The Perimeter is Dead

Here's a copy of my SANS CDI Keynote The Perimeter is Dead.

Build it Once, Build it Right: Architecting for Detection

Here's a copy of my Tactical Detection & Data Analytics Summit & Training 2018 keynote: Build it Once, Build it Right

SANS Blue Team Summit

Here is a copy of my SANS Blue Team Summit talk Threat Hunting via Windows Event Logs

Threat Hunting via Windows Event Logs

Copy of my #SANS2018 keynote talk:

Threat Hunting via Windows Event Logs

DerbyCon 7: DeepBlueCLIv2 Talk and links

Here's a link to my DerbyCon 7 talk: Introducing DeepBlueCLI v2, Now Available in PowerShell and Python

Viedo of my talk (thank you: Adrian Crenshaw): http://www.irongeek.com/i.php?page=videos/derbycon7/t205-introducing-deepbluecli-v2-now-available-in-powershell-and-python-eric-conrad

DeepBlueCLI GitHub site: https://github.com/sans-blue-team/DeepBlueCLI

Last year's talk: http://www.ericconrad.com/2016/09/deepbluecli-powershell-module-for-hunt.html



References:

1. Deconstructing Petya: how it spreads and how to fight back, https://nakedsecurity.sophos.com/2017/06/28/deconstructing-petya-how-it-spreads-and-how-to-fight-back/
2. Mandiant M-Trends 2015, https://www2.fireeye.com/rs/fireye/images/rpt-m-trends-2015.pdf
3. Command Line Kung Fu Episode #31: Remote Command Execution, http://blog.commandlinekungfu.com/2009/05/episode-31-remote-command-execution.html
4. https://github.com/jaredhaight/PSAttack
5. https://github.com/darkoperator/Posh-VirusTotal
6. https://www.virustotal.com/en/documentation/public-api/
7. http://blog.securityonion.net/2017/09/elastic-stack-alpha-release-and.html
8. https://github.com/philhagen/sof-elk
9. https://nxlog.co/products/nxlog-enterprise-edition
10. https://github.com/williballenthin/python-evtx
11. https://github.com/libyal/libevtx

ShadowBrokers PCAPs, etc.

I spent some time enjoying Easter Sunday by analyzing the Shadowbrokers EternalBlue attacks vs. a Windows 7 system. It is a service-side attack vs. TCP port 445. On Monday I analyzed EternalRomance and DoublePulsar.

I will update this post as I test other exploits and victim operating systems.

EternalBlue is the 2017 version of MS08-067, which was the last universal service-side vulnerability in Windows systems. EternalRomance is a similar SMB exploit.

I created EternalBlue PCAPs showing successful compromise vs. an unpatched system, reconnecting to a previously-infected system (using DoublePulsar), plus failed compromise vs. a patched system. I just added successful EternalRomance exploits.

PCAPs are here: https://cyber.gd/shadowbrokers

Includes:

• eternalromance-success-2008r2.pcap (new)
• eternalromance-doublepulsar-meterpreter.pcap (new)
• eternalblue-success-unpatched-win7.pcap
• eternalblue-failed-patched-win7.pcap
• doublepulsar-backdoor-connect-win7.pcap

VirusTotal PCAP analysis (Includes both Snort and Suricata alerts):

• EternalBlue successful compromise
• DoublePulsar backdoor

I confirmed that MS17-010 mitigates this attack. Patch now!

Default Windows event logging shows nothing. Neither EMET nor Applocker stopped EternalBlue.

Promising Wireshark display filters to detect EternalBlue (unconfirmed; there may be false positives):

• EternalBlue: smb.mid == 65
• DoublePulsar: smb.mid == 81

I disabled SMB1 on Windows 7, which stopped EternalBlue with default settings. I need to test more since EternalBlue can allegedly use SMB2. EternalRomance appears to be SMB1-only.

SMB1 is awful, and should be disabled regardless (be sure to test).

It appears Windows 2003 and XP will be vulnerable forever, barring a change in policy by Microsoft.

DoublePulsar is the backdoor (which listens via SMB or RDP) installed by both EternalBlue and EternalRomance. It allows you to inject other DLLs or code. I used it to inject Metasploit's Meterpreter payload, which will probably be a common approach once attacks take off in the wild.

