this is susan bradley for cso online today i'm going to talk about a report that recently came
out talking about 2021 threat detection report it was put out by a group called red canary and
you can sign up for the report and also watch the video that was was done at the same time
and in particular what struck me about this top 10 techniques was how many
techniques did what's called living off the land so there's a technique called living off the land
meaning that the attackers don't bring anything new in to attack you they use the existing
tools and techniques and software that you already have on your machine
so for example the number one threat 24 of total threats used command and scripting interpreter
languages meaning it's using powershell that's already installed on your system
so how do you detect for this you want to look for suspicious commandlets or any other
commands that you don't normally do one of my takeaways from this report was
you want to make sure you have a really good idea of what's going on and what's
normal in your system so you want to install something called sysmon if you haven't already
that's a event logger that specifically looks for attack sequences and then you want
to build a baseline of what is your normal scripts what's your normal tools what are
your normal events and when things start to look unusual you want to take the time to investigate
number two 19 of threats came from signed binary process executions run dnl 32 again it's another
living off the land attack sequence not bringing outside tools into the organization again you'll
want to look to set alerts for malicious use of run dll32 but you'll have to establish a baseline
in your organization what is normal sixteen percent of threats came from create and modify
system processes this one you wanna review and event logs for event 4697 7045 and 46.88
again know yourself know what your organization does and what those event logs normally have
percent of threats came from scheduled tasks or jobs attackers often use scheduled tasks in
order to introduce persistence the red canary report indicated that you should review when a
scheduled task is set to run a system as this is the most typical attack configuration they saw
again you want to look for event 106 or 140 to record when a new task is created or updated
seven percent of threats came from credential dumping the local security
subsystem service or lsas is often used to dump passwords with a little help from
such tools as proctem and mimi cats again the sysmond process access alerts your best toolkit
to help you identify this make sure you look for event 10 in the sysmon events
again i'm going to sound like a broken record you're going to want to know the baseline in
your organization because once you know the baseline then you can identify what's unusual
seven percent came from process injection and attackers use a variety of injection methodologies
to gain more access into your system and again you'll want to use sysmond to help you
alert you into him when these these things occurred
six percent of threats came from files or information and they want to what an
attacker does is they'll use base64 code encoding to hide their attack processes
so make sure that you set policies for using powershell and only use sign script execution
five percent of threats came in from ingress tool transfer now while most of the time the attackers
use living off the land meaning power shell things that are already on the system attackers often use
bits admin our windows update friendly platform tool to import in tools so if you see bits or bits
admin running when it shouldn't this is a sign often that attacker is using something to import
an attack tool into your system number nine four percent of threats came from system services
often attackers use windows service manager to run commands or install services sysmon event
number seven can be monitored for taxi attack sequences and last but not least on their top ten
four percent of threats came from masquerading meaning that the attacker renames system utilities
they name a file close to something that's already on the system
so they pretend to be something they're not alert you to take the time to watch the presentation
it's an excellent guide on on what is being seen in 2021 and of course you want to make sure that
you take the time to install sysmon there is several github alerting techniques out there
take the time to understand and look at it take the time to review the australian government
documentation on windows event logging and forwarding because you want to make sure you
keep logs and you want to make sure you keep them off site often to another hard drive
someplace where the attacker can't clear the logs because one of the things they'll want to do
is clear those log files out so that you can't come back afterwards and go what happened
so if you haven't gotten one thing out of this make sure you install sysmon
make sure you turn on logging make sure you have some place outside of your organization outside
of the normal event processes that you're logging and forwarding those event logs
attackers are getting smarter we need to get smarter as well as always make sure you subscribe
to the youtube channel at the idg tech talk until next time this is susan bradley for cso online you