when threat hunting fails
play

When threat hunting fails Identifying malvertising domains using - PowerPoint PPT Presentation

Jun 29, 2023 •247 likes •717 views

When threat hunting fails Identifying malvertising domains using lexical clustering Tucson, January 9th, 2018 Authors kitty Matt Foley David Rodriguez Dhia Mahjoub 2 Background Ad Network Profiling and Filtering Agenda Lexical Clustering

  1. When threat hunting fails Identifying malvertising domains using lexical clustering Tucson, January 9th, 2018

  2. Authors kitty Matt Foley David Rodriguez Dhia Mahjoub 2

  3. Background Ad Network Profiling and Filtering Agenda Lexical Clustering Hosting space and top talkers 3

  4. Background 4

  5. Exploit Kits Compromised Site Compromised Site Step 1. Gets lander (proxy) EK Server Malvertising Victim Ad Net. Publisher Staged Site (Ad) 5

  6. What is Malvertising Ad Networks Ad Exchanges DSPs Visitors Ad Agencies Publishers Ad Servers 6

  7. 7

  8. Ad Campaign Flow User visits publisher site Publisher Site Publisher site includes ad network javascript Compromised Ad Net. Compromised Ad Net. Examples: Tech support scam Rig Exploit Kit Fake flash/java update Ad network fingerprints and sends user to malvertisement 8

  9. Exploit Kits 9

  10. Tech Support Scams 10

  11. Fake Flash and Java Updates 11

  12. Ad Network Profiling and Filtering 12

  13. Filtering on non-residential IP Address 13

  14. Proxy Network 403 Squid Proxy Choice of region Rotating IPs 14

  15. Filtering on non-residential IP Address 403 GET Ad Network Returns a 403 Browsing with Ad Network DigitalOcean proxy 15

  16. Attempts with other VPS providers 16

  17. Attempts with other VPS providers 17

  18. 18

  19. 19

  20. Lexical Clustering 20

  21. Attention to Details 21

  22. Fake Flash and Java Updates 22

  23. 23

  24. More or Less Traveled Roads 24

  25. Consider the almighty RegeX Keywords safe content build free apple click Synonyms Typos Known UnKnown Keywords Keywords 25

  26. Consider the almighty RegeX grep “*.fake.*” 26

  27. Traffic Pattern of Fake Update Sites 27

  28. Traffic Pattern of Fake Update Sites Look for burst in traffic 28

  29. For one word, many 29

  30. Shingling Fake Flash and Java Update Trigram host name contentfreeandsafe4update {‘con’, ‘ont’, ‘nte’, ‘ten’, ‘ent’, …, ‘ate’} 30

  31. Shingling Fake Flash and Java Update Trigram host name contentfreeandsafe4update {‘con’, ‘ont’, ‘nte’, ‘ten’, ‘ent’, …, ‘ate’} MinHash LSH 31

  32. Locality Sensitive Hashing Fake Flash contentfreeandsafe4update contentfreeandforupdate 3 Domains with a lot of shingles in common content4freeandsafeupdate con tent fre and saf dat 32

  33. On to production 33

  34. Clustering Pipeline Realtime/Batch Count min-sketch Out pipeline hasher pipeline goodnewcontentssafe.download Cluster DB Analyst Dashboard 34

  35. Payday 35

  36. Fake Flash and Java Update Lexical Clustering cluster_1: cluster_2: goodnewcontentssafe.download call-mlcrosoftnw-err81711102.win goodnewfreecontentsload.date call-mlcrosoftnw-err99817109.win goodnewfreecontentall.trade call-mlcrosoftnw-err81711101.win ... ... cluster_3: cluster_4: artificialintelligencesweden.se mkto-sj220048.com artificialintelligencechip.com mkto-sj220146.com artificialintelligence.net.cm mkto-sj220162.com ... ... 36