Quality not Quantity talk, commands, and links

Quality not Quantity: Continuous Monitoring's  Deadliest Events

Commands:

Search service creation events and errors:

PS> Get-WinEvent -FilterHashtable @{logname='system'; id=7045,7030}

User creation events and users added to local and global security-enabled group:

PS> Get-WinEvent -FilterHashtable @{LogName="Security"; ID=4720,4732,4728}

Full command line of all processes (requires https://support.microsoft.com/en-us/kb/3004375):

PS> Get-WinEvent -FilterHashtable @{Logname="Security"; ID=4688}

AppLocker Events (requires AppLocker):

PS> Get-WinEvent -FilterHashTable @{LogName="Microsoft-Windows-AppLocker/EXE and DLL"; ID=8003,8004}

Detect when EMET blocks malware (requires EMET):

PS> Get-WinEvent -FilterHashtable @{LogName="application"; ProviderName="EMET"; id=2}

References:

1. Mandiant M-Trends 2016: https://www2.fireeye.com/rs/848-DID-242/images/Mtrends2016.pdf
2. Verizon DBIR: http://www.verizonenterprise.com/DBIR/2015/
3. USENIX Enigma 2016 - NSA TAO Chief on Disrupting Nation State Hackers https://www.youtube.com/watch?v=bDJb8WOJYdA
4. Neiman Marcus Hackers Set Off 60,000 Alerts While Bagging Credit Card Data: http://www.bloomberg.com/news/articles/2014-02-21/neiman-marcus-hackers-set-off-60-000-alerts-while-bagging-credit-card-data
5. The ASD 35 Strategies to Mitigate Targeted Cyber Intrusions: http://www.asd.gov.au/infosec/top-mitigations/mitigations-2014-table.htm
6. Patch-crazy Aust Govt fought off EVERY hacker since 2013 http://www.theregister.co.uk/2015/06/02/patchcrazy_aust_govt_fought_off_every_hacker_since_2013/
7. CIS Critical Security Controls: https://www.cisecurity.org/critical-controls/download.cfm?f=CSC-MASTER-VER%206.0%20CIS%20Critical%20Security%20Controls%2010.15.2015
8. AppLocker: https://technet.microsoft.com/en-us/library/mt431813(v=vs.85).aspx
9. AppLocker CSP: https://msdn.microsoft.com/library/windows/hardware/dn920019(v=vs.85).aspx
10. Windows 10 Enterprise 90-day Trial: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise
11. Microsoft EMET: https://support.microsoft.com/en-us/kb/2458544
12. Enable Windows command-line auditing: https://support.microsoft.com/en-us/kb/3004375 
13. Windows Commands Abused by Attackers http://blog.jpcert.or.jp/.s/2016/01/windows-commands-abused-by-attackers.html

DeepBlueCLI: a PowerShell Module for Hunt Teaming via Windows Event Logs

Here's a video of my 2016 DerbyCon talk DeepBlueCLI. Thank you, @irongeek_adc

A copy of my 2016 DerbyCon talk DeepBlueCLI slides:



Github site: https://github.com/sans-blue-team/DeepBlueCLI

Link to my Quality Not Quantity talk, which inspired DeepBlueCLI.

C2 Phone Home: Leveraging SecurityOnion to Identify Command and Control Channels

Video of the talk

Links from my Security Onion Con 2016 talk:

C2 Phone Home: Leveraging SecurityOnion to Identify Command and Control Channels

Link to all pcaps, Bro logs and Whitecap Snort Rules

Time is on your Side talk and links

Time is on you Side: Username guessing via Timing Attacks

Links from the talk:

• Eddy Harari's "opensshd - user enumeration" post to the Full Disclosure Mailing List: http://seclists.org/fulldisclosure/2016/Jul/51
• enumer8-ssh: https://github.com/eric-conrad/enumer8
• First names from the 1990 US Census: http://www2.census.gov/topics/genealogy/1990surnames/
• Last names from the 2000 US Census: http://www.census.gov/topics/population/genealogy/data/2000_surnames.html
• Account Enumeration via Timing Attacks https://littlemaninmyhead.wordpress.com/2015/07/26/account-enumeration-via-timing-attacks/
• Password Spraying Outlook Web Access – How to Gain Access to Domain Credentials Without Being on a Target’s Network: Part 2 http://www.blackhillsinfosec.com/?p=4694
• Question: What Can I Learn from Password Spraying a 2FA Microsoft Web App Portal?http://www.blackhillsinfosec.com/?p=5089

Quality not Quantity talk, commands, and links

Quality not Quantity: Continuous Monitoring's  Deadliest Events

Commands:

Search service creation events and errors:

PS> Get-WinEvent -FilterHashtable @{logname='system'; id=7045,7030}

User creation events and users added to local and global security-enabled group:

PS> Get-WinEvent -FilterHashtable @{LogName="Security"; ID=4720,4732,4728}

Full command line of all processes (requires https://support.microsoft.com/en-us/kb/3004375):

PS> Get-WinEvent -FilterHashtable @{Logname="Security"; ID=4688}

AppLocker Events (requires AppLocker):

PS> Get-WinEvent -FilterHashTable @{LogName="Microsoft-Windows-AppLocker/EXE and DLL"; ID=8003,8004}

Detect when EMET blocks malware (requires EMET):

PS> Get-WinEvent -FilterHashtable @{LogName="application"; ProviderName="EMET"; id=2}

References:

1. Mandiant M-Trends 2016: https://www2.fireeye.com/rs/848-DID-242/images/Mtrends2016.pdf
2. Verizon DBIR: http://www.verizonenterprise.com/DBIR/2015/
3. USENIX Enigma 2016 - NSA TAO Chief on Disrupting Nation State Hackers https://www.youtube.com/watch?v=bDJb8WOJYdA
4. Neiman Marcus Hackers Set Off 60,000 Alerts While Bagging Credit Card Data: http://www.bloomberg.com/news/articles/2014-02-21/neiman-marcus-hackers-set-off-60-000-alerts-while-bagging-credit-card-data
5. The ASD 35 Strategies to Mitigate Targeted Cyber Intrusions: http://www.asd.gov.au/infosec/top-mitigations/mitigations-2014-table.htm
6. Patch-crazy Aust Govt fought off EVERY hacker since 2013 http://www.theregister.co.uk/2015/06/02/patchcrazy_aust_govt_fought_off_every_hacker_since_2013/
7. CIS Critical Security Controls: https://www.cisecurity.org/critical-controls/download.cfm?f=CSC-MASTER-VER%206.0%20CIS%20Critical%20Security%20Controls%2010.15.2015
8. AppLocker: https://technet.microsoft.com/en-us/library/mt431813(v=vs.85).aspx
9. AppLocker CSP: https://msdn.microsoft.com/library/windows/hardware/dn920019(v=vs.85).aspx
10. Windows 10 Enterprise 90-day Trial: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise
11. Microsoft EMET: https://support.microsoft.com/en-us/kb/2458544
12. Enable Windows command-line auditing: https://support.microsoft.com/en-us/kb/3004375 
13. Windows Commands Abused by Attackers http://blog.jpcert.or.jp/.s/2016/01/windows-commands-abused-by-attackers.html

CISSP Study Guide 3E - Shipping Now

Just a note to say the CISSP Study Guide 3E is in stock and shipping from Amazon.

http://www.amazon.com/CISSP-Study-Guide-Third-Conrad/dp/0128024372

Electronic editions should be available in January. We are working on the 11th Hour CISSP Study Guide update now, chapters are due by April (but I hope to have it done before then).

CISSP Study Guide 3E is Complete

Lots of people have asked me for the release date of the CISSP Study Guide 3E. Amazon (now) lists December 29th, but it will be sooner.

I can confirm the book done and is at the printers now. I ordered copies as a surprise Christmas gift for students of my MGT 414 class coming up at SANS CDI in 3 weeks, and Syngress has confirmed the books will ship by then.

https://www.sans.org/event/cyber-defense-initiative-2015/course/sans-plus-s-training-program-cissp-certification-exam

MGT 414 and CISSP Study Guide Third Edition

ISC2 recently updated the CISSP® exam, effective April 15th 2015. The biggest change: they went from 10 to 8 domains.

SANS MGT 414 has been fully updated:

Course authors Eric Conrad and Seth Misenar have revised MGT414 to take into account the 2015 updates to the CISSP® exam and prepare students to navigate all types of questions included in the new version. 

MGT414 focuses solely on the 8 domains of knowledge as determined by (ISC)2 that form a critical part of CISSP® exam. Each domain of knowledge is dissected into its critical components, and those components are then discussed in terms of their relationship with one another and with other areas of information security.

We are also working on the CISSP® Study Guide Third Edition. It is due out in November 2015. We will update the Eleventh Hour CISSP Study Guide after that.

I have received a lot of questions regarding CISSP® Study Guide version 2E (and other books that predate this update). Here's ISC2's take:

Q: Since the CISSP has changed from 10 to 8 domains, was some content deleted?
A: No. Content was not removed from the exam and/or training material, but rather refreshed and reorganized to include the most current information and best practices relevant to the global information security industry.

So all of the CISSP® Study Guide Second Edition material still applies, but new concepts have been added. See the CISSP® 2015 Candidate Information Bulletin for specific details on the testable topics. Here's Clement Dupuis' take on cccure.training.

