now I feel good
it's like Chekhov's gun
which is one of the best archer gets of
all time
I was gonna make the actual thing
against the check on Scott check naka
morning one minute warning
they are correct okay okay how do you
get that soon is there so a lot of
people have the hallway I'll just throw
a lot out there oh you were so you're
pushing okay thank you
okay guys we're going to go ahead and
get started hope you had a good lunch I
think we're going to kick off a pretty
exciting afternoon I'm excited for the
rest of the talks I've been excited for
all of the talks but I think we have a
good good closeout for the day just one
thing to mention after Scott and Kyle's
presentation here we're going to have
the vs solution sessions with eyesight
and tinium and then webroot the rooms
are accurate as far as what's in the
guide so pick which one you want to
attend and go to those rooms so without
further ado take a gentleman alright
welcome back from lunch hopefully you're
not too asleep even go to too much of a
coma before we get started want to make
sure that we understand a little bit of
who we're talking to so for those of you
who feel like you identify for us coming
from more of an Intel type of background
raise your hand just whatever that means
to you alright if you feel like you come
from an infosec or incident response or
a UNIX neckbeard background okay so it's
about evenly split would you say that's
yeah okay good Intel heavy little Intel
heavy but you know we're DC what's gonna
happen you know okay so what we're going
to talk about today is is really kind of
focused between both ways between both
groups as where I was here last year and
really kind of spoke more to my fellow
you know infosec into their response
types about the intel analysis process
and this year it's a little bit more
balance between the two i think so so
we'll introduce ourselves a little bit
you know I'm Kyle Maxwell I am a
sysadmin who got pulled into responding
to incidents who now suddenly find
myself doing threat Intel and so forth
at I defense I'm Scott Roberts I work
for a little t-shirt and sticker company
called github we do a little good
hosting on the side as well and I do
Incident Response threat intelligence
dig into whatever maliciousness there is
so twitter is kind of the new tender for
bromances
so Scott and I met on Twitter somehow I
really don't remember how and we became
good friends that years and years ago
and we've been looking for an
opportunity to you know work together
and do stuff together ever since and
today is kind of the opportunity with
that said our good friend Alex Pinto
presented yesterday and he probably
beats us in wanted t of animated gifts
but he also had a hashtag for his talk
and so we have a hashtag for our talk so
we need to beat him and the number of
tweets using our hashtag so if you're on
the twitter i'm at kyle maxwell he's at
s Roberts please feel free to tweet
throughout the talk with the Yolo threat
hashtag which of course means you ought
to look out right um with that said also
please don't feel the need to hold your
questions until the end you can if you
want to but generally speaking you know
please feel free to be interactive
dynamic ask us the questions we will
almost never say hold that if you know
if it's going to be answered on the next
slide we might but generally speaking
you know we like to engage with it right
then mostly because you'll forget or
will forget the question and the moment
will go by with that said I'll hand it
over to my bro here Scott let him go so
I'm for all of you who raised your hands
that you come out of the intelligence
community i'm super jealous by the way i
wanted to be a spy growing up i watch
way too much james bond as a kid and so
when this whole threat intelligence
thing became a big deal i thought all
good it's my chance to be a computer
nerd and a spy at the same time which
thankfully most people i know believe
which is great so i ended up doing a lot
of you know introduction to intelligent
stuff and this is an intelligence
centric conference so i thought i'd go
over a little bit of the basics so we
use a lot of words interchangeably that
shouldn't be data and intelligence or to
two big ones data is a piece of
information that you have that might be
relevant to something you're working on
intelligence is something that's gone
through the intelligence process does
everybody know the intelligence process
this thing which when you say
something's intelligence you're going
through this process correct but at some
point when it comes to operations you
need to find a way to mix these two
things together how do you combine
security operations the dfi our stuff
Kyle and I come from and intelligence
and what we found has really worked in
in the past is this this f3 EAD model so
is anybody familiar f3 ad some some
people can't say if you know about it
that's fine f3 ad actually came out I
don't want to get overly military in
person i'll appreciate that a forces
methodology for for kind of combining
intelligence and operations at the same
time which is what Kyle and I are really
about so fine fix and finish is the
operations portion identify something
bad you're going to go after hunt it
down and come to a conclusion and at the
same time you're conducting the
intelligence portion of it which is
exploit the intelligence you have
analyzed it to learn more and share it
with other people who are dealing with
the same problems and we're going to
kind of you know this this has been
talked about by a lot of people crowd
strikes done a lot of work with with
f380 so we're going to pose it in a
slightly different way so ours is all
about hunting and and the the talk is
the most dangerous game so we're going
to talk about targeting we're going to
