Let the Hunt Begin - Security Bootcamp 2024
0 likes3,398 views
The document outlines a presentation by Tuedenn at a security bootcamp focusing on threat hunting, detailing its importance, benefits, methodologies, and frameworks for organizations. It emphasizes proactive threat detection, the need to improve detection capabilities, and the understanding of threat actors. Key takeaways include the necessity for organizations to adopt threat hunting to enhance their security posture and reduce the time threats remain undetected.
Let the Hunt Begin - Security Bootcamp 2024
- 1. @TueDenn present at Security Bootcamp 2024 Let the Hunt Begin
- 2. About Me TueDenn Security Bootcamp - Let the Hunt Begin 2 ➢ Phạm Tài Tuệ ➢ tuedenn @ goDefend_work ➢ 5y in Infosec Industry ➢ Threat Hunter (3), DFIR (1), SOC manager (1) ➢ still noob but very curious and eager to learn ➢ 2nd time at Bootcamp ➢ I do on my own, not represent for any org
- 3. StOrieS TueDenn Security Bootcamp - Let the Hunt Begin 3 https://vietnamnet.vn/ma-doc-ma-hoa-du-lieu-tong-tien-lockbit-3-0-tan-cong-vndirect-nguy-hiem-the-nao-2271741.html#
- 4. StOrieS TueDenn Security Bootcamp - Let the Hunt Begin 4 https://cand.com.vn/Cong-nghe/yeu-cau-cac-cong-ty-chung-khoan-ra-soat-bao-mat-he-thong-i726369/
- 5. StOrieS TueDenn Security Bootcamp - Let the Hunt Begin 5 https://vtv.vn/cong-nghe/phong-chong-tan-cong-ma-doc-ma-hoa-du-lieu-tong-tien-20240604164927375.htm
- 6. Am I too Late ? TueDenn Security Bootcamp - Let the Hunt Begin 6
- 7. No matter the state of your org! Threat HuntinG Can Help! TueDenn Security Bootcamp - Let the Hunt Begin 7
- 8. TueDenn Security Bootcamp - Let the Hunt Begin 8 Everything Start At 0
- 9. Agenda Introduction 01 Threat, Threat actor, Threat Hunting Benefit of Threat Hunting 02 How Threat Hunting can help Methodologies 03 Threat Hunting Maturity Model, Framework, Process Usecases 04 Simple usecase bring to you Key take away 05 Summary & suggest some resources to follow up
- 10. the Chinese proverb the Best time to Plant a Tree was 20 years ago the Second-best time is NOW TueDenn Security Bootcamp - Let the Hunt Begin 10
- 11. Introduction
- 12. IntrO “ThreAT” ➢ Intent ➢ Opportunity ➢ Capability ➢ To do you harm TueDenn Security Bootcamp - Let the Hunt Begin 12 https://csrc.nist.gov/glossary/term/cyber_threat
- 13. IntrO “ThreAt ActoR” ➢ Focus on Threat Actors is a big win! ➢ Good at avoiding detection and ensuring survivability ➢ React to countermeasures and remediation tactics TueDenn Security Bootcamp - Let the Hunt Begin 13
- 14. ThreAt Actor Will Come (back) SooN TueDenn Security Bootcamp - Let the Hunt Begin 14 If you think your org will never be breached, you are wrong!
