Cyber Threat Intelligence. Is it for me?

Readers!

I have been working as a Cyber Threat intelligence area from quite a long time and today I want to talk about a question that I often get asked.

Do we need Cyber Threat Intelligence?

With this article I will try to answer as much as I can based on my personal experience.

Firstly, one must understand Cyber Threat intelligence and how it can help your organisation. But before we venture into Cyber world we must know Intelligence has always been there before Cyber was even a word. Simply, put Intelligence is ability to acquire certain knowledge and skills and apply where applicable or where they fit. However, as we know Intelligence is a very broad and there can be multiple answers to the question, how can we select one single answer?

Article from Martin T. Bimfort evaluates multiple definitions and perceptions of the person who is defining Intelligence in there own context with the knowledge and skills they have gathered in there field.

SANS CTI course generalized the definition as following:

Intelligence is the collecting and processing of information about a competitive entity and its agents, needed by an organisation or group for its security and well-being.

So, meaning of Intelligence for military individual and a chess player can be completely different and they both be right. However, is it possible they can have same goal? Yes. We all want to win!

Who are we are trying to win against? Enemies, nation state attackers, rival organisations or someone sitting next to you. Let’s call them Threats – internal or external. So does this threat existed before Cyber? Of course they did. However, the threats themselves were limited with their knowledge and skills compared to now.

From the start of the world, there has been war, where Intelligence helped to prepare against enemies. However, this was mostly HUMINT – Human Intelligence, where one of your trusted individual would go around enemy states and give the information back. We didn’t had emails so Falcon, dove were used to transfer messages. Than came ciphers to hide actual messages, morse code etc. From then to now we have seen tremendous uptick on tools and technologies that aids us in defending against these threats. Main point still remains, our threats have same tools and technologies. As time went by, Cyber Intelligence came into existence and now everybody wants to do it.

Note: Intelligence is a field of expertise and not everybody can do it. Steer away from those who claims, we provide Cyber intelligence or Threat intelligence services and just sharing IP addresses and sending email notification without context.

So coming back to the main point what should organisations consider if and when they require Cyber Threat intelligence services and what it actually is.

For me main reason to have a Cyber Threat intelligence program is that it provides actionable outcome or information that helps any organisation to understand their security posture, how to deal with current threats, fills any security gaps and assist in reducing over all risk. For any organisation that is planning to get into Cyber Threat Intelligence following are my prerequisites:

  1. Have a management agreement|vision|understanding in why they want the Cyber Threat intelligence program.
  2. Make sure its not a checkbox that needs to be ticked because of a compliance or insurance or its just cool to have it.
  3. Understand current Risk model of your organisation and works towards a strategy that aligns to your risk model.
  4. Understand Intelligence have different categories and they all require equal attention. Will discuss more in coming articles.
    1. Operational
    2. Tactical
    3. Strategic
  5. Hire expertise – being blunt, companies do tend to transfer or promote internal staff who lacks knowledge and experience in cyber intelligence including adversaries tools and techniques and believe it will yield positive results but actually steers the team to never ending ocean.

Organisations may have more or less prerequisites, however I have seen some organisation will just implement a program without considering any of the above points.

Consider following DONT’S:

  1. Do not believe that Cyber Threat intelligence is achievable by getting a platform or a service. It will help but they are just to supplement an established Threat intelligence program and assist in finding missing pieces.
  2. PowerPoint presentation IS NOT EQUAL TO expertise in Cyber Threat Intelligence. There are lot of vendors now jumping in Cyber Threat intelligence that believes a nice platform with indicators going to SIEM is the intelligence. They are just pretenders and one should stay away from them.
  3. Peer pressure : Do not think that your peer has Cyber threat intelligence program|vendor|platform, we should have that as well. Many organisations have done that mistake by just following what peers do or are doing, but forget the most important part to understand their own organisation requirements, threats etc. This leaves them starting their journey with somebody else’s goal.

Once we understand our prerequisites and what is required we take a step further and understand what and Cyber Intelligence program should do. I have created my own Pyramid of Cyber Threat Intelligence and hope it can help others.

So how I read this. The bottom tip of the pyramid is where Intelligence provides actionable information which can be one or more shown under the line.

Screen Shot 2018-08-13 at 8.59.38 am

Threats are known to the organisation via social media, vendor posts and direct notification and/or news articles. Information gathering starts from there and multiple phases that are shown in the pyramid.  Assessing and analysing available data and identifying actionable information and disseminating the same to the relevant teams within organisation to prepare our defenses against the identified threat is an output of Intelligence.

