Content Instrumentation Standard Application Component Firmware Indicator Removal on Remote System Discovery Windows Admin Shares Layer Protocol Hypervisor Host Security Software Standard Cryptographic Logon Scripts InstallUtil Discovery Protocol Modify Existing Service Masquerading System Information Standard Non-Application Redundant Access Modify Registry Discovery Layer Protocol Registry Run Keys / Start NTFS Extended Attributes System Owner/User Uncommonly Used Port Folder Obfuscated Files or Discovery Web Service Security Support Provider Information System Service Discovery Shortcut Modification Process Hollowing Windows Management Redundant Access Instrumentation Event Regsvcs/Regasm Subscription Regsvr32 Winlogon Helper DLL Rootkit Rundll32 Scripting Software Packing Timestomp High Confidence Med Confidence No Confidence

Defense Evasion Exfiltration Command and Control DLL Search Order Automated Exfiltration Commonly Used Port Hijacking Data Compressed Communication Through . Adversary has the most latitude for variation at the Legitimate Credentials Data Encrypted Removable Media network level Binary Padding Data Transfer Size Limits Custom Command and Code Signing Exfiltration Over Control Protocol Component Firmware Alternative Protocol Custom Cryptographic DLL Side-Loading Exfiltration Over Protocol Disabling Security Tools Command and Control Data Obfuscation . Firewall, IDS/IPS, netflow, proxy, mail gateway, File Deletion Channel Fallback Channels WCF, SSL MitM, protocol decoders, anomaly File System Logical Exfiltration Over Other Multi-Stage Channels Offsets Network Medium Multiband detection etc… Indicator Blocking Exfiltration Over Physical Communication Exploitation of Medium Multilayer Encryption Vulnerability Scheduled Transfer Peer Connections Bypass User Account Remote File Copy . All partial solutions Control Standard Application DLL Injection Layer Protocol . Don’t add up to a complete one Indicator Removal from Standard Cryptographic Tools Protocol Indicator Removal on Standard Non-Application Host Layer Protocol . Often require specific prior knowledge InstallUtil Uncommonly Used Port Masquerading Web Service – IPs, domains, malware changed easily Modify Registry NTFS Extended Attributes . Sector, organization specific infrastructure Obfuscated Files or Information . Frequently modify tools Process Hollowing + Web Shell Redundant Access . Use legitimate channels Regsvcs/Regasm (Persistence & Privilege Escalation) Regsvr32 Rootkit Rundll32 . Better coverage with host sensing Scripting Software Packing Timestomp

