(upbeat music)
- [Malcom] The majority of systems today depend
upon signatures based on malware hashes,
to detect an attempt to infiltrate malware.
Signatures are effective in detecting much of
what's already known,
and for investigating the extent of a known intrusion.
An Indicator of Compromise or IOC,
is essentially a more advanced malware signature
or may be one or more of an MD5 hash,
a command and control domain name,
or a known malicious IP address,
a file or registry key associated with known malware
and so on.
IOCs allow a particular threat to be documented
in a consistent fashion and to facilitate automated sharing
of actionable threat information.
To be effective, they need to be timely, relevant,
accurate, specific and actionable.
The lifecycle of an IOC can be seen in this graphic.
When a compromise due to malware occurs,
an investigation takes place
and data is collected to determine what's happened
and how it's happened.
This provides much valuable information
about the way the malware works.
The data can be analyzed, and IOC is created.
These can then be deployed to intrusion prevention systems
to ensure the same compromise doesn't happen again.
Sharing IOCs is of real value to organizations
that haven't yet been attacked,
because they can use them to avoid attack.
Fortunately, this is possible
with sources such as the IOC Bucket.
IOC Bucket is a free to use community driven platform
which allows sharing of threat intelligence
in a simple but efficient way.
IOCs are developed by the community,
reviewed by the community,
and distributed for use by the community.
When I press Search, we can see that this is as yet still
an early start with only 559 IOCs in the database.
If we click Tools, Open IOC Online Editor,
we get a screen which allows a manual entry of an IOC.
This shows the kind of information held in the database.
A range of items can be included
and built using And/Or expressions to form the IOC.
These include specific parts of cookies,
emails, URLs, files, and so on.
If we click on Email,
we can see the email items we can select.
I'll select Body Text,
and so now I can enter a value.
IOC Bucket is a great initiative
which should become a mainstream source of IOCs over time,
While adversaries constantly change and adapt malware,
they tend to use the same tools,
and techniques and procedures in the malware,
process injection, credential dumping, token stealing,
host enumeration approaches and so on.
By developing ways to detect these indicators
and add them to the standard IOC checks,
the success rate for detecting malware
will be significantly enhanced.
STIX and TAXII are two interacting standards designed
to support automated sharing of threat intelligence.
STIX defines the threat intelligence
while TAXII defines how that information is communicated.
Associated with STIX/TAXII,
is the set of standardized cyber observables
which can be used to build IOC expressions.
These include such things as domain names,
email and IP addresses, file extensions, and so on.
STIX/TAXII is a community project coordinated
by the OASIS Cyber Threat Intelligence technical committee.
STIX/TAXII version two specifications
have now been published under an active use globally.
The STIX 2.0 architecture focuses on adversaries and TTPs,
and provides a rich form of expression for relationships
between the various objects making up the STIX object.
The model includes objects
which describe information relating to observations,
sightings, incidents, campaigns,
attack patterns, tactics, techniques,
and procedures, victims, and threat actors.
With the prevalence of poly and metamorphic malware
amongst other challenges,
signatures in IOCs are insufficient for
the level of malware detection
and prevention needed nowadays to prevent compromise.
Unlike IOCs, an indicator attack or IOA,
focuses on detecting the methods
and intent of what an attacker is trying to accomplish,
regardless of the malware or exploit used in the attack.
This includes detecting hard problems
for traditional defenses,
such as intrusions into systems,
using legitimate but stolen credentials
and detecting software,
which has the characteristics of zero-day exploits.
IOAs are often linked to the cyber kill chain.
The set of steps an attacker will take starting
with basic reconnaissance.
IOAs can be used to monitor for signs of an attack
at many of these kill chain stages.
Azeria labs provide a useful diagram,
explaining the development
of sophisticated detection techniques
from basic signatures with hash values
to IOCs based on IP addresses, domain names, and so on,
through to the most advanced approach using TTPs.
Cyber hunting to check for the presence currently
or in the past of intrusions,
is essentially a manual form
of detecting indicators of attack.
While there has been a lot
of attention placed on cyber hunting,
the reality is that cyber hunting manually
can be very difficult to do effectively, and it won't scale.
However, by combining cyber hunting methodologies
with automation, analytics and artificial intelligence,
intrusions can be detected at speed, and at scale.
These kinds of products are starting to emerge
with Darktrace being an early example.
(upbeat music)