I also use the Pyramid to set my priorities. Closer to the intelligence section higher the priority it is. Organisations can take similar approach but may have different pieces that makes the pyramid. Remember the pieces should align to your organisation Risk model and/or managements vision for what Cyber Intelligence team are supposed to do.

So answer to the question do I need Cyber Intelligence program is YES. Following points summarises my ideology that organisation may want to follow when you want to start with the program:

  1. Gather requirements from your management and understand their vision of the Intelligence program.
  2. Understand current Risk model of your organisation.
  3. Identify key people in your team with expertise|experience in Cyber Threat Intelligence and if not available consider hiring them.
  4. Once requirements are set, plan to put the requirements into action. This involves creating processes. Processes should be created keeping your audiences in mind. Audiences are the people who will receive this actionable information.
  5. Identify current tools and technologies already in place that aids the team in providing the information.
  6. If provided tools are not able to assist Intelligence team in their tasks look for alternatives. Alternatives firstly should be in-house development or an open source tools. However, these alternatives although has no direct cost involved, one must understand there is an indirect cost involved such as maintenance, hiring expertise to build the tool and managing the tool etc.
  7. Collect evidence for what is working and what is not. The evidence can help the team to prepare case to the management if there is any chance of asking more finance if/when required.
  8. If the team is decided to get external help identify which gaps are you trying to fill. The evidence collected will help us in the stage.
  9. For identifying vendors:
    1. Convert the gaps into use cases.
    2. Identify vendors
      1. Check with your peers
      2. Do a bit of research of known vendors with expertise in your line of business
      3. Look up there external presence such as public articles, intelligence reports, known work with law enforcement etc
  10. Once identified give them the use case and see the outcome and verify whether it is actually filling your gaps.
  11. If yes take it to the management
  12. Cross Fingers ūüôā

Before finishing DO NOT consider following vendor types :

  1. Vendors with no public presence or any evidence of helping community.
  2. Consultancy firms who just talks about in social media and conferences with no actual work in intelligence.
  3. Vendors who are not in expert and does multiple things and thinks adding Cyber Intelligence service on the brochure is the way to go.

I would still like to name few vendors that one should check out. This is purely based on my personal experience and their assistance to community.

  1. GroupIB
  2. Flashpoint
  3. Recorded Future

Also, wanted to thanks Robert M. Lee, instructor in SANS for Cyber Intelligence course.

Final words:

Intelligence should assist in making decision to assist organisation in improving its security  posture. Intelligence starts with your logs so make sure you listen to them what they have to say. Intelligence should sit in the middle of all other teams and can assist at every stage within organisation so transparency and sharing of information helps.

I hope the article is useful. Thoughts and feedback are welcome.

Gathering Information about targets

Part II

Once the target is identified/determined attackers begin their tasks. Now we must understand, to launch an attack or gather information, they will rely on the available tools and capabilities that they have.

As per my previous post targets are also determined based on the tools that they can buy or create based on their intent, motives and capabilities. Most of the time their motive is financial gain. Below are few tools that are available to sophisticated attackers and script kiddies as well:

  • Kali Linux comes with plethora of tools starting from gathering information to launch attacks.
  • AutoSploit
  • MetaSploit
  • PowerSploit
  • Exploit builders – Available on multiple marketplaces – these are usually for sale/rent.
  • XXXXX-as-a-service – Malware, ransomware, crypto and others. These services are either for sale or rent. Customized services are also available based on requests such as banking injects.
  • Services like BlackTDS – BlackTDS is a multitenant TDS tool that has been advertising its services on underground markets since the end of December 2017. Proofpoint article.
  • Underground forums/marketplaces where the mentioned or other services and/or tools are advertised.
  • Cracked vendor tools
  • Tools/Project available on Github.

Few underground marketplaces :

  • exploit.in
  • antichat.ru
  • cop.su
  • zloy.bz
  • hackersoft.ru
  • darkweb.ws

Why this is important to know? As a target (any organisation or individual users) one should know about the tools that can be used against that. Monitoring such tools and understanding them can assist to prepare against whats coming.

More about information gathering can be found on my previous blog entry : https://fl0x2208.com/2015/11/28/information-gathering-then-now-and-why/

Consider a scenario of phishing users to get the credentials. Now understand when these credentials are collected they are mostly sold on marketplaces.

