With the Event Query Language, also known as EQL, you can hunt for malicious activity
based on threat intelligence in your environment.
In this video, you will learn how to take threat intelligence reports
and search for attacks at any analyst level within Elastic Security.
This entire dataset is available for free
at EQLPlayground.io so you can start your hunt today.
Let’s get started!
Elastic Security employs a layered strategy for defense.
Starting with the Elastic Endpoint integration
within Elastic Agent, machine learning malware models are used to classify and alert on malicious files.
Ransomware protection is used to prevent files from being encrypted during an attack.
Once data is sent from the endpoint to the
Elastic cluster, free and open detection rules evaluate and alert on attacks.
These steps reduce mean time to response and protect your environment.
Even with this complex layered approach and constantly developing models, sophisticated
attacks can remain hard to detect automatically.
This brings about the need to perform threat hunts across an environment.
As part of Elastic’s philosophy to arm every analyst, we put EQL queries in our posts
and reports to give the community actionable threat intelligence to use.
You could easily copy this block and paste
it into a correlation timeline with Elastic Security and provide actionable value — whether
you have been exposed to this action or not.
The example we dive into here is from our blog post providing analysis
and detections on the Sunburst attacks to Solarwinds.
However, hunting with EQL is not limited to using Elastic-provided reports.
To illustrate this, let’s look at a threat report provided by Palo Alto’s Unit 42 on Sofacy,
also known as APT28.
This report does an outstanding job of outlining the attack details and every step of the infection.
After reading this report, a security analyst
at any level can take provided details and threat hunt for intrusions.
Let’s start with a basic search, keying in on the provided IOCs or indicators of compromise.
The first one is the domain cdnverify.net, highlighted here.
From here we can go into the Correlations tab within Timeline and start writing a query.
Alternatively, you can practice on this exact dataset I am using by going to EQLplayground.io.
The query we can use to search for this domain is network where dns.question.name : “cdnverify.net”
This shows it is a network event category, and a DNS request was sent out to the malicious domain.
As a note, EQL’s syntax can be further explained
in this video, Writing your first Event Correlation rule on Youtube and in the free section on
training.elastic.co.
Once you run this query, the event rendered
will return the results showing you the infected hostname, user, timestamps for the event,
process making the call, and providing the Analyzer view for more details in the timeline
format.
Going back to the threat intelligence report, we can look for another IOC, this time in
the form of a malicious bat file this malware sample drops: cdnver.bat.
Pivoting back to EQL playground, let’s enter a next query based on the file event category.
Here you can enter the query file where file.name : “*cdnver.bat*” and wait for the event
rendered to return results.
Surrounding the string cdnver.bat with the
wildcards as indicated by the asterisk and using a colon for case insensitive allows
for flexible searching across the datasets.
Just like the previous example, we can get
details on the hostnames and users that are present on this file, along with timestamps
for when the file was created.
From the event rendered, you can go into further
analysis with the Analyzer view.
Now let’s take a look at a slightly more
complex query as we jump back to the threat report.
This highlighted portion states that the process rundll32.exe calls the malicious cdnver.dll
with an ordinal number 1.
This provides actionable information to hunt
using the process.args field. Let’s see it in action on the EQL playground.
In this query, we will be using the process event category and querying two fields using
an and. The query process where process.name : “rundll32.exe”
and process.args : “*cdnver.dll*” is looking for an event where the process name
is rundll32.exe and process arguments containing cdnver.dll are surrounded by the wildcards
for search flexibility.
The event rendered returns the results, and
from here the view is like our previous queries in which we can get additional details and
further analyze the information with the Analyzer view.
The last example will be slightly more complex, using sequences.
Sequences in EQL allow you to match an ordered series of events.
In this query, we are searching for rundll32.exe making network connections after being started
and filter for those connected to private IP address using the cidrmatch field.
This query is powerful because it matches on a behavior from the threat intelligence
report, but doesn’t rely on an indicator of compromise.
Once the query has been validated and submitted, the event renderer returns the results in
a similar format as the earlier examples.
by diving deeper into the data.
Thanks for watching this walkthrough on hunting
APTs with threat intelligence and EQL.
Head over to EQLPlayground.io and test out
EQL, or start your 14-day free trial in Elastic Cloud to try out EQL on your own data.
For more information on EQLPlayground.io, this dataset, and EQL, check out the notes section.
You can learn more about EQL and get help
with your queries in the docs, discuss forums, or community Slack channel.
If you’re ready to dive deeper into Elastic Security, kick off your Elastic Security QuickStart
today.