- 15. The Detection GAP TueDenn Security Bootcamp - Let the Hunt Begin 15 https://www.betaalvereniging.nl/wp-content/uploads/DEF-TaHiTI-Threat-Hunting-Methodology.pdf
- 16. Alerting is important but can not be the only focus of a detection program TueDenn Security Bootcamp - Let the Hunt Begin 16 That’s why you need Threat Hunting
- 17. IntrO “ThreAt HuntinG” ➢ Proactive ➢ Iterative ➢ Human-driven, Machine-assisted ➢ Finding which automated detection systems missed TueDenn Security Bootcamp - Let the Hunt Begin 17
- 18. Threat Hunter vs soc analyst TueDenn Security Bootcamp - Let the Hunt Begin 18
- 19. Threat Hunter vs soc analyst TueDenn Security Bootcamp - Let the Hunt Begin 19
- 21. Benefit 1: Shrink Dwell Time ➢ Detection miss ➢ Incident ➢ Lost $$$ Hunt the bad guy down before incident happened TueDenn Security Bootcamp - Let the Hunt Begin 21 https://services.google.com/fh/files/misc/m-trends-2024.pdf
- 22. Benefit 2: Improve Detection ➢ More & more data ➢ Need automation detection ➢ Automation = More FP ➢ More human effort = more $ Threat Hunting can reduce FP & contribute rules for automation TueDenn Security Bootcamp - Let the Hunt Begin 22
- 23. Benefit 3: Increase Visibility Bring the peace-of-mind! The more you know about your network, the better you can defend it! TueDenn Security Bootcamp - Let the Hunt Begin 23
- 24. TueDenn Security Bootcamp - Let the Hunt Begin 24 Threat Hunting MethodologieS
- 25. 50% of organizations have formally defined threat hunting methodologies an increase from 35% in the previous year TueDenn Security Bootcamp - Let the Hunt Begin 25 https://www.sans.org/webcasts/sans-2024-threat-hunting-survey-hunting-for-normal-within-chaos/
- 26. Methodologies ➢ 50.8% defined threat hunting methodologies ➢ 35.3% in 2023 ➢ 49.2% is no method! ➢ Don’t know “HOW”! ➢ Still low ➢ But increase! TueDenn Security Bootcamp - Let the Hunt Begin 26 https://www.sans.org/webcasts/sans-2024-threat-hunting-survey-hunting-for-normal-within-chaos/
- 27. 64% of organizations formally measure the success or effectiveness of their threat hunting efforts TueDenn Security Bootcamp - Let the Hunt Begin 27 https://www.sans.org/webcasts/sans-2024-threat-hunting-survey-hunting-for-normal-within-chaos/
- 28. Measure Success ➢ 64% of organizations formally measure the success or effectiveness of their threat hunting efforts ➢ 36% Don’t know “WHAT & WHY” TueDenn Security Bootcamp - Let the Hunt Begin 28 https://www.sans.org/webcasts/sans-2024-threat-hunting-survey-hunting-for-normal-within-chaos/
- 29. PEAK Prepare, Execute & Act with Knowledge (2023) Threat Hunting Framework From Spunk TueDenn Security Bootcamp - Let the Hunt Begin 29 https://www.splunk.com/en_us/blog/security/peak-threat-hunting-framework.html
- 30. TaHiTi Targeted Hunting Integrating Threat Intelligence (2018) TueDenn Security Bootcamp - Let the Hunt Begin 30 https://www.betaalvereniging.nl/wp-content/uploads/DEF-TaHiTI-Threat-Hunting-Methodology.pdf
- 31. Hunting Loop The Sqrrl Threat Hunting Reference Model (2015) TueDenn Security Bootcamp - Let the Hunt Begin 31
- 32. TueDenn Security Bootcamp - Let the Hunt Begin 32 The Hunting Maturity Model https://medium.com/@sqrrldata/the-cyber-hunting-maturity-model-6d506faa8ad5
- 33. Fit you it TueDenn Security Bootcamp - Let the Hunt Begin 33 https://medium.com/@sqrrldata/the-hunt-matrix-90d8476e8765
- 34. Craft Your Own ➢ Only you know the best fit ➢ Learn from others, innovate on your own ➢ This is my suggestion! TueDenn Security Bootcamp - Let the Hunt Begin 34 Prepare Identify Analysis Document Finding Improve, Automate
- 35. Threat Hunting Life Circle TueDenn Security Bootcamp - Let the Hunt Begin 35 Prepare Identify Analysis Document Finding Improve, Automate know the enemy and know yourself Clear objective Formulate hypothesis To prove or disprove your hypothesis Create the knowledge of your hunt procedures Think for the next!
