NG-SOC in Taiwan The realities , the difficulties and the future Senior Technical Consultant Jack Chou
Who am I 就是一個不長 • 證照 : • 專長 : • Incident Response • CEH CHFI • Palo Alto Network ACE • Penetration Testing & Exploit Research • McAfee Vulnerability Manager • Malware Analysis • Security Solution Implementation • APT Gateway (TM DDI) • 經歷 : • APT Mail (TM DDEI) • 協助調查局偵辦第一銀行盜領案 • APT Endpoint (CounterTack MDR) • 建置企業 APT 防護 • 協助企業資安事件處理 • 犯罪研究及調查 • 司法官律師學分班結業萬惡考生中…
Agenda • What is NG-SOC? • The Realities ( 罪 ) • The Difficulties ( 苦 ) • The Future ( 未來 )
新一代 SOC-OODA(1) 大人物 (Tactics Techniques and Procedures) • 增加監控可視性 • EDR / EPP • 減少人為疏失及人力 • SOAR http://correlatedsecurity.com/an-ooda-driven-soc- strategy-using-siem-soar-edr/
新一代 SOC-OODA(2) 包山包海的 CTI http://correlatedsecurity.com/why-cyber-threat- intelligence-informed-security-operations-is-important/
Taiwan SOC Security Operation Center 客戶的期望是甚麼 ???
罪 在台灣從事資安工作本身就有很多原罪…
SOC 監控共同供應契約 次就是代表不限範圍與目標數 • 低流量 • EPS: 900 • IR: 3 次 • 中流量 • EPS: 2300 • IR: 7 次 • 高流量 • EPS: 4900 • IR: 15 次
我們都是萬能的資安從業人員… 客戶還有您的老闆對我們的高度期待… https://sansorg.egnyte.com/dl/K0PbjzWWau/
台灣的威脅情資 資通安全情資分享辦法 • 保留
苦 身為一個 SOC 商在苦也要盡力滿足客戶的高度期望…
SOC&IR 如何找未知 ??? KPI 用 CTI • 搜尋使用近期 CVE 且 攻擊三家客戶以上… • 甚麼 !!! • 是 大規模預謀攻擊 !!! • 但依然不及友商一年二十幾萬次的情資 回饋分享…
Offensive OSINT Attack Surface Management
Attack Surface Management 來源及方法例舉 Dark Web Monitoring Asset Discovery • Leaked/Stolen Credentials • APIs & Web Services • Pastebin Mentions • Web Applications & Websites • Exposed Documents • Domains & SSL Certificates • Leaked Source Code • Critical Network Services • Breached IT Systems & IoC • IoT & Connected Objects • Phishing Websites & Pages • Public Code Repositories • Fake Accounts in Social Networks • SaaS & PaaS Systems • Unsolicited Vulnerability Reports • Public Cloud & CDN • Trademark Infringements • Mobile Apps • Squatted Domain Names • Databases
Hunting Leaked & Misconfig API • 使用 VTgrep 語法搜尋客戶相關資料外洩 或樣本，發現可能洩漏的帳號密碼 • https://buckets.grayhatwarfare.com
Potential squatting • https://www.immuniweb.com/radar / • https://dnstwist.it/ (phishing domain scanner) • 廠牌名稱 + 客戶域名 +IT 常用關鍵字 (update 、 admin 、 365 、 windows 、 Microsoft…等 ) • Example: • symantecupdates.info • kaspernsky.com • windowsupdate.microsoft.365filtering. com
Leaked/Stolen Credentials Dark Data Discovery( 暗網情資蒐集 ) • https://raidforums. com/ • HUMINT • https://github.com /kevthehermit/Past eHunter • Hunchly Dark Web Report • https://darksearch.i o/ • https://github.com /s-rah/onionscan
Defensive OSINT 攻擊者視角
Digital Discovery • Open Service & Unrestricted Web • https://www.immuniweb.com/webs ec/ • https://www.immuniweb.com/mobil e/ • https://www.immuniweb.com/ssl/ • https://github.com/jack51706/Leak Looker-X
Outbound Hunting 連線 metadata https://blog.binaryedge.io/2019/07/08/guest-post-panda- • banker/ https://www.fireeye.com/blog/threat- • research/2020/07/scandalous-external-detection-using- network-scan-data-and-automation.html https://app.binaryedge.io/services/query?filter=MALWARE • https://www.shodan.io/search?query=category%3Amalwar • e https://blog.fox-it.com/2019/02/26/identifying-cobalt- • strike-team-servers-in-the-wild/ https://censys.io/blog/hunting-mirai • https://censys.io/blog/tracking-roamingmantis-mobile- • banking-threat https://censys.io/blog/hunting-for-threats-coinhive- • cryptocurrency-miner https://censys.io/blog/finding-hacked-web-servers • Infiltrate C&C • Backdoor Reversing •