  1. Motive : Financial Gain
  2. Targets : To phish a user they need to contact them. Its mostly done via their email address or phone.
  3. Getting Emails/phone numbers : Again, this goes back to marketplaces where people sell dumps containing emails and phone numbers from other site. These hacks are mostly done to get vouches and recognition on the underground marketplaces. Other way to get emails/phone numbers are scanning social media sites and other publicly available.
  4. Tools : Bought a phishing kit or created phishing kit. There are document templates and pages available that these actors can use for phishing.
  5. Phishing hosting or compromise a site : Tools mentioned about such as blackTDS, VPS service providers etc helps to host the phishing site. If not attackers looks for vulnerable public sites and host their phishing pages. To compromise they use tools available in Kali for example.
  6. Actions : Mostly the credentials are stored on a database via POST information to php or they are sent to an email address. These credentials are then either used or sold on underground marketplaces.

The cycle continues with number 1 for same scenario or different.

What can we do to stop this?

This can’t be stopped. However, we can make it harder for the phishers or not fall for the phishing by educating ourselves. Being pro-active and notifying phishing attempt to authorities or the organisation that has been phished can also help to take down the phishing site as early as possible.

Following are some links showing some phishing examples:

 

Profiling the adversary : Target Determination

Readers!

As mentioned on my recent LinkedIn update, this is the first blog article in this series about what our adversaries do and from their objectives/actions how a target can learn.

Executives or higher management asks mostly following questions :

  • What is current threat landscape ?
  • How do we protect our organisation ?
  • What is targeting us ?
  • What are our current cyber security risks ?
  • Are we getting return on investment from the the products we have ?

Mostly the executive summary is trying to answer these questions – sometimes other. We always looks for the answers to these questions from our vendors, internal teams etc. However, are we asking right questions ? How about,

  • Why are they targeting us ?
  • What kind of information they are after ? Why ?
  • What kind of data/information they are leveraging ?

To answer these questions we need a combination, to profile what adversaries are doing and what we know about our own organisation.

Based on my experience, I have noticed that there are very few documentation or approaches out there with regards to what Targets (organisations not individual users) should be doing before and after any adversary targets and attacks them. Normally, vendors or organisations follow a framework or a model that is out there.

Lockheed Martin’s Cyber Kill Chain is a good model to understand attackers actions¬† and understanding their objectives and how an organisation as a victim can defend themselves. However, in my hypotheses before targeting an individual or an organisation or a nation, one must first determine the target. This determination is based on INTENT, MOTIVE and CAPABILITY of an attacker/adversary.

Mission of the blog is to understand what steps does attackers/adversaries take, profile them based on the steps taken and as a target what we are suppose to do. Seems like we perform reconnaissance ourselves. Many organisations put this under Reconnaissance phase (Information Gathering), which is wrong. Consider you are traveling :

  • Target : I have 4 days of holidays I will go to place A.
  • Reconnaissance : How do i get there, means of transportation, which hotel to stay in etc

You can see clear differences between the two.

At the end of series, the goal will be to profile attackers, their objectives and what tools, techniques and procedures they use and how we can defend ourselves or at least be pro-active in our incident response. Of what I have mentioned, likely is known globally but, still hoping to spread the word. Later, will also try to match with Diamond model which is very useful in understanding an Attacker and their capabilities.

Every attacker/adversary has an INTENT and MOTIVE to perform an attack or target an entity and for a successful attack their capabilities are also important. From highly sophisticated to script kiddies they have certain objectives. However, intent and motives are majorly used in law and justice field and not on threat report. At-least the reports that I have seen does not mention it. In my opinion, the fields is not only when we have to go to court, but we can also use it to understand our adversaries and  prepare ourselves.

This being said, for me the first phase should be Target Determination or Determining a target, that fits attackers/adversaries objectives. Recently, MITRE has updated the TTP matrix with Pre-ATTACK. The matrix provides the ability to prevent an attack before the adversary has a chance to get in.

We can distribute attackers/adversaries into two groups :

  1. Insiders – Disgruntled employees,
  2. Outsiders – Ex-Employees, Nation State attackers, cyber criminals, script kiddies, hacktivists etc.