Persistence Lateral 24 Movement 14

Privilege Execution Escalation 14 15

Defense Collection Evasion 29 9

Credential Exfiltration Access 8 9

Discovery Command 15 and Control 16

Persistence Lateral 24 13 Movement 14 9

Privilege Execution Escalation 14 10 15 9

Defense Collection Evasion 29 26 9 9

Credential Exfiltration Access 8 8 9 7

Discovery Command 15 15 and Control 16 16

Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Execution Collection Exfiltration Command and Control DLL Search Order Hijacking Brute Force Account Discovery Windows Remote Management Automated Collection Automated Exfiltration Commonly Used Port Legitimate Credentials Application Window Third-party Software Clipboard Data Data Compressed Communication Through Credential Dumping Accessibility Features Binary Padding Discovery Application Deployment Command-Line Data Staged Data Encrypted Removable Media AppInit DLLs Code Signing File and Directory Software Execution through API Data from Local System Data Transfer Size Limits Custom Command and Credential Manipulation Local Port Monitor Component Firmware Discovery Exploitation of Graphical User Interface Data from Network Exfiltration Over Control Protocol New Service DLL Side-Loading Credentials in Files Local Network Vulnerability InstallUtil Shared Drive Alternative Protocol Custom Cryptographic Path Interception Disabling Security Tools Input Capture Configuration Discovery Logon Scripts PowerShell Data from Removable Exfiltration Over Protocol Scheduled Task File Deletion Network Sniffing Local Network Pass the Hash Process Hollowing Media Command and Control Data Obfuscation Service File Permissions Weakness File System Logical Two-Factor Connections Discovery Pass the Ticket Regsvcs/Regasm Email Collection Channel Fallback Channels Service Registry Permissions Weakness Offsets Authentication Network Service Scanning Remote Desktop Protocol Regsvr32 Input Capture Exfiltration Over Other Multi-Stage Channels Web Shell Indicator Blocking Interception Peripheral Device Remote File Copy Rundll32 Screen Capture Network Medium Multiband Basic Input/Output Exploitation of Vulnerability Discovery Remote Services Scheduled Task Exfiltration Over Physical Communication System Bypass User Account Control Permission Groups Replication Through Scripting Medium Multilayer Encryption Bootkit DLL Injection Discovery Removable Media Service Execution Scheduled Transfer Peer Connections Change Default File Indicator Removal from Process Discovery Shared Webroot Windows Management Remote File Copy Association Tools Query Registry Taint Shared Content Instrumentation Standard Application Component Firmware Indicator Removal on Remote System Discovery Windows Admin Shares Layer Protocol Hypervisor Host Security Software Standard Cryptographic Logon Scripts InstallUtil Discovery Protocol Modify Existing Service Masquerading System Information Standard Non-Application Redundant Access Modify Registry Discovery Layer Protocol Registry Run Keys / Start NTFS Extended Attributes System Owner/User Uncommonly Used Port Folder Obfuscated Files or Discovery Web Service Security Support Provider Information System Service Discovery Shortcut Modification Process Hollowing Windows Management Redundant Access Instrumentation Event Regsvcs/Regasm Subscription Regsvr32 Winlogon Helper DLL Rootkit Rundll32 Scripting Software Packing Timestomp

. Attackers post-exploit look very similar to normal users

. Traditional efforts aren’t effective at finding an active intrusion – Internal tools look for compliance violations, exploits, or C2 channels – Indicator sharing only covers what’s known and is fragile

. Post-compromise detection

. Focused on known behaviors

. Threat-based model

. Iterative by design

Picture from: https://upload.wikimedia.org/wikipedia/commons/b/b7/Operating_a_Computer_Keyboard_MOD_45158105.jpg . Developed in a realistic environment

MITRE’s Annapolis Junction, MD site About 250 unclassified computers Primarily user desktops running Windows 7

What behavior do we want to detect?

What did we Data Collection miss? / Sensor Dev.

Analytic Blue Team Development

Red Team Testing

What behavior do we want to detect?

What did we Data Collection miss? / Sensor Dev.

Analytic Blue Team Development

Red Team Testing

Sensors and Security Tools

What behavior do we want to detect?

What did we Data Collection miss? / Sensor Dev.

Analytic Blue Team Development

Red Team Testing

Addressing the ATT&CK TTPs requires host-level sensing beyond typical antivirus and host-based intrusion sensors

Many more opportunities to catch adversaries operating inside networks than at the perimeter

Better awareness of compromise severity and scope – Verizon: 85% of IP thefts lacked specific knowledge of what was taken 2013 Verizon Data Breach Investigations Report

. COTS – CarbonBlack, Mandiant, CrowdStrike, Cylance, others

. Built-in and OS Integrated – Event Tracing for Windows, Sysmon, Autoruns, Event Logs

. Host-based Sensors – Microsoft Sysinternals Sysmon – Custom Event Tracing for Windows Sensor – Hostflows – Windows Event Logs – Microsoft Sysinternals Autoruns – Splunk Universal Forwarder . For facilitation of retrieving logs . WinRegMon . Stream (testing)

. Network Sensors – PCAP – Netflows – Suricata

Provides details Process chains provide context on processes around system activity

Explorer.exe cmd.exe

Outlook.exe Acrobat.exe cmd.exe

Svchost.exe wmiprvse.exe cmd.exe

Metadata on Pivot point between network connections host and network data • IP Addresses • Process initiating Connection • Ports • PID, PPID • Protocol Information • Message Contents Profile process behavior Identify covert channels

Analytic Development

What behavior do we want to detect?

What did we Data Collection miss? / Sensor Dev.

