- So threat hunting, what's threat hunting?
Why threat hunting? How we do threat hunting?
So, I was on one of the trainings
that I was delivering in Malaysia.
I was talking about threat hunting
and one of the students really summarized
what threat hunting is.
It is basically an incident response process
without an incident, simply like that.
Threat hunting is based on a hypothesis
that we have been already compromised.
And through this hypothesis,
you start to do the investigation
and you start to dig deeper
to see how you could compromised,
what are the evidence of being compromised
and how you can contain an attack
if there's actually an attack.
This hypothesis helps you to detect
if this is actually an attack or not.
And if there's an attack, you're able to detect it.
You're asking me, so why we do threat hunting,
why we do an incident handling process,
if there's no incident.
Actually, there's no alert of anything suspicious.
The problem is that there's so many attacks
that stays in the network,
like, the average is the attacks in network,
I think for 8, 9 months.
And that's a really long time.
If this attacker was able to access the network
for eight, nine months he's able to ex-filtrate
all the information he needs,
he is able to go from one machine to another
to the servers, and ex-filtrate
all the important information he wants,
and maybe even wiping all the servers
or installing around somewhere
to really capitalize on his game.
So through the time the impact grows exponentially
with the attack.
And if we can reduce that gap
from eight months or nine months to one month to one week,
then we are able to minimize the risk
and at the same time respond faster to this attack
before it reaches even more machines,
or even more assets in our organization.
So what's threat hunting, how we get up with
the hypothesis that we have been attacked?
There's two different ways to think about it.
One is to create a hypothesis
of the CFO has been hacked, we will investigate on that.
Or you can be based
on what are the attackers spreading nowadays,
targeting your sector or targeting your country
or similar organizations to your organization.
Let's say you know that there's a ransomware
that's been spreading through all
the different organizations that are closer to you,
or even in your country and other countries around
and it's, let's say, a ransomware attack.
And you want to know what are the tactics and techniques
and procedures that this attack is used.
Let's say he's using a spear phishing attack
or a drive-by download or he's using some PowerShell
to execute some commands or he's using Twitter
to communicate with the attacker
or using domain generation algorithms
to generate different domains
and able to get access to the attacker.
Rather than you rely on the question of compromise,
as a way of detecting this attack,
you can rely on this tactics techniques and behavior
and investigative if this technique has been used
against your organization,
or is being actually actively being used.
You'll investigate more if there's an incident
of somebody who's using let's say,
WMX to switch to other machines
or using mini cats or even communicating
to the C&C through Twitter, through Reddit,
through DGA or even communicating normally
to a suspicious domain.
You start to investigate on that
and with that assumption you start to detect
if it is actually something happening like that or not.
If there's nothing happening, that's great.
Now you can convert that hunting process
into a new detection for you
that you get an alert every single time
this is happening on your organization,
then there is a response you can act on real time
if there is any spot of that activity
is happening in your organization.
So you can do the hunting once on one technique
or one hypothesis and automate that
into a detection into a new alert
that you'll get through your sock team
and then into your incident response team,
so you're able to respond to that in real time.
Now I know that I....
I think about the attacks from what's the attacks happening
or around my organization, my country,
I see how the attacks looks like
every single phase and then I try
to come up with hypothesis.
So how I can do the threat hunting
There are three known categories of threat hunting let's say
One is the network-based. Network-based
is looking at the network, looking at the firewall logs,
looking at different logs, looking even into
the network flow of logs from Bro and Zeek Tools.
And here I'm not looking for blacklisted domains,
or blacklisted IPs are any indication of compromise (IoC)
I'm looking for a specific behavior.
When we talk about behavior I'm talking about
some little communication that should not be
that looks abnormal or suspicious, but its not abnormal
from the ideas point of view
when there's specific abnormal bucket
or there's a threshold of of communication
has been done outbound or inbound,
but I'm looking for cases something
like beaconing for example
beaconing is basically for a normal malware
they do communicate with the C&C or the Command and Control
every letter every one minute
or every five minutes every 10 minutes.
They are programmerly trying to communicate with the C&C
every specific amount of time, every interval.
