hi everyone i'm harvey from so forces
managed track response team
today i would like to talk about tread
hunting and why it's no longer just a
once but a necessity in today's cyber
security landscape
so let's look at the trends that's
happening today
as you know everyone is going online
every business has to be online to
survive
that's just the reality of things
the attack surface is expanding and
unfortunately that's where the attackers
are also gaining ground
there's also a very big problem of the
ever-present security gap right the
security skills gap i would say a lot of
times that it's really hard to find
someone that actually understands
security or even understands
everything from a malicious payload or
behaviors of attack
so and the problem here is
there's always a problem of the
confidence in security right as you can
see here
right this is even though this report
was done by accenture back in 2019 it
pretty much is accurate today so as you
can see here is predicted that in year
2023 which is just two years uh no
away right that the confidence for
security is dropping down to 25
so here's the thing here is no
organization here can prevent a breach
that is the mindset today
so look let's look at the actual threat
landscape that's happening around us
right now
so let me bring you back in time so back
in the day no tractors usually were not
that
um dangerous in that sense right they're
all usually just people trying to prove
themselves
they're just doing things having fun
they're just not doing joke awares
trying to prove themselves by saying i
managed to access this data which no
it's off limits to everyone
that was basically the trend back then
unfortunately today
we have organized criminal groups
right they basically run like an
organization right like any big
organization they do have a team leader
they do have a coder
interestingly they also have network
administrators and so on and so forth
that's how organized these criminal
groups are today in fact some of these
components are even outsourced right
they are some providers
uh no in the dark web that provides
certain services like botnet services
for example that you can actually buy
off and some of these organized groups
work in tandem with these outsource
suppliers
and why is that the case like why is it
that we move on from like just a solo
attractor trying to have fun to
know kind of like a business model here
well it's because of profit here so as
you can see here
right that the cyber crime profits saw
to 1.5 trillion and this report was in
2018
and no a little bit more recent 2020
right
it has reached 3.5 billion
in 2019
so as you can see here it's just a trend
that's ongoing
so it is a very profitable business
and we as with any business people
always put in efforts to make it better
right and that's just how it is with
even cyber crimes
so let's touch a little bit on this
concept of parameter pain i'm sure all
you security folks out there know about
this concept here but let me just know
kind of like
do a little recap for everyone so
basically what a perimeter pain is is
how much pain do you cause the tractor
when you block this particular component
so as you can see from this parameter
pin
looking at just ips and hashes which is
very common in iocs
is really simple for a tractor it
doesn't cause that much pain
why because today right since they are
running like a business
they have teams at the back end they
have as mentioned outsourced services
they add a snap of finger they can
change the ip
now as a step over finger i can ask my
team no
we compile this malware and i get a new
hash value
and that's how quickly they can do it
right within seconds
so we need to look further up the
pyramid today we need to look up for
everything from the tools and the ttps
to really really cause kind of pain to
the tractors here
one thing to also note is tractors are
also aware of this
it's not just us defenders
and this is proven
through all the different sources that
we can see
so as you can see here tractors have
actually created all these marketplaces
or even dumps
within the dark websites so you have
everything for credential dams dumps
credentials for sale
no in in this example here of genesis
store this is actually a store that
sells access to computers so basically
what they do is they collect information
about computer everything from all the
websites that there this computer have
access to passwords cookie information
and basically what happens is when you
buy this
you basically can kind of clone out that
computer since you have the cookies you
even have the um the ip information
right so you kind of can clone yourself
to pretend to be that particular machine
and that's how effective it is
bear in mind
that even this website is automated
it is not just a bunch of tractors
sitting there collecting all this
information and posting it on this store
jessica store is actually create managed
automatically by robots
right so basically what the bots do is
they look at
the machine that they have
what
um what applications do they have access
to
right everything from dropbox no what
whatever is useful
if that if that particular machine has
very very useful tools on them
right
access to certain websites that are
exclusive for example
the price
goes up
and that is done automatically
so basically that's how
the tractors have advanced
right they have advanced to
collaborating with robots to basically
do their business
we even have websites that sell you know
what we call
uh
fully undetectable malware or fats for
short
