DeepBlueCLI: a PowerShell Module for Hunt Teaming via Windows Event Logs

Here's a video of my 2016 DerbyCon talk DeepBlueCLI. Thank you, @irongeek_adc

A copy of my 2016 DerbyCon talk DeepBlueCLI slides:



Github site: https://github.com/sans-blue-team/DeepBlueCLI

Link to my Quality Not Quantity talk, which inspired DeepBlueCLI.

C2 Phone Home: Leveraging SecurityOnion to Identify Command and Control Channels

Video of the talk

Links from my Security Onion Con 2016 talk:

C2 Phone Home: Leveraging SecurityOnion to Identify Command and Control Channels

Link to all pcaps, Bro logs and Whitecap Snort Rules

Time is on your Side talk and links

Time is on you Side: Username guessing via Timing Attacks

Links from the talk:

• Eddy Harari's "opensshd - user enumeration" post to the Full Disclosure Mailing List: http://seclists.org/fulldisclosure/2016/Jul/51
• enumer8-ssh: https://github.com/eric-conrad/enumer8
• First names from the 1990 US Census: http://www2.census.gov/topics/genealogy/1990surnames/
• Last names from the 2000 US Census: http://www.census.gov/topics/population/genealogy/data/2000_surnames.html
• Account Enumeration via Timing Attacks https://littlemaninmyhead.wordpress.com/2015/07/26/account-enumeration-via-timing-attacks/
• Password Spraying Outlook Web Access – How to Gain Access to Domain Credentials Without Being on a Target’s Network: Part 2 http://www.blackhillsinfosec.com/?p=4694
• Question: What Can I Learn from Password Spraying a 2FA Microsoft Web App Portal?http://www.blackhillsinfosec.com/?p=5089

Quality not Quantity talk, commands, and links

Quality not Quantity: Continuous Monitoring's  Deadliest Events

Commands:

Search service creation events and errors:

PS> Get-WinEvent -FilterHashtable @{logname='system'; id=7045,7030}

User creation events and users added to local and global security-enabled group:

PS> Get-WinEvent -FilterHashtable @{LogName="Security"; ID=4720,4732,4728}

Full command line of all processes (requires https://support.microsoft.com/en-us/kb/3004375):

PS> Get-WinEvent -FilterHashtable @{Logname="Security"; ID=4688}

AppLocker Events (requires AppLocker):

PS> Get-WinEvent -FilterHashTable @{LogName="Microsoft-Windows-AppLocker/EXE and DLL"; ID=8003,8004}

Detect when EMET blocks malware (requires EMET):

PS> Get-WinEvent -FilterHashtable @{LogName="application"; ProviderName="EMET"; id=2}

References:

1. Mandiant M-Trends 2016: https://www2.fireeye.com/rs/848-DID-242/images/Mtrends2016.pdf
2. Verizon DBIR: http://www.verizonenterprise.com/DBIR/2015/
3. USENIX Enigma 2016 - NSA TAO Chief on Disrupting Nation State Hackers https://www.youtube.com/watch?v=bDJb8WOJYdA
4. Neiman Marcus Hackers Set Off 60,000 Alerts While Bagging Credit Card Data: http://www.bloomberg.com/news/articles/2014-02-21/neiman-marcus-hackers-set-off-60-000-alerts-while-bagging-credit-card-data
5. The ASD 35 Strategies to Mitigate Targeted Cyber Intrusions: http://www.asd.gov.au/infosec/top-mitigations/mitigations-2014-table.htm
6. Patch-crazy Aust Govt fought off EVERY hacker since 2013 http://www.theregister.co.uk/2015/06/02/patchcrazy_aust_govt_fought_off_every_hacker_since_2013/
7. CIS Critical Security Controls: https://www.cisecurity.org/critical-controls/download.cfm?f=CSC-MASTER-VER%206.0%20CIS%20Critical%20Security%20Controls%2010.15.2015
8. AppLocker: https://technet.microsoft.com/en-us/library/mt431813(v=vs.85).aspx
9. AppLocker CSP: https://msdn.microsoft.com/library/windows/hardware/dn920019(v=vs.85).aspx
10. Windows 10 Enterprise 90-day Trial: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise
11. Microsoft EMET: https://support.microsoft.com/en-us/kb/2458544
12. Enable Windows command-line auditing: https://support.microsoft.com/en-us/kb/3004375 
13. Windows Commands Abused by Attackers http://blog.jpcert.or.jp/.s/2016/01/windows-commands-abused-by-attackers.html

