SlideShare a Scribd company logo

MITRE ATT&CKcon 2.0: Zeek-based ATT&CK Metrics and Gap Analysis; Allan Thomson, LooklingGlass Cyber Solutions

MITRE - ATT&CKcon, profile picture
MITRE - ATT&CKcon

The document discusses the Zeek network analysis framework, focusing on its role in network security monitoring and correlation of intelligence with ATT&CK metrics. It outlines the architecture, ecosystem, and processes involved in mapping threat intelligence to ATT&CK, including data preparation, correlation, and alerting techniques. The document emphasizes the importance of effective data modeling and preparation for improving analysis capabilities in security operations.

Technology
Related topics:
MITRE ATT&CK Insights • Cyber Threat Intelligence
1 of 23
Downloaded 123 times
1
2
3
4
5
6
Most read
7
8
9
10
11
Most read
12
13
14
15
16
17
18
19
20
21
22
23
Most read
© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek ATT&CK Metrics Allan Thomson CTO LookingGlass Oct 29th 2019
2Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek Background What is it Why it matters Data Preparation STIX2.1 Intelligence to ATT&CK Mapping Zeek Script Programming Data Processing Intelligence & ATT&CK normalization Zeek/Behavior correlation 3 Things
© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek BackgroundBasic Architecture
4Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek Background Network Analysis Framework Focused on Network Security Monitoring Open Source Community 20 Years Research (www.zeek.org)
5© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Public Disclosure Zeek Ecosystem Botnet Scanning Web - HTTP Exfiltration Email File Sharing - SMB Routing - RIP Domain - DNS Syslog Protocol Vulnerabilities SSH X509 Certificates SSL/TLS Certificate Validation Geo-location Sandbox Integration Intelligence Integration RPC NTLM Fast Flux Statistics DHCP Connections Blacklists ICMP APT IRC NTP Wordpress BittorrentSpam IPv6 IPv4 ShellshockBitcoin Payload VirusTotal Integration MAC Bruteforce
6© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Public Disclosure • Zeek monitor receives copy of all traffic • Zeek employs an event-based programming model • Zeek scripts run to perform analysis on the network traffic • Identify stateful analysis on specific network patterns or network behavior • Can also identify user application behaviors (i.e. nefarious activity) Zeek Based Detection
7Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Supports Actor-Framework (https://actor-framework.org/) • Distributed Messaging & Processing - Event Processing - Cross-Event Correlation - Behavioral Identification - Intelligence Correlation - ATT&CK Analysis  Multi-node  Multi-processing Zeek Processing and Distribution
8Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Applying Zeek For ATT&CK/Intelligence Correlation SOC/NOC Passive Zeek Monitor Perimeter Cloud Network Internal Network LAN Zeek Agent Active Zeek Detection & Mitigation SDN Zeek Controller Agents (Endpoints/Servers)
© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Data PreparationIntelligence & Zeek Updates for AT T&CK
10© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Public Disclosure • How we modelled Threat Intelligence • How we related Intelligence to ATT&CK • How we correlated intel with activities (net, sys, user) • How we applied action based on Intelligence/ATT&CK • STIX2 • STIX2 • Zeek • Zeek Threat Intelligence & ATT&CK
11Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • 90 different intelligence feeds • ~1800 Unique intelligence attack-patterns, intrusion sets, actors - Data-driven Mapping to ATT&CK - Include ATT&CK Mapping when producing STIX2.1 Intelligence Data Preparation: Intel to ATT&CK Mapping
12Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Tactics mapped using kill-chain property on Intel Feed - Attack-Pattern SDO - Intrusion Set SDO - Actor SDO Data Preparation: Intel to ATT&CK Mapping
13Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Intel Feed Attack-Patterns related to ATT&CK Attack-Patterns using SROs Data Preparation: Intel to ATT&CK Mapping Points to ATT&CK UUID
© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Data ProcessingCor relation, Aler ting
15Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Find IP ranges and CIDRs that are associated with the NAICS Industry of ‘Carpet and Rug Mills’; - discover all active IPs contained within these ranges, - and  find FQDNs associated with them where those FQDNs have active threats  that include o Attack-Pattern Exploitation of Remotes Services and o Attack-Pattern Pass the Hash An Intelligence Question ?
16Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Many different sources assert essentially the same data - i.e. FeedA asserts that IP 10.0.0.1 has Malware A, and FeedB asserts the same • Much of the metadata is the same across temporal series - Repeated fact assertions and threat associations - i.e. FeedB asserts that Actor BB, associated with Intrusion Set AA, using Attack-Pattern ZZZ Drive-by Compromise malware YY on Infrastructure CC at time X, and again, at time Y • Different attributes with different data representation that communicate the same semantic information - i.e. country_s of “United States” and “United States of America” and country_code_s of “US”, and “USA” • Multiple different object/entity types, billions of instances that requires large-scale join across data-sets where those data-sets are being updated in real-time The problem answering that question?
17Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Entity - Contains information about an Entity that will never change - Metadata such as name, and IP ranges in Entities allows Facts to only contain reference Solution: Unified Data Modelling • Fact • Asserts attributes on Entity and relationships to other Entities • If Facts contained temporal and source/provider attributes, it would be multiple Fact Record for each • Assertion • Asserts one or more Facts by Source Entity and Provider Entity • Contains all temporal attributes – Observed At, and Asserted At
18Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Impact on Data Bytes: ~150GB/day  ~25-30GB/day. Records: ~150mm/day  ~19mm/day.
19Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek Intelligence Basic Lookup Pipeline Raw Events Zeek Intelligence Framework Lookup Intelligence & ATT&CK Correlation Intelligence Found Event
20Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek ATT&CK Report Event Dissection 1568762713.447733 1568762713.344683 - node1 HTTP::IN_HOST_HEADER comixalex.freeiz.com Intel::DOMAIN STIX::INDICATOR DTD All: comixalex.freeiz.com 1456283538.000000 1568776825.000000 LookingGlass Cyber Solutions :adware,:apt,:bot,:click- fraud,:exploit-kit,:financial,:malvertising,:malware,:mobile-device,:phishing,:port-scanner,:pos-atm,:ransomware,:remote-access- trojan,:rogue-antivirus,:rootkit,:trojan,:worm [domain-name:value = 'comixalex.freeiz.com'] C70GjJ2nFHfFRmARhg 52:54:00:06:76:f2 192.168.123.100 51072 153.92.0.100 80 Where in the network was it seen? What aspect of traffic was it detectedWhat LGC Attack Pattern ID What intel feed produced the intel? What labels are associated?What STIXv2 Pattern was matched?What src net entity? What dst net entity?
21Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek ATT&CK Report Event Analysis 1568762713.447733 1568762713.344683 - node1 HTTP::IN_HOST_HEADER comixalex.freeiz.com Intel::DOMAIN STIX::INDICATOR DTD All: comixalex.freeiz.com 1456283538.000000 1568776825.000000 LookingGlass Cyber Solutions :adware,:apt,:bot,:click- fraud,:exploit-kit,:financial,:malvertising,:malware,:mobile-device,:phishing,:port-scanner,:pos-atm,:ransomware,:remote-access- trojan,:rogue-antivirus,:rootkit,:trojan,:worm [domain-name:value = 'comixalex.freeiz.com'] C70GjJ2nFHfFRmARhg 52:54:00:06:76:f2 192.168.123.100 51072 153.92.0.100 80 Where in the network was it seen? What aspect of traffic was it detectedWhat LGC Attack Pattern ID What intel feed produced the intel? What labels are associated?What STIXv2 Pattern was matched?What src net entity? What dst net entity? Allows gap analysis on coverage of networks Allows analysis of application coverage Allows analysis of feeds coverage/value Allows lookup back to ATT&CK Tactics & Kill-Chain Phase Allows classification analysisAllows cross correlation with other data Allows cross correlation with other data Allows pattern effectiveness analysis
22Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Zeek provides effective and flexible framework for collection and correlation • Data preparation & modelling can have big impact on analysis effectiveness • Data correlation at scale requires end-to-end approach Summary Questions?
Thank You L o o k i n g G l a s s C y b e r. c o m /LookingGlassCyber/company/LookingGlass@LG_Cyber@LookingGlassCyber

