Tweet

@heyjokim

More from @jhencinski

Jon Hencinski

@jhencinski

17 Feb

Can we detect ZIP / JScript for initial access on 🪟?

1. Open txt editor
2. var WshShell = new ActiveXObject("Wscript.Shell");

WshShell.Popup("You can configure WSH files to open in Notepad");

WScript.exit;

3. Save as 1.js
4. Double-click
5. Query SIEM / EDR

What about #BEC in O365?

1. Create an inbox rule to fwd emails to the RSS Subscriptions folder
2. Query your SIEM
3. How often does this happen?
4. Can you build alert or cadence around inbox rule activity?

What about lateral movement?

1. Open PS
2. wmic /node:localhost process call create "cmd.exe /c notepad"
3. winrs:localhost "cmd.exe /c calc"
4. schtasks /create /tn legit /sc daily /tr c:\users\<user>\appdata\legit.exe
5. Query SIEM / EDR

Read 6 tweets

Jon Hencinski

@jhencinski

12 Dec 20

When I think about threat hunting:

- Pro-active search for active / historical threats
- Pro-active search for insights
- Insights lead to better understanding of org
- Insights are springboard to action
- Actions improve security / risk / reduce attack surface

With these guiding principles in hand, here's a thread of hunting ideas that will lead to insights about your environment - and those insights should be a springboard to action.

Here are my DCs

Do you see evidence of active / historical credential theft?

Can you tell me the last time we reset the krbtgt account?

Recommendations to harden my org against credential theft?

How many do we already have enabled?

Where can we improve?

Read 8 tweets

Jon Hencinski

@jhencinski

30 Oct 20

@AshwinRamesh94

To the "do it all" IT folks or new #SOC analysts that need a little help - a thread for you.

Cheat sheets and example queries for Endgame, CS Falcon, ATP, and CbR using a recent incident as the starting point.

cc: thanks to @AshwinRamesh94 for the query work

Yesterday we stopped a #ransomware attack at a customer where initial entry was a remote admin connection from a 3p IT provider

- Attacker had admin
- Connected to host via ConnectWise (RDP)
- Opened CMD shell to open PS download cradle to deploy SODINOKIBI from hastebin[d]com

The attacker ransomed 1 host - but by removing access 6 min after the attack started - stopped it from becoming a much bigger issue.

Let's walk through a question or two we asked along the way using different EDR tech....

Read 15 tweets

Jon Hencinski

@jhencinski

28 Oct 20

TL;DR - Potentially bad #ATP rule update last night. Don't panic. Investigate - don't let me bias you. Providing for broader context.

#MDR insight: Between 06:25 UTC - 07:40 UTC we detected an unusually high # of false positive MS Defender ATP alerts for "Cobalt Strike C2".

We observed false positive alerts for:
[CommandAndControl] Cobalt Strike C2

Observed at: all customers running MS Defender ATP.

Fp sequence: System boot / logon initialization / ATP alert on netconn to 127.0.0.1.

We timelined.

No evidence of attacker activity. Bad rule.

@Microsoft

Please don't let me bias you. This thread was built with the intent to provide greater context.

Yes, other orgs running @Microsoft Defender ATP had false positive alerts for [CommandAndControl] Cobalt Strike last night / this am.

From what we see: bad vendor rule (it happens)

Read 5 tweets

Jon Hencinski

@jhencinski

25 Oct 20

"Do you have any questions for us?"

An effective interview includes 🕘 for the applicant to ask questions.

A few to consider if you're interviewing:
1. What are the big problems you're solving this year?
2. One year from now this person has been successful. What did they do?

3. Conversely, six months from now it didn't work out. What happened?
4. How do you measure performance? What's the cadence?
5. What's the typical tenure for this role?
6. Is the team growing or is this hire a backfill? If backfill: can you talk about the employee's new role?

7. Will we have weekly 1:1s. If so, what's a typical agenda?
8. How many direct reports do you have?
9. What's a typical day look like?

If you're unclear on the traits and skills the hiring manager is seeking, ask!

"What are the traits and skills you're seeking for this role?"

Read 8 tweets

Jon Hencinski

@jhencinski

26 Apr 20

How do you measure #SOC quality? 🤔

1. ISO 2859-1 (#AQL) to determine sample size
2. #Python #Jupyter notebook to perform random selection
3. Check sheet to spot defects
4. Process runs every 24 hrs
5. (Digestible) #Metrics to improve

How'd we get there? Story in /thread

I'll break the thread down into four key points:

1. What we're solving for
2. Guiding principles
3. Our (current) solution
4. Quick recap

My goal is to share what's working for us and how we get there. But I'd love to hear from others. What's working for you?

What we're solving for: All work is high quality, not just incidents.

On a typical day in our #SOC we'll:
- Process Ms of alerts w/ detection engine
- Send 100s to analysts for human judgement

Those 100s of alerts result in:
- Tens of investigations
- Handful of incidents

Read 10 tweets

Share this page!

Jon Hencinski

Try unrolling a thread yourself!

More from @jhencinski

Jon Hencinski

Jon Hencinski

Jon Hencinski

Jon Hencinski

Jon Hencinski

Jon Hencinski

Did Thread Reader help you today?

Like this author's thread?