The Case for EDR: What's In Your Toolkit
Download as PPTX, PDF1 like441 views
The document discusses Endpoint Detection and Response (EDR) and outlines its importance in identifying and managing malware threats. It provides an overview of Cybereason, the speaker's background, and various types of malware including fileless malware and specific examples like Emotet and TrickBot. The presentation emphasizes the need for proactive monitoring and the evolving landscape of cybersecurity threats.
![© 2017 Cybereason Inc. All rights reserved.
Tiny Banker
The process ran a DNS query to the following:
vqwgqnbtectr.pw > 216.218.185[.]162
sucjuv.in > 216.218.185[.]162
hbsnmsmlsvib.in > 216.218.185[.]162
ehhrupqrycm.pw > 216.218.185[.]162
uatuwc.pw > 216.218.185[.]162
fpexkrdtxpfs.in > 216.218.185[.]162
okzhyctznzft.pw > 216.218.185[.]162
zawmg.pw > 216.218.185[.]162
lxpcbahva.pw > 216.218.185[.]162
bifcp.in > 216.218.185[.]162
pojde.in > 216.218.185[.]162
And many many more….](https://image.slidesharecdn.com/talkpresenetationautosavedchou-190706181331/85/The-Case-for-EDR-What-s-In-Your-Toolkit-29-320.jpg)
The Case for EDR: What's In Your Toolkit
- 1. © 2017 Cybereason Inc. All rights reserved. What’s in your toolkit? The Case for EDR
- 2. © 2017 Cybereason Inc. All rights reserved. Index • This presentation: • About Me • About Cybereason • My Job • Disclaimers • Products/Vendors • Defense In Depth • Examples • Q/A
- 3. © 2017 Cybereason Inc. All rights reserved. About me • Hometown boy! • CAL Alumni 2001 • Education • USF (Double BA in Poly Sci and Finance) • UofL (Post Bac Cert in Accounting) • Boston University MET (MS in Comp Sci) • Work • American Well: Security Analyst (2015) • PayPal: Security Engineer (2016-2018) • Cybereason: Security/Malware Analyst (2019) • Other • Jit-Jitsu Whitebelt (Black belt in training)
- 4. © 2017 Cybereason Inc. All rights reserved. About Cybereason • Founded in 2012 by former members of the elite Israeli Defense force 8200 • Currently around 500 employees with $100+ million dollars in funding, most from Japanese Softbank • Offices in Boston, Tel Aviv, Tokyo, London and Sydney (more coming soon)
- 5. © 2017 Cybereason Inc. All rights reserved. What’s my job? • Identify the Malware before it spreads • Drop unidentified Malware into sandbox • Reverse Engineer Malware • Triage and make recommendations based on the type of Malware • Quarantine vs Re-Image the machine
- 6. © 2017 Cybereason Inc. All rights reserved. Disclaimer! • I’m still learning!!!
- 7. © 2017 Cybereason Inc. All rights reserved. Other Disclaimer • EDR is not meant there is a be all end all solution!
- 8. © 2017 Cybereason Inc. All rights reserved. Which products? Who are the vendors? Anti-virus Firewall WAF
- 9. © 2017 Cybereason Inc. All rights reserved. New Generation Products EDR
- 10. © 2017 Cybereason Inc. All rights reserved. Defense in Depth Recognize this?
- 11. © 2017 Cybereason Inc. All rights reserved. Defense in Depth The Layers
- 12. © 2017 Cybereason Inc. All rights reserved. What is EDR? Endpoint Detection and ResponseRemediation • Gives a full story • Shows behaviors and uses data and predictive analytics to determine malicious behavior • Addresses the need for continuous monitoring • Combines many tools for a single purpose which empowers the analyst as well as the party to make sure the proper actions are taken • In other words its helpful!
