Decrypt all the Things: How Encryption is Impacting Network-Based Security Controls

Here's a copy of my SANS @Mic webcast slides: Decrypt all the Things: How Encryption is Impacting Network-Based Security Controls 

Threat Hunting via DNS

My SANS @Mic talk Threat Hunting via DNS

Link to the Youtube video.

Here are the links:

• DNS New World Order: QuadX! DoH! DoT! Da Fuq?
• Paul Vixie on DoH
• Firefox continues push to bring DNS over HTTPS by default for US users
• Firefox to enable DNS-over-HTTPS by default to US users
• Firefox HTTP logging
• Tutorial to setup your own DNS-over-HTTPS (DoH) server
• DNS-over-HTTPS with Pi-Hole
• https://github.com/MarkBaggett/domain_stats
• https://www.arin.net/resources/registry/whois/rdap/

CISSP Cram Session

Here are the slides for my CISSP Cram Session webcast.



The webcast is available here: http://sans.org/u/140g

BSides Halifax

Here's a link to my BSides Halifax talk Threat Hunting via DNS

Here's a link to my SANS Miami 2020 keynote talk:

Threat Hunting via Sysmon

Maine DEFCON 207

Here's a copy of my DEFCON 207 talk Threat Hunting via Windows Event Logs

DeepBlueCLI GitHub site: https://github.com/sans-blue-team/DeepBlueCLI

Threat Hunting via Windows Event Logs

Here's a copy of my SANS Security West keynote Threat Hunting via Windows Event Logs

Here's a copy of my Atlantic Security Conference talk: Build it Once, Build it Right: Architecting for Detection

The Perimeter is Dead

Here's a copy of my SANS CDI Keynote The Perimeter is Dead.

Build it Once, Build it Right: Architecting for Detection

Here's a copy of my Tactical Detection & Data Analytics Summit & Training 2018 keynote: Build it Once, Build it Right

SANS Blue Team Summit

Here is a copy of my SANS Blue Team Summit talk Threat Hunting via Windows Event Logs

Threat Hunting via Windows Event Logs

Copy of my #SANS2018 keynote talk:

Threat Hunting via Windows Event Logs

DerbyCon 7: DeepBlueCLIv2 Talk and links

Here's a link to my DerbyCon 7 talk: Introducing DeepBlueCLI v2, Now Available in PowerShell and Python

Viedo of my talk (thank you: Adrian Crenshaw): http://www.irongeek.com/i.php?page=videos/derbycon7/t205-introducing-deepbluecli-v2-now-available-in-powershell-and-python-eric-conrad

DeepBlueCLI GitHub site: https://github.com/sans-blue-team/DeepBlueCLI

Last year's talk: http://www.ericconrad.com/2016/09/deepbluecli-powershell-module-for-hunt.html



References:

1. Deconstructing Petya: how it spreads and how to fight back, https://nakedsecurity.sophos.com/2017/06/28/deconstructing-petya-how-it-spreads-and-how-to-fight-back/
2. Mandiant M-Trends 2015, https://www2.fireeye.com/rs/fireye/images/rpt-m-trends-2015.pdf
3. Command Line Kung Fu Episode #31: Remote Command Execution, http://blog.commandlinekungfu.com/2009/05/episode-31-remote-command-execution.html
4. https://github.com/jaredhaight/PSAttack
5. https://github.com/darkoperator/Posh-VirusTotal
6. https://www.virustotal.com/en/documentation/public-api/
7. http://blog.securityonion.net/2017/09/elastic-stack-alpha-release-and.html
8. https://github.com/philhagen/sof-elk
9. https://nxlog.co/products/nxlog-enterprise-edition
10. https://github.com/williballenthin/python-evtx
11. https://github.com/libyal/libevtx

ShadowBrokers PCAPs, etc.

I spent some time enjoying Easter Sunday by analyzing the Shadowbrokers EternalBlue attacks vs. a Windows 7 system. It is a service-side attack vs. TCP port 445. On Monday I analyzed EternalRomance and DoublePulsar.

I will update this post as I test other exploits and victim operating systems.

EternalBlue is the 2017 version of MS08-067, which was the last universal service-side vulnerability in Windows systems. EternalRomance is a similar SMB exploit.

I created EternalBlue PCAPs showing successful compromise vs. an unpatched system, reconnecting to a previously-infected system (using DoublePulsar), plus failed compromise vs. a patched system. I just added successful EternalRomance exploits.