More Related Content

PDF
Sharpening your Threat-Hunting Program with ATTACK Framework
MITRE - ATT&CKcon
 
PDF
Threat Hunting Procedures and Measurement Matrice
Vishal Kumar
 
PDF
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
PDF
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
MITRE - ATT&CKcon
 
PDF
Automation: The Wonderful Wizard of CTI (or is it?)
MITRE ATT&CK
 
PDF
SIEM and Threat Hunting
n|u - The Open Security Community
 
PDF
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
PPTX
Snort
Fadwa Gmiden
 
Sharpening your Threat-Hunting Program with ATTACK Framework
MITRE - ATT&CKcon
 
Threat Hunting Procedures and Measurement Matrice
Vishal Kumar
 
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
MITRE - ATT&CKcon
 
Automation: The Wonderful Wizard of CTI (or is it?)
MITRE ATT&CK
 
SIEM and Threat Hunting
n|u - The Open Security Community
 
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
Snort
Fadwa Gmiden
 

What's hot (20)

PDF
Threat Hunting with Splunk
Splunk
 
PDF
Threat Hunting Report
Morane Decriem
 
PPTX
What is Threat Hunting? - Panda Security
Panda Security
 
PPTX
Effective Threat Hunting with Tactical Threat Intelligence
Dhruv Majumdar
 
PPTX
Cyber kill chain
Ankita Ganguly
 
PDF
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE - ATT&CKcon
 
PPTX
Cyber Threat Hunting Workshop
Digit Oktavianto
 
PPTX
Nmap basics
n|u - The Open Security Community
 
PPTX
Abusing Microsoft Kerberos - Sorry you guys don't get it
Benjamin Delpy
 
PDF
Super Easy Memory Forensics
IIJ
 
PPTX
Threat Hunting with Splunk Hands-on
Splunk
 
PDF
0wn-premises: Bypassing Microsoft Defender for Identity
Nikhil Mittal
 
PPTX
Threat hunting in cyber world
Akash Sarode
 
PDF
PHDays 2018 Threat Hunting Hands-On Lab
Teymur Kheirkhabarov
 
PDF
Landing on Jupyter: The transformative power of data-driven storytelling for ...
MITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
PDF
Threat Hunting with Splunk Hands-on
Splunk
 
PPTX
Bsides 2019 - Intelligent Threat Hunting
Dhruv Majumdar
 
PPTX
QRadar, ArcSight and Splunk
M sharifi
 
PDF
State of the ATT&CK
MITRE ATT&CK
 
Threat Hunting with Splunk
Splunk
 
Threat Hunting Report
Morane Decriem
 
What is Threat Hunting? - Panda Security
Panda Security
 
Effective Threat Hunting with Tactical Threat Intelligence
Dhruv Majumdar
 
Cyber kill chain
Ankita Ganguly
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE - ATT&CKcon
 
Cyber Threat Hunting Workshop
Digit Oktavianto
 
Nmap basics
n|u - The Open Security Community
 
Abusing Microsoft Kerberos - Sorry you guys don't get it
Benjamin Delpy
 
Super Easy Memory Forensics
IIJ
 
Threat Hunting with Splunk Hands-on
Splunk
 
0wn-premises: Bypassing Microsoft Defender for Identity
Nikhil Mittal
 
Threat hunting in cyber world
Akash Sarode
 
PHDays 2018 Threat Hunting Hands-On Lab
Teymur Kheirkhabarov
 
Landing on Jupyter: The transformative power of data-driven storytelling for ...
MITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
Threat Hunting with Splunk Hands-on
Splunk
 