Few motivations/intentions :

  1. Financial gain
  2. Fame or generate vouches – Require to gain trust of underground or group of hackers
  3. Intellectual challenges
  4. Damage or disrupt services
  5. Cyber espionage
  6. Personal grievances.
  7. Political motivation
  8. Terrorism

Intentions are sometimes hard to prove, but mostly our adversaries will have malicious intentions.

Only after deciding a Target, they will perform Reconnaissance or Target Profiling. Now, where the attackers/adversaries look is depending on the target or what motivates them. Target can be a single entity or an organisation or a nation/country that accomplishes their intentions/motivations.

Single entity as a target – Individuals are mostly targeted for their personal data. Their personal data such as credentials of their email address, online banking, medical data etc. These information are normally sold on forums and/or marketplaces. Other example is targeting individuals with high positions in corporate places or an institution.

Organisation as a target  An attacker have varied intentions in targeting organisation. Damaging reputation, personal grudge, financial gain or sometimes part of conspiracy and/or nation state attacks.

Nation/Country as a target – This is mostly politically motivated and intentions are mostly malicious towards harming the nation or a country and its infrastructure. Disrupting day to day services that affects human life is also an intent. Recent example – NotPetya malware attack to Ukraine. Here, attackers/adversaries understood their target and profiled them and launched the attack.

In all cases, the better an attacker/adversary profiles their target the better the attack will be.

For individual users, beside security awareness, being careful is the key here. The information that they share or provide can be used to target them. During a presentation I came up with the following tagline.

“Charity begins at home and intelligence begins with your logs”

So attackers/adversaries spend days, weeks or months to collect information about their target, as an organisation for example, you already have this information but,  not using to gain tactical advantage over our adversaries. So what should a targets do ?

  1. Take time to understand your organisation. Understand what information do you have floating on the network and sitting on the systems.
  2. Should know type of information available publicly and understand the risk and how it can be used by an attacker and type of attacks that can leverage these information.
  3. One must take this into consideration that attackers will use available tools to assist them. Mostly these tools are available or sold in underground marketplaces. Being aware of the tools is good way to start. These tools are their weapons and we must know how an enemy weapons work to defend against them. For every poison there is an antidote.
  4. Further action on any successful breaches and data exfilteration beside incident response and BAU activities. If email address were seen on pastebin don’t just change credentials but also understand that these email addresses will be used for phishing or spoofing. Ideal is to change email address and convert the breached one into honeypot email addresses. This will help understand type of attackers targeting your organisation. If not feasible have a mechanism to monitor those email address and profile the incoming spam if any.
  5. Brand monitoring and domain registration – Organisation should be monitoring their brand mentions and/or any domain registration that can be used for phishing or a fraud or to launch attacks.
  6. Phishing is wildly used to lure users and entry points of malware. Organisations should also have a team looking for phishing sites and pro-actively perform takedowns.
  7. It is also ideal to share information of any attacks or compromise within peer industry to understand the possible exposure of an organisation.
  8. Understand your service providers and contractors as they can be a exploited to launch the attack.

Following points are few examples of what kind of information gets out or available that aids an attacker in launching the attack:

  1. It is important to know how your security controls are responding to inbound attacks. The information that they send back (for example a reconnaissance attempt) can also be used to map the network or understand type of device that is stopping adversaries. For example inbound scan blocked by firewall and responding with ICMP network unreachable message.
  2. Websites such as Google and Shodan can be used to collect lot of information about a target and therefore should be monitored. Especially accidental upload by internal employees. Eg – Employee uploading an excel sheet with organisation data on VT, just to make sure there is no malware. Pro-actively monitoring this can assist us to contact respective parties to take the data offline before entities with malicious intent get there hands on.

A Threat Intelligence and/or Hunting team must have this kind of approach. Organisations where there is budget limitation, can also engage their security operations or security service providers to perform these actions on their behalf. Frequency depends on organisations capability to invest in resources.

With this I will end part 1.

Yet another WanaCry Ransomware – Analysis

Recently, organizations are being targeted with new ransomware labelled as WanaCry.

Being curious, I downloaded the sample to understand how the malware actually behaved. The tests were performed on VM connected to internet and NOT connected to the internet. In both tests, machine was successfully infected.

Sample analysed : 84c82835a5d21bbcf75a61706d8ab549

As seen in the screenshot the executable is “Wana Decryptor 2.0”.

Following screenshot shows the process tree.

