Stuck in The Box A Siems Tale

SEC555 Presentation based on SEC555: SIEM with Tactical Analytics
Stuck in the Box: A

SIEM’s Tale
Justin Henderson (GSE # 108)

@SecurityMapper
About Me
• Author of SEC555: SIEM with Tactical Analytics

• GIAC GSE # 108, Cyber Guardian Blue and Red
• 58 industry certifications (need to get a new hobby)
• Two time NetWars Core tournament winner (offense)
• And security hobbyist and community supporter
• Collecting interns/contributors in bulk (research teams)
• Release research to the community
• See https://github.com/SMAPPER
SEC555 | SIEM with Tactical Analytics 2
Welcome!
A copy of this talk is available at

https://www.securitymapper.com
• Virtual machine used during presentation is available for
download at above link
More free stuff: https://github.com/SMAPPER

Disclaimer: This talk is not about bashing SIEM solutions
or promoting one vendor/solution above the others

SIEM Detection Gap
Working with multiple organizations there are clearly gaps

in SIEM deployments
Example: One organization spent 14 months in deployment
• SIEM was/is within top 5 of magic quadrant 2014 - 2017
• Two employees during roll out
(> 1 FTE of labor for 14 months)
• Within less than 1 month open source
solution exceeded what they had

SIEM Deployment
Well they must have lacked training and planning, right?

• Both employees attended week long vendor training
• POC lasted well over three months
• Implementation had >30 days of professional services
• One employee hired as dedicated FTE to SIEM
• One PTE and other employee(s) available to help
Above looks better than what some organizations
have
What Happened?
Ultimately the company discarded commercial solution

• Open source solution still in place
People and processes are more important than the tool!
• Focus should not be solely on SIEM care and feeding
• Detection techniques are required and must scale
• Automation is a must!
Next slides are easy to do with open source
• How does your current solution hold up?
NXLog AutoConfig
Overcomes log agent deficiencies and is a functional proof

of concept
• https://github.com/SMAPPER/NXLog-AutoConfig
Checks systems each day looking for components (IIS, etc)
• If found, automatically configures for consistency
• Or initial configuration…
• Then sets up agent to start shipping logs
Largest deployment maintained > 12 K systems

Traditional vs Network Extraction
Traditional Network Extraction
Multiple collection points Single collection point

DNS logs SMTP logs HTTP logs DNS logs SMTP logs HTTP logs
Log Log
Aggregator Aggregator
agent agent or syslog agent or syslog
agent
DNS SMTP Web Network

Server Server Proxy Extraction Sensor
Service Profiling with SIEM
Infrastructure Service Enrichment Techniques

Logs
• DNS Low value logs can morph into
• HTTP highly actionable detects
• HTTPS • Baby Domains
• SMTP • Entropy Test (PH Imbalance)
Almost every network uses them • Invalid Fields (wrong state)
• Lots of noise = lots of logs • Fuzzy Phishing
• Yet can be high value

freq_server.py
freq_server.py is for large scale entropy tests

• Created by Mark Baggett, author of SEC573
Manual testing
Logstash query

domain_stats.py
Mark Baggett developed domain_stats.py

• Designed for speed and log analysis
• Provides on mass domain analysis
Result
Result
Provides whois information like creation date
• And top 1 million lookups (works with Alexa and Cisco)
Top1M Filtering
Before After - approx < 90% logs

Ordinary to Extraordinary
query: www.google.com query: www.google.com

subdomain: www
En
rich parent_domain: google
es t registered_domain: google.com
o th
is creation_date: 1997-09-15
tags: top-1m
geo.asn: Google Inc.
frequency_score: 18.2778256342
parent_domain_length: 6

Fuzzy Phishing
Many SIEM techniques use insider information

• Such as fuzzy phishing searches
Take legitimate company domains and look for variants
• Extremely effective against phishing domains
• Best used in combination with email alerts or scripts
• Great for targeted attacks

Endpoint Analytics
Endpoint logs are incredibly powerful yet underutilized

• Too much emphasis on “insert security product here”
• Not enough visibility on desktops/laptops
• Endpoint logs can readily be operationalized
Strategies such as below can be used to detect attacks using
• Long command lines • Internal Pivoting
• Unauthorized service creations • Brute force logins
• Malicious PowerShell use • Whitelist evasion
Service Creation Gone Bad (Event ID: 7045)
Common attack techniques

create services
• Top example is of
Meterpreter compromise
through PSExec
• Bottom event is of
privilege escalation

