Coming up,
I'll walk you through Microsoft Advanced Threat Analtyics
which combines machine learning
and deterministic capabilities
to detect, prioritize and investigate
advanced attacks and insider threats within your data center.
I'll show you some real world attack scenarios in play.
How ATA works to detect them in near real-time,
and how ATA integrates with your existing SIEM solutions.
Advanced Threat Analytics works by analyzing metric traffic,
and event locks.
Once a threat is identified
ATA presents a detailed view of the attack.
ATA detects unknown threats using anomaly detection
and known threats using the deterministic detection.
To illustrate this further,
let me simulate several real-world attacks.
And how ATA detects and reports on each attack.
Usually the first stage of an attack is the reconnaissance phase
where the attacker spends time to learn the environment they just infiltrated,
and identify privileged accounts
and the path to them.
A technique often deployed is the net session enumeration.
I'll execute this against the domain controller in the environment
to get a list of users and victims in the environment,
and the IP addresses from which they are connected.
This is a gold mine for any potential attackers.
Let's look at how this type of attack is detected within the ATA console.
I can see that the attack has been successfully detected
in near-real-time.
You can see the details around who is the user that executed the attack.
Which device the attack was executed from,
and details about the exposed account as part of the attack.
Detection of this initial phase of the attack
can help stop it in its tracks before further damage is done.
If you want further details to help you with the investigation.
You can download the Excel report which will show you all the raw information
used by ATA in order to detect this type of attack.
Let's see what happens if the attacker moves beyond the reconnaissance stage
and uses a known technique such as Pass-The-Ticket in this example
to move laterally across the organization.
I'm now going to remotely dump the Kerberos ticket
from the machine in use by specific privileged accounts,
and use those stolen tickets
on my local machine to access corporate resources.
So now as an attacker,
I can freely move inside your environment and I own your network.
So right now we've successfully dumped all of the kerberos tickets
and copied them remotely.
Now I'm going to use the Kerberos ticket on my local machine.
I can see I'm already authenticated
as Nuck Chorris, the privileged account.
And to prove this even further,
I can access the c$ share on a domain controller.
Definitely a privileged operation with Nuck Chorris' credentials.
So now let's go back to our ATA console.
As you can see ATA has detected the successful Pass-The-Ticket attack
again in near-real-time.
ATA offers a description of the attack
where Nuck Chorris' kerberos tickets were stolen from the admin's PC to the victim's PC
and used to access 19 resources.
That's a unique capability of ATA
that it leverages the deterministic detection engine
in order to successfully detect this attack
regardless of the tools or requiring any system learning time.
ATA highlights the device from which the tickets were stolen,
the devices from which the tickets were used,
and the resources.
Namely the service principal names
to which this ticket was used in order to gain access.
If no action is taken,
the attacker could go further with the stolen privilege credentials
to search for high-value assets
such as intellectual property or credit card information.
Here, i'm searching and accessing a handful of different file servers
as I troll the environment for high-value assets.
Now back to the ATA console.
In this case, ATA is able to use its machine learning algorithm
for anomaly detection
to flag the abnormal behavior from Nuck Chorris' account.
This is how we detect the unknown unknowns.
I'm able to get a detailed view of what Nuck typically accesses.
And, where his behavior deemed abnormal through access to resources and file servers
that he has never accessed before.
In addition to providing near real-time detection,
ATA is able to integrate with your existing SIEM solutions.
It uses two-way integration
to both receive data from your SIEM
and write data back to your SIEM using the standard syslog protocol.
Here you can see that you can select specific notification options
and select when you're getting notified in your SIEM Solution.
Eventually the result in your SIEM, looks something like that.
Which includes all the details of the attack
sent in a syslog protocol with the SEF format.
Another unique aspect to ATA
is that it can automatically update via Microsoft updates.
So you can grab them directly from your w SAAS deployment.
Those were just a few of the attack techniques
you detect using Advanced Threat Analtyics.
ATA will continue to receive updates and add new capabilities over time.
The ATA center works on Windows Server 2012 r2 or newer.
But, can detect any domain traffic from any operating system platform.
Download Advanced Threat Analytics to try at the link below.
Thank you for watching.
Microsoft Mechanics.
www.microsoft.com/mechanics