Screen Shot 2017-05-17 at 3.03.50 pm

In the screenshot above, the malware creates taskhsvc.exe which contains TOR data and the CnC server addresses :

  • 57g7spgrzlojinas.onion
  • gx7ekbenv2riucmf.onion

Looked at the dump file for @WanaDecryptor@.exe and identified same domains with additional .onion sites

  • xxlvbrloxvriy2c5.onion
  • 76jdd2ir2embyv47.onion
  • cwwnhwhlz52maqm7.onion

Malware using .onion domains for CnC communications is a technique to stay resilient.

The sample, in my opinion, is a packer/installer that unpacks files shown in below screenshot and also creates @WanaDecrypto@.exe that continuously runs as a process. It is worth noting the folder “msg” and “TaskData” were created when VM was infected connected to internet connection. I will explain each file in the later section.

Executable when connected to internet creates two additional folder
called “msg” and “TaskData”.

Below are MD5 of the files that were in the “TaskData” Folder.

MD5 (./TaskData/Tor/libeay32.dll) = 6ed47014c3bb259874d673fb3eaedc85
MD5 (./TaskData/Tor/libevent-2-0-5.dll) = 90f50a285efa5dd9c7fddce786bdef25
MD5 (./TaskData/Tor/libevent_core-2-0-5.dll) =
e5df3824f2fcad0c75fd601fcf37ee70
MD5 (./TaskData/Tor/libevent_extra-2-0-5.dll) =
6d6602388ab232ca9e8633462e683739
MD5 (./TaskData/Tor/libgcc_s_sjlj-1.dll) = 73d4823075762ee2837950726baa2af9
MD5 (./TaskData/Tor/libssp-0.dll) = 78581e243e2b41b17452da8d0b5b2a48
MD5 (./TaskData/Tor/ssleay32.dll) = a12c2040f6fddd34e7acb42f18dd6bdc
MD5 (./TaskData/Tor/taskhsvc.exe) = fe7eb54691ad6e6af77f8a9a0b6de26d
MD5 (./TaskData/Tor/tor.exe) = fe7eb54691ad6e6af77f8a9a0b6de26d
MD5 (./TaskData/Tor/zlib1.dll) = fb072e9f69afdb57179f59b512f828a4

Folder “msg” contains language packs which also gets encrypted and gets
extension “.wnry”.

Below are the files that were created :

  1. @Please_Read_Me@
  2. @WanaDecryptor@.exe
  3. 00000000.res
  4. c.wnry – contains links to .onion sites and tor browser
  5. f.wnry – List of random files that are encrypted
  6. u.wnry – @WanaDecryptor@.exe decrypter file
  7. b.wnry – bitmap file containing decryption details
  8. r.wnry – some more information about decryption and instructions for the decryption tool
  9. s.wnry – Tor zip file
  10. t.wnry – encryption format instructions
  11. 00000000.eky – Infected machines private RSA key
  12. 00000000.pky – Microsoft public key – RSA 2048
  13. 00000000.res ‚ÄĒ Data for C2 communication
  14. taskdl.exe – file deletion tool
  15. taskse.exe – enumerates RDP connection and executes malware – TOR process runs underneath
  16. msg – language packs. See screenshot below.

  17. TaskData – TOR browser executable and other files. See screenshot below.

When the malware got executed it queried following domains :

– tor.relay.wardsback.org
– tor.ybti.net
– javadl-esd-secure.oracle.com
– belegost.csail.mit.edu
– tor1.mdfnet.se
– zebra620.server4you.de
– maatuska.471.se

System also communicated to 212.47.241.21 which resolves to sa1.sblo.ch. Ran the malware again and this time it went to different domains :

– tor.dizum.com
– tor1e1.digitale-gessellschaft.ch
– lon.anondroid.com

This could likely be due to malware using TOR. Analysed TOR process and saw multiple IP addresses hard-coded. Here you can find all the directory servers used by TOR.

Extensions that are getting encrypted :

Screen Shot 2017-06-11 at 1.10.12 am

Extract from PE Explorer :

Screen Shot 2017-06-11 at 12.58.42 pm

Extract from Sysmon can be found sysmon logs.

WannaCry Fact Sheet – Here.

Kill-chain Phases – Here.

