© 2016 You Have Alerts. Now What? Brian Carrier VP of Digital Forensics Basis Technology 1

Who Am I? Been involved with security for over 15 years. Used to be a Incident Response consultant. Been leading the forensics team at Basis Technology for the past 10 years. Written popular open source forensics tools. Written digital forensics books. © Basis Technology,

A Typical Security Team Day Alerts are being generated from SIEMS, intrusion detection systems, and smart firewalls. Some alerts are ignored. Some alerts get basic analysis. The team does not have: Enough resources Administrator access to all endpoints Forensics expertise © Basis Technology,

Alerts Are Not Being Investigated Only the basics techniques are used. Anti-Virus logs are reviewed Single AV provider may not be seeing it. Only network traffic is reviewed Bad activity could be encrypted or hidden in other traffic. A request is sent to the remote non-security IT staff Insufficient training or tools. © Basis Technology,

The Network is Not Fully Understood If the alerts are not understood, the network is not understood. The same alert could have many causes. Scenario: You get an alert about traffic to a command and control server from an IP address in your network. What do you do? © Basis Technology,

Possible Cause #1 A user opened an attachment. Attachment installed malware on laptop. Malware reached out to C&C server. No alert was triggered – server not in threat intel yet. Malware uploaded the following: Password hashes File names Network mounts, etc. © Basis Technology,

Possible Cause #1 (contd.) Bad guy logs into system. Moves laterally into other systems to look for important data. Malware checks in again with C&C server. IDS now triggers because of threat intel updates. © Basis Technology,

8

This Alert Is The Tip of The Iceberg. Several other endpoints are involved. © Basis Technology,

Possible Cause #2 A user opened an attachment. Attachment installed malware on laptop. Malware monitors for PayPal, credit card, and other website credentials. Malware periodically reaches out to C&C server. Your IDS triggers. © Basis Technology,

© Basis Technology,

This Alert Is The Tip of Ice Cube No other hosts involved. Not targeted at you. © Basis Technology,

Possible Cause #3 A server has been compromised and is hosting malware. Your user visits a website on this server Doesn’t download malware though. Your IDS triggers. It’s a false positive. © Basis Technology,

What Would You Do? What would your company do with the C & C alert: Ignore it because of false positives in the past? Check the anti-virus logs to make sure it didn’t quarantine anything? Collect data from endpoint? Capture network traffic to and from endpoint? Unplug endpoint from the network? …. © Basis Technology,

What You Should Do Respond quickly and thoroughly: Don’t waste time on the false positives Don’t be hasty and miss the icebergs Use a triage process to get quick answers to: Is the host compromised? Have we seen something like this before? What other hosts or resources could be involved? Initially assume the worst: Much like a police officer who pulls a car over. © Basis Technology,

Did They Pull Him Over? © Basis Technology,

Her? © Basis Technology,

Or Her? © Basis Technology,

Typical Triage Process Details vary based on your tools. Lots of variations, such as: Run 12+ command line tools and manually review. Write PowerShell scripts and manually review. Remotely connect and manually use forensics tools. Use automated intrusion triage tools. Use Endpoint Detection and Response (EDR) tools (if they are deployed). © Basis Technology,

Triage Requirements Relatively Fast: Not measured in hours. Flexible: Works in your environment. Easy to Use: Does not require a forensics expert. Thorough: Looks for evidence in all of the places. © Basis Technology,

Triage: Relatively Fast Not measured in hours (or seconds) Don’t want to: Waste too much time on false positives. Skip steps and miss the evidence. Fine balance. Automate as much as possible so that user doesn’t have to wait. Minimize user interaction time. © Basis Technology,

Triage: Flexible Needs to work with your environment. Not all companies are the same: Does your responder have admin access to each endpoint? Do you have persistent agents / EDR always deployed? Do you have a policy to unplug computers from network? Find a solution that works for your needs. © Basis Technology,

Triage: Easy to Use Does not require a forensics expert. Different people need to triage: IT personnel Security team SOC Help desk Triage may not be done every day. Automation and intuitive interfaces are critical. © Basis Technology,