- 36. PrepAre know the enemy and know yourself TueDenn Security Bootcamp - Let the Hunt Begin 36
- 37. Prepare Pyramid of pain (2013) ➢ IOC used to detect an adversary’s activities ➢ How much pain it will cause them TueDenn Security Bootcamp - Let the Hunt Begin 37 http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html HM1 HM2 HM3+
- 38. Prepare How much pain it will cause them? :) #TurlaLicksAss TueDenn Security Bootcamp - Let the Hunt Begin 38 https://x.com/cyb3rops/status/1156599722326528009 https://x.com/cyb3rops/status/1372932191055974403
- 39. Prepare Threat actor profile ➢ you must know your enemy to win the war ➢ Diamond model: Victim-Centered Approach ➢ MITRE ATTCK https://attack.mitre.org/matrices /enterprise/ TueDenn Security Bootcamp - Let the Hunt Begin 39 https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf
- 41. Prepare Data soure ➢ If you know the enemy and know yourself, you need not fear the result of a hundred battles. ➢ Building Better Hunt Data TueDenn Security Bootcamp - Let the Hunt Begin 41 https://attack.mitre.org/datasources/
- 42. Identify Give your hunt a clear objective TueDenn Security Bootcamp - Let the Hunt Begin 42
- 43. Identify A CLEAR objective → Effective threat hunting ➢ Define your hypothesis ➢ What you should hunt for: POST-Exploit! TueDenn Security Bootcamp - Let the Hunt Begin 43
- 44. AnalysiS To prove or disprove your hypothesis TueDenn Security Bootcamp - Let the Hunt Begin 44 https://www.threathunting.net/files/hunt-evil-practical-guide-threat-hunting.pdf
- 45. “ SeArching ” Techniques ➢ the simplest method ➢ Don’t too broadly ➢ For general artifacts ➢ Don’t too specifically ➢ on specific hosts TueDenn Security Bootcamp - Let the Hunt Begin 45
- 46. “ Stacking ” Techniques ➢ the most common techniques ➢ counting the number of occurrences ➢ analyzing the outliers or extremes ➢ Hard to dealing with large and/or diverse data sets ➢ Most effective with a thoughtfully filtered input TueDenn Security Bootcamp - Let the Hunt Begin 46
- 47. “ Grouping ” Techniques ➢ input is an explicit set of items already of interest ➢ Group by based on specific criteria ➢ Example ➢ Group by timeframe ➢ Group by department TueDenn Security Bootcamp - Let the Hunt Begin 47
- 48. “ Clustering ” Techniques ➢ Clustering != Grouping ➢ Input is not explicitly ➢ separate similar data points ➢ certain characteristics ➢ Larger set of data ➢ Machine Learning models! TueDenn Security Bootcamp - Let the Hunt Begin 48 https://www.slideshare.net/slideshow/the-lord-of-the-ring-a-network-analysis/80476370
- 49. Document Create the knowledge of your hunt procedures TueDenn Security Bootcamp - Let the Hunt Begin 49
- 50. TueDenn Security Bootcamp - Let the Hunt Begin 50 SANS Threat Hunting & IR Summit 2020 The SOC Puzzle: Where Does Threat Hunting Fit? Ashley Pearson | @onfvp
- 51. ExpectAtion ManAgemenT Won’t always find bad and that’s okay TueDenn Security Bootcamp - Let the Hunt Begin 51
- 52. Document Your Findings Create the knowledge of your hunt procedures ➢ Historical linking ➢ After: Fully document ➢ During: Partial document ➢ Simple, but clear ➢ Key points ➢ Retrievable ➢ Don’t waste your time! TueDenn Security Bootcamp - Let the Hunt Begin 52
- 53. Document Hunt procedures TueDenn Security Bootcamp - Let the Hunt Begin 53 https://threathunterplaybook.com/hunts/windows/intro.html
- 54. Improve Think for the next! TueDenn Security Bootcamp - Let the Hunt Begin 54
- 55. Improve ➢ Making future hunts more effective ➢ Scalability ➢ Known issues, Better next-time ➢ Don’t do the same hunts over and over ➢ Think can Automation hunt → Rule ➢ Human do, machine helps (AI, ML, automate task) ➢ Remind: “Hunting comes when automation ends!” TueDenn Security Bootcamp - Let the Hunt Begin 55
- 56. Improve ➢ Contribute rules ➢ Harden rules ➢ reduce FP ➢ Recommendations ➢ What missed ➢ how to detect next time ➢ To Improving org’s security TueDenn Security Bootcamp - Let the Hunt Begin 56 https://socprime.com/blog/interview-with-developer-florian-roth/ *Fact: Sigma was created by Florian Roth, for Threat Hunting purpose!
