SECOPS 4: Hunting Cyber Threats Flashcards
HM0
Relies on alerting (IDS). Cannot effectively hunt.
HM1
Manual hunt ops. IDS alerts and internal info. Use threat intel feeds to identify threats.
Manual hunt.
HM2
Incorporate hunt techniques from external. Large amounts of info.
Active hunt operations
HMM
Hunting Maturity Model
Hunting Maturity Model
Created by Sqrrl. Levels of maturity for a threat hunting operation.
HM3
Analyze info of different types and use it to ID new malicious activity.
Do not rely on external.
Machine learning, data vizualization
HM4.
HM3 + automation. Scripts written based on intel and procedures.
Hunting Cycle
Hypothesize
Investigate
Uncover
Inform and enrich
Hypothesize
Look at system from perspective of the atacker
Investigate (Hunting cycle)
Use tools to investigate hypothesis
Uncover (Hunting cycle)
Hunter attempts to discover a pattern or TTP.
Analyst investigates IOC’s to determine who was infected and what was done.
TTP’s are then shared.
Inform and enrich (Hunting cycle)
Documentation and automation
TTP
Tactics, techniques, and procedures.
How an attacker maintains presence.
CVSS calculates…
chance of compromise and potential severity of damage
Base metric
characteristics of a vuln that are constant over time and across user environments.
Base metric composed of…
Exploitability metrics, impact metrics
CVSS Attack Vector
More remote equals higher score.
Local, adjacent, network, physical
Attack complexity
Conditions beyond attackers control that must exist to exploit
Low, High
Privileges required
Privileges needed to exploit
None, low, high
User interaction
Whether a user other than the attacker must participate for exploitation to succeed.
Scope
Ability for vuln in one component to impact other resources or privileges.
Confidentiality Impact
Vulnerabilities impact on confidentiality
Integrity impact
Impact to trustworthiness or accuracy of info
Availability impact
Can affect bandwidth, proc time, disk space
Exploit code maturity
Likelihood of vuln being attacked based on current exploit availability
Remediation level
Score goes down with availability of a patch
Report confidence
Confidence that the vuln exists.
CVSS Environmental Metrics
Customize score based on Importance of IT asset to the users organization
Modified base impacts
Modify the impact of individual base metrics (Attack vector, Scope, CIA, etc.)
CVSS Scores are computed from
“Big 3” CIA
What modifies CVSS scores?
Temporal and environmental scoring
What has largest bearing on CVSS score?
Base score
Temporal scoring
“Time”. Based on vuln.
CVSS scoring interval
Point in time. Scheduled re-evaluation.
CVSS Final score
Score including environmental score. Used to prioritize
Base score
Computed by the vendor or originator with intention of being publishied
CVSS Rating: None
0.0
CVSS Rating: Low
0.1-3
CVSS Rating: Medium
4-6
CVSS Rating: High
7-8
CVSS Rating: Critical
9-10