talk about the hunt we're going to talk
about the kill not not to
euphemistically and then we're going to
talk about hunting stories so if you're
doing threat intelligence the first
question you really have to ask is how
are you targeting and for us this means
making a plan for collection you've got
to pick out who are the people that are
interesting to know more about who are
the groups and how do you define that
there are three big ways that I see you
have groups that choose their hunting
priorities based on actors based on
themselves as targets and based on the
technologies they have available which
kind of goes hand in hand the places you
get that information there's a number
and and one of the big ones that
everybody is dealing with right now is
feeds
who's consuming automated feeds actually
surprised how few hands that is feeds
have become kind of a de facto for a lot
of what is threat intelligence and
becomes a great place to start picking
who you're going to be looking for as
far as your hunt some kind of no-name
guy managed to make this point about
feeds and it doesn't necessarily have to
be that harsh but it does okay it does
if you're recalling but but feeds have a
lot of benefits but also have some
shortcomings which can be volume and
signal-to-noise ratio a lot of people
are talking right now about picking out
who to hunt based on honey pots I'm
going to keep doing this hand raising
thing by the way so enjoy who's running
honey pots right now for your for your
organization or personally okay there's
some great stuff you can get out of
honey pots but it's a really
differentiated issue we have what we
call low interaction honey pots you know
your listeners on hosts that are just
kind of taking in information passively
which are easy to get information but it
tends to be low value you know if you
have a low interaction honey pot and
you're literally researching every IP
address that tries to ssh scan you
christmas is coming and you're going to
be busy until then hi underage
interaction honey pots are also a little
bit more information centric but they
get really complicated as anybody tried
running a massive hi interaction honey
pot it gets dangerous very quickly and
it becomes tough to generate
high-quality or it becomes a good way to
generate high-quality intelligence but
it comes at a lot of risks there's some
great software out there for doing this
if it's something you're interested in
the honey net project and threat streams
modern honey network has been a really
cool project that's come out in the last
few months so that's actor centric if
you
to go to more of a target centric
approach you can base it on
vulnerability information but a lot of
people tend to take that a little bit
too far and while structured
vulnerability analysis is not threat
intelligence it is really important so
vendors also are publishing an
incredible amount of information about a
number of different you know
technologies actors things like that so
I know Kyle and I have worked a lot on
pulling information directly from some
of those sources parking I ox that sort
of thing parsing I ox this gets to one
of my little asides since I know there's
a lot of vendors in the audience please
stop making PDFs I can't cut copy and
paste out of and please put and please
stop putting IP addresses in like pngs
and graphic formats that I then have to
like literally manually type in this
this is this has caused me a lot of
effort and so you know those are some of
the lower lower fidelity ways that you
can start going who are the actors who
are the groups we need to be watching
out for but we've missed out on one of
the most important ones dad did I not
leave that up long enough come on give
it a minute in the end we think that by
far the most important way to generate
who are the people you should be who are
the threats you should be most concerned
with where is the place that your hunt
should begin is this idea of reviewing
your own incidents I know so many people
who've spent an incredible amount of
money on a big fancy shiny vendor
unnamed incident management system and
have never gone back and looked at any
of their past incidents after the fact
and that's just beyond unacceptable and
missing out on one of the best places to
start your hunting experience if you
want to know who's after you the people
that you know our app view is a good
place to start the guy chasing you might
be after you in fact
and more than that let's let's take that
a step further and maybe review the
incidents for other people who are in
your fear your vertical I wouldn't want
to name any names but if you have a
target on your back perhaps it's other
people in that that kind of vertical
should be looking at what those people
are dealing with that's too slow too too
subtle no I think that was not too so
okay good so with that said so once
you've determined what it is that you're
looking for and you still haven't found
what it is you're looking for now you
start thinking about how you're going to
do it well you start thinking first
about sources of technical information
what am I going to analyze as part of
what I'm doing well I always mentioned
because I like to say it my buddy David
Bianco who's now at squirrel talks about
the get ready for it the Pyramid of pain
right the Pyramid of pain is really a
simple concept which is that the easier
it is to gain some information that's
also the easiest information for the
actor to be able to change so the
easiest thing in the world to get our
hashes right those are everywhere it's
really easy for a threat after to change
their hash but it's a place to start
right here are some hashes or something
that we know is bad ok this is there are
it's something right what are some
sources for this stuff well virus share