so you can see these two examples here
right of these are websites they're
actually selling ransomwares
no and they even guarantee you that they
are undetectable by today's
anti-malware vendors
so that's how advanced it is
and you can even pay them and tell them
hey please customize this malware to do
this and put on this message for me they
will do it for you
and this is what i meant by outsourced
services
we even have websites that actually sell
exploits so even though they state here
that oh this is for
educational purposes
but you know
let's be realistic here
i can go there buy this exploit and use
it for malicious use
they are not going to care
right and and that's how it is
you can just go online no collaborate
with any of these groups
build your own malware and start your
campaign
another trend that so far is seeing is
what we call
living off the land attacks
so what this means is the tractors have
also known right as a reference to the
primary opinion they know
that
no today everyone's really very advanced
they pick up hashes really quickly they
pick up ips very quickly they know so i
can't use my tools against you
so what do they do
no they use whatever tools are already
available on the system
so if you guys are familiar right like
for example ps exec pskill
these are tools that are readily
available on a windows platform
these tools no originally right the
intent is more for administrators
they are very powerful tools they allow
administrators to run remotely any
command they wish
or even kill any process they want
however attractors have also
known about this since these tools are
really available on the system
and it is very unlikely that
any security controls would block them
since they are valid administrative
tools
the tractor uses
these tools against you
we have seen attacks that use psq to try
to terminate security controls
followed by ps exec to basically run
everything from
cnc commands to download downloading of
their backdoors
so those are things that happens
and that's the reality of things that
tractors are advancing their methods
it's not just the tools that they are
doing right even the
the procedures they're doing
so as you can see in this example here
of this
research article
they mentioned something called triple
extortion
so what is that
so back in the day when a ransomware
attack happens all it does it encrypts
your data and then you get a note to say
please pay this amount and we'll decrypt
your data
so that is one level of extortion
then we see interactors starting to do
what we call double extortion which is
if you do not pay us
to decrypt your data
we will
post your information to the public we
will let the whole world see know
everything from your accounts your
business dealings and so and so forth
that was the double extortion technique
and today we are seeing tractors even
advancing further to what we call a
triple extortion which is basically if
you don't pay up
we will ddos
no you
basically to kind of convince you right
to come back to uh to them to negotiate
to pay
so this is unfortunate that even
tractors have evolved their methods as
mentioned they are like a business
they they want to make a profit
and they know and they will chase for it
so here's the thing that we also need to
take note i'm very sure everyone heard
of ai and how ai will help the security
solutions
but
the fact remains no then we need to be
aware of this
it's not just on the defenders
even the attackers here
so here's two articles that i picked up
that basic tractors are also using ai
which makes sense think about it
would you would the tractor be using a
team
just to scour the internet for
vulnerable servers
that's not what they're doing they're
doing something for automation
right so that's the thing here tractors
are using some form of ai
right to basically
fight against what we use which is ai
the only difference here is
the tractors have evolved themselves to
embrace this collaboration
right they have used ai tools to churn
out malwares
to kind of detect behaviors detect
vulnerabilities for example weak weak
systems but they also use their human
expertise to break into your system
and basically as you've seen for example
the cheaper extortion method there's
basically a human there that thought of
the idea
so that's how they have actually
collaborated and that brings about a
very big question
if the attackers are doing that why
aren't we the defenders why aren't we
embracing this collaboration and not
just solely depending on ai and hoping
that the artificial intelligence of our
cyber security solutions will do
everything for us
realistically that's not going to happen
so i brought up this article here
right and and this article is basically
to help you guys know be a little bit
more focused on this is that
based on the various verizon 2021 dbi or
data breach investigation it really
shows that there's no such thing as a
safe industry
right i've spoken to a few customers
here and no some of them have the
assumption that oh i'm not a big bank
for example i wouldn't get attacked
but unfortunately that's not the case
we have seen some small companies ever
get hit
by ransomware attacks
and they were pretty advanced
everyone is a target
the other thing to note is tractors are
really moving fast
right
they don't really spend a lot of time
within lateral movement for example
so take take for example right the the
at the haven attack
right
so let's go back in time and look at
this attack and study the entire no
timeline of it
so back in october first right that is
when
this changta guy started the
