Incident Detection and Response Wade Woolwine Mike Scutt

Agenda Introductions Threat Types Attack Lifecycle (Targeted Threats) IDR Program Best Practices Threat Scenarios Q/A

Threat Types Commodity Disruptive Targeted Cryptolocker, virus, bot, etc Disruptive DDoS, Social Media Hijacking, Web Defacement, etc Targeted Organized Crime, Nation State, Hacktivism, etc

IDR Program Best Practices Business Goals and Priorities Asset and Inventory Management Attack Surface Management Threat Detection Threat Validation and Investigation Breach Containment Cleanup and Mitigation Constant Improvements

Spearphishing 91% 72% 78% Breaches begin with a spearphish - 2014 PhishMe Still the preferred method of infiltration Effective in almost 100% of cases It’s evolving More relevance to target IT problems scare people, attackers know that Attackers perform targeted recon 72% Of observed phishing emails sent on weekdays - 2015 M-Trends 78% Of observed phishing emails are IT related - 2015 M-Trends

Spearphish Attack Lifecycle Malware Backdoor Dropper Link Attachment Email The email Technology: relies on threat intelligence Awareness: it works! The dropper Technology: sandbox, AV, whitelisting, proxy Patching: no exploit == no dropper The malware Technology: sandbox, AV, whitelisting, behavior analysis, network IDS/IPS

Exploit and Abuse 35% 73% 89% Breaches begin with a web compromise - 2014 DBIR VPN and other Remote Access Technology Single factor VPN, Virtualized environment Traditional Exploits Exploitable vulnerabilities on internet facing assets Web Based Exploits Webserver, web application, backing databases 73% Of vulnerabilities in 2014 are remote exploitable - 2014 Secunia 89% EHR applications use single factor authentication - 2014 Duo Security

Internet Facing Vulnerability Exploit Lifecycle Lateral Movement Deploy Backdoor Local System Access Exploit Internet Facing Vulnerability The vulnerability Vulnerability scanning and patch management The Exploit Sandbox The backdoor sandbox, AV, whitelisting Lateral movement Behavior analysis, proper network segmentation

Reconnaissance

Active Directory Enumeration DSQuery.exe – query for objects in AD

Active Directory Enumeration DSGet.exe – get object details from AD

Active Directory Enumeration GPResult.exe – view Group Policy Objects for computers and users

Local/Remote Network Drive Enumeration Net.exe view \\COMPUTERNAME View network shares on a remote computer Net.exe view /DOMAIN View network shares on a domain Net.exe share View local network shares

More Discovery Find.exe Network scans SMB scans PSTools find [/v] [/c] [/n] [/i] "string" [[Drive:][Path]FileName[...]] Passwords IP addresses PII Network scans SMB scans PSTools

Lateral Movement

Pass the Hash PSExec / Metasploit

Pass the Hash WCE.exe – Windows Credentials Editor

NTDS.dit Offline Cracking NTDS.dit is a full backup of the AD database, including passwords Use VSSAdmin.exe to create a volume shadow copy Copy NTDS.dit file from the volume shadow copy Exfil offline and use your favorite hash cracking tools

Scheduled Tasks At.exe Schtasks.exe Schedule running code on remote hosts

PSExec Run arbitrary programs on a remote system Other PSTools: PSFile PSInfo PSList PSKill PSLoggedOn PSLogList PSService

Other Techniques Backdoors – deploy backdoors on all systems of interest with remote shell capabilities Proxies – to move around segregated networks with ACLs in place Keyloggers – capture credentials typed by the user Authentication Hooking – hook the Windows authentication and grab hashes/passwords WMI – the sky is the limit!

Mission Target

Staging RAR.exe Zip.exe MakeCab.exe Can encrypt data Can create small parts to reassemble later Not always present on systems Zip.exe Can encrypt Always present on systems MakeCab.exe .CAB files blend in well with Windows

Maintain Presence

Maintain Presence Webshells Remote access (VPN, etc) Backdoors Web based full function backdoors hidden in legitimate applications Remote access (VPN, etc) Reuse compromised credentials to maintain access through legitimate remote access technologies Backdoors Attackers log in to perform maintenance tasks on backdoors and dump additional credentials.

Q/A Thank you!