Final Words :

  1. The malware was not delivered via phishing, but rather via EternalBlue Exploit, taking non-traditional way of infecting systems.
  2. No obfuscation was done – meaning when you open the executable you can see the functions.
  3. Exploit such as EthernalBlue, suggests that getting access to vulnerable systems with user interaction is available. The only we detected this was attacker actually use EternalBlue exploit for financial gain – WannaCry ransomware – however, others can just gain access to the system and perform other tasks. Motive, based on evidence, is financial gain.
  4. Although, patching of systems would have definitely helped, however, we must understand the exploit was only used after dump by Shadow Brokers. Although, the intention of the group would be to expose NSA and its tools, the exploit was used for financial gain. So, may be intention to expose NSA may have been for good, it just did more damage.
  5. Number of articles says that creator of malware made mistakes and they just earned 55 K. However, one must understand all those money are paid ransomware and one must also understand the affects/impact of the malware attack. Although, we cannot quantify the time spent to patch the systems, re-image infected systems, people not being in production globally, it is not small. Although, some analysis suggests that attackers were not sophisticated, but it worked.
  6. Can host based security controls would have helped? Controls such as Application whitelisting, no admin rights to logged in users, use of AppLocker in Windows may have helped in reducing the impact. However, how feasible is to apply this in a corporate environment ?

 

PowerShell : Tool for Admins and Adversaries

Readers!

From last couple of weeks I have been doing some analysing of malware. Mostly, are via phishing attempts. What our adversaries are doing is to first gain easy access to the machine via phishing and creating background processes that calls the compromised domains that downloads the executable, packed with malicious payload. Below is basic timeline of a phishing email with attachment.

timeline

The technique is neither new or unique, however if we are to come up with a trend we can see that most of them have similar tools and procedures.One such tool is PowerShell. The blog is not about what PowerShell is, but how our adversaries are using the tool that was just created to automate admin tasks within Windows environment. As automation is was one of the key points PowerShell was given scripting. The scripting allows to automate admin tasks such as configuration management etc. Here I go explaining what PowerShell is.

Microsoft definitely didn’t intended the tool to be security aware, and therefore till this date one can use PowerShell to perform malicious activities. However, certain controls or functionality within PowerShell can assist us in controlling type of scripts that can run on the systems.

There are indeed multiple security controls that we will discuss later in the blog but first let’s see what our adversaries are doing. I will not be going in specific analysis of a malware as I am trying to reach out to the teams which are responsible to detect/prevent these type of attacks by placing feasible and actionable security controls with regards to PowerShell.

Below is a sample PowerShell command seen in most cases :

ps-command

Frequently used parameters :

  1. ExecutionPolicy bypass – Execution policies ¬†in ¬†PowerShell determines whether a script can run and what type of scripts can run and also sets default policy. Microsoft added a Flag called ‘bypass’, which when used bypasses any currently assigned execution policy and runs the script without any warnings. There are 4 types of Execution policies:
    1. Restricted
    2. Unrestricted
    3. AllSigned
    4. RemoteSigned
  2. windowstyle hidden – This parameter is used when PowerShell script requires to be run in background without the users knowledge.
  3. noprofile – PowerShell profile are set profile or commands (it is actually a PowerShell script), normally for current user and host. Setting -noprofile will just launch any script and will not look for profiles.
  4. DownloadFile – For downloading the file via web

Tools, Technique and Procedures:

  1. The attachments as shown in the first screenshot, are mostly Word/Excel doc with Macros or zip files with JavaScripts.
  2. The Macros or JS are heavily obfuscated and sometimes lightly. For heavily deobfuscated scripts I rely on dynamic analysis(the best way to know what malware is written for). Some scripts, due to practice, I can deobfuscate within minutes.
  3. PowerShell command to download the file are mostly on sites with HTTP rather on HTTPS (there are some sophisticated adversaries created/compromised HTTPS websites). Sometimes, also have noticed use of cmd.exe /c being used which will invoke specified command and terminates it.
  4. File on the compromised domain are mostly windows executables with ‘.exe’ or sometimes the extension is hidden. This depends on the adversary and the packers that they have used. Sometimes, you can unpack the ‘exe’ via 7zip.
  5. Based on the commands the file will be first downloaded and executed. In certain cases I have seen the file gets deleted after execution. Again, it depends on the command.
  6. Most malwares that I have analysed were either ransomware or trying to steal information and sometimes combination of both.

Above TTPs are very simple to understand however, implementing security controls, lets say for each steps to detect and prevent, is much harder. We as a team or individual are working towards reducing the impact of the incident. Consider the phases of cyber kill-chain and perform an analysis of incidents within your team, and understand at which phase you are able to catch the adversary and can you do that earlier?