  37. We need help 37

  38. Simple Flask App Dashboard 38

  39. Hosting space and top talkers 39

  40. Where are these hosted? Any patterns? ● Take 1 week’s worth of detections and their hosting space; Jan 1-7 ● Some hosters are consistently abused AS12876, FR AS14618 Amazon AWS and more Some IPs are actively hosting thousands of domains for months ● Some hosters are highly infested with shady, toxic content; dedicated? AS202023, LLHOST, RO; phishing, tech support scams, fake updates, porn 40

  41. Who is querying these domains? ● Take 1 week’s worth of detections; Jan 1-7 and user IPs ● 10 busiest hours 20000+ user IPs querying 2000+ malvertising domains ● Some top talker clusters emerge Security companies owned ranges querying hundreds of domains Some rogue networks querying hundreds of domains 41

  42. Summary 42

  43. grep “*.fake.*” Look for burst in traffic user IPs hosting IPs 43

  44. Current and NLP on misspellings and common typos Models to categorize clusters Future Work Identifying malicious file hosts using belief propagation 44

  45. Thank you Matt Foley, matfoley@cisco.com David Rodriguez, davrodr3@cisco.com Questions? Dhia Mahjoub, dmahjoub@cisco.com We are hiring 45

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

What The HELK? Enabling Graph Analytics for Effective Threat Hunting HELK THP OSSEM Agenda

What The HELK? Enabling Graph Analytics for Effective Threat Hunting HELK THP OSSEM Agenda

What The HELK? Enabling Graph Analytics for Effective Threat Hunting HELK THP OSSEM Agenda Effective Threat Hunting? Current state of threat hunting programs Graph Theory Definition Origins Types Graph

1.69k views • 75 slides
The New Security Frontier: Threat Hunting, Augmented Intelligence, and Automated Response

The New Security Frontier: Threat Hunting, Augmented Intelligence, and Automated Response

The New Security Frontier: Threat Hunting, Augmented Intelligence, and Automated Response Michael Melore, CISSP IBM Cyber Security Advisor @MichaelMelore June 2018 May 2018 May 2018 Threat Hunting Workflow Cognitive Advanced Analytics

443 views • 15 slides
MRO Security Advisory Council (SAC) Webinar One Companys Path to Establishing Threat

MRO Security Advisory Council (SAC) Webinar One Companys Path to Establishing Threat

MRO Security Advisory Council (SAC) Webinar One Companys Path to Establishing Threat Intelligence and Hunting Jamie Buening, Manager, Threat Intelligence and Hunting, MISO August 21, 2019 MRO SAC Update Technical Training and Social

478 views • 45 slides
Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss

Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss

Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss Post CERT Botconf 2016 | Advanced Incident Detection and Threat Hunting using Sysmon and Splunk | Tom Ueltschi | TLP-WHITE Seite 1 C:\> whoami /all

1.34k views • 115 slides
Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss

Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss

Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss Post CERT FIRST-TC 2018 | Advanced Incident Detection and Threat Hunting using Sysmon and Splunk | Tom Ueltschi | TLP-WHITE Seite 1 C:\> whoami

1.73k views • 128 slides
Bridging Security In Intelligence: Hacking, g, Threat Hunting, g, AI, I, Behavioral Anomalies,

Bridging Security In Intelligence: Hacking, g, Threat Hunting, g, AI, I, Behavioral Anomalies,

Bridging Security In Intelligence: Hacking, g, Threat Hunting, g, AI, I, Behavioral Anomalies, and In Incident Response Dangerous Toys USB Device Impersonators USB Killers Man in the Middle Faceplates Wireless Pineapples Payload Phone

727 views • 30 slides
DNS-BASED THREAT HUNTING: learn, share and improve. repeat. Joo Collier de Mendona @sec_joao

DNS-BASED THREAT HUNTING: learn, share and improve. repeat. Joo Collier de Mendona @sec_joao

TLP WHITE DNS-BASED THREAT HUNTING: learn, share and improve. repeat. Joo Collier de Mendona @sec_joao Zurich, September 2016. $ whoami Brazilian living in Germany for a long time Since 2010 at Deutsche Telekom CERT / CDC

