Anton’s Favorite Threat Hunting Links

As Richard Bejtlich in The Practice of Network Security Monitoring says on Analysis:

“Analysis is the process of identifying and validating normal, suspicious, and malicious activity. IOCs expedite this process. Formally, IOCs are manifestations of observable or discernible adversary actions. Informally, IOCs are ways to codify adversary activity so that technical systems can find intruders in digital evidence. For example, the Mandiant APT1 report (http://www.mandiant.com/apt1/) released in February 2013 listed more than 3,000 IOCs, including IP addresses, domain names, and MD5 hashes of tools used by Unit 61398 of the People’s Liberation Army. (Mandiant identifies certain threat groups with the prefix APT, followed by a number, such as APT1, APT2, and so on.)
I refer to relying on IOCs to find intruders as IOC-centric analysis, or matching. Analysts match IOCs to evidence to identify suspicious or malicious activity, and then validate their findings.

Matching is not the only way to find intruders. More advanced NSM operations also pursue IOC-free analysis, or hunting.

In the mid-2000s, the US Air Force popularized the term hunter-killer in the digital world. Security experts performed friendly force projection on their networks, examining data and sometimes occupying the systems themselves in order to find advanced threats. Today, NSM professionals like David Bianco (http://detect-respond.blogspot.com/) and Aaron Wade (http://forensicir.blogspot.com/) promote network “hunting trips,” during which a senior investigator with a novel way to detect intruders guides junior analysts through data and systems looking for signs of the adversary. Upon validating the technique (and responding to any enemy actions), the hunters incorporate the new detection method into a CIRT’s IOC-centric operations. (Chapter 10 and Chapter 11 contrast the matching and hunting methodologies to demonstrate the strengths and weaknesses of each.)
”

Hunting is not special. It’s just an analysis technique. It doesn’t need these complicated guides. You take a few network or memory capture assessments, gather and/or categorize the artifacts, and analyze them.

The tools and techniques for analysis are what is interesting. When I compare something like Stamus Networks SELKS to SO, I contend there is further value there. Same between Rekall and Volatility, but perhaps less defined. The tools get better, but the techniques are really where the power is.

Take NetSA (or FlowBAT) and compare it to Cloudera OpenNetworkInsight. Take any SIEM, even MozDef, and compare it to Apache Eagle. Once you integrate modern querying techniques against Big Data, it contrasts the old-school way of doing things pretty heavily.

FIR and CRITs have nothing on MISP. Moloch is a sad technique compared to OpenNetworkInsight. There are nice things to say about the NoSQL in Elastic, but the ELK stack itself is having components such as LogStash all-but replaced by Heka, or at least supplanted with Kafka (or both). It’s not about using GRR or MIG, but how you use them against adversaries (and the OPSEC and CI HUMINT involved — way more strategic than commercial EDR).

The big picture for cyber operations, defense, and investigations is in the lifecycle and frameworks, but with a consistent platform. These piecemeal components don’t add up to a singular view. Leverage streaming to Flume and Hadoop… the automation can inquiry the analysts to do the rest. But do build the domain knowledge into your bespoke platform — don’t assume it will do it for you!