Let the Hunt Begin - Security Bootcamp 2024

Let the Hunt Begin - Security Bootcamp 2024

1. @TueDenn present at Security Bootcamp 2024
Let the Hunt Begin

2. About Me
TueDenn Security Bootcamp -Let the Hunt Begin 2
➢PhạmTàiTuệ
➢tuedenn@goDefend_work
➢5yin InfosecIndustry
➢Threat Hunter (3), DFIR (1), SOC manager (1)
➢still noob but very curiousand eagerto learn
➢2ndtimeatBootcamp
➢I do on my own, not represent for any org

3. StOrieS
TueDenn Security Bootcamp -Let the Hunt Begin 3
https://vietnamnet.vn/ma -doc-ma-hoa-du-lieu-tong-tien-lockbit-3-0-tan-cong-vndirect-nguy-hiem-the-nao-2271741.html#

4. StOrieS
TueDenn Security Bootcamp -Let the Hunt Begin 4
https://cand.com.vn/Cong -nghe/yeu-cau-cac-cong-ty-chung-khoan-ra-soat-bao-mat-he-thong-i726369/

5. StOrieS
TueDenn Security Bootcamp -Let the Hunt Begin 5
https://vtv.vn/cong -nghe/phong-chong-tan-cong-ma-doc-ma-hoa-du-lieu-tong-tien-20240604164927375.htm

6. Am I too Late ?
TueDenn Security Bootcamp -Let the Hunt Begin 6

7. No matter the state of your org!
Threat HuntinG
Can Help!
TueDenn Security Bootcamp -Let the Hunt Begin 7

8. TueDenn Security Bootcamp -Let the Hunt Begin 8
Everything Start At 0

9. Agenda
Introduction01
Threat, Threat actor, Threat Hunting
Benefit of Threat Hunting02
How Threat Hunting can help
Methodologies03
Threat Hunting Maturity Model, Framework, Process
Usecases04
Simple usecase bring to you
Key take away 05
Summary & suggest some resources to follow up

10. the Chinese proverb
the Best time
to Plant a Tree
was 20years ago
the Second-best time
is NOW
TueDenn Security Bootcamp -Let the Hunt Begin 10

11. Introduction

12. IntrO“ThreAT”
➢Intent
➢Opportunity
➢Capability
➢To do you harm
TueDenn Security Bootcamp -Let the Hunt Begin 12
https://csrc.nist.gov/glossary/term/cyber_threat

13. IntrO“ThreAtActoR”
➢FocusonThreatActorsis
abigwin!
➢Goodatavoidingdetection
andensuringsurvivability
➢Reacttocountermeasures
andremediationtactics
TueDenn Security Bootcamp -Let the Hunt Begin 13

14. ThreAtActor
Will Come (back)SooN
TueDenn Security Bootcamp -Let the Hunt Begin 14
If you think your org will never
be breached, you are wrong!

15. The Detection GAP
TueDenn Security Bootcamp -Let the Hunt Begin 15
https://www.betaalvereniging.nl/wp -content/uploads/DEF-TaHiTI-Threat-Hunting-Methodology.pdf

16. Alerting is important
but can not be the only focus
of a detection program
TueDenn Security Bootcamp -Let the Hunt Begin 16
That’s why you need Threat Hunting

17. IntrO“ThreAtHuntinG”
➢Proactive
➢Iterative
➢Human-driven,
Machine-assisted
➢Finding which
automated detection
systems missed
TueDenn Security Bootcamp -Let the Hunt Begin 17

18. Threat Huntervs socanalyst
TueDenn Security Bootcamp -Let the Hunt Begin 18

19. Threat Huntervs socanalyst
TueDenn Security Bootcamp -Let the Hunt Begin 19

20. Of
ThreAt
Hunting
Benefit

21. Benefit 1: Shrink Dwell Time
➢Detection miss
➢Incident
➢Lost $$$
Hunt the bad guy down
before incident happened
TueDenn Security Bootcamp -Let the Hunt Begin 21
https://services.google.com/fh/files/misc/m -trends-2024.pdf

22. Benefit 2: Improve Detection
➢More & more data
➢Need automation detection
➢Automation = More FP
➢More human effort = more $
Threat Hunting can reduce FP &
contribute rules for automation
TueDenn Security Bootcamp -Let the Hunt Begin 22

