You have network monitoring capabilities. Great! But what are you looking for?

All too often folks start focusing on individual attacks. And yes, it's important that you can catch the latest RAT from Grid Iguana (from Hacksylvania)

Don't lose sight of the big picture.
Monitor for DMZ outbound traffic.
Almost all DMZ systems are responding to some request from remote user. Your DMZ systems are the destination, not the source. An early indicator an attack worked is a DMZ system phoning home to the C2 network. Your machine is a source here.
Like all things, this isn't 100%. There will be a few DMZ systems that do originate outbound traffic... but it should be rare enough that you can detect on this alone and have a short exception list for known outbound originators.
Next, look at top talkers. I like to do this by protocol.
Who spoke the most DNS (besides the DNS Servers)? That might be a misconfiged box, or DNS tunneling.

Who spoke the most HTTPS? Could be you found the marketing person not doing any work all week long.
For top talker analysis, consider two forms. Raw packet count and raw byte count. Look for the outliers here.

C2 traffic can have high raw packet count.
Exfil of your data can be high raw bytes.
Now start looking for long connections. Most network protocols are short use and short lived. (Think website traffic).

C2 is long lived. Your net mon tools will show it as hours... most other things will be minutes... if that!
Next, look for port/protocol mismatch. While you're allowed to send HTTPS to TCP 53, it's strange (so much so it was odd to type that). Likewise, 80 could be telnet. But dang is that odd.

This will be one of your lowest false positive network detects. PLEASE DO THIS
At the very best, you've found a misconfigured bit of software, or maybe a NIC flaking out. More evil option is you found some post exploitation tool that doesn't expect you to do this analysis.

Port protocol mismatch is awesome and needs to be done everywhere.
If you only did the stuff I've covered so far, and consistently, you'd be ahead of many networks.

The final advice is to start doing this analysis on a per team basis.
Do everything I covered at each point in your network. You'll start being able to ask odd questions.

Future you: Why is Bob in accounting talking to other internal servers at 5x the volume of anyone else? The rate is WELL below our alarm trigger, but he's not THAT busy.
This is how you WIN in NSM. I love doing the deep catches for APT XYZ, but if you did just these outlined steps, (get ready for this)

You won't need APT group specific detects that much, because you'll already be catching them through these meta indicators.

Happy hunting!

• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with Mick Douglas

Mick Douglas Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @bettersafetynet

Jan 11,
I've got several DMs where folks are telling me it's hard to get logs. Yes. I agree. It's also table stakes. If you cannot get logs, hire someone who can... or get a contractor to help. Saying "it's hard" is true... but you 100% need those logs.
It's uncharacteristically harsh of me to say this... I don't care if it's hard for you to get those logs. GET THEM. If you cannot get them you no shot of stopping attackers.

Prevent is great, but it's not nearly enough. You must be able to detect. Logs are how you do this.
If your org isn't allowing you to get the logs for $reasons, maybe you need to leave. This is a no excuses thing. I cannot overstate this. I cannot believe I'm having folks argue this. I take comfort that they're embarrassed enough to only do this in DMs. They know it's bad.
Read 5 tweets
Jan 11,
Blue team folks... we have to talk.

It's awesome that you're logging. That's the first step. Now here's the cool stuff to look for that the vendor didn't tell you about.
Pay careful attention to logs that stop coming in. If it's worth logging, it's worth monitoring when the logs stop flowing. (how long a gap you'll accept is up to you, but I rarely allow for over an hour)
Watch out for log sources where the time changes too much. (except for daylight savings changes)

Time drift is one of the most critical things to account for in log analysis. That's a given... but...
Read 8 tweets
Dec 23, 2021
Pen testers, we need to talk. Please listen up, take notes... and above all, ask questions.

A non-trivial part of my service portfolio is now reviewing the reports of other firms and either adjusting or providing missing context.

Read on for the common issues...
Most important: you need to give clients multiple options on how to fix something. MULTIPLE. At least 3. Telling them "fix the code" when it's from a vendor that's closed, doesn't help at all.
Show your work. There's a few firms that hide what they're doing. Some to the point where they just show a "ta da!" screenshot and don't explain how they did it... and frankly, that's weaksauce.
Read 10 tweets
Dec 11, 2021
Just got off phone with a client. Log4j is in their network. Vendor claims patch will be available next release... which is multiple months from now.

Here's what you do if you're in this situation.

1. Keep calm. There's no need to panic.
2. Carefully read this thread.

First, it's bad. It's a remote code execution meaning any attacker will almost certainly be able to run code of their choice on your systems.

If you can, please patch it's the easiest path. But you're reading this because you can't patch (for whatever reason) OK, let's go!
When dealing with attacks like this you should remember the acronym IMMA.

I = Isolate
M = Minimize
M = Monitor
A = Active Defense

I'll walk you through the IMMA model for the Log4j attacks we've seen so far.

Read 20 tweets
Dec 10, 2021
Boating update:
Mrs signed us up for a week long bootcamp style live aboard sailing adventure... however unlike earlier trainings we've done... this school sent us books 4 months out. With a warning... most take 6 months to do the homework. We have 4.
We were granted an exception since we've got prior experience. After looking at these books... I'm regretting asking for it.

There's just **so** much to learn.

I'm most worried about the night non-radio signaling & signal flags. Stuff I've never done before. :-/
If our paths cross over the next few months, and you hear me making odd dinging or horn sounds... I've not gone mad... I'm practicing overtaking in fog procedures. (which it's cool how nuanced the conversation can be... but like... wow it's also complex)
Read 4 tweets
Dec 8, 2021
HR & middle management folks... we need to talk.

Some management of people is done in the most non-nonsensical ways.

You may know that I mentor folks... like a lot of them.

Today one called me almost in tears. With permission here's a redacted version.
End of year evals are due soon. This person was told to rank each employee. Top 25% will get bonuses and put on advancement path. Bottom 25% will be put on PIP!

For those not aware PIP is Performance Improvement Program, it's basically the first step to being fired.
For a very large team you may have a bell curve distribution where this may be a viable approach. (I'd like to quibble at the numbers, but it's not THAT bad)

The issue is this approach is **horrible** for the small teams we tend to have in infosec.
Read 8 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!


0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy


3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!