- [Katie] Please join me in welcoming Olaf Hartong
(applause)
- Thanks Katie that's way too humbling.
Um thank you for attending.
I wanna talk about data and this is kind of important to me
and most of the people have been talking about coverage,
super important,
but there's multiple ways to achieve that I believe.
So first a very sort intro
because I probably don't have that much time.
I've been in infosec for quite a long time
mostly working on the defensive side
I work together with the red team just to learn more
but um
the most important for me is basically data.
I love data anyway you can get it, I'll play with it.
I didn't always be in infosec,
I used to be a documentary photographer,
I went to art school,
which actually helps me get a different perspective
on things.
Right I don't,
I try to shear away from tunnel vision
and kinda get a helicopter perspective,
I have two boys which I truly love but onwards.
So this is also very important quote,
it's actually cool that I'm not the first to quote her here,
but if you don't really know yourself and not your data,
and your enemy you'll be clueless right.
So you're just chasing chasing whatever you want to do
and not really have a focus on where you wanna go.
So again data, data is very important for me.
So everybody knows this it's been flashed a lot,
you don't have to read it,
it fits on a slide but you can't do anything with it anymore
but the important thing is now
we talk little bit about coverage,
so most, what most people do is
they map their current coverage to it
which it's totally useful for
and in this example everything has the same value
just because other wise it won't be readable
but some of them you'll have more confidence in than others.
So then the next thing you might do
is map some bears and some criminals and some pandas to it
just to have some focus into where you wanna go
and I use them because I like the pictures.
Um but then again so how do you achieve that coverage right?
So then there's a lot of techniques there,
you wanna go ahead and cover those in probably multiple ways
because there's multiple ways to execute them.
So how do you achieve this?
So there's multiple ways,
probably you can start playing with the tools
and then see what it's generating
and then start building your detection rules for that.
But then you also need a lot of this stuff.
So there's a lot of data,
you probably already gathered all of the data.
You have all these tools maybe even more,
um so why not focus on that first.
So that was my idea and what I also get from clients a lot,
is so where do we begin?
So usually you start with like I said before
with the lower hanging fruit,
or the stuff you're really scared about,
or maybe combine it and see okay
where do I have a correlation
and start from there.
So it's just an easier way of starting
So I wanted to create a simple toolkit,
sorry it is based on excel,
but I figured it should be portable
it should be usable by everybody
and sadly everybody uses excel
even though its not always best tool.
Some love it some hate it,
it's not that important.
But it's at least on most of the systems
and then again also PowerShell which is available
at least on Windows and on Mac and Linux you can install it,
it will work mostly.
Um and that's mostly due to my scripting skills
so nothing to fire against PowerShell
because I kinda like it actually,
and then if you use my excel sheet and the PowerShell script
that I provide you'll get a nice JSON file,
you can load that up to the navigator
and I'll show you how that works now.
So essentially that excel sheet contains the tech framework,
so I ingest the whole thing the nice JSON that they provide
and I quickly put it into the right columns for you
so that at least you can reference it
in all the other workbooks.
So there's a weights work book,
so basically what I did is I rated every technique
and I went to all the data sources
and looked which data source was the most important
for that technique.
So this is super biased as the buzz word of the day,
I mean this is my interpretation of every technique,
so if you don't trust me please go through them
and adjust them accordingly.
Um and then there's the important part the rating workbook,
so this is basically the one that he use as a user
which I'll dig in a little bit later
just to show you an overview.
So this is the data source one,
I wasn't sure whether there was read...you could read this
so i actually zoomed it in a little bit
and basically what I did is I explained
so these are all the techniques with adjoining data sources
and I gave them a rating
which adds up to 100 as a total rating score
and that's important later
when I calculate your data coverage before every technique.
So in an example if there's like five
and then the process monitoring
might be the most important one for that technique
it usually gets a slightly higher score
than some of the ones that I deem less important
to be able to properly detect the technique.
Um so to the rating workbook
basically what I did is I went through all the data sources
and put them under each other
and I tied them to the adjoining event codes
that are being logged and so I love Sysmon also,
and so there's a lot of Sysmon in there
and it's definitely not complete
it's just what I usually encounter.
So you can add your own event ID's if you are,
or if you have some specific application log that you have
and so on and what you do then
is you rate them on completeness,
timeliness and availability.
So how well are you covering it throughout your network
how quickly do you get it
into your central logging environment
which might be important as well
because you have to adjust your detection rule against that
and where do you store it?
So do you even ship it
to your local or to your central environment,
or do you keep it locally?
