hello everyone thank you for joining us
today in threat report roulette
we have some amazing guests today and
i'm gonna go through the list really
quick
uh we have chris russell and he's the
head of information security for t zero
group
we have koran and he's a cti analyst for
a big four consulting cyber security
firm we have will thomas with us
and he is a security researcher
for psyjax uh we have me zena olsen or
cheerio and i am a senior cyber security
analyst at a fortune 500
and we have the stakeholders we have the
blind hacker he's representing red team
and he's an infosec enthusiast and
all-around awesome dude
we have danny d henderson and he hails
from
being previously a cti analyst but
moving more indeed first so he's going
to represent the defer slash cti angle
of threat report roulette we have jorge
and he is the most awesome
unicorn joining us from scythe he
represents red and purple he's the cto
and the co-creator of the c2 matrix
which i love
um and also a ton of other stuff and i'm
a huge i stan jorge like honestly i do i
can't help it he's awesome
um and then finally we have ricky banda
and he has a really fancy title he's the
incident commander for amazon security
incident response team so
all of these people are a big deal super
awesome
uh seasoned professionals coming in to
share their knowledge and wisdom
for the threat reports that we have
selected and for the purposes of this
talk they are all tlp white so we will
not be discussing any tlp amber anything
or tlp red or tlp green so
um and also too the focus of this talk
is and panel is more
actionable takeaways taking the
information to the next level and
um you know we wanted to bring
vegas to you in case you're not there in
person so threat report roulette
and as you can see on the screen we have
a threat report roulette wheel and what
we're gonna do we're gonna spin the
wheel uh we'll call on an analyst
and then they will give their insights
for a couple of minutes and then
from there uh we will have our
stakeholders and the reason why we have
stakeholders is because
well they're the consumers of all of the
info
and
if they don't like it
that's bad so we want to make things
that they like and want to consume
and are actionable within their org
and for the sake of debate and all of
that all of the reports we're going to
assume are actionable and relevant to
their organization as their as the
analysts are performing their analysis
all right so is everyone ready to get
started for threat report roulette yep
we are good again yay okay so and uh
audience just just be forewarned i have
a timer and so i'm going to be timing
the participants responses
and uh they have approximately five
minutes to respond so if they
meet time i'm gonna yell time
so uh don't just be forewarned that i
will be uh very vocal in
moving the session along so i am going
to spin the wheel
oh what's it gonna be the defer report
number two
so i'm going to the github gonna look at
the default report number two oh that's
soda no kibi um and rival and in case
you guys want to play along in the
audience
it is at bitly or it's a bitly link dc
29 roulette
dc 29 roulette and that takes you to the
github page
so
uh let's see defer report two
and that goes to crewster
[Music]
and you have 15 seconds to organize your
thoughts and i'm going to start the
countdown right now
sure excellent
so um
right off the bat these dfi reports are
very extensive these are the type of
things that multiple consumers and your
org can use from the technical and
strategic side so among the reports
we've gone through i found these to be
the most beneficial for the widest
audience
but in this particular report i went
through and looked and saw some
particular things that i would key on on
for kind of creating some custom
indicators aside from just static hashes
and ips and domains that we all know
change
pretty pretty rapidly so for this one
with revo
uh one of the things i noticed during
the process is that they have excel
calling wmic.exe
now if you're not familiar with that
process that's a kind of information
kind of system gathering process there's
really no reason why an excel
document should ever be calling that in
a normal environment uh maybe you have a
developer or a sysadmin that built their
own custom tool but in that case you'd
know about that this would be something
that would be you know whitelisted in
some way but right off the bat if you
have an excel document calling
wmic.exe right off the bat if you create
an alert for that that's one of the
early stages of this kind of kicking off
you can get an indicator there
um
but again there will be fringe case here
and there with an admin that may be
built in excel spreadsheet with other
scripts it's possible
another thing here i noticed is that um
as we know with any of these uh with
revo and even malware ransomware samples
they're going to want to
maintain persistence so they're going to
try and do some registry key
modifications and whatnot for this
they're gonna they they created a a run
once key
and that's something that's you know
pretty common for programs that want to
boot up every time the system starts but
they use an asterisk meaning that it is
it is also boots up in safe mode
so if you think about it what other
applications do you have users that want
to have to open up during safe mode so
right off the bat if someone you know
makes a registry modification for one
what's key and uses the asterisk that
means it has to be open during safe mode
and that would be another thing i
learned on because again what what user
what what normal circumstance in your
environment is that is that necessary um
if this is like a custom server that has
