1. Defeat Tomorrow’s Threats Today

2. Problems Evolving threat landscape
Traditional security detection easy to defeat
Lack of enterprise incident response tools

3. Physical Memory Forensics
Endpoint Automation
Digital DNA
(Behavioral Analysis)
Code
Reverse
Engineering
Physical Memory Forensics
Under the hood we start with physical memory. If you ever looked at a memory dump you’ll see that it is unstructured garble-dee-goop. HBGary has reverse engineered over 50 undocumented Windows structures to give you organized information of the data contained in memory. We uncover all digital objects, so automated reverse engineering on each and every binary to uncover low level behaviors. Digital DNA examines the behaviors to identify which binaries are malware.

4. Digital DNA Automated malware detection
Digital object classification system
5000 software and malware behavioral traits
Example
Huge number of key logger variants in the wild
About 10 logical ways to build a key logger

5. Ranking Software Modules by Threat Severity Software Behavioral Traits
Digital DNA
Ranking Software Modules by Threat Severity
0B 8A C2 05 0F F B ED C D
8A C2
Malware shows up as a red alert. Suspicious binaries are orange. For each binary we show its underlying behavioral traits. Examples of traits might be “packed with UPX”, “uses IRC to communicate”, or “uses kernel hooking with may indicate a presence of a rootkit”. The blue bar shows the Digital DNA sequence for the binary iimo.sys.
0F 51
0F 64
Software Behavioral Traits

6. Under the Hood
These images show the volume of decompiled information produced by the DDNA engine. Both malware use stealth to hide on the system. To DDNA, they read like an open book.

7. Efficacy Curve Efficacy is rising ZERO KNOWLEDGE DETECTION RATE DDNA
Detecting more than not (> 80%)
ZERO KNOWLEDGE DETECTION RATE
Detecting very little
Signatures
And scaling issue getting worse

8. Traditional Incident Response, Memory Forensics, and Malware Analysis are Difficult
Requires lots of technical expertise
Time consuming
Expensive
Doesn’t scale
Traditional methods to analyze memory and malware are difficult. It requires expertise, is time consuming and expensive, and it doesn’t scale. 9

9. Responder Professional

10. HBGary’s Approach Digital DNA Responder Pro Queries Scan all endpoints
Sort into buckets
Responder Pro
Look at closer
Infected
Queries
Remediation
IOC query database
constantly getting
smarter
CLEAN
IOC
queries
Ongoing Remission Detection

11. Demo