investigation he started his research on
this but um exchange
looking up whether there's such a
vulnerability
he also know only
about
two months right where he actually
discovered
this particular vulnerability and they
attacked it with this cve
right the
five cve202126855
which we today know as the half name
activity
however if you can see the gap here
right it's only in january six
that microsoft acknowledged that of this
vulnerability
so
about one month later does microsoft say
yes this vulnerability
is exists on my exchange server
in march first that's when microsoft
disclosed of the hafnium activity
so you can see here there's this huge
gap there
right almost two months
of when they acknowledge the
vulnerability not even when the
track researcher discovered it well when
they acknowledged it to the day that no
they did they disclosed that of this
housing activity it was about two months
and further research actually shows that
the very first possible exploitation of
this vulnerability was way back in
november 2020
so you can see here the tractor
basically had this huge
window to attack environments
when did microsoft release the patch
well you can see here
the patch was released in march the 2nd
2021 so if you look back at the timeline
then the question comes about how big is
your window of exposure
right since it is possible that they
haven't activity started way back in
november
do you just patch your system
and no pray for the best
or do you patch your system and start to
investigate
back
from the day you patch all the way back
to november were there any suspicious
activities happening in your environment
i think that's a very important question
that we need to ask ourselves
so here are a few more examples here
right as you can see here
no
bit locker ran somewhere right
as you know bit locker is something
available on all windows machines and
they're actually a tool to help us
encrypt our systems to protect them
unfortunately in this case it was used
against us
so this is a pretty good example of
using a tool that is already available
on your system against you
we have also seen
now in this epsilon rate right another
ransomware but in this case it uses
powershell scripts basically it doesn't
do any it doesn't really use any
payloads basically all these you know
bare bones ransomware does is all the
functionalities are running off
powershell which i mentioned earlier on
living off the lander text pretty much
undetectable because most security
products or most users trust these tools
because they are inbuilt windows tools
you know
splitting a little bit more is a little
bit more recent right we've seen the
epoxy shell exchange exploit and again
the quantity group was really quick in
using this exploit to launch their
ransomware tags
right something a little bit more um
interesting which is from
so forces on research
we actually discovered
for on one of our customers a very
stealthy ransomware operator right they
can't use something you know what you
call dll site loading
kind of to hide their tracks well but
this basically shows that again they are
using a lot of this not just a
combination of exploits but also certain
things like living off the land
basically the dlls within uh a system to
kind of like run this stuff stealthy
attacks
so that's how much
the tractors have evolved
so let's come back to this how about us
the cyber defenders
how have we evolved
right
so a little quote from one of my buddies
here in the manage track response team
right which i really really think it's
valid
that human experience and the ability to
respond a vital part of any security
solution
so that's really only so much
machines can do right machines are
designed to look up for patterns collect
data
as quickly as possible right that's what
machines do and they are really great at
that
but sometimes it is really difficult to
ask a machine to
can you see if this is bad
if there's no baseline for the machine
the machine is not going to be able to
tell you that
a machine still needs some form of
baseline to and build build an entire
table like in a sense to kind of know
what is good and what's bad
but from a human approach when you look
at it
you know your your gut feeling sometimes
to tells you something else
and i think that's where human
experience comes into play
i think this is further reinforced in a
report that i read in fsi sec
so in this report you just mentioned
that you kind of need that right mix of
automation and human intelligence to
really build a
very strong security controls right a
basic security program in place
right so as you can see they also
mentioned here that no cybers still need
human
right
and i think with my further um
explanation of it
tractors are also doing that combination
tractors are not just relying on their
you know ai to basically attack
environments here
but they use it to open the door
but they are using humans to do what you
call hands-on keyboard living out the
lan attacks here
so you know kind of we need to do the
same to basically defend ourselves
so i've been talking about all those
concepts here so what is exactly what is
tread hunting
so i would say let's sum it up right
assume rich mindset
so trying to think is really different
it's not just about monitoring for
alerts
it's basically assuming that you've
already been breached
for example right you look at a report
and you understood oh okay this is new
attack so let's just use let's go back
in time and think of half name for
example
and you read the report about half name
what do you do
do you just say okay yeah i'm safe