Intelligence-Driven Incident Response and Threat Hunting 問世間 情資是何物…
Pivot and Threat Attribution Make Enrichment Great Again Sample Infrastructure • Unique Strings • Passive DNS • Network Communication/Encryption • TLS certificate tracking Algorithm • Correlation through metadata (web • Code / Strings Reuse server version, hosting provider, HTTP headers, Whois …) • Metadata(filename, description, version, title, author name) • Search of domain names/IP addresses on public sandboxes • Mutexes results • Behavior • HTTP static content tracking • Network flow https://github.com/threatresearch-issdu/ITHOME2020
情資蒐集方法及來源 • IR • VIRUSTOTAL Yara Hunting • Event Hunting • OSINT • 客戶提供之不明樣本分析及後續關聯 • Honeypot( Open Proxy 、 Tor node) • 主動木馬檢測 ( 資安健診 ) • 客戶資產監控 • https://www.one- tab.com/page/BQ9hxrRER9GYDMd 5d_v09Q • 多來源交叉關聯查證
CTI Lifecycle Pivot Enrichment Attribution IPS Detection VT IP / DN Block similar-to: Sample(175+) AV VT Block code- similar-to: CTI platform HTTP_PlugX_Trojan Deliver & Response VT Hunting & _CnC Crowdstrike 185.161.209.234 185.161.209.234 Enrichment 追蹤與分析 https://www.carbonblac k.com/2020/02/20/threa VT: t-analysis-active-c2- discovery-using- tag:winnti protocol-emulation- Infra enrichment part2-winnti-4-0/ 該 IP 經追蹤後可關聯到 VMWARE 提出的威脅情資 報告 該入侵源頭標記為 Winnti4.0 該文章可取得樣本共 19 隻
Attack Surface Management Commercial • https://cyberint.com/solutions/ • https://www.immuniweb.com/ • https://www.riskiq.com/illuminate- platform/
Human-Intelligence Network Anomaly Detection 工人智慧
SOC&IR 如何找未知 設備 RULE • TM DDI Rule: • Executable requested from root directory of web server
AI Network Anomaly Detection ExtraHop & DarkTrace • 圖論權重可視化 • 協定流量統計分析 • 攻擊途徑階段統計分析 • 資產屬性統計分析 • Network artifact metadata
SOC&IR 如何找未知 連線 metadata • PASTEBIN • GITHUB • Vultr.com • 頻率 + 過濾資料比對 + Dest IP/DN 不在 Alexa TOP 100M • DDNS
SOC&IR 如何找未知 防毒 RULE • 偵測到駭客工具 (TM OfficeScan) (HKTL_DUMP*) • 偵測到駭客工具 (TM OfficeScan) (HKTL_PASS*) • 偵測到駭客工具 (SEP) (Hacktool) • 防毒不是沒用，只是要看怎麼用跟看
Endpoint Visibility and Response
傳統端點偵測應處 EVTX 分析 • https://github.com/sans-blue- team/DeepBlueCLI • https://github.com/sbousseaden/EVTX- ATTACK-SAMPLES • https://www.malwarearchaeology.com/cheat- sheets • https://github.com/mvelazc0/Oriana/wiki/Hu nting-Analytics • https://github.com/0Kee-Team/WatchAD • https://github.com/JPCERTCC/LogonTracer • https://blogs.jpcert.or.jp/en/2017/12/research -report-released-detecting-lateral-movement- through-tracking-event-logs-version-2.html • https://github.com/NVISO-BE/ee-outliers
滅證 人工 IR 的極限 • Sdelete • ClearEventLog • https://github.com/Rizer0/Log-killer • https://github.com/hlldz/Invoke-Phant0m • Clear MBR • Ransomware
端點偵測應處 EDR Hunting Hypothesis • Office 0 day • 產生 Powershell 執行緒 (Fileless) • 中繼站連線 ( 網路連線行為 ) • 以客制 Threat Hunting 規則，即時發現並進 行處置 (process_name:winword.exe OR • process_name:excel.exe OR process_name:powerpnt.exe) AND netconn_count:[1 TO *] AND childproc_name:powershell.exe • APT VPN Lateral Movement ERS20191125 cb.urlver=1&q=file_desc:PacketiX •
未來 如何在客戶高度期待下…
SOAR 如果有東西把前面講的一堆手工方法半自動化… • Security Orchestration Use Case: Automating Threat Hunting • Playbook (436) • Detonate • Enrichment • Extract • Hunting • Investigation • Integration (569) • Automation (677) • Script (617)
ISSDU 新世代 SOC 架構 + =
Thank You
Recommend
More recommend