23. Benefit 3: Increase Visibility
Bring the peace-of-mind!
The more you know
about your network,
the better you can
defend it!
TueDenn Security Bootcamp -Let the Hunt Begin 23

24. TueDenn Security Bootcamp -Let the Hunt Begin 24
Threat
Hunting
MethodologieS

25. 50%of organizations have formally
defined threat hunting methodologies
an increase from 35%in the previous year
TueDenn Security Bootcamp -Let the Hunt Begin 25
https://www.sans.org/webcasts/sans -2024-threat-hunting-survey-hunting-for-normal-within-chaos/

26. Methodologies
➢50.8% defined threat
hunting methodologies
➢35.3% in 2023
➢49.2% is no method!
➢Don’t know “HOW”!
➢Still low
➢But increase!
TueDenn Security Bootcamp -Let the Hunt Begin 26
https://www.sans.org/webcasts/sans -2024-threat-hunting-survey-hunting-for-normal-within-chaos/

27. 64%of organizations formally measure
the success or effectiveness
of their threat hunting efforts
TueDenn Security Bootcamp -Let the Hunt Begin 27
https://www.sans.org/webcasts/sans -2024-threat-hunting-survey-hunting-for-normal-within-chaos/

28. MeasureSuccess
➢64%of organizations
formally measure
the successor
effectivenessof their
threat hunting efforts
➢36% Don’t know “WHAT &
WHY”
TueDenn Security Bootcamp -Let the Hunt Begin 28
https://www.sans.org/webcasts/sans -2024-threat-hunting-survey-hunting-for-normal-within-chaos/

29. PEAK
Prepare, Execute & Act
with Knowledge (2023)
Threat Hunting Framework
From Spunk
TueDenn Security Bootcamp -Let the Hunt Begin 29
https://www.splunk.com/en_us/blog/security/peak -threat-hunting-framework.html

30. TaHiTi
Targeted Hunting
Integrating Threat
Intelligence (2018)
TueDenn Security Bootcamp -Let the Hunt Begin 30
https://www.betaalvereniging.nl/wp -content/uploads/DEF -TaHiTI-Threat-Hunting-Methodology.pdf

31. Hunting Loop
The SqrrlThreat Hunting
Reference Model (2015)
TueDenn Security Bootcamp -Let the Hunt Begin 31

32. TueDenn Security Bootcamp -Let the Hunt Begin 32
The HuntingMaturityModel
https://medium.com/@sqrrldata/the -cyber-hunting-maturity-model-6d506faa8ad5

33. Fit you it
TueDenn Security Bootcamp -Let the Hunt Begin 33
https://medium.com/@sqrrldata/the -hunt-matrix-90d8476e8765

34. Craft Your Own
➢Only you know the best fit
➢Learn from others,
innovate on your own
➢This is my suggestion!
TueDenn Security Bootcamp -Let the Hunt Begin 34
Prepare
Identify
Analysis
Document
Finding
Improve,
Automate

35. Threat Hunting Life Circle
TueDenn Security Bootcamp -Let the Hunt Begin 35
Prepare
Identify
Analysis
Document
Finding
Improve,
Automate
know the enemy
and know yourself
Clearobjective
Formulate hypothesis
To proveor disproveyour hypothesis
Create the
knowledgeof
your hunt procedures
Think for the next!

36. PrepAre
know the enemyand know yourself
TueDenn Security Bootcamp -Let the Hunt Begin 36

37. Prepare
Pyramid of pain
(2013)
➢IOC used to
detectan
adversary’s
activities
➢How much painit
will cause them
TueDenn Security Bootcamp -Let the Hunt Begin 37
http://detect-respond.blogspot.com/2013/03/the -pyramid-of-pain.html
HM1
HM2
HM3+

38. Prepare
How much painit will cause them? :) # TurlaLicksAss
TueDenn Security Bootcamp -Let the Hunt Begin 38
https://x.com/cyb3rops/status/1156599722326528009 https://x.com/cyb3rops/status/1372932191055974403

