- [Katie] Please join me in welcoming Ivan Kirillov.
(audience applauding)
- All right, thanks, Katie.
So I don't have any spreadsheets, but I do have memes
and I do have a heat map, so, drink a beer, something.
All right, so, first quick show of hands,
who's familiar with CAR, like at all?
Have you guys, have you heard of it?
Oh wow, all right, awesome.
That's more than I thought.
No, that's great, that's great, that's not a problem.
Yeah, so for those of you that aren't familiar with it,
it's not a plane, it's not a real car.
What it is is it's an acronym and a website, so (chuckles)
as you can imagine, yeah, so what it is,
it's really an ATT&CK-driven analytics repository
that we have on GitHub, so, it's actively maintained,
which is nice because it wasn't for a while.
So CAR was kind of really actively maintained
from 2013 to 2016,
and then it had kind of three-year hiatus,
but now it's back, and it's back in a big way,
at least I hope so. (chuckles)
But yeah, besides analytics,
I think we have some interesting things
that a lot of people don't have,
with regards to analytic repositories, right?
So we have a data model that allows you
to do vendor agnostic mappings to our data model,
and then you can use those inside of your analytics.
We also have mappings to sensors, although there's a caveat
on that, which I'll mention.
Most of them are horribly outdated. (chuckles)
And then we have an exploration tool called Carrot,
so Carrot, I think, is kind of an interesting tool
for showing kinda the relationships between sensors,
data sources, and analytics.
It's really more of a proof of concept.
I don't think you'd do much operationally with it,
but it is kind of a cool way of showing
that if you add a sensor, you'll get a lot more coverage
in terms of your analytics,
so there's some nice stuff there.
Yeah, so, but recently, we've been doing a lot of stuff
on just trying to kind of increase the quality,
the good stuff we have in CAR,
just trying to make it better.
One obvious thing is just adding new analytics,
so, again, we didn't have any since 2016.
We've added eight new ones this year,
so I think that's pretty awesome.
Another one is we've converted all our analytics to YAML.
So, if you want to parse them and adjust them into your sim,
into your Splunk instance, whatever, you can do that now,
so I think that's pretty cool.
And then another one
is we've added multiple implementations to each analytics,
so this is an example of one, right?
So, as you can see here, we have pseudocode at the top.
So that's what CAR used to have.
CAR used to have only pseudocode implementations.
Since then, we've started adding things
like Splunk, Sigma, Equal.
We don't really care.
We're kind of agnostic to all these implementations.
Our goal is really just trying to increase the coverage
of these, both from a user perspective, I mean,
I think if you're a new analyst, just coming
and having a ready-made Splunk query
you can at least start with is nice,
but I think there's also some other things
you can gain from that.
You can see what different languages support.
All of these syntaxes, these languages,
have different capabilities,
so I think it's kind of interesting just seeing it that way.
Yeah, but wait, there's more.
(gasp) We have high-tech metal alloys.
No, I'm kidding.
We have something even better, though.
We have BZAR, or BZAR, I guess.
I'm always kinda confused 'cause there's no I in there,
but anyway, so BZAR is a set of a Bro ATT&CK scripts
that we've written.
Help detect several network-based analytics.
It's pretty cool work.
I think it's kind of, more on the cutting edge
of what you can detect with some of this stuff.
It uses the SumStats framework in Zeek to do this,
and, from what I understand, it's pretty,
well, it's pretty popular.
We have already got a couple of pull requests
against that code base, so, yeah,
I think that's something else that's pretty neat.
Besides that, we've been updating our data models.
So, I mentioned we have this data model, it's agnostic.
We have a process object, we have a file object,
we have all of that good stuff, but we haven't updated
for three years, so there's clearly some things
that we're missing from analytics, EDR tools.
We've been slowly kind of building that up,
and then otherwise,
we've been trying to just increase our attack coverage,
so just make it more accurate, right?
So we had some mappings that were just plain wrong.