of course virus total we're going to
mention them a few times today malware
com which is a great site that needs to
buy a vowel but it's real with the tech
and the front end is really great it's
from the guys who do cuckoo sandbox and
all of that once you have some
interesting malware perhaps somebody
share with you some hashes you go and
you can find a sample that matches that
hash right and you will say well what am
I going to do with this now it's much ok
you can go scan your enterprise for that
hash and that's not really going to be
that useful to you because somebody
flips one bit and half of the average of
the bits and the hash flip and you're
looking for my totally different but you
can get most of the value of
reversing from some really simple stuff
look you may not have somebody who can
spend 10 hours a day in ida pro and take
this stuff apart if you do great those
guys those folks are really sharp at it
but maybe all you want is some basic c2
information what does it call out to
maybe you get a little bit of developer
artifacts that are still in there
somebody you know didn't strip debug
symbols from their malware or you know
something equally a name okay I'll black
out they just leave comments in there
just plain text well court i saw that
kaspersky says you can attribute
everything based on that okay okay so I
was talking about a movie fair enough so
passive DNS is for me personally the if
there was only one tool i could use
passive DNS would be it pasadena is
really simple in content it is recording
the dns responses between servers that
you see for later use what resolve to
what at what time okay there are a
number of different places to get it
that have slightly different foci and
how they and how they do it dns DB from
Farsight you know they've got some folks
here they have a really extensive really
broad database from a bunch of different
organizations that contribute in DNS
data right and a long history of that
data so you can say show me all the
names that resolve to this IP and you're
going to get a pretty good sense of the
different names at different times that
ever resolved that IP or vice versa
passive total is more collaborative a
lot of researchers kind of shared data
they get different data feeds and
there's a you know some tagging and some
collaborations so for example i love
looking at address and find oh that's a
sinkhole that's why i'm seeing all this
stuff here and then virustotal of course
is going to be very malware focused so
every time they get a sample and they
run it through their behavioral analysis
and they do a dns resolution they record
that so then you go later on look up a
domain or an IP address and i say oh
that was associated and these days with
this these malware samples for example
super useful in many many ways when
you're in
skating infrastructure who is data um
the the good folks at domain totals
domaintools talked about this yesterday
a little bit it's really easy to get
current who is data it's tough to get
historical who is data which is what you
really want I can't tell you how many
actors have made you know we talked
yesterday about OPSEC fail at oops a
quick Brian Krebs right how many actors
originally registered their domain name
with their real name and address and
they're like oh crap i need to put on a
privacy guard well great but you know we
already can can go look that up those
sorts of things you also want to do
ongoing tracking okay i know these
actors like these tlds i want to track
it over time you can either keep doing
the lookups every day which is a pain or
you can use a tool like who dat or one
of those for doing your kind of ongoing
tracking okay so those are technical
indicators right what about actor
information well this varies a little
bit now when we talk about the type of
actors the type of adversaries that
we're talking about if you're talking
about criminals and in this particular
context hacktivists kind of falls under
the same rubric um honestly your best
weapon is Google and for those who don't
believe it go ask ross ulbricht right
now what he thinks about literally the
way he was found initially was a google
search ready to a domain name before a
certain date in other words it wasn't
just you know type in a search term add
a few operators and bam oh look here's
this guy with his real name starting up
this site what could that be tracking
social media you know Brian Krebs talk
yesterday again about this right all
these guys have their Twitter and
Facebook accounts and you can get a lot
of good information from that and
Facebook in particular I've had great
success with oh look this guy he's smart
enough not to use his real name but this
is his girlfriend and this is his mom
and this is his cousin across town now I
know a lot more about him and that
triangulates very quickly occasionally
you know over the years hear people talk
about tracking underground forums right
criminal forms
another area that krebs investigates
because this is the area where he's
tracking actors right those can be full
of really great information it also
takes a lot more work right to be able
to do this so I would never recommend
that somebody start here this is where
you get when you know the sorts of
actors that you're looking for you may
even know some specific folks that
you're looking for and then you can have
you know somebody or a vendor or what
have you focus on this stuff this is
high value but also a lot of work to
extract it it's kind of like you know
cracking open like lobster a crawfish
right the meat really tasty bits a lot
of work to get to that meat was really
wonder where you're going with that food
food you're the foodie that's logical
and with that said now Scott who thinks
that he's James Bond in a hoodie I hear
that's coming up in the next movie sweet