software that has to boot up during safe
mode this is all going to be done during
configuration this is all going to be
created while you're not in an alerting
mode so
while these things are in the wild and
people interacting with servers this
isn't something a user an admin is going
to make changes to they're not going to
they're not going to have it boot up in
safe mode unless they're in some sort of
change window or configuration menu uh
period where you would know and if you
saw the story you wouldn't be concerned
about it with it
um another thing they do again changes
to schedule tasks although you know
changes are scheduled to task isn't
always an indicator that's a key thing
to look at because how many of your
common users are making changes to
scheduled tasks on their own it's just
not that common so you find that the
situations where
and the you know certain key value pairs
that kind of indicate the scheduled task
is something that keeps persistence and
it's another good indicator
um let's see oh another thing is so
prior to executing the ransomware the
threat actors created gpo disabled
windows defender across your system if
you don't have some sort of alert that
that alerts when your antivirus is
turned off then you know that's kind of
table stakes but that's another key one
right there aside from you know gpos
being pushed in general they should be
getting some sort of change window so if
it's being pushed from a non-admin or a
new account or something
so those are some of the you know aside
from the obvious ones that i picked up
on from this document
anyone have any thoughts oh right
awesome so that is actually perfect
within the time so now our stakeholders
will be able to comment on this
particular report for the next five
minutes and i am going to start the
timer and jorge is raising his hand so
please feel free
awesome
awesome uh review there um chris i wanna
touch on something you said very briefly
at the beginning that uh
some of you might not have caught and
that is that the defer report is a great
resource and uh goes to the widest
audience i think we're going to see this
as we go through
the roulette here there are going to be
some reports that target different
audience some are targeted to people in
the detection world some are targeted to
red teams some are targeted um to uh
analysts looking up iocs and things like
that right so um
plus one on that we love the d4 report
uh sponsor them if you can i definitely
sponsor them out of pocket they're
amazing um and yes this report right
everyone's heard about uh rival right um
especially after uh
and uh
i i like the the intro right you can
read the first couple paragraphs without
being that technical and still get
something out of this report but once
you dive deeper into it we get all the
way to the point where we have actual
procedures
and one that you touched on right now
was adding a registry key that has an
asterisk in it um i was actually today
days old so first five minutes of uh
roulette you taught me something i did
not know that an asterisk in front of a
registry key meant that it could start
in safe mode so thank you for that bit
of knowledge and again shout out to the
default report i'll let someone else uh
weigh in
oh i just want to say i i was today
years old as well when i heard that so
thank you so much for your insights this
is why i love this
and uh i wanted to add too besides me
being a sponsor of the d4 report as well
or i pay out of pocket
because i think it's awesome
and uh you know i give them my money so
um is actually the community involvement
with the deferred report too like beyond
beyond analysts using it
something that i thought was really
interesting was black matter 23
and he he tweeted out
eight detection ideas and 18 rules 18
rules and so he has a whole github with
detection ideas detection rules based
solely on the differ report and so i
just really love
to see the positive impact that the
differ report is having within the
community and all of these amazing
professionals around the world kind of
like the people on this panel they're
people from around the world
coming together and discussing cyber
security and protecting organizations
so thank you anyone else want to comment
on this
okay danny
okay
so for me as
a
incident responders l3 sock analyst some
of the things that i like about this is
that it tells me what it gives me
information of what to look for if i'm
trying to find the intrusion
so talk about where the files could be
located
there are some things that will change
but there are some things that are
static based on how the adversary likes
to place things so finding things in say
a public folder is out of the ordinary
so those are artifacts that i will look
for
and furthermore some things that i would
also try
we usually get we usually respond to
alerts and so some of the alerts is
generally when a phishing occurs
but finding uh finding any sort of
registry
key such as the
safe mode is definitely a um
definitely a interesting indicator to
look into so looking into the
auto runs
so the uh so the default report is
definitely a good one for incident
responders
okay thank you and will any comments
uh just as a quick one is i i believe
that this was one of the first instances
of iced id being used as the initial
access vector for um our evil which was
a which was an interesting evolution for
that particular malware family because
it has is associated with other
ransomware actors so it's definitely a
now our family want to prioritize if
you're worried about being targeted by
ransomware operators
oh yes i i totally agree with this
initial access brokers like that's where
the money's at right
