1. Standardized Threat Indicators Indicator Export Adversary Analysis (Pivoting) Private and Community Incident Correlation ThreatConnect Intelligence Research Team (TCIRT) Community Notifications

2. Slide Sections Using Address Indicators with SecurityCenter Using File Indicators with SecurityCenter Using Host Indicators with SecurityCenter Using URL Indicators with SecurityCenter Using File Indicators with Nessus

3. Using Address Indicators with SecurityCenter Step 1 – Extract Address Indicators Step 2 – Create a Watchlist from Address Indicators Step 3 – Filter Events by Watchlist Step 4 – (Optional) Create Query for 3D Tool Step 5 – Save Asset List of All Addresses Step 6 – Perform Audit Analysis Using Asset List Step 7 – Perform Event Analysis Using Asset List Step 8 – (Optional) Create List of Internal Addresses Step 9 – (Optional) Nessus Audit of Internal Addresses

4. Step 1 – Extract Address Indicators

5. Step 2 – Create a Watchlist from Address Indicators

6. Step 3 – Filter Events by Watchlist Inbound or outbound

7. Step 4 – (Optional) Create Query for 3D Tool

9. Step 5 – Save Asset List of All Addresses

10. Step 6 – Perform Audit Analysis Using Asset List Recommended Reading – Predicting Attack PathsPredicting Attack Paths

11. Step 7 – Perform Event Analysis Using Asset List Recommended Reading – Tenable Event CorrelationTenable Event Correlation

12. Step 8 – (Optional) Create List of Internal Addresses Only

13. Step 9 – (Optional) Nessus Audit of Internal Addresses

14. Using File Indicators with SecurityCenter Step 1 – Extract Hashes Step 2 – Upload Hashes to Scan Policy Step 3 – Perform a Scan Using Credentials Step 4 – Review Scan Results Step 5 – Save Asset List of Infected Hosts Step 6 – Perform Audit Analysis Using Asset List Step 7 – Perform Event Analysis Using Asset List Step 8 – (Optional) Use Asset List with 3D Tool

15. Step 1 – Extract Hashes

16. Step 2 – Upload Hashes to Scan Policy

17. Step 3 – Perform a Scan Using Credentials Recommended Reading – Nessus Credential Checks for UNIX and WindowsNessus Credential Checks for UNIX and Windows

18. Step 4 – Review Scan Results

19. Step 5 – Save Asset List of Infected Hosts

20. Recommended Reading – Predicting Attack PathsPredicting Attack Paths Step 6 – Perform Audit Analysis Using Asset List

21. Step 7 – Perform Event Analysis Using Asset List Recommended Reading – Tenable Event CorrelationTenable Event Correlation

22. Step 8 – (Optional) Use Asset List with 3D Tool

24. Using Host Indicators with SecurityCenter Step 1 – Filter Events by Host Step 2 – Perform Further Analysis Recommended Reading – Using Log Correlation Engine to Monitor DNSUsing Log Correlation Engine to Monitor DNS

25. Step 1 – Filter Events by Host

26. Step 2 – Perform Further Analysis See slides for “Using ThreatConnect Address Indicators” steps 5 through 9 Filtering by the domain summary event before saving the asset list will get you a list of only those hosts that performed a DNS lookup for the host indicator.

27. Using URL Indicators with SecurityCenter Step 1 – Divide Host and Location from URL Step 2 – Filter Events by Host Step 3 – Save Asset List Step 4 – Filter Events by Location Step 5 – Perform Further Analysis

28. Step 1 – Divide Host and Location from URL

29. Step 2 – Filter Events by Host Use Host in Syslog Text filter Use web-access in Type filter

30. Step 3 – Save Asset List

31. Step 4 – Filter Events by Location Use Location in Syslog Text filter Use Asset List in Source Asset filter

32. Step 5 – Perform Further Analysis See slides for “Using ThreatConnect Address Indicators” steps 5 through 9 We will be creating a second and final asset list to use for further analysis. Verify the URL is matched correctly by looking at the web-access details in Step 4. Steps 1 through 4 perform an intersection; however, it’s by host.

33. Using File Indicators with Nessus Step 1 – Extract Hashes Step 2 – Use Windows Malware Scan Wizard Step 3 – Perform Scan and Review Results

34. Step 1 – Extract Hashes

35. Step 2 – Use Windows Malware Scan Wizard

36. Step 3 – Perform Scan and Review Results