Analytic Blue Team Development

Red Team Testing

Analytic Development

Types of Analytics

. TTP Analytics . Situational Awareness . Anomaly/Statistical . Forensic

. Designed to detect a certain adversary tactic, technique or procedure. . Examples: . Suspicious Commands (net.exe, at.exe, etc.) . Remotely Launched Services . SMB Copy and Execute . Services launching cmd.exe . SPL: eventtype=process_start image_path=*\cmd.exe parent_image_path="*\windows\system32\services.exe" | table _time host_name user ppid pid image_path command_line

. Analytics geared towards a general understanding of what is occurring within your environment at a given time. Information like login times or running processes don’t indicate malicious activity, but when coupled with other indicators can provide much needed additional information. . Example: . Running processes (e.g. security software) . Local User Login . Psedudocode: EventCode == 4624 and [target_user_name] != "ANONYMOUS LOGON" AND [authentication_package_name] == "NTLM"

. Detection of behavior that is not malicious but unusual and may be suspect. Like Situational Awareness analytics, these types of analytics don’t necessarily indicate an attack. . Examples: – New Executables – Outlier Parents of cmd.exe – Clearing Event Logs . SPL: (eventtype = wineventlog_security EventID=104) OR (eventtype = wineventlog_system AND (EventID=1100 OR EventID=1102))

. These types of analytics are most useful when conducting an investigation regarding an event. Oftentimes forensic analytics will need some kind of input to be most useful. . Examples: – Determine Accounts Compromised by Credential Dumper – Remote logons to or from the box within a timespan

Analytic Development

Cyber Analytic Repository

. Description – Description of the hypothesis being tested in the analytic – Relevant information about the interest or benefit of the alert . Categorical Information – CAR analytic number: for alerting and tracking purposes – Submission date – Information domain: host v. network – Available and applicable subtypes – Type of analytic – Status: conceptual, active, deprecated, etc.

. ATT&CK Detection – Summary of the tactic(s) and technique(s) covered by the analytic – Level of coverage . Pseudocode – The analytic instantiation defined using pseudocode . Unit Tests – Requirements, configuration, description, and command applicable to the analytic

Analytic Development

Implementation

index=old_sensor type=PROC_EVENT_CREATE hostname=A4123456.mitre.org imagepath=“c:\\location\\foo.exe” - OR - index=sysmon Message=“Process Create” ComputerName=A4123456.mitre.org Image=“c:\\location\\foo.exe” - OR – index=mcafee sourcetype=hips alert=“process launch” node_name=A4123456.mitre.org image_path=“c:\\location\\foo.exe”

eventtype=process_start host_name=A4123456 image_path=“c:\location\foo.exe”

Current eventtypes: file_access, process_start, process_stop, flow, logon

props.conf in our custom Sysmon TA: . process_start elements: – command_line [source::WinEventLog:Microsoft-Windows-Sysmon/Operational] – exe FIELDALIAS-image_path = Image AS image_path FIELDALIAS-host_name = ComputerName AS host_name – fqdn … – host_name EVAL-exe = replace(image_path, ".*\\\\", "") – image_path EVAL-parent_exe = replace(parent_image_path, ".*\\\\", "") – parent_exe … – parent_image_path – pid – ppid eventtypes.conf in our custom Sysmon TA: – sid – user [process_start] search = source=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 – uuid

CAR-2014-07-001: Search Path Interception Hypothesis: As described by ATT&CK, one method of escalation is intercepting the search path for services, so that legitimate services point to the binary inserted at an intercepted location. This can be done when there are spaces in the path and it is unquoted.

Instantiation: eventtype=process_start parent_image_path="*\\system32\\services.exe" command_line!="\"*" command_line="* *" | rex field=image_path ".*\\\(?.*)" | rex field=img_exe "(?.*)\..*" | where NOT like(lower(command_line ), lower("%"+img_exe+"%")) AND like(lower(command_line), lower("%"+img_ba se+"%")) | table _time host_name ppid pid parent_image_path image_path command_line img_exe

Evaluating Analytics

What behavior do we want to detect?

What did we Data Collection miss? / Sensor Dev.

Analytic Blue Team Development

Red Team Testing

. Red/Blue Team operations within production environment – Emulated adversary – Asynchronous – Designed to push analytic boundaries . Goals – What dates did activity occur? – What hosts were affected? – What credentials were compromised? – What was the RT’s goal? – Was the RT successful?

What behavior do we want to detect?

What did we Data Collection miss? / Sensor Dev.