Clement also has a fantastic guide to the changes (with links to online sources of new material).

Long Tail Analysis of Windows Event Logs

This is a demo from a portion of lecture and lab from SEC511: Continuous Monitoring and Security Operations.

Link to T510-security.evtx.

Here are the PowerShell commands:

# Black text on white background (thank you @MarkBaggett)
PS C:\> cmd /c "color f0"

# Pull all security events (Requires administrator PowerShell)
PS C:\> Get-WinEvent -LogName security

# Pull all security events, search for date, count lines  (Requires administrator PowerShell)
PS C:\> Get-WinEvent -LogName security| findstr "1/19/2015"| Measure-Object

# List all events in the file T510-security.evtx
PS C:\> Get-WinEvent -Path .\T510-security.evtx

# Show event 4624 from T510-security.evtx, format list output
PS C:\> Get-WinEvent -FilterHashtable @{Path=".\T510-security.evtx"; ID=4624}| fl

# Perform long tail analysis of T510-security.evtx
PS C:\> Get-WinEvent -Path .\T510-security.evtx| Group-Object id -NoElement| sort count

Announcing: SEC511: Continuous Monitoring and Security Operations

I am happy to announce that the first beta for SANS SEC511: Continuous Monitoring and Security Operations has been scheduled for June 16-21 in Washington DC. Seth Misenar and I wrote the class, and it's proven to be a very timely (and necessary) topic!

I will teaching the first beta.

Note: This course is eligible for special beta pricing. Please enter discount code SEC511-BETA1 when registering to take advantage of the special beta price of $2450.

Flyer for SANS Course SEC528: SANS CompTIA Advanced Security Practitioner (CASP) Certification course

Flyer for my new SANS Course SEC528: SANS Training Program for the CompTIA Advanced Security Practitioner (CASP) Certification, beta class scheduled the week of July 22nd in Washington DC.

Special Beta pricing of $1995, plus $250 additional off when you use the code CASP_528B1. 

Hope to see you in DC!

Links from SANS Special Webcast: How to Prepare for the CompTIA CASP Exam

Here are the links for my SANS Special Webcast: How to Prepare for the CompTIA CASP Exam

SEC528: SANS Training Program for the CompTIA Advanced Security Practitioner Certification, beta class scheduled the week of July 22nd in Washington DC.

My previous webcast, Passing the CompTIA CASP: Discussing Sample Exam Questions

Updated DoD 8570.

Sample questions from SANS Security 528

• 30 Sample CompTIA CASP questions, in VCE format
• 30 Sample CompTIA CASP questions, in PDF Format
• 30 Sample CompTIA CASP questions with Answers, in PDF Format

A set of CompTIA CASP sample questions, from CompTIA. Another set from Darril Gibson

CompTIA CASP Exam Objectives

CompTIA CASP added to DoD 8570

CompTIA's CASP exam has been added to DoD 8570 for the following roles: IAT Level III, IAM Level II, and IASAE Levels I and II.

The beta run of my brand-new course: SEC528: SANS Training Program for the CompTIA® New Advanced Security Practitioner Certification™ has been scheduled in Washington DC the week of July 22nd.

It's a 5-day course, with a great beta discount. Hope to see you there!

SANS Webcast: Passing the CompTIA CASP Exam

I'll be conducting a webcast on September 7th called Passing the CompTIA CASP Exam.

If you miss the live webcast, an archive will be posted shortly thereafter.

My slide deck is posted here.

As I posted previously:

It is based on the new CompTIA Advanced Security Practitioner (CASP) certification, which is the first in CompTIA's "Mastery Series of Exams". 

I passed the CASP a few months ago, and was throughly impressed. It seems designed to be a more technical alternative to the CISSP. CompTIA has stated that is targeted for IA Technical Level III and IA  Management Level II of the US DoD Directive 8570. The CASP exam was also recently ISO certified.

'The CASP is the result of our being advised over a couple of years that the Department of Defense was looking for a more technical security exam to include in the “IA Technical Level III” job classification, for those military and military contractors who are in information assurance roles.  The job classification that I referred to is in the Dept. of Defense “8570” directive that requires certification of all information assurance personnel.

The CASP is targeted at the lead security professional in the enterprise environment who has years of experience with security considerations specific to large multi-location organizations.  The U.S. military refers to that environment as the “enclave”, which means the same thing as the enterprise in the corporate environment.'

Source: CASP – The Evolution of Technical Security Certifications? (ethicalhacker.net)