okay so i if everyone's okay uh we're
gonna move on to
the next threat report thumbs up good
all right
so
i'm going to spin the wheel
and secure list so
this one
goes to who wants it who wants it first
is this the black kingdom
yes do you want this one danny
yeah i'll take this one okay it's all
yours and i'm starting the timer right
now
okay so
black um black kingdom that one was one
of the more interesting ones
uh
i don't remember
i took notes on this one
kingdom
shoot
okay
so this one was actually using pipe um
python for the entries especially web
shells
since this one deals with web shelves um
this one the web shelves are generally
targeting on forward-facing
public-facing servers
so the as far as the public-facing
servers go these are
some ways that we want to take a look at
one
finding out that there's no
no out of the ordinary
php files or any sort within our servers
and especially the
for this one this one targeted the
microsoft exchange server which
was one of the big
big events back in a couple months ago
once that was out we did
in fact thinking of my last
people i worked for
we had to
go around making sure that no one made
any authentications and uploads into the
exchange servers
but the way that this was
interestingly done
they hard coded
some when some folders to exclude rather
than using regex
but for me as an incident responder i
would be looking for
any sort of anomalous php files or
executions within
the exchange servers that the client
owns
and that's pretty much about it this one
was um
[Music]
this one went more into depth and how it
was programmed but from a ttp
perspective
it's
what it would generally upload in
and so that for me is where i would be
focusing on
to make sure the client does not have
any
anomalous uploads into their servers
no that's great that's great and
definitely um
uh you know look at patching those cves
that are in the report too right yeah
yeah like um and prioritizing them if
they aren't already done and any
stakeholders that are interested in
commenting on this particular report
i'll be glad to take that okay thanks
joe
so um
from um the explanation here um you know
again so as a red teamer uh my my job
with uh the most of these reports is to
either uh
because this report does uh is not as uh
in-depth as the you know dfir reports
thiefer reports which are again plus one
fantastic um this report is pretty
in-depth though but they do uh the
specific report the cti channel that you
know we're getting it from um here on
the stakeholders panel um is really
telling me you know the the things that
i do as a red team with these is i
either have to try to write the same
ransomware they are the same tactics
ttps they have to help try to break into
the network to again help write iocs um
take it to my detection and engineering
team say have you guys seen these things
we're about to run these things for you
guys to help you see if we can commit to
creating better detections and better
iocs
uh for the indicators of compromise so
uh while writing these things uh this
report is
thorough enough that um i could take it
and then from a cti perspective um you
know it's one of the things that i have
to ask though is is looking at this
report um
you know am i even a potential affected
uh uh you know
an affected client am i a target of this
report you know i want to spend the time
that i have an in a 9 to 5 40 hour work
week making sure that i'm writing the
right defenses here for my
my company for the company here um so
when it comes to this report
some of that stuff is here uh anybody
getting in some of the ttps are
definitely here and i can see that the
cves they're attacking so i can again
try to reverse engineer find pocs proof
of concepts that'll work
and then develop again a um
a single executable or a string or an
individual poc that mimics this specific
kind of
um ransomware malware
okay thank you very much and
uh oh it looks like uh we have ricky
chiming in
do you want to chime in really quick
ricky
uh yeah yeah
um
so
looking at the report
listening to uh
what we have folks saying right i look
at something like this
and i'm thinking
this is impacting me or this isn't
affecting anywhere i work or
an organization i'm responsible for
business
something like to that effect
and
i have to be able to look at these uh
reports and
take action
right
so i'm looking at something like this
and uh
i have multiple lines of pipelines of
work kind of already kind of going out
of my mind right now
i'm thinking okay
we have this scenario
are we prepared from a
insurance perspective are we prepared
from a pr
perspective uh do i know my stakeholders
in these areas meanwhile i'm assigning
two to three incident response engineers
to go into log dives into the network
our endpoints making sure that we have
detections and engaging with the service
owners and service teams to go and get
me you know data
so i can also make those types of
assessments in the interim probably also
on the phone with our legal team
you know uh
you know
people who
are uh also
um
in charge you know like executives
directors and i'm thinking
i have no [ __ ]
i have a
you know
a um
potential right for exfiltration within
an environment i own or you know
something that
is uh going to impact the business in
some way shape or form
and so i don't of course i don't want to
take up
too much time
but the thought process when i look at
something that's uh
related to
ransomware or
excellent date or anything like that is
i have to think through
what the
actions on objective are what the impact
is going to be
and
that i am collecting the right people in
the room
to
make sure that we have an appropriate
response