PCAPs are here: https://cyber.gd/shadowbrokers

Includes:

• eternalromance-success-2008r2.pcap (new)
• eternalromance-doublepulsar-meterpreter.pcap (new)
• eternalblue-success-unpatched-win7.pcap
• eternalblue-failed-patched-win7.pcap
• doublepulsar-backdoor-connect-win7.pcap

VirusTotal PCAP analysis (Includes both Snort and Suricata alerts):

• EternalBlue successful compromise
• DoublePulsar backdoor

I confirmed that MS17-010 mitigates this attack. Patch now!

Default Windows event logging shows nothing. Neither EMET nor Applocker stopped EternalBlue.

Promising Wireshark display filters to detect EternalBlue (unconfirmed; there may be false positives):

• EternalBlue: smb.mid == 65
• DoublePulsar: smb.mid == 81

I disabled SMB1 on Windows 7, which stopped EternalBlue with default settings. I need to test more since EternalBlue can allegedly use SMB2. EternalRomance appears to be SMB1-only.

SMB1 is awful, and should be disabled regardless (be sure to test).

It appears Windows 2003 and XP will be vulnerable forever, barring a change in policy by Microsoft.

DoublePulsar is the backdoor (which listens via SMB or RDP) installed by both EternalBlue and EternalRomance. It allows you to inject other DLLs or code. I used it to inject Metasploit's Meterpreter payload, which will probably be a common approach once attacks take off in the wild.

Quality not Quantity talk, commands, and links

Quality not Quantity: Continuous Monitoring's  Deadliest Events

Commands:

Search service creation events and errors:

PS> Get-WinEvent -FilterHashtable @{logname='system'; id=7045,7030}

User creation events and users added to local and global security-enabled group:

PS> Get-WinEvent -FilterHashtable @{LogName="Security"; ID=4720,4732,4728}

Full command line of all processes (requires https://support.microsoft.com/en-us/kb/3004375):

PS> Get-WinEvent -FilterHashtable @{Logname="Security"; ID=4688}

AppLocker Events (requires AppLocker):

PS> Get-WinEvent -FilterHashTable @{LogName="Microsoft-Windows-AppLocker/EXE and DLL"; ID=8003,8004}

Detect when EMET blocks malware (requires EMET):

PS> Get-WinEvent -FilterHashtable @{LogName="application"; ProviderName="EMET"; id=2}

References:

1. Mandiant M-Trends 2016: https://www2.fireeye.com/rs/848-DID-242/images/Mtrends2016.pdf
2. Verizon DBIR: http://www.verizonenterprise.com/DBIR/2015/
3. USENIX Enigma 2016 - NSA TAO Chief on Disrupting Nation State Hackers https://www.youtube.com/watch?v=bDJb8WOJYdA
4. Neiman Marcus Hackers Set Off 60,000 Alerts While Bagging Credit Card Data: http://www.bloomberg.com/news/articles/2014-02-21/neiman-marcus-hackers-set-off-60-000-alerts-while-bagging-credit-card-data
5. The ASD 35 Strategies to Mitigate Targeted Cyber Intrusions: http://www.asd.gov.au/infosec/top-mitigations/mitigations-2014-table.htm
6. Patch-crazy Aust Govt fought off EVERY hacker since 2013 http://www.theregister.co.uk/2015/06/02/patchcrazy_aust_govt_fought_off_every_hacker_since_2013/
7. CIS Critical Security Controls: https://www.cisecurity.org/critical-controls/download.cfm?f=CSC-MASTER-VER%206.0%20CIS%20Critical%20Security%20Controls%2010.15.2015
8. AppLocker: https://technet.microsoft.com/en-us/library/mt431813(v=vs.85).aspx
9. AppLocker CSP: https://msdn.microsoft.com/library/windows/hardware/dn920019(v=vs.85).aspx
10. Windows 10 Enterprise 90-day Trial: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise
11. Microsoft EMET: https://support.microsoft.com/en-us/kb/2458544
12. Enable Windows command-line auditing: https://support.microsoft.com/en-us/kb/3004375 
13. Windows Commands Abused by Attackers http://blog.jpcert.or.jp/.s/2016/01/windows-commands-abused-by-attackers.html

DeepBlueCLI: a PowerShell Module for Hunt Teaming via Windows Event Logs

Here's a video of my 2016 DerbyCon talk DeepBlueCLI. Thank you, @irongeek_adc

A copy of my 2016 DerbyCon talk DeepBlueCLI slides:



Github site: https://github.com/sans-blue-team/DeepBlueCLI

Link to my Quality Not Quantity talk, which inspired DeepBlueCLI.