CISSP Study Guide 3E - Shipping Now

Just a note to say the CISSP Study Guide 3E is in stock and shipping from Amazon.

http://www.amazon.com/CISSP-Study-Guide-Third-Conrad/dp/0128024372

Electronic editions should be available in January. We are working on the 11th Hour CISSP Study Guide update now, chapters are due by April (but I hope to have it done before then).

CISSP Study Guide 3E is Complete

Lots of people have asked me for the release date of the CISSP Study Guide 3E. Amazon (now) lists December 29th, but it will be sooner.

I can confirm the book done and is at the printers now. I ordered copies as a surprise Christmas gift for students of my MGT 414 class coming up at SANS CDI in 3 weeks, and Syngress has confirmed the books will ship by then.

https://www.sans.org/event/cyber-defense-initiative-2015/course/sans-plus-s-training-program-cissp-certification-exam

MGT 414 and CISSP Study Guide Third Edition

ISC2 recently updated the CISSP® exam, effective April 15th 2015. The biggest change: they went from 10 to 8 domains.

SANS MGT 414 has been fully updated:

Course authors Eric Conrad and Seth Misenar have revised MGT414 to take into account the 2015 updates to the CISSP® exam and prepare students to navigate all types of questions included in the new version. 

MGT414 focuses solely on the 8 domains of knowledge as determined by (ISC)2 that form a critical part of CISSP® exam. Each domain of knowledge is dissected into its critical components, and those components are then discussed in terms of their relationship with one another and with other areas of information security.

We are also working on the CISSP® Study Guide Third Edition. It is due out in November 2015. We will update the Eleventh Hour CISSP Study Guide after that.

I have received a lot of questions regarding CISSP® Study Guide version 2E (and other books that predate this update). Here's ISC2's take:

Q: Since the CISSP has changed from 10 to 8 domains, was some content deleted?
A: No. Content was not removed from the exam and/or training material, but rather refreshed and reorganized to include the most current information and best practices relevant to the global information security industry.

So all of the CISSP® Study Guide Second Edition material still applies, but new concepts have been added. See the CISSP® 2015 Candidate Information Bulletin for specific details on the testable topics. Here's Clement Dupuis' take on cccure.training.

Clement also has a fantastic guide to the changes (with links to online sources of new material).

Long Tail Analysis of Windows Event Logs

This is a demo from a portion of lecture and lab from SEC511: Continuous Monitoring and Security Operations.

Link to T510-security.evtx.

Here are the PowerShell commands:

# Black text on white background (thank you @MarkBaggett)
PS C:\> cmd /c "color f0"

# Pull all security events (Requires administrator PowerShell)
PS C:\> Get-WinEvent -LogName security

# Pull all security events, search for date, count lines  (Requires administrator PowerShell)
PS C:\> Get-WinEvent -LogName security| findstr "1/19/2015"| Measure-Object

# List all events in the file T510-security.evtx
PS C:\> Get-WinEvent -Path .\T510-security.evtx

# Show event 4624 from T510-security.evtx, format list output
PS C:\> Get-WinEvent -FilterHashtable @{Path=".\T510-security.evtx"; ID=4624}| fl

# Perform long tail analysis of T510-security.evtx
PS C:\> Get-WinEvent -Path .\T510-security.evtx| Group-Object id -NoElement| sort count

Announcing: SEC511: Continuous Monitoring and Security Operations

I am happy to announce that the first beta for SANS SEC511: Continuous Monitoring and Security Operations has been scheduled for June 16-21 in Washington DC. Seth Misenar and I wrote the class, and it's proven to be a very timely (and necessary) topic!

I will teaching the first beta.