PowerShell Attacks (Event ID: 4104 or 4688)
PowerShell is now commonly used for modern attacks

NirSoft USBDeview1
Simplification is
acceptable/preferred
• Possible to run 3rd
party tool once a
day and log to file
• Better late than
never

File Auditing (Event ID 4663)
Automated scripts/malware often used to find patterns

• Social security #, credit card #, or drivers license
• Operate by enumerating and reading through files
• Often ignores hidden folders

Group Querying (Event ID 4662 and 4663)
By default all users can list group members

• Attackers enumerate members to find users to target
• Many alternative methods to list group members

Mickey Perre has a blog on detecting this behavior
• Windows auditing can capture read member requests
• Combined with agent/aggregator filters = AWESOME
HALO (Honeytokens Against Leveraging OSINT)
Fake users can be created publicly to combat recon

• Could be just in hidden metadata and/or key public sites
Example: Peter Parker([email protected])
• On LinkedIn, Facebook, Adobe, PGP, Github, etc.
• Likely to be picked up during OSINT
• Eventually may make compromised account lists
• Takes minimal time to setup… can get fairly elaborate
Activity from this account is malicious and provides context
Flare
Austin Taylor wrote a beacon discovery script called Flare

• Uses Elasticsearch to crawl historical connections
• Identifies connections with consistent beaconing
• Supports analysis of custom time periods
Additional capabilities being baked in

ELK Hunter
Designed for analysis, research, and proof of concept

• ELK Hunter is a test bed for configs and concepts
• Contains Security Onion, ELK, and analysis scripts
• Designed to plug into network or deploy to hypervisor
• Verifies legitimacy of techniques and configurations
• Discover new techniques or abnormal behaviors
• Performs mass pcap analysis such as Contagio dumps
• Project in pipeline to add mass analysis of Windows logs

Stuck in The Box A Siems Tale

Uploaded by

Copyright:

Available Formats

Stuck in The Box A Siems Tale

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Stuck in The Box A Siems Tale

Uploaded by

Copyright:

Available Formats

SEC555 Presentation based on SEC555: SIEM with Tactical Analytics

Stuck in the Box: A

Justin Henderson (GSE # 108)

• Author of SEC555: SIEM with Tactical Analytics

A copy of this talk is available at

More free stuff: https://github.com/SMAPPER

SEC555 | SIEM with Tactical Analytics 3

Working with multiple organizations there are clearly gaps

SEC555 | SIEM with Tactical Analytics 4

Well they must have lacked training and planning, right?

Ultimately the company discarded commercial solution

Overcomes log agent deficiencies and is a functional proof

SEC555 | SIEM with Tactical Analytics 7

Traditional Network Extraction

Multiple collection points Single collection point

DNS SMTP Web Network

Infrastructure Service Enrichment Techniques

SEC555 | SIEM with Tactical Analytics 9

freq_server.py is for large scale entropy tests

SEC555 | SIEM with Tactical Analytics 10

Mark Baggett developed domain_stats.py

Before After - approx < 90% logs

SEC555 | SIEM with Tactical Analytics 12

query: www.google.com query: www.google.com

SEC555 | SIEM with Tactical Analytics 13

Many SIEM techniques use insider information

SEC555 | SIEM with Tactical Analytics 14

Endpoint logs are incredibly powerful yet underutilized

Common attack techniques

SEC555 | SIEM with Tactical Analytics 16

PowerShell is now commonly used for modern attacks

SEC555 | SIEM with Tactical Analytics 17

SEC555 | SIEM with Tactical Analytics 18

Automated scripts/malware often used to find patterns

SEC555 | SIEM with Tactical Analytics 19

By default all users can list group members

• Many alternative methods to list group members

Fake users can be created publicly to combat recon

Austin Taylor wrote a beacon discovery script called Flare

Additional capabilities being baked in

Designed for analysis, research, and proof of concept

SEC555 | SIEM with Tactical Analytics 23

You might also like