Triage: Thorough Look for evidence in all of the places. Types of data to collect: Malware: Places of persistence Running processes User Activity: Programs they ran, shares mounted, files deleted, etc. Event logs System Configuration © Basis Technology,

Thorough Data Analysis Analysis is where triage gets hard. Bad guys hide their tracks and tools. Attacks evolve and locations of evidence change. Every computer is used differently. © Basis Technology,

Data Analysis: Known Bad Evidence from previous incidents: Indicators of Compromise (IOC) Known malware Threat intelligence feeds Looking for: File names and MD5 hashes Registry keys Signatures © Basis Technology,

Data Analysis: Typically Bad Heuristics often associated with bad guys: Startup programs running from “C:\Temp” “cmd.exe” process with Adobe Reader as parent process. These require knowledge of past incidents. Global knowledge, not just your network. A little more false positive prone. © Basis Technology,

Data Analysis: Suspicious Lastly, look for the stuff that is not normal: Is the computer configured correctly? Is this user behavior normal for their job and technical abilities? Is this computer being accessed as expected? This is where triage gets really hard… Requires knowledge from the company, fellow responders, and global trends. Easy to miss things and generate false positives. © Basis Technology,

Example: Network Shares A computer has the following shares mounted: \\BostonCommons\schematics \\BostonCommons\finance \\FenwayPark\home\jdoe \\FenwayPark\home\frank Are these bad? © Basis Technology,

Example: Network Shares A computer has the following shares mounted: \\BostonCommons\schematics \\BostonCommons\finance \\FenwayPark\home\jdoe \\FenwayPark\home\frank Are these bad? It depends. Is (s)he in engineering, finance, or IT? Is (s)he jdoe, frank, or a different user? Do the share names mean anything? © Basis Technology,

Automation is Critical Necessary for speed, thoroughness, and ease of use. If you are manually reviewing 12+ text files and merging them together, will you miss things? Do you remember what happened on this system 2 months ago to know how it changed? Do you remember all of the threat intelligence to know what should be suspicious? Do you know what is normal on your endpoints? Automated systems can store this info. © Basis Technology,

Alert Triage Process Alert comes about suspicious network activity Run your automated triage process to determine: List of threats (known bad, typically bad, suspicious). List of remote hosts accessed by the host. List of network shares accessed by the host. Ideas about if you have seen this before Review the results and make decisions: Evidence of lateral movement. Files seen elsewhere in network? © Basis Technology,

Example: Cyber Triage Cyber Triage is our endpoint triage tool. Let’s review how it implements the requirements. Relatively Fast: 60 minutes or less for collection and analysis. Collection and analysis and automated and do not need user interaction. © Basis Technology,

Cyber Triage: Flexible Collection is done with a single executable. Does not need to be installed on system. If you have admin access: Push agent over network. If don’t have admin access: Send agent to someone who does. Double click to run. If system is unplugged from network, use USB. Also supports forensic images. © Basis Technology,

Cyber Triage: Easy to Use Simple, one-click collection. Intuitive interfaces. Fuse data to make it as easy as possible for user to come to conclusions. © Basis Technology,

Cyber Triage: Thorough Collection contains: Processes, ports, users. Startup programs, drivers, services Programs user ran Event logs and registry Suspicious files Analysis results are shown in the interface. © Basis Technology,

© Basis Technology,

© Basis Technology, Scans executables using 40+ malware engines from OPSWAT ®

© Basis Technology, Finds known bads using black lists, IOCS, & hash databases.

© Basis Technology, Identifies suspicious items using heuristics.

Guided Review Every host is used differently. Need human assistance to review: Network connections Network shares Remote desktop connections User accounts Cyber Triage fuses data to make data easier to review. © Basis Technology,

© Basis Technology,

© Basis Technology, Identify suspicious network activity by connection type.

© Basis Technology, Obtain context by correlating with previous collections.

Group Related Hosts Incident-level © Basis Technology,

Summary Understanding alerts is key to understanding your network. You need to treat each alert seriously. Automation makes this possible. Have a triage plan and set of tools to help you determine the basic scope and severity. © Basis Technology,

Contact Info Brian Carrier © Basis Technology,