no that's not how trending works
basically trending what we will do is we
look at the report and we look okay
these are the type of
things i notice obviously the research
talks about that half new activity does
i will go back and look at my
environment do i see such activities
happening
so basically that's the assumed rich
mindset
right i assume i'm rich i'm looking for
something suspicious based it could be
based on my own
ideas of what i would look out for like
for example uh suspicious logins during
our office hours
that's a that's a very simple one or
looking at this style track research
right from external track intelligence
and kind of like use that within my own
environment
and most importantly the most important
thing is it's not looking out for iocs
expansion early on iocs are really easy
to change today
right they are good indicators
but the thing here is they get still
really really quickly
so the main thing to look out for is
indicators of attack looking out for
that pattern of this particular campaign
so this picture here i think everyone's
seen this picture here right um of a
sock everyone assumes that's how it
looks like a room full of monitors and a
bunch of people staring at those
monitors
and everyone's solution back then was
let's all build a sock
and that's i'm not saying that's wrong
that's right right that's the right
approach that's the idea here we need
humans to look at all this information
however i think the it got blurred you
know
through the times
and a lot of people assume that to build
a sock what i need is to buy
the most expensive tools i can find
right they buy a really expensive same
essentially saw they are great they are
great tools
but again that's the main thing the key
word is they are tools
you need the team to be able to
understand what am i looking out for
right a sim cannot magically collect and
tell you i'm under attack the same is
just collecting data from different
points from could be your endpoint your
firewall your network devices or even
your login or system events from your
servers that's all the sim is doing it's
basically collecting all these really
quickly into a single place
and you know correlate all this
information together but it's also based
on the human tools look at all the
information and say is this suspicious
activity or is it just a one-off
right so that's
the main misconception i would like to
bring about that we need to change that
perception of what a stock should be
even today right everyone is evolving
the sock to include tread hunting right
not just about alert more interviewing
not just about what my tools are
bringing to me but
well adding on the capabilities of
hunting for threats proactively
so a survey by so force right has both
even proven this further that you guys
can see here we have did a survey across
different countries and we actually
asked them this question what are your
plans to incorporate human lecture hunts
so as you can see
majority
right
some already doing it which is fantastic
but many have plans to implement it
so i would like to use this diagram here
to actually explain that process
and i really love this diagram i've been
using this diagram for quite a couple of
years already
so as you can see here data right on the
top left just no empty white dots
that is basically what data is
right data is useful right everyone says
that which is true
but if you don't convert the data to
information
you don't connect the dots to turn it
into knowledge
right and then you do that foresight
kind of understand no that's where your
insight comes in
and then you convert you know and you
connect the dots and unsaid oh okay this
is what this data means
and that's your wisdom
and from then on you can come up with
the impact
i think this basically is a great way to
illustrate what i'm talking about here
so your same and saw probably are great
at collecting the data they probably can
help you do a bit of correlation give
you the information and the knowledge
there
but i think you really need your team
right your sock team your trade ending
team
to look at all this information and kind
of convert it into
you know usable effective impact
i bring up this
um table here and i think a lot of you
security folks here know of know this
that the miter attack framework right
everyone more or less knows about this
but why am i bringing this up here
so the thing here is a lot of the
security folks here they understand that
what the mighty framework is for
basically it helps you to tag right um
when i see this okay what sort of
id this belongs to and this falls under
for example the discovery stage of
attack
right and that's really useful
but the thing is
as the trending team
is also about
looking out at what i'm seeing in my
environment
and figuring out
this behavior
what id does it match up to in the miter
tech framework
why is that important
one is to help you to kind of like
streamline and understand is is this uh
what attack is happening here at what
stage of the attack is happening here
so why is this important because let's
say for example i discover
a particular behavior i mapped it to a
miter attack id and i seen that oh this
is in lateral movement
right
that the track hunting team shouldn't
stop there
because
identifying that is lateral movement
means that the this particular attack
has already gone through the stages from
initial access all the way down to
discovery
right
that's not right right if you if the
track hunting team is so focused on just
blocking
right since they have that's what they