to handle everything from pr
to legal to
financial to investigation
risks all in kind of the same room and
organizing all of these cats
no that's great and so ricky makes a
really great point um that i need to
point out especially for people in the
audience that are in larger
organizations
building those relationships ahead of
time so that you know the product owners
and you know the people and you
understand their their backup schedule
let's say your go-to person is on
vacation
and you don't know who to contact other
than that you know and just
understanding who to contact building
the relationships and forming those
connections before
something horrible happens
um i know it sounds simple but it's
definitely been very beneficial in my
experience to be able to just be like yo
uh i need your help with something and
already have that report established
um so if everyone's okay i'm going to
click on another report unless anyone
else has something to add
we're good thumbs up
all right
and i'm spinning the wheel
ooh bc security two let's see which one
that one is
let's see that one is the overview of
empire 4.0 c-sharp
and let's see who wants to take that one
we have
uh
you want that one well
um could i
pass for the next one
okay uh let's see who wants this one
no takers i i can take it okay go for it
all right so uh bc security are the
makers of empire empire
what was originally called powershell
empire uh is one of the most popular
command and control frameworks i know
that because of a project called the c2
matrix um i also chose empire as the c2
to teach people red team in my security
564 class um the sans right team
exercise and adversary emulation course
because in a classroom environment you
want a tool that is consistent and
reliable and does what you tell it to do
every time and with a lot of c2s that's
just not the case but empire is one of
those so uh back in july 2019
the original creators of empire said
that they were ending development and
the folks over at bc security took over
development which is fantastic um
in this case we're gonna talk about in
this blog post it's talking about the
latest version of empire which is 4.0
and c sharp and
uh right off the bat in the intro
uh you can see that a lot of the new c2s
are popping up and the way to create
implants actual payload or the stager
that runs in your environment
is
before was powershell right um now lots
of people say powershell's dead
sometimes it was python but we're
definitely seeing an uptick in c sharp
um and c sharp is a language you can
anyone can actually write c sharp code
you can download a version of visual
studio community and
compile your own uh c sharp uh code so
uh in this case we take a look at
how empire works the the latest updates
to it how to run it so c2 framework so
you have the server component which is
your listener listens on a particular uh
uh port
we can see that empire has uh
mostly http listeners so
we we know the the c2 will be over uh
http and https you set the uh delay and
jitter which is how often that uh
endpoints gonna call out
and then you have to create a payload
what they call a stager um so the net
new here is the ability of creating this
c sharp stager it's just the code used
to compile that payload and get it to
execute on a windows system um as we see
this just like powershell when
powershell was starting to be used the
infamous
derby contact or def con talk by dave
kennedy
there was no detections right and even
today powershell is tough to catch but
essentially what what we're seeing is
the move to c sharp because of that same
thing right it's able to execute a lot
of antivirus and anti-malware and
anti-exploit solutions aren't catching a
lot of c-sharp code so that's really the
the biggest uh net new here in this case
if you haven't tested or used empire by
all means
check them out um they're free there's a
whole bunch of c2s out there um and
understand how these work right um a lot
of these are are open source they're
used by um red teamers and adversaries
alike and the ability to understand and
be able to see how those stagers execute
on the target system connect to the c2
server and
look at it is
is going to be important uh so
definitely more of a
red team uh
cti report uh not much talk on detection
or anything like that so back over to
you so the reason why i included this
one is because powershell empire empire
as jorge said it's really popular uh
with the threat actors and
so uh before the new release of
powershell empire there was a paper
called disrupting the empire
identifying powershell empire c2
activity and it's a sans white paper
that's available on the sans website
under their resources and paper section
just fyi and so in it they talk about
http request behavior
they talk about uh anomalous uris and a
bunch of other network-based indicators
to be able to
detect powershell empire and so there's
even whole githubs with like uh
detection rules that are uh for those
specific configurations of empire so now
that they released a new version
uh you know i wanted to highlight this
report to bring attention that we need
some defenders to come in here and be
like
to do another sans white paper on this
new
edition of powershell empire and to
perform security research and to
try to find a way to
find those unique tool marks
um i believe key dot
89 let me let me get his proper twitter
handle so i don't uh
misquote here
stand by
key um
89
uh
he changed his name so i'll have to look
it up later anyways i'll put it in the
chat and i'll put it in the github but
he's a big proponent of something called
tool marks
so um trying to detect the custom out of
the box and i'm horribly paraphrasing it