Bsides 2019 - Intelligent Threat Hunting
Dhruv Majumdar
 
QRadar, ArcSight and Splunk
M sharifi
 
State of the ATT&CK
MITRE ATT&CK
 
Ad

Similar to MITRE ATT&CKcon 2.0: Zeek-based ATT&CK Metrics and Gap Analysis; Allan Thomson, LooklingGlass Cyber Solutions (20)

PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2018: ATT&CK: All the Things, Neelsen Cyrus and David Thompso...
MITRE - ATT&CKcon
 
PPTX
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
PPTX
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
Harry McLaren
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
MITRE ATT&CK
 
PDF
MITRE ATTACKcon Power Hour - January
MITRE - ATT&CKcon
 
PPTX
ATT&CKing Threat Management
Andy Piazza
 
PDF
MITRE ATT&CKcon 2.0: attckr - A Toolkit for Analysis and Visualization of ATT...
MITRE - ATT&CKcon
 
PDF
ISACA -Threat Hunting using Native Windows tools .pdf
Gurvinder Singh, CISSP, CISA, ITIL v3
 
PDF
Dealing With ATT&CK's Different Levels Of Detail
MITRE ATT&CK
 
PDF
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...
CloudVillage
 
PDF
State of ATT&CK
Adam Pennington
 
PDF
MITRE AttACK framework it is time you took notice_v1.0
Michael Gough
 
PDF
Cyber Threat hunting workshop
Arpan Raval
 
PDF
MITRE-Module 4 Slides.pdf
ReZa AdineH
 
PDF
2012-12-12 Seminar McAfee ESM
Pinewood
 
PPTX
Applying Provenance in APT Monitoring and Analysis Practical Challenges for S...
Graeme Jenkinson
 
PDF
Mitre getting-started-with-attack-october-2019
Thang Nguyen
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: ATT&CK: All the Things, Neelsen Cyrus and David Thompso...
MITRE - ATT&CKcon
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
Virtual Splunk User Group - Phantom Workbook Automation & Threat Hunting with...
Harry McLaren
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
MITRE ATT&CK
 
MITRE ATTACKcon Power Hour - January
MITRE - ATT&CKcon
 
ATT&CKing Threat Management
Andy Piazza
 
MITRE ATT&CKcon 2.0: attckr - A Toolkit for Analysis and Visualization of ATT...
MITRE - ATT&CKcon
 
ISACA -Threat Hunting using Native Windows tools .pdf
Gurvinder Singh, CISSP, CISA, ITIL v3
 
Dealing With ATT&CK's Different Levels Of Detail
MITRE ATT&CK
 
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...
CloudVillage
 
State of ATT&CK
Adam Pennington
 
MITRE AttACK framework it is time you took notice_v1.0
Michael Gough
 
Cyber Threat hunting workshop
Arpan Raval
 
MITRE-Module 4 Slides.pdf
ReZa AdineH
 
2012-12-12 Seminar McAfee ESM
Pinewood
 
Applying Provenance in APT Monitoring and Analysis Practical Challenges for S...
Graeme Jenkinson
 
Mitre getting-started-with-attack-october-2019
Thang Nguyen
 
Ad

More from MITRE - ATT&CKcon (20)

PDF
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
MITRE - ATT&CKcon
 
PDF
State of the ATTACK
MITRE - ATT&CKcon
 
PDF
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
MITRE - ATT&CKcon
 
PDF
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
MITRE - ATT&CKcon
 
PDF
Using ATTACK to Create Cyber DBTS for Nuclear Power Plants
MITRE - ATT&CKcon
 
PDF
Helping Small Companies Leverage CTI with an Open Source Threat Mapping
MITRE - ATT&CKcon
 