Observables such as IP addresses, domains, URLs and file hashes with context are the IOCs that normally we look for and use it for detection and prevention. Some people call that Threat Intelligence. Darwin would have gone here Seriously?

download

Security controls such as Endpoint solutions, Proxy, IDPS and FW can help us but they are heavily dependent on what they know and history has shown us that they can be bypassed. However, they are indeed very good controls to either reduce the impact and/or preventing the known attacks or IOCs.

What we need is security controls based on TTPs. So let’s see some of the following controls that can be implemented to either detect and/or prevent such attacks :

  1. DO NOT give admin privileges to the local account. If required based on their role give have a Admin pass generator with User Access Control (UAC) enabled, that will prompt to enter password for Administrator every time a system change such as installing a program, running an Admin task etc is created.
  2. Group policies to have certain tasks especially script execution and writing to registry and windows directory only allowed by Administrator. Can use Administrative Templates.
  3. Group policy to not allow any executables in TEMP directory to be saved/executed.
  4. Sign all PowerShell script. If not possible or the team not willing to sign at restriction placed via above mentioned points can assist.
  5. Can also set the Execution Policy to Restricted, PowerShell can only be used interactively to run the script. Organisation who are not pushing any policies via PowerShell can choose this option.
  6. Application whitelisting – Windows AppLocker. The tools can assist to define what level of access a user can have on the system with regards to executables, scripts and DLLs.
  7. Having AppLocker in Allow Mode can assist the team with a rule that only scripts at trusted location can run on the system. A attacker can re-write the rule provided, he/she has access on the system with Admin privileges.
  8. PowerShell Language Mode РAdmin can setup the language modes to Constrained Language Mode that permits all Windows cmdlets and all Windows PowerShell language elements, but it limits permitted types. It has list of types that are allowed within a PowerShell script. For example, New-Object type cmdlet can only be used with allowed types which does not contain system.net.webclient.
  9. Logging of PowerShell is also important. Here, in my opinion Sysmon is a must have. The logs can be forwarded to SIEM for correlation. If Sysmon is not feasible, enabling PowerShell Module logging is highly recommended. Enhanced logging is always recommended and will  write another blog on that.
  10. Organisation proxy to be configured properly to detect/prevent web request invoked via PowerShell. Have tested with command Invoke-request that can show WindowsPowerShell within User-Agent. However, no User-Agent string is noted when above mentioned to DownloadFile is used. May be Proxies can be configured to disallow any traffic without User-Agent – still have to verify whether such functionality exists. If not a SIEM rule can be used to alert on web traffic that has no User-Agent string, going to external sites and downloading files.

Please note, that AppLocker and Powershell constrained mode are not security feature but another layer of defense which can help to reduce the impact of the attack and in some cases completely prevent the execution of foreign scripts.

When making a business case to the board or C-Level executives to make any changes in the organisation the presenter should use language they understand. As part of the evidence it highly recommended to show actually incidents where current security controls failed which impacted the productivity of the user, loss of data and hours spent to recover and restore systems. They want to know how any new mentioned or suggested changes will help in reducing impact to the user or business.

If there are other methods that other organisations are using please let me know.

A good read – PowerShell for Blue Team

 

Finding Evidence of Data Exfil – USBStor artefacts

Readers!

Last year one of the member on SANS DFIR posted a question with regards to identifying whether there was any data leakage occurred in the environment via a USB thumb drive. As for the evidence investigator had USBStor artefacts. Shell bag analysis(TZ Works sbag) showed a large number of files touched (reg-UTC) within a very short time period and a few with the MRU (Most recently used list) flag set with different times.

This blog is a concise article of the tips provided by myself and other members. Provided tips assisted the investigator to support the theory of data leakage.