Note: This course is eligible for special beta pricing. Please enter discount code SEC511-BETA1 when registering to take advantage of the special beta price of $2450.

Flyer for SANS Course SEC528: SANS CompTIA Advanced Security Practitioner (CASP) Certification course

Flyer for my new SANS Course SEC528: SANS Training Program for the CompTIA Advanced Security Practitioner (CASP) Certification, beta class scheduled the week of July 22nd in Washington DC.

Special Beta pricing of $1995, plus $250 additional off when you use the code CASP_528B1. 

Hope to see you in DC!

Links from SANS Special Webcast: How to Prepare for the CompTIA CASP Exam

Here are the links for my SANS Special Webcast: How to Prepare for the CompTIA CASP Exam

SEC528: SANS Training Program for the CompTIA Advanced Security Practitioner Certification, beta class scheduled the week of July 22nd in Washington DC.

My previous webcast, Passing the CompTIA CASP: Discussing Sample Exam Questions

Updated DoD 8570.

Sample questions from SANS Security 528

• 30 Sample CompTIA CASP questions, in VCE format
• 30 Sample CompTIA CASP questions, in PDF Format
• 30 Sample CompTIA CASP questions with Answers, in PDF Format

A set of CompTIA CASP sample questions, from CompTIA. Another set from Darril Gibson

CompTIA CASP Exam Objectives

CompTIA CASP added to DoD 8570

CompTIA's CASP exam has been added to DoD 8570 for the following roles: IAT Level III, IAM Level II, and IASAE Levels I and II.

The beta run of my brand-new course: SEC528: SANS Training Program for the CompTIA® New Advanced Security Practitioner Certification™ has been scheduled in Washington DC the week of July 22nd.

It's a 5-day course, with a great beta discount. Hope to see you there!

SANS Webcast: Passing the CompTIA CASP Exam

I'll be conducting a webcast on September 7th called Passing the CompTIA CASP Exam.

If you miss the live webcast, an archive will be posted shortly thereafter.

My slide deck is posted here.

As I posted previously:

It is based on the new CompTIA Advanced Security Practitioner (CASP) certification, which is the first in CompTIA's "Mastery Series of Exams". 

I passed the CASP a few months ago, and was throughly impressed. It seems designed to be a more technical alternative to the CISSP. CompTIA has stated that is targeted for IA Technical Level III and IA  Management Level II of the US DoD Directive 8570. The CASP exam was also recently ISO certified.

'The CASP is the result of our being advised over a couple of years that the Department of Defense was looking for a more technical security exam to include in the “IA Technical Level III” job classification, for those military and military contractors who are in information assurance roles.  The job classification that I referred to is in the Dept. of Defense “8570” directive that requires certification of all information assurance personnel.

The CASP is targeted at the lead security professional in the enterprise environment who has years of experience with security considerations specific to large multi-location organizations.  The U.S. military refers to that environment as the “enclave”, which means the same thing as the enterprise in the corporate environment.'

Source: CASP – The Evolution of Technical Security Certifications? (ethicalhacker.net)

Teensy talk at SANSFIRE SANS360

I'm reposting some information from a previous post, for a SANS360 talk tonight at SANSFIRE 2012. 
My paper is available here. The Arduino sketches used in my talk are here.
Here are the resources I used to launch the Teensy attack:

• Where to buy Teensy: http://www.pjrc.com/teensy/
• I bought the USB enclosures from Mouser Electronics.
• I bought the USB Type A Male to Mini 5-Pin Adapters from Amazon.
• Microsoft TechNet Prevent Installation of Removable Devices article.
• NirSoft's USBDeview may be downloaded here.

Here are some excellent Teensy articles:

• Adrian Crenshaw's Plug and Prey. Lots of great information there, plus Adrian discusses mitigation options in depth.
• DaberMania has some great Teensy articles here.
• AstroBaby's Teensy++2.0 and Metasploit.
• 0x80's Create your own malicious keyboard or mouse!

CISSP Study Guide, 2nd Edition

Just a quick note to say the CISSP Study Guide, 2nd Edition, will be out in a few weeks. More details to follow: stay tuned.

