(suspenseful music)
(audience claps)
- This is just my story about submitting a profile
to MITER ATT&CK and think those folks are here.
I need to meet Katie
but quick disclaimer, I'm not here in the name of
or speaking on behalf of my employer.
All opinions here are expressed are my own.
Just here to tell a story.
Okay, so a little bit of background.
Like I said, I was a consultant.
Did a lot of work doing incident response in forensics.
I'm gonna talk about what that was like before ATT&CK,
discovering ATT&CK, the research that I did,
the submissions I made,
talk about indicators and techniques
and some of the differences between the IOCs and TTPs
and a few takeaways.
Okay, so it all began for me in about 2010.
I went from doing forensics work for law enforcement
to one of the big consulting firms
and one of our clients was repeatedly a victim.
We did a lot of incident response all over the world.
We got to know how they did what they did very well
but as happens in consulting,
you get different clients, you move on.
That was kind of a new thing for me
because in law enforcement, as a forensic examiner,
you didn't just move on until a case was closed
and the bad guy was where he needed to be.
And so these guys kind of in my view got a pass from that
so I never forgot really about what they had done
to our client but life moves on, four years go by,
and in those four years,
some things changed for me personally.
I moved, got a new job, got married,
and now I have three kids.
And if you don't know, three is harder than two.
And both my bosses told me to have fun today
so I hope we have some fun today.
If you're married, you know what I'm talking about,
having two bosses.
Okay, so four years went by but I wanted to talk about
and share living through this constant barrage of repeated
attacks and what it cost as far as time and travel and work.
There just wasn't a lot of things out there.
I could talk about it but I couldn't really share much.
It felt like I was in the dark ages or something
because there wasn't a lot at this time in 2012
the best one I found was the Mandiant, it was really great.
I shared this a lot but it was one of two that I could find
that really, I think, describe well enough
what was going on so to me, it was the dark ages.
And so in May of 2015 when the ATT&CK framework come out,
was published, I immediately recognized its incredible start
a way to share how adversaries behave.
And ATT&CK now has all of these 11 tactics,
70 threat groups, 200 techniques, tools, but to me,
the most valuable thing were the references.
That to me, was the thing that stood out
because those references
and I'll talk about this in a little bit,
they were pretty authoritative.
And so to me, the dark ages were over
and information security to me
was the beginning of the Renaissance.
When you talk about the Renaissance,
you have to talk about the Mona Lisa.
To me, ATT&CK is like information security
entering the Renaissance.
So I saw it, I wanted to be a part of it.
In August 2015, I emailed them.
They said, here's what you need.
You have public references that
associate the malware to the threat group.
Do you have public references that
associates the techniques to the threat group?
And can these references be linked to a definitive source?
And are they clear and not open to interpretation?
I mean, it sounds pretty similar coming from law
enforcement, I kinda knew what they were asking for.
I thought about it a little bit more and bottom line,
they basically just wanted proof and what is proof,
it's simply evidence of the truth.
And if you're former law enforcement,
you know that evidence comes from the Latin word provideo.
They wanted to see and have it be obvious.
So nothing that you had to interpret.
They wanted it to be definitive and so they wanted,
after looking into it, a little bit more detail.
They've since come out with the philosophy paper
that details this even more.
If you haven't read that, I recommend it.
Philosophy and design paper, I think, June or July,
they came out with it
and they talk about empirical evidence.
And for me, former law enforcement,
empirical evidence that supports your science-based
investigation, that is your forensic evidence.
So light bulbs went off for me,
okay, they just want some evidence.
But they wanted empirical evidence
and empirical comes from the word experience
so experience comes from your sense so again,
they wanted to see and have it be obvious.
It's hard to, video being the best form of evidence.
It's hard to get, you don't often get your adversaries
on video doing the crime, it does happen.
Anybody seen the recent Muller indictment?
Thanks to the Dutch intelligence service,
they did actually catch them on video, it does happen.
But in October, they came back.
They said, "don't think there's enough public reporting
"to assert with high confidence" of what I gave them.