- 13. © 2017 Cybereason Inc. All rights reserved. Attack Lifecycle
- 14. © 2017 Cybereason Inc. All rights reserved. Different types of Malware
- 15. © 2017 Cybereason Inc. All rights reserved. APT vs. Commodity Malware WannaCry • NSA Leak • Eternal Blue & Double Pulsar
- 16. © 2017 Cybereason Inc. All rights reserved. APT vs. Commodity Malware Stuxnet
- 17. © 2017 Cybereason Inc. All rights reserved. Types of Malware • PUP (potentially unwanted program) • Applications that would be considered unwanted despite often having been downloaded by the user. • Ransomware • Threatens to publish the victim's data or perpetually block access(encrypt) to it unless a ransom is paid.
- 18. © 2017 Cybereason Inc. All rights reserved. Types of Malware • Dropper • Malicious code that exists only to download other malicious code. • Information-stealing malware • Collects information from a victim’s computer and usually sends it to the attacker. • Rootkit • Malicious code designed to conceal the existence of other code.
- 19. © 2017 Cybereason Inc. All rights reserved. Fileless Malware • What is it? • Legitimate process being ran in the background • Data saved in Registry can be called by wscript • Powershell process one liner process base64 etc pushses straight to RAM • Calling invoke expression can run via admin and collect and receive data and go undetected to typical AV as this is a legitimate process • Using Operating System against itself • Cobalt kitty --------------------------
- 20. © 2017 Cybereason Inc. All rights reserved. Fileless Malware • Current Trends • 42% of companies surveyed by the Ponemon Institute reported experiencing at least one fileless malware attack in 2017 and 77% of all successful attacks were fileless. (https://digitalguardian.com/blog/what-fileless-malware-or-non-malware-attack- definition-and-best-practices-fileless-malware) • In the first half of 2018 there was a 94% increase in fileless malware attacks and 5.2 Powershell attacks per 1000 endpoint according to Threatpost (https://threatpost.com/threatlist- ransomware-attacks-down-fileless-malware-up-in-2018/136962/)
- 21. © 2017 Cybereason Inc. All rights reserved. Mimikatz • What is it? • Open source application (Used both by Red team and malicious individuals) to dump clear text authentication credentials • By default since windows 8.1 wont spit out clear text passwords (Wdigest)
- 22. © 2017 Cybereason Inc. All rights reserved. Emotet/Trickbot/Ryuk
- 23. © 2017 Cybereason Inc. All rights reserved. Emotet/Trickbot/Ryuk
- 24. © 2017 Cybereason Inc. All rights reserved. Emotet/Trickbot/Ryuk
- 25. © 2017 Cybereason Inc. All rights reserved. Emotet/Trickbot/Ryuk
- 26. © 2017 Cybereason Inc. All rights reserved. Emotet/Trickbot/Ryuk
- 27. © 2017 Cybereason Inc. All rights reserved. Tiny Banker
- 28. © 2017 Cybereason Inc. All rights reserved. Tiny Banker
- 29. © 2017 Cybereason Inc. All rights reserved. Tiny Banker The process ran a DNS query to the following: vqwgqnbtectr.pw > 216.218.185[.]162 sucjuv.in > 216.218.185[.]162 hbsnmsmlsvib.in > 216.218.185[.]162 ehhrupqrycm.pw > 216.218.185[.]162 uatuwc.pw > 216.218.185[.]162 fpexkrdtxpfs.in > 216.218.185[.]162 okzhyctznzft.pw > 216.218.185[.]162 zawmg.pw > 216.218.185[.]162 lxpcbahva.pw > 216.218.185[.]162 bifcp.in > 216.218.185[.]162 pojde.in > 216.218.185[.]162 And many many more….
- 30. © 2017 Cybereason Inc. All rights reserved. Tiny Banker
- 31. © 2017 Cybereason Inc. All rights reserved. Tiny Banker
- 32. © 2017 Cybereason Inc. All rights reserved. Tiny Banker
- 33. © 2017 Cybereason Inc. All rights reserved. Tiny Banker
- 34. © 2017 Cybereason Inc. All rights reserved. Demo https://www.youtube.com/watch?v=Hc7h-rIyd5A
- 35. © 2017 Cybereason Inc. All rights reserved. Q/A • Feedback • Joshua.chou@cybereason.com • jdudeoflife
- 36. © 2017 Cybereason Inc. All rights reserved. you.Thank www.cybereason.com