I'll tell that was the girl to dragon
tattoo anyway so my background more
comes out of the Espionage side of
things we're tracking actors
specifically can get a little bit more
complicated simply because they tend to
have a little bit better OPSEC so in our
case we find that most of your ability
to track an actor is based on you know
the malware you actually find and
reversing that the the things they do on
a system if you're lucky enough to get
you know command shell usage things like
that sometimes who is register our data
can give away some i believe the apt one
guys had made some mistakes early on
that but the most important thing from
from that perspective is really the
actions over target where I've been
tracking groups of bad guys from an
espionage side most effectively it's
more been who are they going after and
what are they trying to get to and kind
of correlating those actions over target
versus mistakes they make an ongoing
basis because those groups are more
likely to be deploying new pieces of
malware new exploits things like that
right so as you're dealing these
different sort of actors you kind of
have to in this sense ass in that
pyramid of pain right because you can't
because you're not going to track
sophisticated actors just via hashes you
need you need to track how they do what
they do what they're targeting you know
the things that really at the pinnacle
the stuff that's the hardest and may be
impossible in some cases for them to
change also is more work on our end as
defenders right to track that and with
that how do you keep tracking this
information okay this is great I've
pulled together some really useful
information it's all in PDFs and it's
all in my head and maybe if my in my
private get repositories or what have
you right um how do you track this okay
so threat libraries there are you know
some open source solutions right crits
from the fine folks at mitre right miss
P is another one that's a bit more
malware focused but you know kind of
exists in the same area it for some for
some shops lighter solutions like
literally wiki pages right with some
wiki templates Scott has that the
pathways right or go to for a long time
right and for some things that works
really well there are a lot of vendors
in this market some of them are here you
know there's some that are doing good
work and kind of iterating the space you
know threat connect us here you know
I've used their tool you know they're
doing some good work making good
progress there there are others that are
kind of starting to address this but
there's a lot of room for growth a lot
of group because nobody in our selves
included right even really understands
what we want yet much less how to build
that right and so it's you've got to
kind of figure that out if you're
tracking over time as well things on the
internet if anybody here has used scum
blur anybody has anybody heard of scum
blur has anybody heard of Netflix okay
so netflix prop to them yeah the one
that you know is that I watched my
chromecast every night released an open
source tool that they use its kind of if
you will a meta search engine so for
example I go set up a Google custom
search I set up several of them actually
I go give the API keys to my scum blur
instance and then I tell it I want you
to keep watching for these things over
example I have a Google custom search
for all the different pay sites i can
find and i look for certain keywords and
it shows up in my scrambler engine
recorded future that just spoke before
lunch right they do you know they're in
kind of a similar more or less area here
obvious it's a lot more
refined than all the extra work that you
would have to do in scum blur but
regardless you're going to have to do at
least some level of custom development
because you're you're focusing on
whatever the targeting is that we talked
about at the beginning whether that's
for your organization your technologies
for specific threat actors that you're
that you're hunting what have you as
well as how you want to integrate this
data into other things do you want to
use the hits you get off of a system
like this to block things directly to go
into a sim to go into log management to
just send it somebody an email right and
and that remind me of that you pointed
that out because this works alongside
another tool they have called sketchy
there's a bunch of different tools that
do it sketch is the one that works best
with scum blur but you can find others
and the idea is it takes screenshots of
websites automatically not that you have
to pull it up in your browser but you
feed this tool list of URLs and it comes
back and it says here the screenshots
this is great for example for evaluating
Possible's fishing lure sites right so
in that context it does a great job for
that if you're looking for malware virus
total is the King here they're not the
only player but they are the the biggest
and baddest and if you're not at least
including them you're missing so much
stuff there are a lot of other malware
feeds that you can go with custom
internal development there's open source
stuff you can do so mal tree of a tool
that I wrote that is basically a crawler
for finding malware edges to being
served today you can feed that into
cuckoo for some automated dynamic
analysis Viper from the same guy who
same folks who wrote cuckoo as sort of a
malware storage thing and then you may
have you know different sorts of
commercial things as well as you're
doing your hunting you don't just want
to hunt externally right so as as anti
jovica and I talked about a lot together
log management is important log analysis
it matters way more log management is to
make your auditors happy log analysis or
so you could do something with it right
so you want to go look in your firewall