Analytic Blue Team Development

Red Team Testing

. 13 Cyber Games from 2013-2015 . Detected Significant RT Activity Every Cyber Game

Hosts Credentials

Summary and Example

Suspicious . Certain commands are frequently used by Commands malicious actors and infrequently used by normal users. . By looking for execution of these What did we Data Collection commands in short periods of time, we can miss? / Sensor Dev. not only see when a malicious user was on the system but also get an idea of what they were doing. . ATT&CK Coverage: Analytic Blue Team Development Credential Access Exfiltration Defense Evasion Lateral Movement Discovery Persistence Red Team Execution Privilege Escalation Testing

Suspicious . Sysmon event example: Commands 1234ABCD.DOMAIN.COM…2016-08-05 16:01:13.851…22520C:\Windows\System32\net.exe Analytic net start Blue Team Development splunkforwarder…DOMAIN\USER123…10972C:\Windows\System32\cmd.exe Red Team cmd /c Testing net start splunkforwarder

Suspicious eventtype=process_start exe="arp.exe" OR Commands exe="at.exe" OR exe="attrib.exe" OR exe="cscript.exe" OR exe="dsquery.exe" OR exe="hostname.exe" OR exe="ipconfig.exe" OR exe="nbstat.exe" What did we Sysmon OR exe="net.exe" OR exe="netsh.exe" OR miss? exe="nslookup.exe" OR exe="mimikatz.exe" OR exe="ping.exe" OR exe="quser.exe" OR exe="qwinsta.exe" OR exe="reg.exe" OR exe="runas.exe" OR exe="sc.exe" OR exe="ssh.exe" OR exe="systeminfo.exe" OR CAR-2013-04- Blue Team 002 exe="taskkill.exe" OR exe="telnet.exe" OR exe="tracert.exe" OR exe="wscript.exe" | stats values(exe) values(UtcTime) by Red Team host ppid parent_exe Testing

Suspicious . Red Team event occurs Commands . Blue team is alerted on the following: – Added service with sc.exe

What did we – Started service with net.exe Sysmon miss? – Dumped credentials with mimikatz.exe

Blue Team CAR-2013-04- Detects 002 Commands

Red Team Executes Commands

Suspicious . Blue Team missed: Commands – Creation of scheduled task via schtasks.exe Need to expand – Collection of documents using xcopy.exe list of Sysmon . Blue Team updates query: commands – Add schtasks.exe – Add xcopy.exe

Blue Team CAR-2013-04- Detects 002 Commands

Red Team Executes Commands

Our experiments validate that end-point sensing can be used to detect an emulated cyber adversary

Understanding parent / child relationships of processes is highly valuable for identifying malicious behavior

We continue to improve analytics and test sensing capabilities to better detect adversary behavior

The Fort Meade Cyber Analytic ATT&CK Experiment Repository

[email protected] [email protected] [email protected]

Public website: Public website:

attack.mitre.org car.mitre.org

Effectively defending a network from Advanced Persistent Threats (APTs) remains a difficult problem for enterprises, as evidenced by the large number of publicly documented network compromises. MITRE has been performing research on ways to detect APTs more quickly post- compromise, once they gain initial access to a network. As part of our research, we developed an adversary model (ATT&CK™), a suite of behavior-based analytics for detecting threats operating on a network, and an iterative method for developing future analytics.

ATT&CK™ is a model and framework for describing the actions an adversary takes while operating within an enterprise network. The model can be used to better characterize post- compromise adversary behavior with the goal of distilling the common behaviors across known intrusion activity into individual actions that an adversary may take to be successful. The techniques described in ATT&CK™ relate to observed APT intrusions, and are at a level of abstraction necessary for effectively prioritizing defensive investments and comparing host- based intrusion detection capabilities.

. Post-compromise detection

. Focused on known behaviors

. Threat-based model

. Iterative by design

. Developed in a realistic environment

. Work – Senior Cybersecurity Engineer at The MITRE Corporation – Principal Investigator of BASIS – Behavioral Analytics for Security: Implementation and Sharing – EIC - network and endpoint sensor integration and analytic platform engineering . Past Presentations – Detecting the Adversary Post-Compromise with Threat Models and Behavioral Analytics . Gartner Security and Risk Management Summit – June 2016 . US Army Europe G6 Cyber Summit – July 2016 . Splunk .conf – September 2016 . The Learning Forum's Cyber Security Risk Council – October 2016 – Discovering threats by monitoring behaviors on endpoints . Splunk .conf – October 2014 . Education – M.S. in Engineering Management, Cybersecurity focus from UMBC – B.S. in Electrical Engineering from Lehigh University