They were right, there wasn't a lot.
Most of what I knew from my experiences
had not been made public so I kinda knew some things
but I wasn't able to disclose.
And so they were right to say we don't think so.
They said, we need to go deeper and they were right
so back to the drawing board but at the same exact time,
come to find out Mircon is going on in DC 2015
and for the first time,
the threat group that I had dealt with finally got a name.
FIN5, they finally got definitively
associated with their malware RawPOS
so for me, it was like okay, case back open.
And another mention a day later,
I didn't close out my case, I kept it open,
I kept occasionally looking, there was new stuff.
That's one of my takeaways, just have a little persistence.
If you find yourself on the trail
of one of these threat groups,
they're the ones that need to be afraid
if you have persistence.
They made a mistake, you caught them, you're following them,
just keep watching, you'll find more.
So a year later, in GrrCon, this presentation,
attacking the hospitality and gaming industries,
tracking an attacker around the world in seven years,
it was a 55 minute talk, it had tons of details.
So much detail that I reached out to some former colleagues
who were still consulting and they confirmed it's exactly,
they're talking about the same person.
So Mandiant had been dealing with the same group
that we were and so it was really great confirmation
and the only thing that was different was some of the names.
They liked to name things differently
but after decoding that, it became obvious again
that we were dealing with the same group
and now I had some information to add to mine.
Another thing he mentioned in the talk that these guys
were in or around a place called Hackerville.
Anybody heard of Hackerville?
It's a place in eastern Europe, one of the towns that
is like the Ferrari and Lamborghini capital of the world.
These guys,
I'm not super upset with these guys
but they're criminals, they belong in jail
from my experience, they're still out seven years later,
driving Ferraris, I'm driving a Ford.
I'm not upset.
So they talk about their everything, their whole lifecycle
from compromise to reconnaissance to privilege escalation,
conducting their mission, completing their mission.
It's all identical, I now have a great reference point.
They use RawPOS, talk about how they do it.
If it's RawPOS, it's FIN5, authoritative, direct proof.
So I keep looking, I find more.
I had some of these because they'd been around for so long.
I knew there was more out there
so I start looking some more and I find more.
And so as an investigator, one of your jobs is to keep sight
of the big picture just like putting a puzzle together.
Anybody like puzzles?
All it takes is a little bit of time,
a little bit of connecting the dots.
So I took what I had, I made sure they were linked,
but I come to find out there were more, I was missing a few.
I added a few more, I'm up to 14 now
and so the next thing I do, I have a great picture.
It's coming together, it's not all the way yet
so I keep looking, I go back to that Mircon conference
and I look at who talked.
There's a great resource out there called ConCollector.
It's a database that now has around 50,000 speakers
and presenters covering 2,000 conferences
of the last 30 years.
It's a tremendous resource for finding out
who has talked where on what.
And Emmanuel and Barry, best talk in hospitality industry,
APT in hospitality and gaming industry.
This talk was never published
and these guys never spoke again unfortunately.
But this talk Preston Lewis and Matt Bromley,
they spoke again.
NolaCon last year in fact was Matt Bromley's.
Talked about their use of PsExec
and what version it was, had some great details,
and then Preston Lewis talked about attacking
the hospitality and gaming industries,
tracking an attacker around the world in eight years.
And that was another great talk, hour long talk almost,
full of details so I had another great reference
so the picture is coming together.
Just a little bit of persistence.
Again, the lifecycle, a lot of details.
Anybody notice any additions to this?
It's hard to see.
So they are slow to do many changes,
I was surprised they did any 'cause it still works.
What they're doing is still working since 2008
but they did change,
I guess things are getting a little harder.
They added Mimikatz which is latest greatest way
to capture credentials to their escalating privileges.
They added HeidiSQL for reconnaissance
and they are starting to defeat single factor VPNs
for their initial access
so interesting additions to their techniques.
Next thing I do to try to finish this picture
so that it's pretty obvious for them is
I use a tool called POC Parser by Armand Buscher I believe.