logs your IDs logs your proxy logs for
stuff related to what you're hunting but
don't just think about those things
right your perimeter network devices are
important
but think about your web server logs
your mail server logs yeah they're a
pain to read send mail logs but you send
mails a pain in a lot of ways in on its
own of DNS logs oh my gosh imported
right authentication and audit so for
example anybody ever worked on a case
where it may be you can't region and I
understand where owa logs were super
useful if you haven't you should go look
at your owa logs because I guarantee
there's something in there right now for
your number whether that VPN VPN logs
anything that's remote access right um
with that said the whole goal of this is
to get to doing the gathering
information is great and it's fun and it
might even be a hobby as you sit at home
at night because you don't want to rate
a world of warcraft anymore you just
like hunting this stuff so the whole
goal is to get the internet response
what do we mean by that right the whole
idea is no I don't just mean reaction
right there's also because we're talking
now about actively hunting down
adversaries and not waiting for somebody
to call you and say um I see a strange
screenshot on all my desktops everywhere
can you come look at it yeah right you
want to see Brian Krebs up here on
speaking not writing an article about
your organization right so the first
thing it could get confusing because
sometimes as you find stuff you don't
want to let them know that you know that
they know that you know that it starts
to feel like from the princess bride but
the other idea is that it's sometimes
it's better to kind of spend some time
and gather some more information to
assess the full extent of what you're
looking for right the full extent of
what they've done now the question
always comes up yeah but who was it I
don't mean was it you know hurricane
panda or whoever right would you know
legitimately you want to have some level
of understanding of who but was it this
specific in do you know what is the guys
name where does he or she live probably
the specific who doesn't matter unless
you could be this right if you can
actually go after the actual individual
with you know handguns and
cars and Ronald Reagan driving our so
it's the license plate Liberty that you
probably can't read that's what's
particularly great to me yeah so Ronald
Reagan in in a muscle car with the
handgun through the windshield not
looking back at the explosions it's
great as Scott likes to say this is this
should be attributed to Scott instead of
to me is unless you can use handcuffs or
cruise missiles on somebody it probably
doesn't matter their specific name and
location but fair yeah yeah as we said
sometimes it's better to spend some time
just watching for a while and getting
some information the reason that some
level of intra beauty is that you can
say okay once we believe that this is
linked to this particular threat group
what else do we know about them all we
know that they also do this sort of
activity and we know that they also use
this infrastructure well now I have more
stuff to go look for whereas before if
you had cut it off immediately before
you understood anything about them you
haven't really accomplished anything
because now they're just going to kind
of you know hide a little bit a little
bit more yes Bertha
Scott you wanna take that sure I mean
the question was where does attribution
fit in with what a group is after in in
my experience I mean groups have our our
very few groups are just compromising a
network just to get a foothold and call
it a day there are groups obviously that
do that but it's rare in most cases
there's an objective and you may have
four or five different groups attacking
your organization all with wildly
different objectives and so in in many
cases we can see a new piece of malware
deployed in the environment something
we've never seen before a new fishing
lure new everything and then we see them
try to access the same person that we
saw three campaigns ago and at that
point you start to be able to identify
changes in TTP's when they don't end up
changing their goals and so that becomes
just one one aspect of attribution and
that too and to kyles I'm going to make
you do it the Pyramid of pain they're a
bit of a uh it turns out that if a
groups interested in stealing widget
plans they can't suddenly decide to
change their malware change their
exploits and change the fact they're
after widget plans that that's just the
toughest thing of the pyramid of pain to
change for any actor and once you do
some level okay we believe it's these
actors you have an interesting of the
sorts of things they might do and what
you need to prepare for the sorts of
kids who are typically doing DDoS
attacks for example may make a bunch of
fish but they're frequently usually
don't have the capabilities to say drill
into your credit card database for
example or what have you if the Syrian
electronic army gets into your twitter
account versus panda whoever they're
going to have two wildly different goals
as to what they want to do with that
level of access so to that point right
we talked about Intel driven response is
so traditionally writing infoset we
think about deny pull the plug on the
hack server you know add a firewall rule
take the server offline reformat it
reinstall and put it back on and never
understand what really happened that is
certainly one way to do things but you
may want to think about other things
to do sir eventually you want to do a
denial right eventually you do need to
kick them out and safeguard your
infrastructure before you may do things
like feed them fake data and see what
happens this so not just an i deceived a
grade disrupt and eventually well you