Here's the Amazon Link.

Here's the Syngress link.

Installing OpenWRT on a RouterBOARD 750GL

I have a project that requires a small Linux router/firewall, with a requirement of no wireless (due to physical security policies for the site). There are many third-party firmware options for wireless routers, with distributions such as dd-wrt and Open-WRT on APs from Linksys, Buffalo, etc. But the options for a simple wired router are more limited.

I found this excellent post: OpenWRT on Mikrotik Routerboard 411/750 on Wolfs Tech Blog, which indicated that OpenWRT is flashable onto a RouterBoard 750GL. I bought a pair from rOc-nOc.com. They were $59.95 each via Google Checkout, and shipping was fast.

I highly recommend rOc-nOc.com: great service!

The RouterBOARD 750GL has 5 gigabit ports, 64MB of SDRAM, 64MB NAND, and it literally fits in the palm of your hand.

RouterBOARDs ship with a proprietary RouterOS, but my project requires Linux.

I used the Wolfs Tech Blog post as my guide for installation, with help from this German post, with an assist from Google Translate. I ran into a few gotchas, so I thought I'd save someone else future grief and post my step-by-step instructions. Firmware installation can be tricky: there is no serial or display port on the 750GL: you need to "fly blind" and install over the network.

I used Xubuntu 12.4 as the OS for building OpenWRT, and as the TFTP/DHCP server to boot the RouterBoard via the network. I initially tried using a VMWare Workstation guest, but later encountered problems making the DHCP server work properly via a bridged interface. I ended up installing to USB, booted off the USB, and ran Xubuntu natively.

Install the required packages and Wireshark (which will be handy later):

$ sudo apt-get install subversion
$ sudo apt-get install g++ gawk libncurses5-dev zlib1g-dev git-core
$ sudo apt-get install dhcp3-server atftpd apache2
$ sudo apt-get install wireshark

Download the OpenWRT trunk code with Subversion and "make menuconfig":

$ cd
$ mkdir openwrt
$ cd openwrt
$ svn co svn://svn.openwrt.org/openwrt/trunk
$ cd trunk
$ make menuconfig

We need to compile twice. Once for the .tar.gz file, and once for the ramdisk.  Two steps because the .tar.gz file has has different requirements than the ramdisk, such as squashfs.

First the tar.gz file:

Choose:

• Target System: Atheros AR7xxx/AR9xxx 
• Subtarget: (Devices with NAND flash (mostly Mikrotik)) 
• Target Images: .tar.gz

Exit and type "make". It will take a long time to compile.

When complete, type the following:

$ cp ~/openwrt/trunk/bin/ar71xx/openwrt-ar71xx-nand-vmlinux-initramfs.elf /var/www
$ cp ~/openwrt/trunk/bin/ar71xx/openwrt-ar71xx-nand-rootfs.tar.gz /var/www

This prepares them for the "wget2nand" flashing step, coming up later.

Next the ramdisk:

$ cd ~/openwrt/trunk
$ make clean
$ make menuconfig

Choose:

• Target System: Atheros AR7xxx/AR9xxx 
• Subtarget: (Devices with NAND flash (mostly Mikrotik)) 
• Target Images: ramdisk

Exit and type "make". 

When complete copy the ramdisk to /srv/tftp:

$ cp ~/openwrt/trunk/bin/ar71xx/openwrt-ar71xx-nand-vmlinux-initramfs.elf /srv/tftp/

Configure atftpd and isc-dhcp-server. I used 192.168.1.3 as the TFTP server address, and assigned 192.168.1.99 to the RouterBoard. Avoid 192.168.1.1 (the default OpenWRT IP address).