His name, it's on GitHub, it's great tool
if you want to extract IOCs out of PDF files for example.
Here are the hashes I got out of the reports.
So I started researching the hashes just to keep going here.
These reports were good but they were not great,
they were not the smoking guns or anything.
So keep going, next thing I do is I import all those hashes.
I'm still driving my Ford so I'm mad but I'm not so mad
I'm gonna go through every single hash
from every single report.
Obsession is not required to do this.
It's just a little bit of persistence.
So I found a shortcut so by, I'm familiar with Multego,
it's a great tool if you're not familiar.
It can handle CSVs and you can do anything with it
to create a visual.
I created this, the yellow are the reports
and the red are the hashes and some of the red are bigger.
That's 'cause those are the ones
that are in multiple reports so I focus on those.
Turns out more reports, these guys have been around
a long time I knew there was more out there.
These were definitive, these were directly linked,
these were authoritative so October 2017,
I felt I had enough to make another submission.
Included 10 tactics, 14 techniques, from 30 references,
from 30 different security organizations.
Carbon Black being one of them, they were great.
So give a shout out to our sponsor.
And they came back this time and they published.
They published five at first.
There's now, I don't know how many now up there,
at least 10 or so but they covered,
I was pleased they covered each stage in the lifecycle
and so now I felt like my case was finally closed.
I have shared what cyber criminals were doing,
how they were doing it, and so now,
this is my way of doing that.
So some of my favorite of the techniques
being a former law enforcement forensic examiner,
the anti forensic techniques were my favorite.
The removing of indicators,
that they would delete the event logs.
At the time, that's all you could do was delete,
you couldn't edit them like you can now thanks to NSA.
Dumped by the, who was it, the shadow brokers.
So a little bit harder to tell now,
that was a big giveaway at the time.
The other one was encrypting their tool sets
so they would encrypt RAR files full of all their tools
and that was sometimes effective.
We usually could crack the password but not always
so it was sometimes effective.
Time stomping at the time, that was not super effective
because like on XP systems, there're two sets of timestamps,
standard information attribute,
filename attribute and at that time,
you could not change the filename attribute
only the standard information attribute
which is the timestamp you saw on Windows.
The back up timestamp, there was no way to change it
so they were simply hiding from administrators basically
by changing these timestamps.
We had a tool we could run a comparison, pretty quick,
and we could see what they did stood out pretty quick.
Now, unfortunately, there's tools,
there's ways to change both timestamps
so it's a little bit harder now
if you're doing incident response but there is a way
and I encourage vendors to, especially EDR vendors,
to grab this information when you change timestamps,
you're not changing the entire time.
You're only changing the minutes, seconds, hours.
You're not changing the milliseconds or nanoseconds.
Those are zeroed out.
If you see zeroed out nanoseconds that's an indicator
so EDR vendors, take note please.
File deletion, so they used SDelete,
it's a sysinternals tool, Secure Delete.
It's very effective because it didn't delete.
It overwrites and once that happens,
there's no more evidence.
Okay, here's a graphic, I just love this graphic.
It was recently on Twitter.
Guy by the name of Control Commando put it out there.
I loved it because it shows that
not all techniques are under just one tactic.
So different adversaries use different techniques
for different tactics.
So I think that's just important to note.
If you're trying to do attribution with ATT&CK,
just keep that in mind.
ATT&CK will get you started
but it will not get you all the way there.
So if you find yourself encountering an adversary
and you think there's any chance it's gonna happen again,
incident response best practices say you need to get
the tools, the tactics, the techniques right.
This NIST is from the NIST best practices
and I recommend it because it works.
We kept our client out of the news
because we got their TTPs.
We knew what they were gonna do before they did it
so we could watch for them.
We saw them start to complete their mission,
we would cut them off before they could finish.
If you're sharing, if you're intelligence
and you're sharing cyber threat intelligence,
intelligence is more than indicators.
Intelligence includes the tactics,
techniques, and procedures.
Everybody knows David Bianco, pyramid of pain.
I just love this slide.