643 views • 27 slides
OSINT: The Secret Weapon in Hunting Nation-State Campaigns alon@intsights.com Alon Arvatz

OSINT: The Secret Weapon in Hunting Nation-State Campaigns alon@intsights.com Alon Arvatz

DETECT . ANALYZE . REMEDIATE OSINT: The Secret Weapon in Hunting Nation-State Campaigns alon@intsights.com Alon Arvatz +972-545444313 1 1 1 What People Think 2 True or False? Threat intelligence Nation-state actors Commercial threat

247 views • 24 slides
Hunting Manufactures and distributes products that enable the extraction of oil and gas Hunting

Hunting Manufactures and distributes products that enable the extraction of oil and gas Hunting

Hunting Manufactures and distributes products that enable the extraction of oil and gas Hunting PLC Global Footprint 2 2009 Corporate Highlights Completed three acquisitions 47.3m Sale of Hunting Energy France 11.1m Year end

857 views • 37 slides
Cyber Security, Threat Hunting and Defense Challenge in Taiwan Academic Network NCHC/TWCSIRT

Cyber Security, Threat Hunting and Defense Challenge in Taiwan Academic Network NCHC/TWCSIRT

Cyber Security, Threat Hunting and Defense Challenge in Taiwan Academic Network NCHC/TWCSIRT Research Fellow Yi-Lang Tsai 1 Google Me. Yi-Lang Tsai ( ) Research Fellow , NCHC (National Center for High-performance

781 views • 49 slides
DESIGN, SIMULATIONS AND ANALYSIS OF AN AIR LAUNCH ROCKET FOR HUNTING LOW EARTH ORBIT'S SPACE

DESIGN, SIMULATIONS AND ANALYSIS OF AN AIR LAUNCH ROCKET FOR HUNTING LOW EARTH ORBIT'S SPACE

DESIGN, SIMULATIONS AND ANALYSIS OF AN AIR LAUNCH ROCKET FOR HUNTING LOW EARTH ORBIT'S SPACE DEBRIS HAMED GAMAL MOHAMED G. ABDELHADY Contents A concept for hunting unburnt space debris 1. Space Debris and the major threat of unburnt debris

294 views • 28 slides
Community benefits from trophy hunting: realities vs pretence by Dr Louise de Waal - EMS

Community benefits from trophy hunting: realities vs pretence by Dr Louise de Waal - EMS

Community benefits from trophy hunting: realities vs pretence by Dr Louise de Waal - EMS Foundation Slide 2 It is generally accepted that the greatest threat to wildlife and nature conservation is the ever- increasing footprint of the human

428 views • 10 slides
Waterfowl Hunting for Beginners by John Martsh R-3 Program Manager Hunting Techniques: Spot and

Waterfowl Hunting for Beginners by John Martsh R-3 Program Manager Hunting Techniques: Spot and

Waterfowl Hunting for Beginners by John Martsh R-3 Program Manager Hunting Techniques: Spot and Stalk Hunting Techniques: Decoying Hunting Techniques: Pass Shooting Gauge Sizes Choke extracted from muzzle Choke lengths and wall diameters

783 views • 29 slides
Hunting and detecting APTs using Sysmon and PowerShell logging TOM UELTSCHI BOTCONF 2018 C:>

Hunting and detecting APTs using Sysmon and PowerShell logging TOM UELTSCHI BOTCONF 2018 C:>

Hunting and detecting APTs using Sysmon and PowerShell logging TOM UELTSCHI BOTCONF 2018 C:> whoami /all Tom Ueltschi Swiss Post CERT / SOC / CSIRT since 2007 (over 11 years!) Focus & Interests: Malware Analysis, Threat Intel,

1.45k views • 115 slides
Assessment What is Threat Assessment Threat assessment is the process of gathering

Assessment What is Threat Assessment Threat assessment is the process of gathering

Threat Assessment What is Threat Assessment Threat assessment is the process of gathering information to understand the threat of violence posed by a person. Threat management is the process of developing and executing plans to mitigate