Edit /etc/network/interfaces, use 192.168.1.3 as a static IP address:

auto eth0
iface eth0 inet static
address 192.168.1.3
netmask 255.255.255.0

Edit /etc/default/atftpd, changes in bold:

USE_INETD=false
OPTIONS="--bind-address 192.168.1.3 --tftpd-timeout 300 --retry-timeout 5 --mcast-port 1758 --mcast-addr 239.239.239.0-255 --mcast-ttl 1 --maxthread 100 --verbose=5 /srv/tftp"

Locate the first MAC address printed on the bottom of the RouterBOARD 750GL:

Edit /etc/dhcp/dhcpd.conf, and use the first listed MAC address as the hardware ethernet address:

authoritative;
allow booting;
allow bootp;
one-lease-per-client true;

subnet 192.168.1.0 netmask 255.255.255.0 {
  option routers 192.168.1.254;
  option subnet-mask 255.255.255.0;
  option broadcast-address 192.168.1.255;
  ignore client-updates;
}

group {
  host routerboard {
    hardware ethernet 00:0c:42:aa:bb:cc;
    next-server 192.168.1.3;
    fixed-address 192.168.1.99;
    filename "openwrt-ar71xx-nand-vmlinux-initramfs.elf";
  }
}

Now restart networking, atftpd and isc-dhcp-server:

$ sudo /etc/init.d/networking restart
$ sudo /etc/init.d/atftpd restart
$ sudo /etc/init.d/isc-dhcp-server restart

Run Wireshark, sniffing on eth0, to watch network traffic.

Boot the RouterBOARD 750GL via TFTP:

• Connect an ethernet cable between port 1 on the RouterBOARD 750GL and the TFTP server.
• Other ports won't work 
• Press the small "RES" button and plug in the power cable. 
• The "PWR" and "ACT" lights will illuminate. Then "ACT" will flash, and finally stop. 
• Now release the "RES" button. 
• The 750GL should request a DHCP address, receive 192.168.1.99, download openwrt-ar71xx-nand-vmlinux-initramfs.elf via TFTP, and boot OpenWRT. 

Use Wireshark to ensure everything's working; look for the TFTP "DATA Packet" packets to verify the ramdisk download.

The device will boot OpenWRT and use IP address 192.168.1.1.

Swap the cable to a different port to access OpenWRT. I used port 2 (port 1 won't work). Then telnet to the device:

$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to openwrt.lan.
Escape character is '^]'.
 === IMPORTANT ============================
  Use 'passwd' to set your login password
  this will disable telnet and enable SSH
 ------------------------------------------


BusyBox v1.19.4 (2012-05-10 11:17:53 PDT) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 ATTITUDE ADJUSTMENT (Bleeding Edge, r31673)
 -----------------------------------------------------
  * 1/4 oz Vodka      Pour all ingredients into mixing
  * 1/4 oz Gin        tin with ice, strain into glass.
  * 1/4 oz Amaretto
  * 1/4 oz Triple sec
  * 1/4 oz Peach schnapps
  * 1/4 oz Sour mix
  * 1 splash Cranberry juice
 -----------------------------------------------------
root@OpenWrt:/# 

Now that the 750GL has booted to ramdisk, the last step is flashing OpenWRT to make it permanent.

WARNING: the next steps will erase the existing RouterOS installation. Make sure to back up the OS, configuration and license first.

root@OpenWrt:/# wget2nand http://192.168.1.3
Connecting to 192.168.1.3 (192.168.1.3:80)
kernel               100% |*******************************|  2717k  0:00:00 ETA
Connecting to 192.168.1.3 (192.168.1.3:80)
rootfs.tgz           100% |*******************************|  1222k  0:00:00 ETA
Erasing filesystem...
Mounting /dev/mtdblock2 as new root and /dev/mtdblock1 as kernel partition
Copying kernel...
Preparing filesystem...
...
Cleaning up...
Image written, you can now reboot.  Remember to change the boot source to Boot from Nand

The 750GL should boot OpenWRT natively and respond to pings shortly.

USB Reloaded: the Teensy Attack

I'm posting this information in advance of my "USB Reloaded: the Teensy Attack" lightning talk, which I am delivering at SANS 2012 in Orlando. The talk is part of SANS360: Top Security Takeaways. The talk is scheduled for Tuesday, March 27, 2012 at 7:30 PM EDT and will be streamed live here.


Ten talks in 60 minutes, with 360 seconds per speaker. I can't wait!


My paper is available here. The Arduino sketches used in my talk are here.