can't I can't you can't why not but are
you the military should know are you the
intelligence community definitely then
you really can't do that okay fair
enough so what I can do hopefully is
where it's appropriate where it makes
sense work with law enforcement for
example and let them follow their their
process and you know if they can go give
somebody a shiny new pair of handcuffs
we deserve it and finding a pair of
silver bracelets great but you can in
the meantime you can certainly try to
deceive then there's nothing that says
hey I see this connection i see this
account logging in i'm going to feed
them some fake dated written direct them
to some you know to a honey pot or other
fake infrastructure try to if anybody
remember his years ago the tool called
park it right that was just supposed to
just slow down their connections and
make them you know i will ferrell says
the best way you can get to know
somebody is to see how they react at a
slow internet connection and i really
want to see that when it's my adversary
who's like why is this taking so long
and eventually of course you know
disrupt which is you know in similar but
not identical to deny right the idea
being that you're trying to you know
find ways to interfere somehow with
their operation someone's ftp doubt 36
of 37 RAR files and you cut off the last
one mid transfer or you give them a zip
bum that it's a you know 100k file that
expands to four terabytes let sir those
are great interesting ideas I don't know
that I would ever seen anybody do that
it doesn't destroy any anybody right
doesn't even to show their
infrastructure it may you know fill up a
hard drive the point the point with not
talking about destroy is whenever you
talk about active response the first
thing everyone wants to jump to is hack
back and the fact is that's not really a
legitimate answer for most organizations
and the few that it is a legitimate or
you know option for already know about
it
they're probably doing it already and
they're not they're not taking advice
from the other publisher okay the other
thing that you can do is communicate
with other folks right who can make use
of this enforce you got to ask yourself
who else needs to know about this right
so for example you know there's a lot of
folks probably hear from financial
services financial institutions right
you never see banks call each other out
publicly about security right well you
should come to that bank got robbed the
bank across town got robbed yesterday
you'd be much safer take it all your
money out of that ax coming to us right
because they have a vested and
legitimate interest in the public
trusting in the system right believe
that okay overall banks are overall
secure so in general financial
institutions share threat information
because they might be competing on you
know interest rates and for underwriting
the new IP or whatever but they're not
compete in terms in these sense um also
who might be able to provide additional
information to me right so it might be a
whole different organization might even
be a competitor right it may be an
organization that I have no relationship
with but I know that they're they're
involved they don't even know they're
involved yet but hey if I can work with
them then maybe we can share some some
logs or whatnot so so all that gets into
this idea of hunting stories which is
how do you talk about these compromises
you identify these actors you identify
an all that and and discuss them after
the fact and so the the two big
breakdowns are the idea of products and
the next one will get to his audience
and so that the big products will talk
about our IOC's and rfis short term
products and then long-form products and
before you even get into that the next
thing you got to consider is your
audience if you've ever written about an
incident you've had written about a
threat actor you have to treat things
completely differently whether you're
talking to other members of your
security team peers who might understand
what you're dealing with inside your
organization I think this is a really
underserved topic in our community of if
you have a breach what do you say to the
people inside your own organization
because when you don't give them a
message
tend to make one up on their own and
that might not be what you're looking
for so one of the first ones is IOC's
and this has become a really important
thing and it's a really hard problem how
do you describe these wildly generalize
large large issues in a formulaic way
that you can share between multiple
people programmatically god I'm just I
just can't that like I think that that's
all and the two big products for talking
about iocs right now in a generalized
way are obviously sticks and open IRC I
like both these projects I like what
they're trying to accomplish I know
they're both moving forward in good ways
but as a friend of mine put it the XML
issue is kind of hard to deal with and I
know that this is a doubt of the weeds
but it's you know there yeah Jarrah the
sticks team I know specifically is
working to improve a lot of this up but
but the one of the tough things is
whenever we get to talk about this we
just start getting frustrated you go I
can't really stand the XML thing or
anything else something else about it
bothers you and and the one thing I'll
say is then we all start talking about
we should just write our own we could
totally do a better job it would be
great I'm gonna go start a new repo on
github and the right that's all I mean a
repo is all right so that being said we
support I'd at least personally support
the products that are out there and want
to see them improve because they are one
of the best ways to share this
information that can be used in multiple
sources from a more specialized level