discovered i'm trying to block the
lateral movement they are not going to
stop the tractor here
because the tractor has already got a
foothold in your environment they
already have the initial access
right they already have the discovery
and all and so on and so forth
so as a trending team it's really
important to identify
what are the hints from what i've
discovered today i trying to link it
back upwards
because end of the day it's more
important to block attack at the earlier
stage of the attack
right
basically whatever is earlier is
basically covering up your security gaps
for example right
the attack could have not
come from this particular machine
this particular machine could be doing
the lateral movement
but for all you know after deeper
investigation you discover that
that machine got
infected through a server that was not
patched and that's the
initial access
so
you handling just on that machine it's
not going to help you much because the
tractor has access to that server and
they'll probably use server to do other
forms of attacks
so so that's the importance of
understanding the miter attack framework
so as mentioned earlier right about the
window exposure
the track hunter team needs to be really
aware of this
right it's not about when
the of the vendor releases the patch
right
your investigation should begin from the
day you patch
back
backwards all the way to
when was the
most likely possible first date of
exploitation
right because
that's your window exposure
and yours your child entity needs to
understand this and look out for any
hints
or any suspicious activities that happen
within this window
and and see if they are connected back
to that particular exploit
if they do
then they need to basically remove all
persistence that the tractors already
injected into the environment
so another thing about you know the
skill sets so all we here we're talking
about is basically skill sets that are
required
right the skill another skill set that
is really useful for any
stock team it's basically an individual
or a team
which is even better to basically do
what i call attack analysis right
understanding how
this payload behaves for example right
so again i'm not talking about hashes or
ips i'm talking about the behaviors does
this payload you know how what does it
do does it try to change the system
registries does it try to
use powershell from that point onwards
all these type of behaviors
those are basically expertise that are
required
even more even better if the team is
able to decipher malware payloads right
see how the script is running what is
this script trying to do right we have
seen many trackers try to hide their
code using base 64. right so
does your team know like when i look at
this i need to maybe use everything from
7-zip to decrypt it followed by a base64
decryption which actually happens
that's a that's the basic skill set and
experience that's required
using all those information of course
you generate know all your usual iocs
which are useful for current trade
hunting
but the most important thing is using
all those information
right converting them into the mitech
framework which basically helps you to
see the tractor groups
ttps their tactics techniques and
procedures
so basically this is where i i talked
about previously about being familiar
the miter tech framework the ability to
map it back
right and use this information to your
benefit
so the tracking hunting group should be
able to do this looking at this i'm able
to tell at what stage of the attack am i
looking at today am i missing anything
right so it could be two ways either
your team is able to map this on your
own and of course
check with
you know
public available research articles or
the other way around so take for example
you collected this research article from
so forth labs right so as you can see
here we have mapped the quantity group
ttps through this might attack framework
and use this information to hunt within
your environment do i see these
behaviors within my environment
if they do then i can assume that we
have been hit by contiguous
and every stage
so that's the type of expertise
that we need within a sock team
so
basically that's how i like to sum it up
right
we need a very mature
chat hunting model within our security
program
right
and i hope this this conversation here
really helps everyone be aware of this
and i hope that everyone know will
basically evolve their security
programs to not just say oh let's buy
the best tools
those are great moves
but i think the another part of
investment is
finding
people right or team
or maybe even an outsourced service to
basically help you out with that
right because we also understand it's
really difficult to know to to hire
know like really really experienced
people
so
coming back to this question here
what's the hunting maturity of your own
sock
is it at hmm0
no where everyone is just relying on
what the sim brings in
right
or is it hmm4 where your team is really
very experienced
that they are using the sims as tools
not as the main alerting systems right
they are using them as tools to
say okay let's look out for this
information now let's look out for this
particular
track behavior right now within our
environment to see if we are under
attack from this particular campaign
so let's let's go back to that and ask
ourselves this and there no create a
more effective cyber security program
for our own environments
so
thank you so much
and i hope this
session has been um you know
eventful
and useful for everyone
and yeah thank you so much
take care