Which is also kind of a feedback thing,
your detection capabilities.
So that will be calculated into a mathematical score
but I look at completeness and availability,
most of the time in this you can usually accommodate
by looking at the index time instead of the generator time
and so on so this is slightly easier one.
And what I do then is basically I factor that total score
which is at the right
and I calculate that
against the weight of that data source for that technique
and that will give you a coverage score
for basically that technique in the end.
So I do that through PowerShell
because I'm not really good at excel
nor am I at PowerShell but this works.
So basically what I did is
I created the module for you that you can install or load
and basically there are a couple of functions
so you can download the latest tech JSON file
which was updated a couple of days ago
which added a lot of cool stuff and thank you.
Um you can update it then so you can update your excel sheet
with the same PowerShell module
you can request the JSON file that I'll show you later,
and I also added some new features now
where I have some issues
with the way people sometimes use the tech.
So you can also see where you could apply it best
and now they are starting to implement the mitigation
and detecting capabilities more so I'm also working towards
implementing this into my toolbox.
So this is a short demo basically
of showing you whenever you generate the JSON file
which I won't bother you with,
it's just a simple PowerShell command,
but when you load it up you get a coverage map like this
and then in the comments field,
you'll see your total coverage for that technique
but also the stuff you're missing.
So if there's a zero there then you don't ingest the logs,
maybe its not important
but at least you know you're missing it
so you might be working towards onboarding that
or you have a proper coverage so you're actually fine.
Um and the cool part about this is also that
I saw in the change log there's warning for the navigator
that you're actually now able to export the comments as well
so you can look it up in excel again
instead of having to hover all these boxes
which is cumbersome at the least.
So I was already ranting a little bit about that right,
so there's a couple of ways
that I perceive a tech to be used,
not only for creating an alert
but also hunting an incidence response
and if you visualize that and basically the way I look at it
to properly cover everything in alert is super hard
so usually I deem techniques a little bit lower
than for instance hunting where you can do a lot more
and it takes more time to dig into it,
there's less pressure on false positive rates and so on
and actually the same for forensics
because they usually take more time
and the likelihood of covering that technique fully
is higher than when you start doing this
from an alert perspective.
So it's not exact science it's my opinion again
so please bare with me there.
I did the same thing basically so I added them all up,
I looked at the data sources I knew,
I know what the name is I know what it does
and I rated it,
I'll zoom in again sorry,
and basically on a one to five scale
how likely it is that you will be having full coverage
for that technique.
Maybe we move to sub-techniques later on
it will be a little bit more granular.
So I'm really looking forward to that.
Um and as I said I love Sysmon
so I also filled it in for Sysmon that's another caveat
and this looks amazing right
it's a lot of coverage from just one tool,
but mind you the actual wave covering it
probably a little bit more than that,
it's actually the orange one and there's a huge difference
on the right side of the spectrum
and this partially has to do with Sysmon
as you have to configure it
so some of the stuff you configure will give a big load
on your systems here we really don't want that
but also the gap in the quality of the naming
in the data sources from my side,
I mean it's not perfect and they know it,
they're working on it I'm really helpful,
I really wanna help them there as well,
but this is something that you have to keep in mind
throughout the whole thing of using it.
It won't be full a assessment that really guides you okay.
You have to find it there so keep that in mind.
Um and then as I mentioned
I am working on the defense mitigation
and they actually now are changed
also with a lot of the mitigations
that are in the latest update
which I didn't have time to include
since I was pushed I think Thursday.
So but the same process goes there as well,
so basically all the defenses can be weighed
for that technique and then how easy is it to buy parts
you know how likely is it you are able to cover it.
Um and with three minutes left,
part of my roadmap is adding those mitigations
but also I am working with a colleague
on graphing the whole Att&ck framework
and what we did there is actually
the 11th tactics aren't really linear,
so they're not hopping along which was also the beef
with what the kill chain does
but they keep on moving back and forth and back and forth
so we modeled that into Att&ck,
or into graph sorry
and basically what we want to end up with
is a sort of plot out for Att&ck
where you can fill in the sheet I showed you before
import that with the ratings and then it will show you
okay you've got good coverage here
an attacker won't be able to probably take the whole path
and you have to go another way.
So it makes it a little bit easier
for defender to focus again
where you should be covering your techniques most.
But also from an attacker it might be very useful
if you land on the...(mumbles),
they have an EDR they probably cover this, this and that.
Then I probably need to go there, there and there,
and then you might be happy.
So it works both ways.
Um and actually I have one minute left
so I have time for questions I didn't expect that.
Um
So thank you.
(applause)