332 views • 15 slides
THE LEGALITY OF TIGER FARMING, TROPHY HUNTING AND CANNED HUNTING UNDER INTERNATIONAL LAW Cecil

THE LEGALITY OF TIGER FARMING, TROPHY HUNTING AND CANNED HUNTING UNDER INTERNATIONAL LAW Cecil

THE LEGALITY OF TIGER FARMING, TROPHY HUNTING AND CANNED HUNTING UNDER INTERNATIONAL LAW Cecil the Lion, Hwange National Park, Zimbabwe, 2013 Yann Prisner-Levyne WILD FAUNA= NATURAL RESOURCES UNDER INTERNATIONAL LAW Principle of permanent

400 views • 21 slides
GSN Investment Committee Presentation March 4, 2011 DRAFT Executive Summary GSN operates a

GSN Investment Committee Presentation March 4, 2011 DRAFT Executive Summary GSN operates a

DRAFT GSN Investment Committee Presentation March 4, 2011 DRAFT Executive Summary GSN operates a multiplatform U.S. cable network focusing on game show content and a digital business that includes skill-based games, casual games and an

402 views • 25 slides
Evaluation & Measuring ROI Spokane Regional Marcom Association A Hill+Knowlton Strategies

Evaluation & Measuring ROI Spokane Regional Marcom Association A Hill+Knowlton Strategies

Evaluation & Measuring ROI Spokane Regional Marcom Association A Hill+Knowlton Strategies Company February 2012 Agency History and Background 2 Established in 1927 as the nations first PR Agency Part of WPP company, a group of

200 views • 19 slides
Custom Writing Service - Special Prices Writing an evaluation paper presentation Creative writing

Custom Writing Service - Special Prices Writing an evaluation paper presentation Creative writing

Custom Writing Service - Special Prices Writing an evaluation paper presentation Creative writing 2015 sentence starters proposal of thesis research paper about alcoholism fostering critical thinking john chaffee review of related literature on

235 views • 4 slides
E A S T E R N M I C H I G A N U N I V E R S I T Y February 18,

E A S T E R N M I C H I G A N U N I V E R S I T Y February 18,

E A S T E R N M I C H I G A N U N I V E R S I T Y February 18, 2008 To All Professional Contractors Including General Contractors, Sub-Contractors, Service Vendors, & Material Suppliers RE: Contractor

477 views • 44 slides
Investor Presentation November 2019 Disclaimer This presentation contains forward-looking

Investor Presentation November 2019 Disclaimer This presentation contains forward-looking

Investor Presentation November 2019 Disclaimer This presentation contains forward-looking statements. All statements other than statements of historical facts contained in this presentation, including statements regarding possible or assumed

431 views • 26 slides
2018/19 Performance Benchmark Report Directors Office of Asset Management 1 What is the

2018/19 Performance Benchmark Report Directors Office of Asset Management 1 What is the

Tab 19 2018/19 Performance Benchmark Report Directors Office of Asset Management 1 What is the Performance Benchmark Report? CTC Guidelines: CTC Guidelines require an annual report to the Commission showing progress toward asset

490 views • 13 slides
2019 Atla nta Bike Cha lle ng e : Bike to b e r People I Partnerships I Planning Ma ke it fun,

2019 Atla nta Bike Cha lle ng e : Bike to b e r People I Partnerships I Planning Ma ke it fun,

2019 Atla nta Bike Cha lle ng e : Bike to b e r People I Partnerships I Planning Ma ke it fun, a ppe a ling , a nd e ng a g ing So urc e Prize s De ve lo p Me ssa g e E ng a g e Pe o ple Re c ruit Pa rtne rs Co o rdina te Pa id

440 views • 17 slides
Social Media: This is how we do it Better Information Presented by: Matthew Hurst

Social Media: This is how we do it Better Information Presented by: Matthew Hurst

Social Media: This is how we do it Better Information Presented by: Matthew Hurst Communications Manager Date: 27 November 2019 What we will cover today Why use social media? Selecting the right channels Defining your goals and

829 views • 66 slides

More recommend