And every five minutes.
If you are looking at the network flow for like 24 hours,
you see that these domains have been accessed
every one minute, exactly one minute,
or one minute and few seconds
exactly that time this has been accessed.
That could be for some applications doing some updates.
So it could be legitimate,
or it could be something malicious
could be actually a malware
that was trying to communicate to the C&C.
This is a good way to detect
there's actually something could be suspicious
or this could be a malware
that's trying to communicate to the C&C.
The domain could be not blacklisted,
it could be not an indication of compromise
for a normal malware.
But at the same time, it could be that behavior,
it could tell you that there is actually a malware
in your organization
that does communicate to this domain on a specific interval.
This is beaconing.
There's also another indication
it could be the long connection
if the malware is having a long connection
which is like doing the handshake, the TCP handshake
and on the field bucket,
it takes a long long time even hours.
That's also an indication that the moral side
to keep this communication with the attacker,
keep this communication alive
so you can receive any commands at any time.
These cases are...
this as a behavior could be suspicious thing
to investigate on and dive deeper.
This is the common control phase
There is also another another category of threat hunting,
which is the endpoint threat hunting.
In the endpoint threat hunting,
you may look at other phases in the whole attack.
Let's say the execution phase
when you see a document with macro
executing, Visual Basic script (VBScript),
that's for sure VBScript for applications
and after that the execute a PowerShell command.
This is something very suspicious,
if I can see in an any endpoint or any host
that there is a PowerShell command
or PowerShell process have been created
from a Word.exe or Excel.exe process,
It means that there is an Office application
has executed the PowerShell Command
or an Adobe.exe PowerShell Command
that there's just something suspicious
that I need to alert on
or even a chrome that takes you...whatever
the way we do the investigation.
So I create a hypothesis that there is a phishing document
that has been sent to employees.
It includes a Macros that executes
some commands on the shell for executing PowerShell.
And from that, from this hypothesis,
I can scan the endpoints and see
if there's something suspicious.
I can look at the event logs, I can look at the memory dump,
I can do some forensics, or even I can deploy sys mon,
which is a free system monitoring tool created by Microsoft.
It's actually used in...
It's actually free in system internal tools.
And this tool can correlate lots of different event logs
and create a new event log
that's filtered with your filters that you want,
And at the same time can give you exactly
if there's something malicious or something suspicious
is happening on the organization.
It doesn't focus,
it gives just alerts of different events happening
and you can use that for your own threat hunting
to detect in different phase of the attack
wherever the execution, wherever the lateral movements
or wherever the phase that you want to detect.
You can look at the spam folder
or where the accounts have been accessed from
where they have been accessed,
what firm they have been accessed.
And from that you can understand
if there is any accounts have been compromised
or there's any initial access,
there's any suspicious emails
have been sent through the whole....
to many different employees in the organization.
And from that you can detect the initial access
for example. The third phase could be the application
like the application threat hunting.
The application threat hunting is basically
is trying to detect if there is any...
if attackers has tried to abuse the website for example
and finding an SQL injection or
a different attack trying to investigate
if there's anything is happening to the access logs,
or different logs from different applications.
And through that you can dig deeper to see
if there's any attacker that's able
to compromise the website and able to dig deeper
and actually get to your...
install a web shell, or do
something malicious on your web server, for example,
or any other any other application
that's exposed to the internet.
Threat hunting again is not looking
for specific indication of compromise (IoC)
is not another firewall is not another WAV.
But the idea behind it is to actually look at the behavior.
Look at the whole communication and from the behavior,
I try to detect this technique
or this tactic the attacker is using.
that's it about threat hunting.
If you have any questions, just let me know,
I will also have a live webinar coming soon.
And it's about the most important skill-set to have
if you want to become a really Professional Threat Hunter.
This skill-set is very important
for any Blue-Team, Cybersecurity expert.
It's important for response,
digital forensics threat hunting and so many other teams.
It's really one of the critical skills
that is really needed to better protect an organization.
Check my life webinar it could be coming soon.
I will leave the link up there.
I think it's maltra.com/webinar so check it out.
And see you there. Bye bye.