Intro

In short, Threat Intelligence (aka Threat Intel) is the process of analysing data and information, with the use of techniques and tools with the goal to generate meaningful insight and patterns as to how you would mitigate potential risk that are associated with existing or emerging threats that are targeting orgs, industries, governments, etc.

We are generally interested in who is attacking us, why, and what are their capabilities. Also, we care about what IOCs and artefacts we should look for, when investigating our environment (for a particular group/threat actor).

Since Threat Intel tries to understand the connection between your operational environment and the threat actor, it usually gets broken down into the following:

• Strategic Intel
• Technical Intel
• Tactical Intel
• Operational Intel

Strategic Intel – Here, you look at your org’s threat landscape, mapping the risk areas based on trends, patterns and emerging threats that might be able to impact your business’ decisions.

Technical Intel – IR teams use this intel to create an attack surface to analyse and create defence mechanisms. Usually done by looking at the IOCs and artefacts that are tied to the threat actor.

Tactical Intel – Assessment of the TTPs used by the threat actor.

Operational Intel – Investigates the threat actors’ intent and motives for the attack. This intel may be used to understand what some of the critical assets are the org has that can be targeted. (people, technologies, etc.)

Abuse.ch

This project started as one man’s initiative but is today a community driven threat intel platform for cyber threats. In their own words:

abuse.ch‘s main goal is to identify and track cyber threats, with a strong focus on malware and botnets. We not only publish actionable threat intelligence data on cyber threats but also develop and operate platforms for IT security researchers and experts enabling them sharing relevant threat intel data with the community.

Their platforms are:

Malware Bazaar – For sharing malware samples with the community and threat intel providers

Feodo Tracker – Tracking botnet C&C infrastructure associated with Emotet, Dridex and Trickbot

SSL Blacklist – Resource for collecting and providing blocklist for malicious SSL certificates and JA3/JA3s fingerprints

URL Haus – For sharing malware distribution sites with the community and threat intel providers

Threat Fox – Resource for sharing IOCs (Indicators of Compromise) with the community and threat intel providers

Yaraify – Resource for hunting suspicious files with YARA. Also, for sharing your YARA rules with the community

 

Malware Bazaar

This platform acts as a malware collection and analysis database.

You can upload malware samples through browser/API, consequently adding to the intelligence database. This threat intel can also be integrated into your SIEM.

You can also hunt for malware setting, by making alerts that would match different signatures, YARA rules or vendor detection.

 

Feodo Tracker

This platform looks to share intel on botnet C2 (command & control – C&C) servers that are associated with Dridex, Emotet (Heodo), TrickBot, etc.

This is done by giving the C&C servers db’s to the security analysts that can then investigate any IP address they deem suspicious or have seen already. There’s also information on IP and IOC blocklists, and mitigations used to avoid infections by botnets.

SSL Blacklist

This tool identifies and detects malicious SSL connections, further blacklisting the SSL certificates used by botnet C&C servers. It also identifies JA3 fingerprints which can help you detect and block botnet C&C comms within the TCP layer.

You can sift through the SSL certs and JA3 fingerprints, but you can also download them and add them to your deny list/threat hunting ruleset.

URL House

As an analyst, this is an awesome tool for you to perform some validation for your investigation. You can look through the database for URLs, hashes, domains and other malicious filetypes. You can also contribute with your own malware URLs in order to help others protect their networks.

URL House can also give you information on AS numbers, TLDs and associated countries.

ThreatFox

The ThreatFox platform is made with the idea of sharing and exporting IOCs that are associated with malware. You can export the threat intel from ThreatFox in many formats (JSON, CSV, MISP events, Suricata IDS ruleset, Domain Host files, etc.)

Recap

Threat intelligence (aka TI or Cyber Threat Intelligence) is what you would use to supply information regarding threat landscape – TTPs, threat actor groups, etc.

To be considered threat intel (TI) the data must become actionable, and to become actionable, you would want to analyze it first. Thus, the data needs some context in order to qualify for becoming a viable piece of threat intel.

The threat intelligence usually changes quickly, as the threat actors change their TTPs often.

Companies and vendors can share their threat intel within ISACs – Information Sharing and Analysis Centers.