but detecting custom out of the box
features of like you know cobalt strike
or powershell empire or a lot of the
other really popular tools that
ransomware actors and cyber criminals
and all of that use um and they just use
it straight out the box and they don't
try to reconfigure stuff sometimes so
like taking that low hanging fruit
essentially building detections around
it of course it's easy whatever but
getting it out of the way so that at
least you have that as an alert in the
event they decide not to modify any of
the settings so i wanted to bring that
to people's attention does anyone else
want to comment on this particular
report oh danny yes and then in the
meantime i'll look up what he changed
his name to on twitter
so
with this one it's definitely looking
for network-based
indicators at this point
so some of the signatures that we've
i've seen before was going to news.php
now whether is that change or not for
this one
i would have to start looking for
indicators that is
by netflow
or
any of the themes that's letting me know
that there's rapid connections going on
to
a certain ip or domain
and really quick i did find the person's
name i just spelled it wrong i apologize
it is
t k-e-y-d-e-t-89
harlan carvey he is an author of books
and super smart and he talks about tool
marks and he's a d4 professional sorry
for interrupting thank you dan no no
worries
and then from there i can pivot to the
host that is emitting um that connection
and try to find any other indicators
from there
that may be agnostic of
the c2 but for now with this one
especially
with the update i'm gonna have to rely
on network indicators
that uh
that
indicators are beaconing
okay anyone else so i'll quickly say so
the you know tool marks uh there's
there's a lovely tool out there for
cobalt strike called jarm j-a-r-m
um if you think you're being targeted by
a cobalt strike uh tool server
you can turn around and use jarm to scan
the endpoint and it will literally see
if it can find like the proper files
that you usually cobalt strike use
running so tool marking be a real valid
way to detect these things because again
empire when it boots up there are
certain ports that need to be open when
you are executing from a external source
and um as uh
georgia said that uh there's uh a lot of
uh a lot of these things the reason that
they
became popular was because the power
shell and then when people said
powershell was dead people were like not
really but sort of and then so they were
like but here's the c sharp thing that
you know you've been worried about
powershell so long
you've missed this entire construct
that's been here all along um and then
uh you know again using the c2 matrix
this will tell you that this is one of
the most popular ones and i love empire
myself so
thank you
yeah i know it's a great it's a great
tool um
okay so are we good to move on to the
next threat report and i have just real
quick a couple host space indicators i
came up with for that one that i'll slip
in real quick so first of all uh csi.exe
fsi.exe without any command line
arguments that's going to be an
indication of interactive session
any sort of uh arguments being passed
from those two executables renamed
instances those binaries network
connections from those binaries
um
you know file creations from those
binaries and
um you know that's
you know in certain environments where
people are heavily using crf that's
obviously loud but you just have to go
through and see if it's present and if
and then you know white list what your
developers or whatever is doing but
other than that the average user is not
going to be using either one of these so
simply the the presence of those
executables without any command line
arguments right off the back should be
indicator that someone is not on the
host running that
okay thank you so much
are we good
anyone else we're good oh okay
i will move on and spin the wheel
okay what's gonna land on
d for report number one
let's see what that one is and who
iced idea and cobalt strike versus
antivirus ooh
let's see
who wants to speak to that one who wants
to start on that one
any takers
danny all right danny go for it
let me get myself mentally prepared for
this one yeah you have 15 seconds so
yep thank you
i can jump in on that one afterwards too
okay
i was just muted
[Laughter]
all
right so based on what i was reading on
this report this one that um this one is
a
resurgence of the use of ice
ice id
and some big interesting key points is
the use of not only the cobalt strike
but wmi
and from what i've seen they were trying
to use the it start to start off with
the
with the word of spear phishing word doc
which will release an hta file and
includes a jpeg
that
is actually a library
that's supposed to be executed by run
deal
32 or reg
serve 32
and then it tries to do it tries to do
the host discovery
as well as encoder powershell payloads
for mo
what i like about this default report is
the fact that it goes through the
various stages of how it operates its
credential accesses it's
how it tries to do a host discovery in
the actual manipulation of
wmic
other processes and it also shows that
the
antivirus that's already installed can
detect some of those anomalies
but it's also a good to know of
[Music]
what wmic's that should not be coming
consecutively
in the environment
especially when it's trying to do
a view in the domain
uh trust domain admins and
trying to find
your domain list
and just see some um visible monolateral
movement some other
key takeaways with this one that i do
like
is for me as
a sock analyst not only am i looking for
any strange wmic activities
but processes ran by services or
certain power shell
activities