- 57. Improve TueDenn Security Bootcamp - Let the Hunt Begin 57 https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_loadlibrary.yml
- 58. Let simple Threat Hunting procedure demo The Hunt Begin TueDenn 58
- 59. POWERShell Hunting TueDenn Security Bootcamp - Let the Hunt Begin 59 Let Hunt together!
- 60. Prepare - Threat Report TueDenn Security Bootcamp - Let the Hunt Begin 60 https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf
- 61. Prepare - Threat Report TueDenn Security Bootcamp - Let the Hunt Begin 61 https://web-assets.esetstatic.com/wls/2020/05/ESET_Turla_ComRAT.pdf
- 62. Prepare - Threat Report TueDenn Security Bootcamp - Let the Hunt Begin 62 https://web-assets.esetstatic.com/wls/2020/05/ESET_Turla_ComRAT.pdf
- 63. Identify – Hypothesis Threat Actor has created a schedule task that ➢ without being caught → detection miss ➢ Still Remain persistence ➢ Run powershell ➢ Using techniques: https://attack.mitre.org /techniques/T1053/005/ TueDenn Security Bootcamp - Let the Hunt Begin 63
- 64. Identify – Hunting Plan ➢ Scope: Scale all (1000 ppl) ➢ Collect: ➢ Data source: File (Tasks file path, create, …) ➢ Data source: Registry (Entry, Lauch Strings,…) ➢ Techniques: ➢ Searching, grouping, stacking ➢ Notes TueDenn Security Bootcamp - Let the Hunt Begin 64
- 65. Analysis - Searching Using your SIEM to search the IOC (YES/NO question!) TueDenn Security Bootcamp - Let the Hunt Begin 65 NO RESULT!
- 66. Collect - Large Volume TueDenn Security Bootcamp - Let the Hunt Begin 66
- 67. Analysis - Grouping TueDenn Security Bootcamp - Let the Hunt Begin 67
- 68. TueDenn Security Bootcamp - Let the Hunt Begin 68 Analysis – Grouping & Stacking
- 69. Analysis – Stacking TueDenn Security Bootcamp - Let the Hunt Begin 69
- 70. Analysis – Stacking TueDenn Security Bootcamp - Let the Hunt Begin 70
- 71. Analysis – Stacking TueDenn Security Bootcamp - Let the Hunt Begin 71
- 72. Analysis – Stacking TueDenn Security Bootcamp - Let the Hunt Begin 72
- 73. Document ➢ Follow your document method ➢ Report finding threat for stakeholder ➢ IR need? ➢ Enrich your procedures knowledge base ➢ Share! TueDenn Security Bootcamp - Let the Hunt Begin 73
- 74. Improve Security ➢ There is 01 rule about CREATE powershell job in the wild! ➢ what if bypassed? ➢ Do you monitor the powershell job folder? ➢ The time is NOW! TueDenn Security Bootcamp - Let the Hunt Begin 74 https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml
- 76. Take Away Keys
- 77. Key Take Away ➢ Threat Hunting is for all organization ➢ Threat Hunting shink the dwell time & improve detection capability ➢ Threat actors is coming! ➢ know enermy, know yourself ➢ Follow your method ➢ Mature your hunt to cutting-edge TueDenn Security Bootcamp - Let the Hunt Begin 77
- 78. TueDenn Security Bootcamp - Let the Hunt Begin 78 What’s Next
- 79. What’s Next ➢ Define & follow Strategy, Methodologies and Maturity model ➢ Start on Post-Exploitation ➢ Thinking offense, leads to smarter hunting! ➢ Assume nothing, Belive no one, Curious everything! ➢ Remind "hunting is a practice like any other; you learn best by doing it, so don’t hesitate to jump in“ TueDenn Security Bootcamp - Let the Hunt Begin 79
- 80. References ➢ threathunting.net ➢ huntpedia ➢ framework-for-threat-hunting- whitepaper ➢ hunt-evil-practical-guide- threat-hunting ➢ threat-hunting-team-maturity- model ➢ splunk-threat-hunting ➢ ready-to-hunt-first-show-me- your-data ➢ sans-webcasts-threat-hunting- 100967 ➢ sans-generating-hypotheses- successful-threat-hunting-37172 ➢ sans-2024-threat-hunting- survey-hunting-for-normal- within-chaos/ TueDenn Security Bootcamp - Let the Hunt Begin 80