Another breakdown of the TI process can be like this:

• Strategic – Helping management make informed decisions when it comes to security and strategy.
• Operational – Interacting with IOCs and learning more about how threat actors do their work
• Tactical – Interacting with the TTPs and attack models to learn more about the specific threat actor group and its patterns of attack

I also suggest checking out these two great resources to learn more about APTs and their techniques (TTPs):

• https://docs.google.com/spreadsheets/u/1/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/pubhtml
• https://www.mandiant.com/resources/insights/apt-groups

(I will add a few more links at the end of this article)

Conclusion

Okay! So, I looked into the TI process for a bit. This is a big landscape, with a lot of events that are constantly happening. To stay current, you would need to find good resources to follow, as well as create an adequate process at your company on how to handle it, why, and in what ways/cases.

The most interesting part (at least for me) is the fact that when you investigate this behaviour (let’s say you’re using the aforementioned Feodo Tracker to investigate C2 botnet servers) you’re actually learning about what the adversary does and this is the most precious thing to have. You’re learning realistic things, that are happening all the time around the globe, all the while trying to prevent your organization from getting compromised.

You’re not only being proactive, but you’re also learning about what is really used in some of those breaches you can usually read about. This is invaluable, as it can give you the edge against adversaries, when it comes to securing your environment against them.

Stay safe out there, and gather some TI!

Additional Resources

• https://www.nationalisacs.org/member-isacs-3
• https://www.circl.lu/doc/misp/
• https://github.com/MISP/
• https://threatconnect.com/
• https://otx.alienvault.com/
• https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework.en.pdf
• https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/pf/ms/sb-tiber-eu.pdf
• https://www.enisa.europa.eu/topics/national-cyber-security-strategies/information-sharing

Cover image by Alexandre Debieve

#threat_intel #abuse.ch #ioc

Intro

Alrighty! This one has long been on my to-do list! OpSec! Why, how, when, who… how much and how long… Let’s see! Let’s answer some questions. Whether you’re sleuthing for some OSINT investigation, or your country is blocking you from watching your favorite shows on Netflix, you need to figure out your specific OpSec needs, and behave accordingly.

This one is a particularly interesting topic, as it combines a lot of elements – from purely technical to some psychological/behavioural ones.

Before I go further into the topic, I would emphasize that this is my opinion. You can always argue the technicalities, sure, but the methodology is unique – as it should be – again, in my opinion. (Though in this article I am not discussing that many technical aspects)

This is quite logical, as we all have different needs, and are encapsulated within different contexts. What’s true in my case might not necessarily be true in yours. So, with that in mind one might ask – what’s there to learn, then? And it is a valid question! However, we’re interested in the approach here – which is also unique to each and every one of us.

My goal here is to help you be more involved in taking the control of your own privacy and having a healthier and safer online presence which surely accounts to a large portion of your life in general, as we’re all getting more and more dependent on myriad of online services.

Now that I’ve made the intro, and safely fenced off from the personal aspect involved in this topic – let us proceed.

Basics

At its core, OpSec is just managing risk. In the personal case (one I’m looking at), the risk comes from whatever you deem worthy of incorporating into your model. Thus, you’d also want to have a threat model – no need to go overboard here though. This is just meant in a context of you identifying what information you’d want to protect at all costs i.e., no leaks, or if there’s some that you might be fine with being discovered. I purposefully lead with the first sentence above, as you will probably encounter many definitions – but the bottom line is always about that I/O of your personal information. You want to control both I and O in the I/O, but you definitely have to focus on the O – in other words, your model and the way you conduct yourself should be in sync with what you’re trying to achieve. Again, based on the model.

You want to prioritize as well. Best practices are best practices for a reason but will deteriorate rapidly if applied blindly (without context to match). I debated with myself whether to include best practices at the end of this article and opted for it in the end. The argument against it was backed by the second sentence of this paragraph. I am counting on you here!

Traditionally, there are stages when it comes to OpSec (well, for 3 letter agencies and Military it really makes sense) and I will mention that here as well. However, I want to emphasize that I am doing that for the contextual and historical reasons, as well as for you to be more informed. In the end, though, you’re not required to draft any complex models based on the ones Military uses. Their threat model is surely different than yours, so their OpSec needs are too. The methodology/approach is what you should focus on. Thus, before taking any action first, take a pause and contemplate on it. The future you will be better off i.e., safer online.

Defining OpSec

Okay! I am now going to reference some definitions so you can see how that compares to what I’ve been trying to convey.