Here are the resources I used to launch the Teensy attack:

• Where to buy Teensy: http://www.pjrc.com/teensy/
• I bought the USB enclosures from Mouser Electronics.
• I bought the USB Type A Male to Mini 5-Pin Adapters from Amazon.
• Microsoft TechNet Prevent Installation of Removable Devices article.
• NirSoft's USBDeview may be downloaded here.

Here are some excellent Teensy articles:

• Adrian Crenshaw's Plug and Prey. Lots of great information there, plus Adrian discusses mitigation options in depth.
• DaberMania has some great Teensy articles here.
• AstroBaby's Teensy++2.0 and Metasploit.
• 0x80's Create your own malicious keyboard or mouse!

Announcing SANS Security 528: SANS Training Program for the New CompTIA Advanced Security Practitioner Certification

I am happy to announce my brand-new SANS course: SANS Security 528, SANS Training Program for the New CompTIA Advanced Security Practitioner Certification.

It is based on the new CompTIA Advanced Security Practitioner (CASP) certification, which is the first in CompTIA's "Mastery Series of Exams".

I passed the CASP a few months ago, and was throughly impressed. It seems designed to be a more technical alternative to the CISSP. CompTIA has stated that is targeted for IA Technical Level III and IA  Management Level II of the US DoD Directive 8570. The CASP exam was also recently ISO certified.

The CASP is the result of our being advised over a couple of years that the Department of Defense was looking for a more technical security exam to include in the “IA Technical Level III” job classification, for those military and military contractors who are in information assurance roles.  The job classification that I referred to is in the Dept. of Defense “8570” directive that requires certification of all information assurance personnel.

The CASP is targeted at the lead security professional in the enterprise environment who has years of experience with security considerations specific to large multi-location organizations.  The U.S. military refers to that environment as the “enclave”, which means the same thing as the enterprise in the corporate environment.  

Source: CASP – The Evolution of Technical Security Certifications? (ethicalhacker.net)

CISSP® Study Guide sample chapter posted

Elsevier posted a sample chapter from CISSP Study Guide. Chapter 4, Domain 3: Cryptography: http://www.elsevierdirect.com/samplechapters/9781597495639/02~Chapter_4.pdf

Here's a small section:

Digital Signatures

Digital signatures are used to cryptographically sign documents. Digital signatures provide nonrepudiation, which includes authentication of the identity of the signer, and proof of the document’s integrity (proving the document did not change). This means the sender cannot later deny (or repudiate) signing the document.

Roy wants to send a digitally signed email to Rick. Roy writes the email, which is the plaintext. He then uses the SHA-1 hash function to generate a hash value of the plaintext. He then creates the digital signature by encrypting the hash with his RSA private key. Figure 4.13 shows this process. Roy then attaches the signature to his plaintext email and hits send.

Figure 4.13, Creating a digital signature

Rick receives Roy’s email and generates his own SHA-1 hash value of the plaintext email. Rick then decrypts the digital signature with Roy’s RSA public key, recovering the SHA-1 hash Roy generated. Rick then compares his SHA-1 hash with Roy’s. Figure 4.14 shows this process.

Figure 4.14, verifying a digital signature

If the two hashes match, Rick knows a number of things:

1. Roy must have sent the email (only Roy knows his private key). This authenticates Roy as the sender.
2. The email did not change. This proves the integrity of the email.

If the hashes match, Roy cannot later deny having signed the email. This is nonrepudiation. If the hashes do not match, Rick knows either Roy did not send it, or that the email’s integrity was violated.

I took many of the photos from this chapter at the National Cryptologic Museum in Fort Meade, Maryland. I highly recommend this museum, for old and young cryptographers alike.

Ben Rothke Reviews The CISSP® Study Guide

Ben Rothke reviews the CISSP® Study Guide:

Quoting from Ben's review:

The common wisdom is to choose two study guides when preparing for the CISSP exam.  For those that are serious about passing, the CISSP Study Guide should be one of them.

https://365.rsaconference.com/blogs/securityreading/2010/08/17/cissp-study-guide