especially when
i ex is used which is trying to execute
something
no that's crazy
um are you are you good danny are you
ready chris
christie yeah okay so and i have a
little bit of comment too uh and then
well it looks like
yeah so uh you know danny mentioned
pretty much a lot of stuff i'm gonna
cover i'm just gonna kind of get a
little specific on a couple of them so
right off the bat uh if you see me me
cat's bad so anytime that pops up
you should have some sort of learning
for that uh second jpeg making any sort
of uh process command line arguments
that should be some sort of indicator
there there's no reason why jpeg ever
needs to
do call for system info ipconfig
anything like that so um although you
know it would be hard to basically do
every single file type that does that
they may not use jpeg they may kind of
pivot you should probably figure out you
know
what what file types you can include in
some sort of list to do an su recon next
the adf continued intel and scanning
piece
so
calling the adf.bat to do again more
system gathering information that's not
something that any user does it's not
something your assist admins are going
to do they've got tools to gather
information they've got all sorts of
other things that you're never going to
sit in there and gather it that way so
if adf dot bad is calling any sort of
process and command line that's
information gathering that should be
some sort of ioc
uh last thing uh lateral movement
registry value set we're using encoded
powershell
there's never a time where you're gonna
have any users that need to hop to
another device using registry value set
and with imported encoded powershell go
to powershell as we know you're going to
use that if there's some sort of escape
character in there or something that
will make the code not run there's
nothing that you would need as a normal
host or a normal user that can pivot to
another host legally in an environment
there's never an argument you'd have to
run that would require you to use
encoded power shell except for some
really rare edge cases in which case
there's probably some sort of change
window
no that's great unless you're in some
environments where the where the people
like to use encoded commands all the
time oh i know people just like doing it
for for for you know walls yeah
but like you know sentinel one all these
tools now they'll they'll decode it for
you they'll check through it you can you
can still dig into it but yeah you're
right people use it when they don't even
need to
yes and will did you want to comment on
this one
did i get uh
right okay yeah so um
this another another blog piece on iced
id uh attacks and as we know it's it's
associated with ransomware but
it's it's another
important piece because um i study so in
this specific one the iso d variant is
using a loader called
what the researchers dub photo loader so
it uses a jpeg file to to sort of deploy
a hidden payload
um
strategically like following ice id and
the overall campaign that so it's been
it began as a banking trojan and turned
into an access broker but more recently
in like the last maybe six to nine
months it has been pushed by a spam
botnet called the shatak botnet linked
to a threat actor called ta 551 and it's
distributed a range of payloads but more
recently it's it's iced id has been it's
primarily primary payload so
it's
it's another
example of what to expect if your if one
of your endpoints is infected with
device id but i mean the the main point
that an analyst should be bringing home
if they decide to write this report up
and you know document it as an instant
report they should be
sort of explaining why ice id is an
important threat and it's it's basically
taking over from emo tech the emote
botnet that got shut down in january by
the uh europol and ukrainian police and
things it's there's been a vacuum and
iced id and quackport have basically
taken over and pushed in parallel
campaigns between them
so it's and then you know cobalt strike
that's what we normally see with with a
lot of these malware families so it's
the two two sort of staple
threats to be aware or be around be
aware of and
as as the guys have explained some
good detection rules that you should be
using to alert on
okay great thanks well and the little
comment that i wanted to add and we'll
hop on over to the stakeholders uh
really quick
is from a hunt perspective i saw the
discovery and i saw wmic ipconfig system
info net nl test net
um and a bunch of other uh
other related uh processes that would
need to execute within a short amount of
time
and so if you're performing a hunt for
this type of thing instead of making it
per se specific about command line
arguments
uh grouping the processes you know of
like all of these all of these within
this particular report that are used and
then you time bound it
by like you know 24 hours or even an
hour or whatever right because they move
very quick
and so um
i believe if you do that it'll cut down
on false positives within your
organization of you know the random
person just doing uh
because you don't want to alert on that
because that'll that'll create a lot of
traffic a lot of alerts to look through
so
aggregating the whole report as a whole
and then creating a hunt around that
specifically and then
investigating any potential anomalous
activity of any uh matching results if
you do have any
which
i'm hoping you don't
that was my contribution
anyone else want to say anything
i'll uh as a stakeholder i'll say uh you
know again another uh from from my cti
panel if you guys were feeding me this
information again um as a red teamer i
can definitely help you recreate
the actual ioc's actual detections with