1 – (Published by Range Commanders Council, U.S. Army White Sands Missile Range – full .pdf document found here)

The OPSEC is a process of identifying, analyzing, and controlling critical information indicating friendly actions attendant to military tactics, techniques, and procedures (TTPs), capabilities, operations, and other activities to:

• Identify actions that can be observed by adversarial intelligence systems.
• Determine what indicators adversarial intelligence systems might obtain that could be interpreted or combined to derive critical information in time to be useful to adversaries.
• Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

As you can see, this is very applicable for us as well! TTPs of the well-known ATPs are already documented by MITRE (since I am talking about the Cyber domain), and aside from the specific stuff regarding military operations, this definition seems quite solid!

To digress for a bit:

Unless you’re a CEO of large Enterprise that’s targeted by advanced threat actors, you might care more about the TTPs. In an average guy wants to prioritize his privacy online scenario those ‘TTPs’ are quite different in nature. However, the goal is the same – a script kiddie trying to mess something up for the fun of it might not invite ATP levels of controls, yet they can still devastate you. Take it all into account and assess critically. Start with the basics, and build from there, don’t go overboard just to get pwned by a newbie hacker that bought a phishing kit on the Darkweb.

Circling back to the definitions, let’s do one more:

2 – (Published by the Department of the Navy, US Marine Corps – the .pdf can be found here)

OPSEC is a capability that identifies and controls critical information and indicators of friendly force actions attendant to military operations, and incorporates countermeasures to reduce the risk of an adversary exploiting vulnerabilities. When effectively employed, it denies or mitigates an adversary’s ability to compromise or interrupt a mission, operation, or activity. Without a coordinated effort to maintain the essential secrecy of plans and operations, our enemies can forecast, frustrate, or defeat major military operations. Well-executed OPSEC helps to blind our enemies, forcing them to make decisions with insufficient information.

This is it …a capability that identifies and controls critical information… and incorporates countermeasures to reduce the risk of an adversary exploiting vulnerabilities…

As you can see the proactive nature is what lies at the heart of OpSec. You taking into account stuff that could compromise your vulnerabilities and drafting a plan to mitigate that before it occurs. There is no reactive OpSec! At that point, you’ve already been pwned, and depending on the criticality of the breach you’re in some (deep) trouble. This also means that one misstep in your (not so) robust model is enough to take it all down. And it makes sense – a hacker just needs to find one way in and they’re off to the races!

Stages of OpSec – OpSec process

Using our US Navy document, we found this neat little graphical representation of OpSec stages

From 1. to 5. you’d have:

1. Identification of critical information
2. Analysis of threats
3. Analysis of vulnerabilities
4. Assessing the risk
5. Applying countermeasures

This is also what you’d get if you Googled for “OpSec stages.”

However, it might be hard(er) for you to analyse threats – as you’re just a civilian, so you’re not really the target, but you still can end up being a target. Just some more food for thought.

(Also, note that the process is circular)

Anonymity vs Privacy

This is the hot stuff right here! VPNs are there for your privacy not anonymity. That’s what TOR is all about. You need to understand this distinction.

The idea is that privacy is you keeping some things for yourself, and this can include your actions. On the flipside, anonymity is supposed to keep your identity private, but not your actions.

This is a very, very, brief overview, but it’s a start. Check out this blog for a bit more information on these two terms. Or this one.

Good (best?) practices

It’s a bit unrewarding to say best practices which is why I purposefully added good to the title. Let’s review some:

• Don’t talk openly (about your ‘mission’ critical stuff) – Duh!
• Don’t operate from home – If you intend on doing anything that needs to keep that level of separation from your real persona. If you’re just trying to do normal stuff where that’s a non-issue, then you can adjust accordingly. (I am not trying to help you operate a botnet, also, those guys already know this stuff.)
• Encrypt everything – this is a great one, though, again, it might not be necessary in your case. You might want to encrypt and safely store only the most critical data. Also, this does require a fair bit of technical knowledge.
• Create personas – This is the anonymity part. If you really need to do something but it is not a great idea to do as ‘you,’ create another persona and be them. Great example of this are sock puppets, or something like OSINT CTFs I like to participate in.
• Don’t contaminate – This one ties to the previous one. If you have personas, don’t cross-contaminate them, as in this case they are actually working against you, and you’d be better off just using other controls to protect the real you. It can backfire. Significantly.
• Don’t trust – I mean… you’re on the Internet after all, adopt a healthy amount of paranoia if you haven’t already.
• Be paranoid – See the previous one. Even if nobody’s out to get you personally, that doesn’t mean that they’re not out to get you. That’s just the Internet for you.
• Don’t give people power over you – Just don’t. Don’t overshare, be careful. Anything you say can and will be used against you is very, very, true in this context as well.

