Webinar 1534 Slides

12/18/2018
Building MITRE ATT&CK Sponsored by
Technique Detection into

Your Security Monitoring
Environment
© 2018 Monterey Technology Group Inc.
 Made possible by
Thanks to
1
12/18/2018
 MITRE ATT&CK
 Tactics
Preview of key  Techniques
 Examples
points  Using ATT&CK
 Assess
 Enhance
 Test
 A normalized, structured approach for classifying, describing

ATT&CK attack methods
 High-level to the technical and specific
 Many uses
2
12/18/2018
Tactics Persistence
ATT&CK Techniques Registry

Run Keys
New Service
AppInit
DLLs
Procedures
Examples Procedures
Examples
APT19 BADNEWS Briba Mitigation Detection
Initial Access • gain an initial foothold within a network
Execution • of adversary-controlled code
Persistence • maintain access to target through interruptions
Privileged Escalation • obtain a higher level of permissions
Defense Evasion • evade detection or avoid other defenses

Tactics
Credential Access • Control of accounts
Discovery • gain knowledge about the system or network
Lateral Movement • access additional systems on target network
Collection • Gather information prior to exfiltration
Exfiltration • removing information from target
Command and Control • communicate with systems under control
3
12/18/2018
 Tactic: Persistence
Drilldown  https://attack.mitre.org/tactics/TA0003/
 Technique: Registry Run Keys / Startup Folder
 https://attack.mitre.org/techniques/T1060/
 https://mitre.github.io/attack-navigator/enterprise/
ATT&CK
Navigator
4
12/18/2018
 Adversary Emulation
How can we  Red Teaming
use ATT&CK?  Behavior Analytics Documentation

 Defensive Gap Assessment
 SOC Maturity Assessment
 Cyber Threat Intelligence Enrichment
How can we
 Let’s zero in on how to use ATT&CK for designing, enhancing,
use ATT&CK? assessing your security monitoring effort and keeping it up-to-
date
5
12/18/2018
Security  Gap analysis

Monitoring  Enhancements
 Testing
 Classify what you are currently doing

 Map dashboards, alert rules, SAO, etc. to tactics and techniques
Security  Include anything that alerts you
Monitoring:  Antivirus
 EDR
Gap analysis  SIEM
 UEBA
 Which tactics are your efforts light on?
 Which techniques are you missing?
6
12/18/2018
Security  Prioritize techniques identified in gap analysis
Monitoring:  Examine the detection content

 Are we currently capturing that information?
Enhancements  Where can we implement the detection logic?
 Implement
 Test
Security
Monitoring:  How do you know if your security monitoring environment really
works – if it will really alert you if you are attacked?
Testing
 https://www.redcanary.com/blog/atomic-red-team-testing/
7
12/18/2018
 MITRE ATT&CK is cool

 Systematic way to classify, document and respond to attacker
Bottom line techniques
 Use it to
 Assess your security monitoring
 Keep your security monitoring up-to-date
 Test your security monitoring
 Brian Coulson, from LogRhythm Labs, is leading an outstanding

project at LogRhythm Labs where-in he will show you how
they’re aligning the ATT&CK matrix with log sources, including
Let’s see windows event logs (XML – Security, XML Sysmon 8.0 and XML-
System). While the matrix is wide spread in what it monitors,
ATT&CK being there are effective ways to filter around common and relevant
detection techniques and logs.
implemented in
the real world He will be demonstrating a gap analysis around MITRE ATT&CK
Techniques and a SIEM (LogRhythm). While existing compliance
and threat module rules are likely to detect the MITRE defined
techniques, Brian is going to take it a step farther and walk
through a MITRE attack process from inception to finalization
while focusing on rule development and alignment in
LogRhythm.
© 2018 Monterey Technology Group Inc.
8
12/18/2018
Building MITRE ATT&CK Technique Detection

into Your Security Monitoring Environment
Brian Coulson
Threat Research, Senior Engineer
Dec 2018
Agenda
• Gap Analysis
• via SCRUM and Documentation
• Preparing a Test lab
• Microsoft Sysmon and Advanced Auditing
• LogRhythm Sysmon Agent
• Importance of Tuning
• Testing MITRE Techniques
• LogRhythm Detection of Techniques
COMPANY CONFIDENTIAL
9
12/18/2018
SCRUM and Documentation
SCRUM: Gap Analysis
10
12/18/2018
Confluence
Preparing a Test Lab
11
12/18/2018
Swift On Security: Sysmon Config
Swift on Security + LogRhythm: Sysmon Config
12
12/18/2018
Microsoft: Advanced security audit policy settings
LogRhythm Sysmon Agent: Log Source Types
13
12/18/2018
LogRhythm Registry Integrity Monitoring Policies
Importance of Tuning Log Sources
14
12/18/2018
Microsoft Sysmon: Event ID 10
Microsoft Sysmon: Event ID 10 Post Tuning
15
12/18/2018
Testing MITRE Techniques
Red Canary: Atomic Red Team
16
12/18/2018
Atomic Red Team: T1035 - Service Execution: Atomic Test #1
Atomic Red Team: T1035: Execution of Test
17
12/18/2018
LogRhythm Detection of Techniques
MITRE: Service Execution: Detection Guidance