39. Prepare
Threatactorprofile
➢you must know your
enemyto winthe war
➢Diamond model:
Victim-Centered
Approach
➢MITRE ATTCK
https://attack.mitre.org/matrices
/enterprise/
TueDenn Security Bootcamp -Let the Hunt Begin 39
https://www.activeresponse.org/wp -content/uploads/2013/07/diamond.pdf

41. Prepare
Data soure
➢If you know the
enemy and know
yourself, you
need not fear the
result of a hundred
battles.
➢Building Better
Hunt Data
TueDenn Security Bootcamp -Let the Hunt Begin 41
https://attack.mitre.org/datasources/

42. Identify
Give your hunt a clearobjective
TueDenn Security Bootcamp -Let the Hunt Begin 42

43. Identify
A CLEARobjective→Effectivethreat hunting
➢Define your hypothesis
➢What you should hunt for: POST-Exploit!
TueDenn Security Bootcamp -Let the Hunt Begin 43

44. AnalysiS
To proveor disproveyour hypothesis
TueDenn Security Bootcamp -Let the Hunt Begin 44
https://www.threathunting.net/files/hunt -evil-practical-guide-threat-hunting.pdf

45. “SeArching”Techniques
➢the simplestmethod
➢Don’ttoobroadly
➢For generalartifacts
➢Don’ttoospecifically
➢onspecifichosts
TueDenn Security Bootcamp -Let the Hunt Begin 45

46. “Stacking ”Techniques
➢the mostcommontechniques
➢countingthe numberof occurrences
➢analyzing the outliersor extremes
➢Hard to dealing with largeand/or
diversedata sets
➢Most effectivewith a thoughtfully
filteredinput
TueDenn Security Bootcamp -Let the Hunt Begin 46

47. “Grouping ”Techniques
➢input is an explicit set of
items already of interest
➢Group by based on specific
criteria
➢Example
➢Group by timeframe
➢Group by department
TueDenn Security Bootcamp -Let the Hunt Begin 47

48. “Clustering ”Techniques
➢Clustering!= Grouping
➢Input is not explicitly
➢separate similardata
points
➢certain characteristics
➢Largerset of data
➢Machine Learning models!
TueDenn Security Bootcamp -Let the Hunt Begin 48
https://www.slideshare.net/slideshow/the -lord-of-the-ring-a-network-analysis/80476370

49. Document
Create the knowledge of your hunt procedures
TueDenn Security Bootcamp -Let the Hunt Begin 49

50. TueDenn Security Bootcamp -Let the Hunt Begin 50
SANS Threat Hunting & IR Summit 2020 The SOC Puzzle: Where Does Threat Hunting Fit? Ashley Pearson | @onfvp

51. ExpectAtionManAgemenT
Won’t always find bad
and that’s okay
TueDenn Security Bootcamp -Let the Hunt Begin 51

52. Document Your Findings
Create the knowledgeof your hunt procedures
➢Historical linking
➢After: Fullydocument
➢During: Partialdocument
➢Simple, butclear
➢Key points
➢Retrievable
➢Don’t wasteyour time!
TueDenn Security Bootcamp -Let the Hunt Begin 52

53. Document
Hunt procedures
TueDenn Security Bootcamp -Let the Hunt Begin 53
https://threathunterplaybook.com/hunts/windows/intro.html

54. Improve
Think for the next!
TueDenn Security Bootcamp -Let the Hunt Begin 54

55. Improve
➢Making futurehuntsmore effective
➢Scalability
➢Known issues, Better next -time
➢Don’t do the same hunts over and over
➢Think can Automationhunt →Rule
➢Human do, machine helps (AI, ML, automate task)
➢Remind: “Hunting comes when automation ends !”
TueDenn Security Bootcamp -Let the Hunt Begin 55

56. Improve
➢Contribute rules
➢Harden rules
➢reduceFP
➢Recommendations
➢What missed
➢how to detect next time
➢To Improving org’s security
TueDenn Security Bootcamp -Let the Hunt Begin 56
https://socprime.com/blog/interview -with-developer-florian-roth/*Fact: Sigma was created by Florian Roth, for Threat Hunting purpose!