PDF
What's New with ATTACK for ICS?
MITRE - ATT&CKcon
 
PDF
From Theory to Practice: How My ATTACK Perspectives Have Changed
MITRE - ATT&CKcon
 
PDF
Putting the PRE into ATTACK
MITRE - ATT&CKcon
 
PDF
What's a MITRE with your Security?
MITRE - ATT&CKcon
 
PDF
ATTACKing the Cloud: Hopping Between the Matrices
MITRE - ATT&CKcon
 
PDF
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile
MITRE - ATT&CKcon
 
PDF
Transforming Adversary Emulation Into a Data Analysis Question
MITRE - ATT&CKcon
 
PDF
TA505: A Study of High End Big Game Hunting in 2020
MITRE - ATT&CKcon
 
PDF
What's New with ATTACK for Cloud?
MITRE - ATT&CKcon
 
PDF
Starting Over with Sub-Techniques
MITRE - ATT&CKcon
 
PDF
MITRE ATTACKCon Power Hour - December
MITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon Power Hour - November
MITRE - ATT&CKcon
 
PDF
MITRE ATTACKcon Power Hour - October
MITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE - ATT&CKcon
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
MITRE - ATT&CKcon
 
State of the ATTACK
MITRE - ATT&CKcon
 
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
MITRE - ATT&CKcon
 
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
MITRE - ATT&CKcon
 
Using ATTACK to Create Cyber DBTS for Nuclear Power Plants
MITRE - ATT&CKcon
 
Helping Small Companies Leverage CTI with an Open Source Threat Mapping
MITRE - ATT&CKcon
 
What's New with ATTACK for ICS?
MITRE - ATT&CKcon
 
From Theory to Practice: How My ATTACK Perspectives Have Changed
MITRE - ATT&CKcon
 
Putting the PRE into ATTACK
MITRE - ATT&CKcon
 
What's a MITRE with your Security?
MITRE - ATT&CKcon
 
ATTACKing the Cloud: Hopping Between the Matrices
MITRE - ATT&CKcon
 
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile
MITRE - ATT&CKcon
 
Transforming Adversary Emulation Into a Data Analysis Question
MITRE - ATT&CKcon
 
TA505: A Study of High End Big Game Hunting in 2020
MITRE - ATT&CKcon
 
What's New with ATTACK for Cloud?
MITRE - ATT&CKcon
 
Starting Over with Sub-Techniques
MITRE - ATT&CKcon
 
MITRE ATTACKCon Power Hour - December
MITRE - ATT&CKcon
 
MITRE ATT&CKcon Power Hour - November
MITRE - ATT&CKcon
 
MITRE ATTACKcon Power Hour - October
MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE - ATT&CKcon
 

Recently uploaded (20)

PDF
Modernizing your data center with Dell and AMD
Principled Technologies
 
PDF
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
PDF
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
PDF
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
PDF
NewMind AI Monthly Chronicles - July 2025
NewMind AI
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
PPT
Teaching material agriculture food technology
LiaRayya
 
PDF
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
PDF
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
PDF
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PDF
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
PDF
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
PPT
“AI and Expert System Decision Support & Business Intelligence Systems”
ZubinRadhakrishnan
 
PDF
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
PDF
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
PPTX
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
PDF
CIFDAQ's Market Insight: SEC Turns Pro Crypto
CIFDAQ
 
Modernizing your data center with Dell and AMD
Principled Technologies
 
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
NewMind AI Monthly Chronicles - July 2025
NewMind AI
 
Approach and Philosophy of On baking technology
30anthuong17
 
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
Teaching material agriculture food technology
LiaRayya
 
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
“AI and Expert System Decision Support & Business Intelligence Systems”
ZubinRadhakrishnan
 
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
CIFDAQ's Market Insight: SEC Turns Pro Crypto
CIFDAQ
 

MITRE ATT&CKcon 2.0: Zeek-based ATT&CK Metrics and Gap Analysis; Allan Thomson, LooklingGlass Cyber Solutions