Technical good (best?) practices

• Don’t be the only guy using TOR on a network that’s monitored. It’s how they caught this guy.
• Don’t do stuff on your own infrastructure that might get you in trouble
• VPN provides privacy! Not anonymity
• Isolate/segment your environment if there’s a need – I’m thinking VMWare, VirtualBox, etc.
• Check for DNS leaks
• If your use case is such, use Tails/Qubes OS/Whoonix
• Strong passwords! (And a password manager – I prefer KeePass, as it keeps the stuff locally and you can add more functionality through plugins, such as 2FA)
• Encrypt your disk, encrypt important stuff – where needed
• Protect yourself against WebRTC leaks
• Educate yourself on browser fingerprinting – there’s a lot of stuff online (as well as right here on Vsociety!) There’s this article, too.

Conclusion

I am hoping I’ve piqued your interest with all this OpSec talk. It might seem like an overkill to someone who’s maybe coming from a different field, but I assure you it is not! The Internet is a hostile place, and in a hostile environment you’d act accordingly, right? If you’re on vacation in, let’s say, a gorgeous but realistically dangerous place like some cities in Latin America, you would be careful. Do the same when online. Know where you’re threading, and act accordingly.

This is all for now! I hope I’ve made a decent introduction for some of the upcoming articles that will focus on the Darkweb, all the while bringing this fascinating topic closer to you. Stay tuned!

 

Some additional cool stuff to check out

https://www.youtube.com/watch?v=zXmZnU2GdVk

https://www.youtube.com/watch?v=8u7yyFYvzC4

https://www.youtube.com/watch?v=9XaYdCdwiWU

https://www.youtube.com/watch?v=eQ2OZKitRwc

Cover image by ueberform

#opsec #privacy #anonymity #best-practices #vicarius_blog

Intro

On first glance, the collection of tools that I chose for this article might seem all over the place. However, the idea behind this article is to talk more about some of the most important and well-known tools in the Infosec space.

Thus, I talk about Volatility (DFIR tool) and Metasploit (exploitation and exploit development) as well as Yara(Malware research & analysis) MITRE(Threat Intel knowledge base) and Sysmon(Advanced logging tool, that we can also use to hunt for threats).

Volatility

Volatility is a memory forensics tool, developed by Volatility labs. It is a standard tool in virtually every Incident Responder’s/Blue Teamer’s toolkit, it can be easily expanded through a bunch of plugins that are available, and, most importantly, it is completely free.

There are many ways to acquire memory captures from a system, and we won’t go into that. We’ll just mention that the tools would differ depending on our system’s state (on/off). For example, for offline systems, specifically Windows OS, we can do this through the hiberfil.sys which is located in %SystemDrive% – if the disks are unencrypted.

This file is the compressed image of the previous boot, but that doesn’t mean we can’t do some forensics on it!

Notice I am using volatility standalone (because I am running Window/CMD in the image) otherwise the command would just be volatility.

Imageinfo is the command that gives the profile on which we can work. You need to identify the right one.

Further, we can look for hidden processes with psxview, we can use ldrmodules if we need more details – it will show inMem, inInit, inLoad (if they are False)… and all of these are quite bad as they indicate that module has been injected. Injected code is obviously very bad and we can look for it with malfind, and even dump it to a file.

Also, some of the usual hypervisor formats are:

• .vmem – Vmware
• .mem – Parallels
• .sav – VirtualBox

Generally, the most common format is .raw – raw files are collections of unaltered, unprocessed data.

Further, we might want to check see what the community says about these processes and upload the dumps to VirusTotal.

MITRE ATT&CK

MITRE ATT&CK is a global knowledge base, which documents adversary TTP’s (Tactics, Techniques, and Procedures). Their mission is to enable better Cybersecurity by connecting communities together. The framework, which is used for Threat Modelling is free, open, and available to anyone. If your role has anything to do with Cybersecurity – from SOC Analyst, to a Red Team Operator, or Pentester, you should know your MITRE ATT&CK.

ATT&CK® Navigator is a great place to start, and there you can see different matrices, from Enterprise to Mobile and ICS. They all describe how adversaries reach their goals, and what specific actions they might take for the said goals to be obtained. For example, they might deploy Rootkits if the goal is to evade your systems and hide their malicious activity.