C2 Phone Home: Leveraging SecurityOnion to Identify Command and Control Channels

Video of the talk

Links from my Security Onion Con 2016 talk:

C2 Phone Home: Leveraging SecurityOnion to Identify Command and Control Channels

Link to all pcaps, Bro logs and Whitecap Snort Rules

Time is on your Side talk and links

Time is on you Side: Username guessing via Timing Attacks

Links from the talk:

• Eddy Harari's "opensshd - user enumeration" post to the Full Disclosure Mailing List: http://seclists.org/fulldisclosure/2016/Jul/51
• enumer8-ssh: https://github.com/eric-conrad/enumer8
• First names from the 1990 US Census: http://www2.census.gov/topics/genealogy/1990surnames/
• Last names from the 2000 US Census: http://www.census.gov/topics/population/genealogy/data/2000_surnames.html
• Account Enumeration via Timing Attacks https://littlemaninmyhead.wordpress.com/2015/07/26/account-enumeration-via-timing-attacks/
• Password Spraying Outlook Web Access – How to Gain Access to Domain Credentials Without Being on a Target’s Network: Part 2 http://www.blackhillsinfosec.com/?p=4694
• Question: What Can I Learn from Password Spraying a 2FA Microsoft Web App Portal?http://www.blackhillsinfosec.com/?p=5089

Quality not Quantity talk, commands, and links

Quality not Quantity: Continuous Monitoring's  Deadliest Events

Commands:

Search service creation events and errors:

PS> Get-WinEvent -FilterHashtable @{logname='system'; id=7045,7030}

User creation events and users added to local and global security-enabled group:

PS> Get-WinEvent -FilterHashtable @{LogName="Security"; ID=4720,4732,4728}

Full command line of all processes (requires https://support.microsoft.com/en-us/kb/3004375):

PS> Get-WinEvent -FilterHashtable @{Logname="Security"; ID=4688}

AppLocker Events (requires AppLocker):

PS> Get-WinEvent -FilterHashTable @{LogName="Microsoft-Windows-AppLocker/EXE and DLL"; ID=8003,8004}

Detect when EMET blocks malware (requires EMET):

PS> Get-WinEvent -FilterHashtable @{LogName="application"; ProviderName="EMET"; id=2}

References:

1. Mandiant M-Trends 2016: https://www2.fireeye.com/rs/848-DID-242/images/Mtrends2016.pdf
2. Verizon DBIR: http://www.verizonenterprise.com/DBIR/2015/
3. USENIX Enigma 2016 - NSA TAO Chief on Disrupting Nation State Hackers https://www.youtube.com/watch?v=bDJb8WOJYdA
4. Neiman Marcus Hackers Set Off 60,000 Alerts While Bagging Credit Card Data: http://www.bloomberg.com/news/articles/2014-02-21/neiman-marcus-hackers-set-off-60-000-alerts-while-bagging-credit-card-data
5. The ASD 35 Strategies to Mitigate Targeted Cyber Intrusions: http://www.asd.gov.au/infosec/top-mitigations/mitigations-2014-table.htm
6. Patch-crazy Aust Govt fought off EVERY hacker since 2013 http://www.theregister.co.uk/2015/06/02/patchcrazy_aust_govt_fought_off_every_hacker_since_2013/
7. CIS Critical Security Controls: https://www.cisecurity.org/critical-controls/download.cfm?f=CSC-MASTER-VER%206.0%20CIS%20Critical%20Security%20Controls%2010.15.2015
8. AppLocker: https://technet.microsoft.com/en-us/library/mt431813(v=vs.85).aspx
9. AppLocker CSP: https://msdn.microsoft.com/library/windows/hardware/dn920019(v=vs.85).aspx
10. Windows 10 Enterprise 90-day Trial: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise
11. Microsoft EMET: https://support.microsoft.com/en-us/kb/2458544
12. Enable Windows command-line auditing: https://support.microsoft.com/en-us/kb/3004375 
13. Windows Commands Abused by Attackers http://blog.jpcert.or.jp/.s/2016/01/windows-commands-abused-by-attackers.html

CISSP Study Guide 3E - Shipping Now

Just a note to say the CISSP Study Guide 3E is in stock and shipping from Amazon.

http://www.amazon.com/CISSP-Study-Guide-Third-Conrad/dp/0128024372

Electronic editions should be available in January. We are working on the 11th Hour CISSP Study Guide update now, chapters are due by April (but I hope to have it done before then).