our tools
the the dfir report and what you guys
have explained is again one of the like
uh the the level of detail they go into
that then comes to you guys that can
then come to me
and then i can take to the operations
team is just phenomenal but uh the the
the tooling here again being things that
are free simple easy to use um
and and but good news is it's highly
detailed so we can write the right
detections and build the right tooling
to emulate it
okay thank you and uh i want to throw a
little bit of a mix in and have karan
speak about our mystery threat report
that we picked
um so karan's gonna have three minutes
to speak to this mystery threat report
and then we're gonna close on out with
jorge and the rest of us commenting on a
scythe threat thursday
because a i love it and b i warned y'all
that i'm a huge fan of jorge
okay so
karan has the floor and you have three
minutes
okay um
okay so this report mystery report is
basically for the recent uh bazaar
bazaar backdoor campaign
bazaar call
it's the report in in terms of you know
how it's reporting is done it's it's
very good
but i feel that it's not very accessible
because some stakeholders for example
uh dfir they would like quick access to
the ttps they would like quick access to
the iocs uh
the ttps and iocs uh it's generally
like you need to siphon off by reading
there's a lot of reading involved so
but the the good thing about it like
this has good content this has good
screenshots diagrams explaining the
attack chain screenshots about the email
even the
uh you could say the the unique uh
unique ids that the attackers use to
identify all of the victims
uh and uh another good point about this
are there there are hunting rules where
which which can be used with microsoft
365 defender it's pretty good
the only disadvantage as i said before
is which heavily relies on actually
reading the report and some stakeholders
might not like it
in terms of key takeaways this is
particularly very interesting because i
think microsoft has been
tracking this for around a month and
this is like one of the newer campaigns
so and due to it resulting into a
ransomware which is i i think it's kanti
or ryok uh it's definitely interesting
in that sense because bazaar loader is a
prolific mother and any updates on their
ttps their new campaigns is particularly
interesting
uh in terms of speaking about the
um
the
detection rules the detection rules uh
particularly provided by them are
extremely good because it provides
tracking for the uh you know hunting for
the emails it even includes uh hunting
for the exfiltration tool of the
ransomware which is i think our clone
yeah
and uh other than that there's very
particular interesting thing and i want
to
like focus on this is the use of social
engineering uh in in like this whole
campaign because the highlight of this
is they used the attackers the threat
actors used like a
fraudulent call center to in case uh the
victim decides to call uh that number
which is provided in the email that can
actually
lead to like a
person over the other call center and
social engineer the vic victim into
you know uh malicious execution link
attachment whatever it can cause more
harm
that is very interesting in my opinion
and
other than that nothing else for this
report it's a good report but i feel
like they they could have included the
tdps and the ics like a particular table
in the last to make it easier for people
who are researching it
okay and the comment that i would like
to add to this is
um unit 42 palo alto's unit 42 recently
came out with a report 729 2021 on
baseloader
and so in it they have like uh they have
a bitly link
that has a bunch of iocs and stuff like
that it may not necessarily be tied to
the basic call campaign
um you know i would need to perform
analysis to see the difference between
the microsoft report that was the
mystery report it was called uh
basically
let me go to the top of the report
basically phony call centers lead to
exfiltration and ransomware
so i would have to compare the basic
call report to the one that was produced
by palo alto with the iocs but the point
is that it both that both of them
involve baseloader
so um i would look at that and take a
look at those iocs as well as you know
that's bau activity but the whole point
of this is that if you get a report and
they don't have the ttps or iocs or
whatever
um pivoting on that and looking for
other organizations that may have done
reporting such as palo alto
unit 42 they do some awesome work too
and uh supplementing the reports that
come out for that
so
anyone else want to comment on that
before we move over to jorge
okay will and then danny
uh yeah so the bazzalota bizarre cool
campaign is uh is a really interesting
one to me um it's linked to the infamous
riok and conti gang which i think
crowdstrike tracks as wizard spider
this group is
very well known for using like a range
of delivery techniques that purposely
are designed to evade detection i wrote
a blog about all the different
techniques they use and our call is the
one that currently running and the thing
that makes it so interesting is there's
no malicious links inside the email
itself it's just the phone number that
you call and are guided to and then once
you reach the fake website that they've
created you have to enter a code to be
able to download like the spreadsheet
that they give you so there's so many
different ways to thwart researchers
like myself and
methods to evade detection it just makes
this gang a really
prolific threat and and one to
definitely you know actively hunt for
because there's a chance your tools
won't won't pick them up
thank you so much for stating that and
danny