57. Improve
TueDenn Security Bootcamp -Let the Hunt Begin 57
https://github.com/SigmaHQ/sigma/blob/master/rules -threat-hunting/windows/create_remote_thread/create_remote_thread_win_loadlibr ary.yml

58. Let
simple Threat Hunting procedure demo
The Hunt Begin
TueDenn 58

59. POWERShellHunting
TueDenn Security Bootcamp -Let the Hunt Begin 59
Let Hunt together!

60. Prepare-Threat Report
TueDenn Security Bootcamp -Let the Hunt Begin 60
https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf

61. Prepare-Threat Report
TueDenn Security Bootcamp -Let the Hunt Begin 61
https://web-assets.esetstatic.com/wls/2020/05/ESET_Turla_ComRAT.pdf

62. Prepare-Threat Report
TueDenn Security Bootcamp -Let the Hunt Begin 62
https://web-assets.esetstatic.com/wls/2020/05/ESET_Turla_ComRAT.pdf

63. Identify –Hypothesis
Threat Actor has created
a schedule taskthat
➢without being caught
→detection miss
➢Still Remain persistence
➢Run powershell
➢Using techniques:
https://attack.mitre.org
/techniques/T1053/005/
TueDenn Security Bootcamp -Let the Hunt Begin 63

64. Identify –Hunting Plan
➢Scope: Scale all (1000 ppl)
➢Collect:
➢Data source: File (Tasks file path, create, …)
➢Data source: Registry(Entry, LauchStrings,…)
➢Techniques:
➢Searching, grouping, stacking
➢Notes
TueDenn Security Bootcamp -Let the Hunt Begin 64

65. Analysis-Searching
Using your SIEM to searchthe IOC (YES/NO question!)
TueDenn Security Bootcamp -Let the Hunt Begin 65
NO RESULT!

66. Collect -Large Volume
TueDenn Security Bootcamp -Let the Hunt Begin 66

67. Analysis-Grouping
TueDenn Security Bootcamp -Let the Hunt Begin 67

68. TueDenn Security Bootcamp -Let the Hunt Begin 68
Analysis–Grouping &Stacking

69. Analysis–Stacking
TueDenn Security Bootcamp -Let the Hunt Begin 69

70. Analysis–Stacking
TueDenn Security Bootcamp -Let the Hunt Begin 70

71. Analysis–Stacking
TueDenn Security Bootcamp -Let the Hunt Begin 71

72. Analysis–Stacking
TueDenn Security Bootcamp -Let the Hunt Begin 72

73. Document
➢Follow your document method
➢Report finding threat for
stakeholder
➢IR need?
➢Enrich your procedures
knowledge base
➢Share!
TueDenn Security Bootcamp -Let the Hunt Begin 73

74. Improve Security
➢There is 01 rule about
CREATEpowershelljob
in the wild!
➢what if bypassed?
➢Do you monitorthe
powershelljob folder?
➢The time is NOW!
TueDenn Security Bootcamp -Let the Hunt Begin 74
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml

76. Take Away
Keys

77. Key Take Away
➢Threat Hunting is for all organization
➢Threat Hunting shinkthe dwell time
& improvedetection capability
➢Threat actors is coming!
➢knowenermy, knowyourself
➢Followyour method
➢Matureyour hunt to cutting-edge
TueDenn Security Bootcamp -Let the Hunt Begin 77

78. TueDenn Security Bootcamp -Let the Hunt Begin 78
What’s
Next

79. What’s Next
➢Define & follow Strategy, Methodologies and
Maturity model
➢StartonPost-Exploitation
➢Thinkingoffense, leads to smarterhunting!
➢Assumenothing, Beliveno one, Curious everything!
➢Remind "hunting is a practicelike any other; you
learn best by doingit, so don’t hesitate to jump
in“
TueDenn Security Bootcamp -Let the Hunt Begin 79

80. References
➢threathunting.net
➢huntpedia
➢framework-for-threat-hunting-
whitepaper
➢hunt-evil-practical-guide-
threat-hunting
➢threat-hunting-team-maturity-
model
➢splunk-threat-hunting
➢ready-to-hunt-first-show-me-
your-data
➢sans-webcasts-threat-hunting-
100967
➢sans-generating-hypotheses-
successful-threat-hunting-37172
➢sans-2024-threat-hunting-
survey-hunting-for-normal-
within-chaos/
TueDenn Security Bootcamp -Let the Hunt Begin 80

81. tuedenn
goDefend
tuedenntuept