Yara

Yara, or Yet another ridiculous acronym is a tool used for malware detection and research. You can find much more about Yara here, and here.

A quote from VirusTotal is truly revealing of what kind of importance Yara holds in the Cybersecurity community today:

“The pattern matching swiss knife for malware researchers (and everyone else).”

Yara works by identifying binary as well as text patterns (strings contained in a file, etc.)

To detect those patterns, Yara uses rules, which you can think of as labels that we can write if we want to determine maliciousness of a file. Applications can use strings to store text data, and that string can be a Bitcoin address stored as a string inside some Ransomware.

Yara rules are easy to read and understand, and were made to resemble C. We are not going into details as to how you would create your Yara rules, instead, you can check out this awesome article by an Infosec Researcher named fr0gger_, where you can find out more by looking at his Anatomy of a Yara rule infographic.

Also, if you find this tool awesome (as we do!) and decide to follow down the path, be sure not to miss

Valhalla – an online Yara rule feed, made by Nextron-Systems.

Metasploit

Metasploit is the biggest and most well-known Exploitation framework. There are two versions, the paid one having a GUI – its called Metasploit Pro, and the free version being CLI-based.

Metasploit framework is basically a bundle of tools which can do scanning, exploitation, post-exploitation, exploit development, and more. Even though its mainly geared for Pentesters, it is invaluable for Exploit Developers.

The main components of Metasploit are: Modules, msfconsole, and standalone tools. The msfconsole is your CLI interface, modules are there to support your various exploits, payloads, and more… and your standalone tools can help you with exploit development, as well as with pentesting.

Sysinternals

Sysinternals is a tool, rather, a collection of (70+) tools, that were created by Mark Russinovich, way back in the 90’s by him and Bryce Cogswell under the name of a software company called Wininternals – where he was a co-founder. In 2006 Microsoft acquired his company, and Mark Russinovich started working for Microsoft. Currently, he is the CTO of Microsoft Azure.

The Sysinternals suite is used literally by everyone. From seasoned IT veterans like Sysadmins and the like, to Red Teamers and even adversaries! And this is no surprise, since in the 70ish tools that come with the Sysinternals Suite you are covered on many, many fronts, such as: system information, security utilites, process utilites, networking utilities, and more.

These tools are real, and you should really learn to use them if you’re working in IT, it shouldn’t matter if you’re a Support Engineer, or a Security Engineer, Sysinternals is a must. (We will briefly look into one of those below – Sysmon)

Sysmon

Sysmon is a tool for logging and monitoring events on Windows machines. It is also a part of the Windows Sysinternals Suite (which is now also available in Microsoft Store – though originally made by Mark Russinovich). You can think of Sysmon as a Windows Event Log viewer on steroids. Similar to Process Explorer from the Sysinternals Suite and the in-built Task Manager.

Sysmon collects detailed logs, and even traces events – which can help with pinpointing abnormalities in your environment. Ideally, you would use Sysmon in conjunction with a SIEM (System Information and Event Management tool – most known example being Splunk) which can further parse the logs, and provide even more insight about your systems and the potential abnormal behavior.

Sysmon requires a config to work, so you can either create, or download a config. With this, you can fine tune what you would like to log.

With Sysmon you can filter the events, in order to reduce clutter and further hunt for threats, malware, persistence, even evasion techniques. You can also detect Mimikatz – one of the most used Windows post-exploitation tools, for dumping credentials from memory; and Metasploit – which needs no introduction – too.

Mimikatz signature might be well known and an Antivirus will pick it up, but your adversary can obfuscate this, thus rendering the AV useless. The idea is to use a config that will help us focus on hunting the threat. On MITRE, we can find Mimikatz activity documented here. Information on hunting Metasploit (and more – PsExec, netstat, net, etc.) can be found here.

These are some extremely powerful features to have, and also it goes to show we don’t need to break our bank to protect our systems, there’s a plethora of tools out there that have much to offer. Just like Sysmon.

Conclusion

My ideal audience for this article are people newer to the Infosec field, who are naturally curious and hungry for knowledge.

However, I hope that there’s some interesting bits and pieces of info even for some of the more experienced Cybersecurity practitioners – there also might be a link or two above that you find interesting.

Stay tuned for Part 2!

#MITRE #yara #volatility #sysinternals #tooling