• Detection
• Changes to service Registry entries and command-line invocation of tools
capable of modifying services that do not correlate with known software,
patch cycles, etc., may be suspicious. If a service is used only to execute a
binary or script and not to persist, then it will likely be changed back to its
original form shortly after the service is restarted so the service is not left
broken, as is the case with the common administrator tool PsExec.
18
12/18/2018
LogRhythm: Registry Logs
LogRhythm: Registry Logs: Security: Event ID 4663
19
12/18/2018
LogRhythm: Registry Logs: MS Sysmon: Event ID 12
LogRhythm: Registry Logs: MS Sysmon: Event ID 13
20
12/18/2018
LogRhythm: Registry Logs: LogRhythm Sysmon: Add
LogRhythm: MS System and Security Logs
21
12/18/2018
LogRhythm: MS Security Logs: Event ID 4697
LogRhythm: Identifying Logs by Command
22
12/18/2018
LogRhythm: Filtered by Command: Dashboard
Security Event ID: 4688
23
12/18/2018
Microsoft Sysmon: Event ID 1
LogRhythm Echo: Building the use case
24
12/18/2018
LogRhythm Echo: Logs
LogRhythm AIE Rule: Detect Software Installed
25
12/18/2018
LogRhythm AIE Rule: Detect Registry Add
LogRhythm AIE Rule: Information about the rule
26
12/18/2018
LogRhythm Echo: Run Use Case
LogRhythm Alarm Card
27
12/18/2018
End and Q&A

• Thank you! 
28

Webinar 1534 Slides

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Webinar 1534 Slides

Uploaded by

Copyright:

Available Formats

12/18/2018

Building MITRE ATT&CK Sponsored by

Technique Detection into

 A normalized, structured approach for classifying, describing

ATT&CK Techniques Registry

APT19 BADNEWS Briba Mitigation Detection

Initial Access • gain an initial foothold within a network

Execution • of adversary-controlled code

Persistence • maintain access to target through interruptions

Privileged Escalation • obtain a higher level of permissions

Defense Evasion • evade detection or avoid other defenses

Discovery • gain knowledge about the system or network

Lateral Movement • access additional systems on target network

Collection • Gather information prior to exfiltration

Exfiltration • removing information from target

Command and Control • communicate with systems under control

use ATT&CK?  Behavior Analytics Documentation

Security  Gap analysis

 Classify what you are currently doing

Security  Prioritize techniques identified in gap analysis

Monitoring:  Examine the detection content

 MITRE ATT&CK is cool

 Brian Coulson, from LogRhythm Labs, is leading an outstanding

© 2018 Monterey Technology Group Inc.

Building MITRE ATT&CK Technique Detection

SCRUM and Documentation

SCRUM: Gap Analysis

Preparing a Test Lab

Swift On Security: Sysmon Config

Swift on Security + LogRhythm: Sysmon Config

Microsoft: Advanced security audit policy settings

LogRhythm Sysmon Agent: Log Source Types

LogRhythm Registry Integrity Monitoring Policies

Importance of Tuning Log Sources

Microsoft Sysmon: Event ID 10

Microsoft Sysmon: Event ID 10 Post Tuning

Testing MITRE Techniques

Red Canary: Atomic Red Team

Atomic Red Team: T1035 - Service Execution: Atomic Test #1

Atomic Red Team: T1035: Execution of Test

LogRhythm Detection of Techniques

MITRE: Service Execution: Detection Guidance

LogRhythm: Registry Logs

LogRhythm: Registry Logs: Security: Event ID 4663

LogRhythm: Registry Logs: MS Sysmon: Event ID 12

LogRhythm: Registry Logs: MS Sysmon: Event ID 13

LogRhythm: Registry Logs: LogRhythm Sysmon: Add

LogRhythm: MS System and Security Logs

LogRhythm: MS Security Logs: Event ID 4697

LogRhythm: Identifying Logs by Command

LogRhythm: Filtered by Command: Dashboard

Security Event ID: 4688

Microsoft Sysmon: Event ID 1

LogRhythm Echo: Building the use case

LogRhythm Echo: Logs

LogRhythm AIE Rule: Detect Software Installed

LogRhythm AIE Rule: Detect Registry Add

LogRhythm AIE Rule: Information about the rule

LogRhythm Echo: Run Use Case

LogRhythm Alarm Card

End and Q&A

You might also like