Threat Hunting Section 5 Flashcards
Things to consider when determining what level of risk exists:
- How can the attack be performed (Can in be performed against our current configurations?)
- What is the potential impact to the CIA of data
- How likely is the risk to occur. (how exploitable is it?)
- What mitigations are in place. (if we already have controls in place to prevent the vulnerability it is effectively mitigated.)
Threat modeling
the process of identifying and assessing the possible threat actors and
attack vectors that pose a risk to the security of an app, network, or other system
When conducting threat modeling, whose POV are you evaluating the system from?
Both the defenders and attackers POV. You’re evaluating the system from both the inside-out and the outside-in.
▪ By doing this you can start seeing where your systems are vulnerable and what type of mitigations you need to put in place.
What are the main areas to considered when conducting threat modeling?
- Adversary Capability
- Attack Surface
- Attack Vector
Adversary Capability
▪ a formal classification of the resources and expertise available to a threat actor
Types of capabilities (Main and additional considerations)
- Acquired and augmented
- Developed
- Advanced
- Integrated
Additional considerations: 1. Likelihood - chance of a threat being realized (usually expressed as a %) and 2. Impact - cost of a security incident or disaster scenario (usually expressed as a dollar amount)
what does Acquired and augmented mean in threat modeling
they’re using commodity malware and open source tools and techniques.
what does Developed mean in threat modeling
they can ID and exploit 0-day vulnerabilities and deploy significant human and financial resources to attack planning and execution.
what does Advanced mean in threat modeling
they can exploit things like supply chains and introduce vulnerabilities early in the cycle where you won’t even know they’re inside your systems.
*This can be especially true if you’re dealing with a nation state because they use an integrated approach when they’re using cyber and non-cyber methods to achieve their goals.
Attack surface
▪ the point at which a network or application receives external connections or inputs/outputs that are potential vectors to be exploited by a threat actor.
What are some examples of an attack surface?
- The holistic network - switches, routers, computers, all the things that makeup your corporate data network.
- Websites or cloud-services - things that could be attacked from an end user either through the web front end or programmatically through our API.
- Custom software applications - Customizations always introduce vulnerabilities that need to be considered when they’re being delpoyed.
Attack Vector
▪ a specific path by which a threat actor gains unauthorized access to a system.
Name 3 Attack Vector types
- Cyber - this means you’re using hardware or software against an IT system.
- Human - this means you’re using social engineering to conduct your attack through coercion, impersonation or even force.
- Physical - this means you’re trying to take over local access by being on-premise and touching the thing to do your attack.
How is risk assessed?
by factoring your likelihood of an event and the impact of that event.
Threat Hunting
A cybersecurity technique designed to detect presence of threats that have not been discovered by normal security monitoring. (proactive rather than reactive like incident response is)
What are the steps of threat hunting
- Establish a hypothesis
- Profiling Threat Actors and Activities
Establishing a hypothesis is derived from..
threat modeling and is based on potential events with higher likelihood and higher impact if they were to occur.
o We sit and think things like, ‘who might want to harm us?’ ‘Who might want to break into our networks and how might they be able to do that?’
o By going through our threat intelligence, we can create a good hypothesis about what type of campaign or what type of adversary group might want to do us harm.
Profiling Threat Actors and Activities involves..
the creation of scenarios that show how a prospective attacker might attempt an intrusion and what their objectives might be. (we are really relying on that threat intelligence here)
o We sit and think things like, ‘what TTPs might they use?’, ‘are they an insider, a hacktivist, a nation state or an APT?’
What can we start determining from profiling threat actors and activities
what their objectives might be and what systems they might be going after.
What does threat hunting rely on
the use of the tools developed for regular security monitoring and incident response.
▪ We are going to be analyzing logs, process info, file system and registry changes from all the different hosts. Generally, all that info is going to be consolidated for us inside of a SIEM.
What are we looking for when we are threat hunting?
the things that aren’t detected, things that have bypassed the rules, things where the query isn’t returning the data we expected it to.
o You need to assume that these existing rules have failed when you are threat hunting.
Example of a process for threat hunting
- Analyzing network traffic - determine if theres network traffic to some sort of sus/mal domain or C2 server based on our threat research and reputation DB.
- Analyze the executable process list - Seeing what programs and services are being run and which ones were opening that network connection. Are these valid connections or something sus?
- Analyze other infected hosts - to help us see similarities.
- ID how the mal process was executed - what allowed it to start, is there a way we can block that attack vector against future compromises?
What benefits can come from threat hunting?
- Improve detection capabilities.
- Integrate Intel
- Reduce attack surface
- Block attack vectors
- ID Critical assets
How does threat hunting improve detection capabilities
when we find a way a bad guy got in and bypassed detection, we can feed that info back into the detection plan and rewrite the rule sets and detection algorithms to make sure that you use additional scripting and customizations to detect things more accurately. This way your results from threat hunting can be used to improve your signature-base detection and prevent future infections.