(chuckles) Part of that was just, honestly,
I think just error, but there were also,
in those three years that CAR wasn't really active,
we had new attack techniques that came along,
so I think we've kind of fixed that.
So everything in CAR now, it should be a lot cleaner,
a lot better mapped to ATT&CK.
So I think I'm kind of required legally to have a heat map,
at least in terms of coverage, (chuckles) so here it is,
but the main thing here is we have pretty good coverage
of things like discovery, right?
That's kind of low-hanging fruit, I think, for a lot of us,
so that's not really not surprising.
Where we do have I think some gaps is pretty obvious,
command and control.
As you can see, we kind of don't have a lot
of network things, so I mentioned BZAR,
that's kind of one of the things we do have,
but most of our analytics are, right now, unfortunately,
they're Windows-centric and they're host-based,
which, again, is kind of not surprising
'cause that's kind of where the state of these things are,
but we are working to improve that.
So I have foreseen some new things we could be doing.
Before I go into these, I just want to mention,
kind of the philosophy that I think
we should be taking with this stuff, so,
there's other analytical repositories out there.
They're doing different things and I think that's great.
I think our focus with ATT&CK or, sorry, with CAR,
is that we want to kind of experiment,
so we want to try new things,
we want to implement new ideas.
I think we can be really agile there
because the state of analytics sharing,
I think it's still pretty nascent.
There's certainly good content out there,
but I think people aren't really sharing it,
and I think there's some issues that we've seen,
so hopefully we can kind of prototype that in CAR.
If it doesn't work, that's great, but hopefully,
we'll learn something from that, so, anyway,
that's my hope going forward.
So, obviously, we want new analytics, right?
So I mentioned we're kind of lacking in certain areas.
I don't know if Tony's in the room,
but we would love to get his Linux stuff in here.
So Linux is definitely one of our priorities.
Besides that, we want to do something like building blocks.
So building blocks is sort of this concept
where you kind of decompose analytics into smaller pieces
that make them easier to manage.
So as an example, I wrote an analytic about a year ago
for UAC bypass, and I actually,
basically rolled in several different,
actually seven different techniques of UAC bypass
into that analytic.
That's pretty, I don't know, almost kind of cloogy,
it's difficult to maintain.
Let's say one of those techniques
suddenly becomes no longer valuable, what do you do?
Do you just throw that away?
Do you create a new analytics?
So I think there's a lot we can do
about kind of helping us think
about how you create analytics and manage them,
and I think this sort of notion of building blocks
could be interesting on top of that.
Besides that, data model I mentioned already,
but I think there's a lot more we could do to update it,
so, we could definitely do more work
on network-based modeling for layer seven.
HTTP and DNS are I think one of the few areas
that aren't really explored very well,
so I think we can do some work there.
And then, obviously, I mentioned EDR tools,
so Sysmon is great, but there's other tools out there,
and I think we want to make sure
that we can roll in whatever those tools do well
into our data model.
Another idea we've had
is kind of what we call baseball cards.
So this is basically trying
to kind of give all the critical information
about an analytic in a really short, succinct fashion
because when you're looking at analytics,
it can be really difficult to understand.
Do they apply to your environment?
Can you use it?
Do you have the right data sources?
Is it riddled with false positives?
So all that is kind of really good information
that I think we could convey much better.
So I think there's something we could do there as well.
So I mentioned our sensor coverage earlier.
It's, (chuckles) unfortunately, it's pretty outdated,
so right now, we only have Sysmon 3.2,
and I think it's what, on version nine or something?
So, (chuckles) yeah, we need to fix that.
And I think we definitely will (chuckles) 'cause I think,
again, that's one of the really kind of interesting pieces
that CAR does well right now and no one else really has.
I mentioned Carrot a little bit, so, Carrot works okay.
Like I said, it's fine.
You guys should check it out.
It's a cool visualization,
but I think there's definitely work we can do
to make it more useful and also just kind of work better
in the hood, maybe rewriting some of that lovely JavaScript.