everybody writes snort cigs and
basically everything reads snort cigs
and from a network perspective it's
become a really great way to share this
information Yara's kind of a newer up
comer on the specifically on the malware
space but has started to add all kinds
of things I think Moloch will let you
use it for network flows yeah oh I got
you on that one you did I did not know
that I know that volatility now supports
it for memory objects things like that
and your is great because it gets you to
use my company which is even better well
it doesn't have to well get pulls so
then you've got you know those are your
ways of formatting this information
you're going to be sending along the the
easiest way to pass this information
other people is this idea of an RFI so
your boss comes to you and says hey I
heard about this new group are they a
problem for us the RFI is a short you
know couple sentence response that that
answers that email your q3 stock analyst
says what do we know about this specific
you know set of domains let's find out
some information about it but yeah and
these are things that should be short
and turned around fairly quickly for
most people what they'll eventually
start working on is longer form short
form products which are you know call it
a page a couple paragraphs discussing
information to support an incident
response and the intelligence you've
generated through there and your blog
post maybe a blog post for very few but
but not nonetheless really important are
the longer form products these are going
to be multiple pages encompassing all
different types of intelligence as
anybody not at a vendor generating these
on a regular basis not edit on oh we
should talk later I'd be curious about
that um these are hard these take a lot
of effort that they can be really useful
especially at a strategic level and so
we promise to cipro well we've talked
about doing a little bit of a surprise
and the fact is you only live once you
only live once Kyle and I have been
working on something for a while and
we've talked about it a lot and decided
this seems like the best place to
release what we've been working on and
so I always like to say you can't
download a threat intelligence till now
welcome we're starting a company called
yellow threat you can go to our domain
yes it is a domain that 80 is real we're
just coming out of start up I'm sorry
okay so apparently we're actually out of
money so we're going to be going back to
our original jobs but uh we have
released some stuff on yellow threat a
collection of docker images that will
basically stand up a number of open
source tools that are really useful for
an up-and-coming threat intelligence
team getting started so we're going
there there are some we've created the
darker fires us ourselves right Moll
trees combine the other tool that Alex
talked about yesterday that we released
last year of some we wrote a docker file
and found somebody else had a better
docker file and we said well what
instead we focus on being kind of docker
librarians about a lot more mature
longshoreman there are the docker
containers you know the container ship I
don't okay that didn't work okay the
idea of being like okay somebody has
done a really fantastic job of putting
together an elk doctor for elasticsearch
well what is it less elastic search log
stash Cabana that that thing a thug for
example from which is a kind of a honey
client for web requests right is there
is a great tool has tremendous
dependency problems well you know what
let me back up for a second how many
people here know what docker is wow
that's way more hands-on I was expecting
for the for the other 75% that don't
write docker is I'm going to
overgeneralize here and this applies
mother was like no no that's not
accurate it's close it's a little bit
more than a package think like a you
know like a Deb or rpm or msi file a
little bit less than a full vm okay um
and so you have this container that has
just the the information it needs to run
an app and runs inside a container
within dr. in particular is fairly linux
specific there are other similar tools
if you're a freebsd person you know
freebsd jails solaris zones it's the
same kind of thing this is just linux
pacific so all you do really is you do a
docker pull
a name like you know a Remnick / viper
and then you run it and it's done all
the stuff where your thug has so many
difficult dependencies and special
patches to apply that Lennie's else are
you know announced on a recent sands
webinar that he was releasing some of
this stuff which was great because I was
like oh man half the stuff I had started
I could just like RM desh RF but we use
it Lenny's instead so thanks man so
these are essential useful recipes for
getting these sometimes hard to get up
and running pieces of software up and
running really really fast so if your
boss comes in on Thursday and says hey
we really should have a threat
intelligence capability by Monday this
might be a great place to start so to to
kind of summarize it did you have
something else to say Yolo Yolo to
summarize you know we talked about how
to identify the targets you're most
interested in some different processes
for working through gathering
information about them and kind of
starting your incident response cycle
intelligence specific incident response
and then how to talk about things after
the fact and you know we bombed a
company you know everybody has got to
have that one right it's like your
starter startup right well if you hadn't
had that caramel macchiato this morning
we wouldn't have used up our five dollar
starbucks gift card from Drake any
additional questions i love questions
feel free to say you know i think you're
wrong about this yes sir speak up i
repeat the question
so this is gets to the a fuse to use the