This has been out how long now, five years now.
It's awesome, thank you.
This shows where ATT&CK lives, the ATT&CK framework lives.
It lives up there in the TTPs that are so hard to change.
That's why when you get those TTPs,
you can predict what they're gonna do with some accuracy
because it's hard for them to change these things.
Hash values are trivial.
IP addresses, right, easy.
Little bit more about hashes in a second.
And Joe Slowik, he has done some posts recently
talking about indicators
and how they essentially expire immediately now.
It used to be they were useful for a little while
and I think that's, if that was ever true,
that's no longer true, unfortunately
and Threat Connect said the same thing not long ago.
Guy by the name of Wade Baker who,
if anybody's familiar with the Verizon DBIR,
the Data Breach Investigations Report,
he helped spearhead that.
That's a great report, been reading that for years.
I love that report because it's based on
that empirical forensic evidence also.
But IOCs again, not lasting long.
Hash values, if anybody's heard of Webroot.
They now have one of the largest hash databases available.
For the last 3 years,
over 90% of malware has only been seen at one endpoint.
So it's really brief, really narrow shelf-life
for hash values in particular.
So don't count on an IOC getting you out of trouble.
Okay, adversary emulation.
It's another great use case for the ATT&CK framework.
I was kinda skeptical about this at first.
Like, how you gonna pretend to be an adversary.
You don't know what an adversary's gonna do.
Well if you know their TTPs,
you can't just change those easily.
You can absolutely can IOCs are backward looking,
TTPs are forward looking
so you absolutely can in a meaningful way now
thanks to how empirically supported these techniques are,
it is absolutely something you can do
and they're in the process of in fact
testing a lot of the EDR vendors right now.
And I very much look forward to those results
'cause those are gonna show who can detect what.
It's very exciting to be part of the Renaissance here.
There's only I think two and correct me if I'm wrong,
there's two I think categories of things
there's still vendors out there who want to spread
and sow on your fear, uncertainty and doubt.
Well, there's still a couple of things to worry about.
One of them are things that are not in ATT&CK yet.
The second, our adversaries like this for example
who are in this case APT29,
which I know some of you are very familiar with,
and I wanna talk to you later if you know more than me
but here's an example of how bad it can get.
If they're determined and they're persistent
and they're not giving up,
it can take months to get them out of your systems
and this is just an example of worst case scenario
I recently read about.
David Sanger had a book recently,
I don't know if anybody's read it,
called The Perfect Weapon, talks about this situation
and anybody, Rob Joyce from NSA,
he talked about this at DEF CON this year.
It was in the book, it was called A Digital Dogfight.
Incident responders had very rough time
with getting them out and I don't know
if it is this talk by Mandiant, excuse me, FireEye
but this talk was about APT29 as well.
Very interesting talk, I recommend you check it out.
It's a very amazing, from incident responder's standpoint,
very cool story, Nick Carr and Matthew Dunwoody from
Mandiant, given this talk a couple times I think now.
It's really amazing what they can do
so if you run into an organization bigger than yours,
it's okay to call for help, I recommend you call.
There's two I can recommend to you.
FireEye and also CrowdStrike,
they're two of the incident response firms.
The only two in the world that are both
accredited by the NSA and by the payment card industry
so they're in the news a lot
because they do a lot of good work.
So call for help if you need it.
In the meantime, I recommend you,
if you run into an attacker,
recover what they're doing, recover the evidence.
If your forensics guys aren't
drawing you that picture, get them to.
If they can't do it, get outside folks.
You can determine how your attacker likes to operate.
You can get, ever hear of left of boom?
You can get left of them and David Sanger in his book talks
about left of launch which I thought was pretty interesting.
Talking about the North Korean missile launch
and how we actually apparently
stopped some of those with electronic means.
Pretty interesting,
so just a little persistence is all you need
to put together that hard evidence
that can be now be shared thanks to the ATT&CK framework.
So get out there, share, if you run across something,
let us all know about it.
Alright, thank you very much, appreciate it.
(audience claps)
(suspenseful music)