(chuckles) And then ATT&CK coverage, so this one I think
is actually really important and it kind of gets out
to maybe some of the sub-techniques work
that the core team is doing as well, but so, in CAR,
we have not only the ATT&CK technique,
but we have the actual kind of level of coverage
for each technique, which we, right now,
just we say low, medium, high, so it's pretty arbitrary.
I think we're gonna need to think
about that more scientifically.
We need to do, I think, much better
about discussing how we cover these techniques,
because if you say you have a,
let's say you have a medium or high level of coverage,
but your technique is actually missing
in a lot of key procedures, a lot of key implementations,
of that technique, then, obviously,
you're not really covering anything.
I mean, you're not doing what you expect to do.
So I really want to refactor some of that work,
and then ISO evasion, right?
So I think that one is also pretty important.
A lot of analytics we have in CAR are, unfortunately,
I would say, brittle, in the sense that if an adversary
changes something simple, like a file name or a hash,
then they can easily evade that analytic,
so I think we need to capture that as well.
So as you can see, a lot of these things are,
just like additional properties,
they're just helping us define things about analytics,
but I think, as a community,
we need to think about this, right?
I think some of us have these ideas,
they're kind of all over.
I had great discussions during our BoF earlier,
so I think there's obviously some things
we can take away from that, but I really hope
we can kind of use CAR as a means
of just getting the ideas out there.
Again, if maybe they don't work,
they're not fully fleshed out, that's fine.
At least we'll have some way to actually try it out
and test it out.
So I know you guys have analytics,
everybody's analytics, right?
So please share them. (chuckles)
You don't want to make the kitty angry, do you?
'Cause he looks pretty mean, I don't know. (chuckles)
No, but seriously, thanks to everybody else
who's contributed, so, we actually, it's pretty cool.
So we had four contributions, like I said,
in the past several months of new analytics to CAR,
and they were all from different countries.
So Meric Degirmenci, IBM, he's from Turkey, I believe.
Kaushal Parikh from Cyware Labs, he's from India,
and then Tony Lambert, Red Canary is from the US,
but yeah, it was really cool just to see just random,
it's like, hey, GitHub pull request for new analytic
and it's pretty awesome, so anyway,
I definitely encourage you guys.
Maybe next year, I'll bring a little matchbox car
and I'll paint it gold, and whoever has the most submissions
over that year, they'll win the golden car.
It's gonna be awesome. (chuckles)
All right, so that's pretty much it.
So these are the resources I mentioned.
So we have the main CAR website,
that's where all this stuff lives.
The YAML-ized analytics, you can go there in GitHub
and basically, everything is on GitHub,
so if you just go to that root URL, you'll find it all.
And then, yeah, just to end with a quote
from the great thespian, Vin Diesel,
maybe we can get a 10-second car with your contributions,
so I'll leave you with that.
All right, thank you.
(audience applauding)
- We have time for maybe one quick question about CAR.
You have Ivan up here.
Any questions anyone has?
If not--
- [Man] Can I ask a question?
- There we go, gentleman down front. (chuckles)
- What inspired the CAR revival?
- That's a good question. (chuckles)
- [Katie] Did you and John just have more time magically?
- Yeah, yeah, yeah, basically, what happened
was we realized we had this CAR thing,
it was still out there, and people were,
people do still use it, even in the 2016 state,
and we were like,
hey, maybe we should actually start active work
on this again, so it was just kind of one
of those spur of the moment things, and I think it's led
to much bigger and better things,
but that's sometimes how it happens, yeah.
- I agree, I think from my perspective,
going out and briefing like, oh, you can use ATT&CK
for analytics or at the ATT&CK EU workshop last year
that just happened again this year, around Hack.lu,
we heard from folks like, we'd really like to see more,
so I'm really grateful to Ivan and John for all their work
on CAR and more to come, it sounds like.
Give us your analytics.
- That's right.
- All right, thank you so much, Ivan.
- Thanks, guys.
(audience applauding)