  • 1. © 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek ATT&CK Metrics Allan Thomson CTO LookingGlass Oct 29th 2019
  • 2. 2Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek Background What is it Why it matters Data Preparation STIX2.1 Intelligence to ATT&CK Mapping Zeek Script Programming Data Processing Intelligence & ATT&CK normalization Zeek/Behavior correlation 3 Things
  • 3. © 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek BackgroundBasic Architecture
  • 4. 4Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek Background Network Analysis Framework Focused on Network Security Monitoring Open Source Community 20 Years Research (www.zeek.org)
  • 5. 5© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Public Disclosure Zeek Ecosystem Botnet Scanning Web - HTTP Exfiltration Email File Sharing - SMB Routing - RIP Domain - DNS Syslog Protocol Vulnerabilities SSH X509 Certificates SSL/TLS Certificate Validation Geo-location Sandbox Integration Intelligence Integration RPC NTLM Fast Flux Statistics DHCP Connections Blacklists ICMP APT IRC NTP Wordpress BittorrentSpam IPv6 IPv4 ShellshockBitcoin Payload VirusTotal Integration MAC Bruteforce
  • 6. 6© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Public Disclosure • Zeek monitor receives copy of all traffic • Zeek employs an event-based programming model • Zeek scripts run to perform analysis on the network traffic • Identify stateful analysis on specific network patterns or network behavior • Can also identify user application behaviors (i.e. nefarious activity) Zeek Based Detection
  • 7. 7Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Supports Actor-Framework (https://actor-framework.org/) • Distributed Messaging & Processing - Event Processing - Cross-Event Correlation - Behavioral Identification - Intelligence Correlation - ATT&CK Analysis  Multi-node  Multi-processing Zeek Processing and Distribution
  • 8. 8Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Applying Zeek For ATT&CK/Intelligence Correlation SOC/NOC Passive Zeek Monitor Perimeter Cloud Network Internal Network LAN Zeek Agent Active Zeek Detection & Mitigation SDN Zeek Controller Agents (Endpoints/Servers)
  • 9. © 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Data PreparationIntelligence & Zeek Updates for AT T&CK
  • 10. 10© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Public Disclosure • How we modelled Threat Intelligence • How we related Intelligence to ATT&CK • How we correlated intel with activities (net, sys, user) • How we applied action based on Intelligence/ATT&CK • STIX2 • STIX2 • Zeek • Zeek Threat Intelligence & ATT&CK
  • 11. 11Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • 90 different intelligence feeds • ~1800 Unique intelligence attack-patterns, intrusion sets, actors - Data-driven Mapping to ATT&CK - Include ATT&CK Mapping when producing STIX2.1 Intelligence Data Preparation: Intel to ATT&CK Mapping
  • 12. 12Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Tactics mapped using kill-chain property on Intel Feed - Attack-Pattern SDO - Intrusion Set SDO - Actor SDO Data Preparation: Intel to ATT&CK Mapping
  • 13. 13Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Intel Feed Attack-Patterns related to ATT&CK Attack-Patterns using SROs Data Preparation: Intel to ATT&CK Mapping Points to ATT&CK UUID
  • 14. © 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Data ProcessingCor relation, Aler ting
  • 15. 15Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Find IP ranges and CIDRs that are associated with the NAICS Industry of ‘Carpet and Rug Mills’; - discover all active IPs contained within these ranges, - and  find FQDNs associated with them where those FQDNs have active threats  that include o Attack-Pattern Exploitation of Remotes Services and o Attack-Pattern Pass the Hash An Intelligence Question ?