  1. Evaluating USB dates as a group.  If any number of artefacts is detected with the same exact time stamp, investigate it further. Having such artefacts indicates that they were somehow modified. It is also, worth the effort to carve the data for deleted registry files and look for relevant keys there.
  2. Normal users will/may access the files again after copying to any removable media to make sure the files were copied correctly and are not corrupted. This operation leaves shell items in the form of shell bags and link (.lnk) files. One can use Windows Time Rule to for evidence of file copy. Using the time rule examine the link files with target data pointing to files on removable media (tz works ‚Äėlp‚Äô is excellent for this). If the modified date of the target file data in the link file precedes the created date of the target file data in the link file, then this is an indication that the file was opened from the removable media, after the file was copied to the removable media. This means that even without access to the removable media, you can state that files were copied to the removable media and then they were opened from the removable media. The created date of the target data in the link file is when the file was copied to the removable media. One can state that the files were copied, but cannot state where the file was copied from, as that is not tracked.
  3. Now to determine when the file was opened from the removable media, look at the times of the link file itself. The created date of the link files will be the first time the file was opened and the modified date of the link file will be last time the file was opened. To discover the removable media, locate the volume serial number of the removable media’s file system which will be stored in the link file’s data. Correlate the volume serial number to the data from your USB drive analysis and you will get the manufacturers unique serial number for that removable media. Find that unique serial number across your enterprise and you will discover other machines where that drive was connected to. Correlate the link file target data to the shell bag data and you should be able to get a neat timeline of what happened on the system.
  4. Memory analysis of the system can assist. If the files were copied it should have data on the clipboard. Drag and drop will not likely have any artefacts.
  5. Registry hives Р one can use FTK registry viewer for ease. Usbstor have last written values Рdates when the last device was accessed or connected.
  6. Look at the recent files in Windows section. Although if one is not able to open the file it may show which file from which volume – it may not prove that file was copied however if the document name is ‘organisationconfidential‘ than you can argue what was the file doing on USB? The link files should also contain volume serial that one can match/compare with removable media serials.
  7. Registry restore points can also be used to check last written dates.
  8. Look at the MFT records – they have sourceMFT and destinationMFT.

Tools mentioned : SBE – Shellbag Explorer and MFTparser

Links mentioned :

https://files.sans.org/summit/Digital_Forensics_and_Incident_Response_Summit_2015/PDFs/PlumbingtheDepthsShellBagsEricZimmerman.pdf

 

Hash Values – A Trivial Artefact

Readers!

Merry Christmas and Happy new year to all. The days of holiday spam and vendor predictions are here.

Here I am spending summer afternoon watching TV and writing on my blog. As I am bit lazy during holidays I am posting something simple. The post is about HASH values and how trivial they are in identifying malicious files/programs.

You can read about Hash here.

Hash values are important to first verify the files. Think of it as a signature or footprint. As living beings has a signature or footprint that we can recognise them from, similarly files  have something called digital footprint that we can identify them from.

Take example of HashCalculator. Following screenshot shows different hash values of HashCalc.exe.

hashcalc

As you can see HashCalc provides lot of information (digital footprint) of its own. With regards to security the hashes are normally used to verify the file as mentioned earlier. Let’s look at the output in brief for commonly used hash values :

  • MD5 – Based on Message Digest algorithm. Normally represent as 32 hexadecimal digits. Vulnerable to collision attacks. Read further here.
  • SHA-1 – Secure Hash Algorithm 1. Represented as 40 digit hexadecimal digits. Generates 160 bits message digest. Vulnerable to collision attacks. No longer in use and has been replaced by SHA-2 and SHA-3. Read further here.
  • SHA-256 – Secure Hash Algorithm 2. Represented as 64 digit hexadecimal digits. Generates six digests –¬†SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256. Read further here.

Now, why the blog entry. The information is available on google and Wikipedia. Reason for the blog is Hash values are considered trivial/important in Threat Intelligence and/or cyber security world. Lots of OSINT, vendor intelligence systems share hash values of known malware dropper. This could be an executable, MS office document, Adobe document, image files etc.

Following are few scenarios where Hash values can assist :

  • Hash values can assist in identifying whether the file/program that we have is legitimate or not.
  • Lot of malware analysis blogs will always provide Hash value of identified file/program.
  • The Hash value is also used by Endpoint solutions to detect known malicious files/programs.
  • During Incident Response, one can also use Hash values in YARA rules to detect any malicious files/programs.
  • Organisations can have a list of program with the Hash values of known good ¬†and authorised programs in their organisation, which than can be used to identify any unwanted programs¬†on the system, either via endpoint for real time detection and/or during incident resposne. Benchmarking/Baselining is a complicated process and sometimes not feasible in large organisations.

NIST provides list of known good hash values of legitimate programs, that one can use to compare good vs bad. Read here.

Hash values are just another indicator that gives more targeted detection of malicious files/programs. IP address and URLs are dynamic, not 100% reliable and have low confidence level as a Threat Indicator and therefore Hash values is considered important artefact in Security world.

Happy Holidays!