okay so this one is a very interesting
one because this one actually involves
more than just going into
the network and trying to hunt this one
involves working with
your organization to put out a message
as far as dealing with um fake call
centers just a reminder to the in to the
cohort to the employees hey you are you
have a call center
in the organization
you this is an external email that's out
you're not using that
you're using this particular one and i
bring this up because there's been cases
where there's been
fake um calls acting as microsoft trying
to help with situation with uh computer
issues
by running commands there was a fake
call center
a little similar but not quite it was
involving running scripts which
inevitably effect infected the host
so this is where you want to leverage
your departments to help put out a
message
now from the forensic side i see a
couple of things of
say the use of cert util
depending up especially when cert utils
being used to do url cache to
grab things from
another location
do you want to watch out for
okay great and now we will take it over
to the final report uh just an
overarching discussion of
threat thursday um i had the wonderful
opportunity through independent research
to speak with some really awesome
professionals and they've actually
operationalized uh this threat thursday
where every thursday it comes out they
mobilize their team to like perform an
actual real purple team exercise related
to
this particular report that they put out
and we happen to have jorge with us
so i thought um it would be nice if he
could just speak to it really quick and
another
reason why i really really like this is
that they include
not only uh community uh based
information uh sourced information but
they also have like a detect and respond
section as well which i feel is
exceedingly exceedingly important so
thank you very much jorge take us take
us out oh yeah no just real quick um
so this was something that i started
early when i joined scythe i've been
there for about a year um essentially
was to make some of these uh threat
intel reports and reports from instant
responses more actionable and bring
value to organizations so we do kind of
what we did here right which is consume
these cyber threat intel reports and
make them actionable um for the purposes
of adversary emulation and essentially
what we're now calling attack detect and
respond right essentially everything we
talked about today was something post
initial access i think all organizations
nowadays are working under that assumed
breach of you know whether it was an o
day which we've heard a lot of or um you
know some iced tea or trick bar or
whatever
what happens next right so
we take these reports the default report
is a fun one uh right and actually get
those procedures and that's i think
something where the cti world can
improve on is actually providing the
procedures the deeper report being a
great example of that because then uh
people like myself like uh joe blind
hacker uh right we grabbed those actual
procedures and then we can create these
emulation plans and of course we build
these emulation plans and share them
with everyone uh we share them with our
customers uh in json format they can
simply import it but of course we want
to contribute to the community as well
so we publish them um as uh attack
navigator heat maps as well um we give
the actual procedure so if you just want
to copy and paste them or use something
like atomic red team you can still get
value out of it right we don't force you
to to have to use site um and things
like that but um here's a perfect
example of uh the the one you're sharing
is um
microsoft published
how uh a nobelium was getting around
defenses uh leveraging this attack chain
and what we read through the attractions
hey wait there's a new procedure here
and i looked it up on atomic red team it
wasn't there said all right let's play
with this figured it out and then of
course contributed it back and this
particular case um actually ended up um
printing it into atomic red team as well
but of course if you want to do it
manually i showed how you can create an
iso file with malicious payload in it
and uh then just through twitter kind of
purple teamed it with uh cyber monk and
uh florian and black matter um
essentially just finding ways to to do
the detections i believe uh ryan also
was uh pragman was on there so uh so
yeah it's a lot of fun i it's probably
one of the funnest things that i do is
get to read some of these reports and
build these adversary emulation plans
and share them with the community and uh
yeah they're they're all free like i
said you don't have to use psych for
this we're big believers in giving back
to the community and doing purple
teaming so thank you for for a little
for that shout out i i appreciate it and
like i said just trying to give back to
the community
yeah thank you so much and thank you to
all the panelists too um i really
appreciate you
uh coming to share your insights and
wisdom and knowledge i learned something
i hope the audience learns something as
well
and um thank you very much i hope you
enjoy the rest of defcon i believe this
airs on the last day
so uh thanks for taking time out to
watch threat report roulette
and once again the bitly link is bitly
slash dc 29 roulette
and that's how you can get it or you can
find it on my github it's on cheerio and
it's called
uh defcon 29 bt btv threat report
roulette and it provides the list of all
the threat reports the
threat report roulette wheel as well as
our favorite resources and more
information if you want to contact any
of the panelists
so thank you very much and have a great
summer