I've had 3 calls so far today (it's not even 10) about defending against Russian cyber ops
I'm tired of having the same call... so... here's what I've told everyone. This is the playbook you need... but it's not going to be what you think it will be.
Ready? Lets go!
1
I'm tired of having the same call... so... here's what I've told everyone. This is the playbook you need... but it's not going to be what you think it will be.
Ready? Lets go!
1
Watch your egress. Firewalls work both ways. Carefully monitor outbound traffic. DMZ servers RESPOND to external requests. Look for DMZ systems initiating outbound. This is what "phoning home" (aka C2) looks like.
2
2
Note: you will have a handful of DMZ servers initiating outbound. File xfer systems, any mail server (you likely shouldn't be running your own). Some web services may also initiate outbound.
But it's rare.
Most orgs? Your exception list will fit on a single sheet of paper.
3
But it's rare.
Most orgs? Your exception list will fit on a single sheet of paper.
3
Don't get too hung up on IP address blocks. Geo blocking has some advantages, but the only time Russian groups come from Russian IP space is when they want to rub it in.
Start treating the entire internet as hostile... because it is.
4
Start treating the entire internet as hostile... because it is.
4
You 100% must know what is "normal" exes on your systems. App control (used to be call white listing) is no longer a "nice to have" it's IMO table stakes. Anyone who claims otherwise is giving dated & dangerous advice.
5
5
If building an app control list sounds hard, you're doing it wrongly. Use native logging functions to know the apps that are running on systems.
If you don't have an EDR, etc.
Windows SRUM is my go to. It has a 30 day rolling view of EVERY exe run. Use that. Please.
6
If you don't have an EDR, etc.
Windows SRUM is my go to. It has a 30 day rolling view of EVERY exe run. Use that. Please.
6
I'd suggest you use @MarkBaggett's SRUM Dump utility or ESE tools
For single hosts:
github.com/MarkBaggett/sr…
For multiple hosts:
github.com/MarkBaggett/es…
7
For single hosts:
github.com/MarkBaggett/sr…
For multiple hosts:
github.com/MarkBaggett/es…
7
For knowing normal app use on linux hosts, use auditd or sysmon for linux. (again... if you don't have a fancy edr or something that can track this info)
Auditd
access.redhat.com/documentation/…
(this info will work even if you're not RH/RPM based)
8
Auditd
access.redhat.com/documentation/…
(this info will work even if you're not RH/RPM based)
8
You *must* know how your systems are being used for two reasons.
1. you need to block any app not on your accepted list. (set block alerts at highest priority. It might be legit need, and you'll want to fix that right away)
2. Living off land attacks...
10
1. you need to block any app not on your accepted list. (set block alerts at highest priority. It might be legit need, and you'll want to fix that right away)
2. Living off land attacks...
10
Living off land attacks are NOT new.
In 2013, there were two talks about LOL attacks. If you're not familiar with this... watch them NOW.
at is the new black
Living off the land
11
In 2013, there were two talks about LOL attacks. If you're not familiar with this... watch them NOW.
at is the new black
Living off the land
11
The reason it's key that you DEEPLY understand LOL attacks... they are what state sponsored attackers use when pressured to do so.
LOL attacks _work_
They allow attackers to bypass your AV, and yes likely your EDR.
12
LOL attacks _work_
They allow attackers to bypass your AV, and yes likely your EDR.
12
Because many orgs over rely on EDR and SIEM now, LOL attacks are highly successful. Attackers blend in. They are using core parts of the OS against you. None of your tools will stop these. You likely already have exclusions for the ports and protocols these tools use.
13
13
Do NOT believe your heuristics or ML/AI based tool will save you either.
A *CRITICALLY* under-viewed talk from @HackingDave at @WWHackinFest 2019 is how attacker are bypassing these techniques
(don't let Dave's outfit confuse you, it was Halloween)
14
A *CRITICALLY* under-viewed talk from @HackingDave at @WWHackinFest 2019 is how attacker are bypassing these techniques
(don't let Dave's outfit confuse you, it was Halloween)
14
Super critical: Don't buy vendor tools to catch the attackers. No matter how good the demo is... it's a demo.
Folks, I run a small company. We're not yet 5 years old. But I've personally bypassed EVERY SINGLE defensive control. Every single one.
15
Folks, I run a small company. We're not yet 5 years old. But I've personally bypassed EVERY SINGLE defensive control. Every single one.
15
I bypass all these controls in a lab. I invested about $17k and have a massive 3 node proxmox cluster and 14 TB NAS. I can emulate most orgs, or a significant portion of them.
If my boutique infosec consultancy has these resources... what does a state sponsored one have?
16
If my boutique infosec consultancy has these resources... what does a state sponsored one have?
16
If your IR plan doesn't have a rapid (host and network level) isolation workflows. Make it just after the stuff I've talked about in prior tweets. Drill it. You're going to need to work at a speed you likely haven't before.
17
17
Have a frank talk with your cyber insurance provider. It might get *real* bad. Ask where you will be on the priority list. Chances are if you're not a fortune single digit org, you're going to be way down the queue. Find some alternate DFIR firms that will take you on.
18
18
Increase your logging, while both filtering out stuff you don't care about at your aggregators, and SHORTENING the retention length for the data you don't need long term.
Many logs age like milk. (looking at you DNS logs)
19
Many logs age like milk. (looking at you DNS logs)
19
I know things are going to get spicy. It sucks. It's not fair. But it is what it is.
The playbooks we've been following for too long are now being used against us. You can either accept that, or be beaten before you even show up to fight.
20
The playbooks we've been following for too long are now being used against us. You can either accept that, or be beaten before you even show up to fight.
20
That said, you *can* win this fight.
Once the attackers are in, you only need to detect them once.
You can do stuff like make MSFT an untrusted publisher on a Windows box by allowing ONLY what is listed in SRUM analysis.
21
Once the attackers are in, you only need to detect them once.
You can do stuff like make MSFT an untrusted publisher on a Windows box by allowing ONLY what is listed in SRUM analysis.
21
You have the best CTI at your fingertips. Leverage CTI feeds if you have them.
Your hosts tell you how they're being used and abused. Start listening.
Prevent isn't possible. Try anyway.
Move to a detect and respond model. That's our path to victory.
You got this.
fin
Your hosts tell you how they're being used and abused. Start listening.
Prevent isn't possible. Try anyway.
Move to a detect and respond model. That's our path to victory.
You got this.
fin
• • •
Missing some Tweet in this thread? You can try to
force a refresh