term for the long special forces acronym
a 23 e80 that one so it's two mil speak
for me I'm a neckbeard so you have these
two parallel tracks right and they feed
back and forth right so it shouldn't be
you have a cycle and then you hand
information off the internet responder
and then they come back with questions
right they should run in parallel so as
the as the the hunter the Intel analyst
says you will that for the first one you
know is aware of something to look for
and tells the its response or hey go
look for this in the environment and
they have a collaborative process that's
going forward as they do the initial
hunting they the Intel analyst is
finding more external information or
more sorts of things to look at the
instant responder is you know she's
going off in and you know imaging
systems or you know gripping through
logs or what have you right how you
split up between those two is going to
be a little bit org dependent right so
if you have an organization that is
large and mature enough to actually have
an internal threat Intel team right that
threat until team might actually coexist
with an incident response team and
they're going to have one way of doing
it you might have an organization that
has an external sock and that external
sock has a third-party third thread and
tell vendor that X as their kind of tier
4 to your three analysts for them and
they're going to have a different one
right because the fact the organization
here may only have one I our person and
that I our person is also the firewall
admin and ven admin and all those things
right so typically speaking the way I
would think of it myself is that the
incident responder and somebody you may
or may not agree the entrant responder
is the person that is most responsible
for dealing with the infrastructure in
an organization
right the actual assets the you know
she's got the access to the system so
the logs to the network devices what
have you whereas the Intel analyst you
know hopefully doesn't have direct
access to those things and is instead
working with you know external feeds or
just other data sources and trying to
you know correlate that to what else is
known about this that how you would
approach it yeah I mean I think what
I've seen be most effective is teams
that are co-locating threat Intel and I
are in in the same place whether that be
fusion fusion al who had fusion in
buzzword bingo I I think i think that
where you can Co locate those things so
I mean if you've been in a sock
environment it's not unusual for
somebody to be on a console and go does
anybody know anything about and should
just say an IP address and it's so much
more valuable if not only are other sock
people with the same access looking at
that but people with completely
different access from an intelligence
side are responding in the same way and
so co-locating those two skills might be
a single dfi our analyst who also has a
strong intelligence mindset and it might
also be a too specialized teams
coexisting in the same area what what I
think we're really just trying to get to
you in this whole presentation is CTI by
itself doesn't affect anything it
generates reports and I are without the
intelligence to back it up can't respond
to today's threats just waits for screen
for bed screenshots fun yeah so so it's
really more about co-locating those two
things in whatever way makes most sense
for your organization actually this is a
selfish question so yarra on flow it's M
olo ch yes Moloch is a like full packet
capture indexing in it so let's say that
you capture all the packets on your
outside pipes right and you want to
index that and be able to search that
any time because you're doing full
network monitoring you know that whole
network security monitoring mindset
Moloch is an open source tool to do that
and a parent
yarra can write tool orchid jharokon so
yar is effectively a tool like snort but
has historically been host focused you
say okay look for files I have these
binary strings there and match these
different conditions and you have some
indoors and those sorts of thing are you
can do some boolean logic within it
Moloch is a whole separate tool it's
actually believe it or not from AOL you
know occasionally they do one thing
right no sorry I have my best friend for
the rest of my life with all those cds
and my best friend got laid off mayor
well last week so i'm still hurting for
him so anyway um the the idea being that
you know these are you know just two
different tools yarra itself is a kind
of an open-source way to write AV
signatures if you will one of the ways
that it's useful by the way is if you
have the subscription to virustotal the
for pay the virus total intelligence or
whatever you you can actually feed them
yarra signatures and they'll alert you
on any new sample that matches that Yara
cig and then you can go download the
sample and and and whatever and say okay
I have a yaris egg for example let's say
that has a mic um you know any email
that has my company's domain in it right
okay you're going to end up having to
refine that I guarantee especially if
you work for a company that does
internet standards but the idea being
that then you can have a yaris igg2 then
go look for those things and now let me
go see you know what's happening that is
related to that any other question let's
see one more question if we've got one
it's a great opportunity don't lose out
going once going twice Yolo good job
alright thanks thank you guys a lot
we're going to break out for the
solution soap solutions showcase and
that'll be the next hour then we have
another network break and then we'll
come back for a one-two punch with
Lockheed guys and gal guy and gal for
some really good stuff that are thinking
we'll get a lot of benefit