  • 16. 16Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Many different sources assert essentially the same data - i.e. FeedA asserts that IP 10.0.0.1 has Malware A, and FeedB asserts the same • Much of the metadata is the same across temporal series - Repeated fact assertions and threat associations - i.e. FeedB asserts that Actor BB, associated with Intrusion Set AA, using Attack-Pattern ZZZ Drive-by Compromise malware YY on Infrastructure CC at time X, and again, at time Y • Different attributes with different data representation that communicate the same semantic information - i.e. country_s of “United States” and “United States of America” and country_code_s of “US”, and “USA” • Multiple different object/entity types, billions of instances that requires large-scale join across data-sets where those data-sets are being updated in real-time The problem answering that question?
  • 17. 17Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Entity - Contains information about an Entity that will never change - Metadata such as name, and IP ranges in Entities allows Facts to only contain reference Solution: Unified Data Modelling • Fact • Asserts attributes on Entity and relationships to other Entities • If Facts contained temporal and source/provider attributes, it would be multiple Fact Record for each • Assertion • Asserts one or more Facts by Source Entity and Provider Entity • Contains all temporal attributes – Observed At, and Asserted At
  • 18. 18Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Impact on Data Bytes: ~150GB/day  ~25-30GB/day. Records: ~150mm/day  ~19mm/day.
  • 19. 19Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek Intelligence Basic Lookup Pipeline Raw Events Zeek Intelligence Framework Lookup Intelligence & ATT&CK Correlation Intelligence Found Event
  • 20. 20Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek ATT&CK Report Event Dissection 1568762713.447733 1568762713.344683 - node1 HTTP::IN_HOST_HEADER comixalex.freeiz.com Intel::DOMAIN STIX::INDICATOR DTD All: comixalex.freeiz.com 1456283538.000000 1568776825.000000 LookingGlass Cyber Solutions :adware,:apt,:bot,:click- fraud,:exploit-kit,:financial,:malvertising,:malware,:mobile-device,:phishing,:port-scanner,:pos-atm,:ransomware,:remote-access- trojan,:rogue-antivirus,:rootkit,:trojan,:worm [domain-name:value = 'comixalex.freeiz.com'] C70GjJ2nFHfFRmARhg 52:54:00:06:76:f2 192.168.123.100 51072 153.92.0.100 80 Where in the network was it seen? What aspect of traffic was it detectedWhat LGC Attack Pattern ID What intel feed produced the intel? What labels are associated?What STIXv2 Pattern was matched?What src net entity? What dst net entity?
  • 21. 21Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. Zeek ATT&CK Report Event Analysis 1568762713.447733 1568762713.344683 - node1 HTTP::IN_HOST_HEADER comixalex.freeiz.com Intel::DOMAIN STIX::INDICATOR DTD All: comixalex.freeiz.com 1456283538.000000 1568776825.000000 LookingGlass Cyber Solutions :adware,:apt,:bot,:click- fraud,:exploit-kit,:financial,:malvertising,:malware,:mobile-device,:phishing,:port-scanner,:pos-atm,:ransomware,:remote-access- trojan,:rogue-antivirus,:rootkit,:trojan,:worm [domain-name:value = 'comixalex.freeiz.com'] C70GjJ2nFHfFRmARhg 52:54:00:06:76:f2 192.168.123.100 51072 153.92.0.100 80 Where in the network was it seen? What aspect of traffic was it detectedWhat LGC Attack Pattern ID What intel feed produced the intel? What labels are associated?What STIXv2 Pattern was matched?What src net entity? What dst net entity? Allows gap analysis on coverage of networks Allows analysis of application coverage Allows analysis of feeds coverage/value Allows lookup back to ATT&CK Tactics & Kill-Chain Phase Allows classification analysisAllows cross correlation with other data Allows cross correlation with other data Allows pattern effectiveness analysis
  • 22. 22Public Disclosure© 2019 LookingGlass Cyber Solutions, Inc. All Rights Reserved. • Zeek provides effective and flexible framework for collection and correlation • Data preparation & modelling can have big impact on analysis effectiveness • Data correlation at scale requires end-to-end approach Summary Questions?
  • 23. Thank You L o o k i n g G l a s s C y b e r. c o m /LookingGlassCyber/company/LookingGlass@LG_Cyber@LookingGlassCyber