Hunting Hidden Empires with TLS - Certified Hypotheses - SANS Cyber Threat Intelligence Summit 2018

The “threat hunting” landscape has drastically changed due to the increase in encrypted transport layer security (TLS) Internet traffic. The days of adversaries registering domains with their given names are gone,and malicious actors increasingly use malware that takes advantage of TLS encryption to hide their tracks. Yet, even in this brave new world of altered tactics, techniques, and procedures, adversaries leave clues that can expose their infrastructure. To find these clues, however, blue teams need to learn some new tricks.

This talk focuses on expanding on techniques that have been researched and presented at various conferences by Mark Parsons, and specifically on his methods for using TLS certificates to find malicious malware infrastructure. We will build on
Parsons’ body of work and show how his approach to malware certificate hunting can be expanded to detect instances of PowerShell Empire servers that have self-generated SSL certifications on port 443 and 8080. These certificates have a unique fingerprint that can be detected by leveraging tools like
zmap/zgrep, python, and statistics/machine learning. The results of this research will show how network defenders can find previously unknown instances of malicious infrastructure communicating with their network and prevent them in the future.

Finally, we will discuss our creation of hypotheses, codes and techniques, and methods of validation for verification. We’ll then
release our tools and methodology for use by the community to explore other potential “hidden empires” of malware.

Dave Herrald (@daveherrald), Staff Security Strategist, Splunk
Ryan Kovar (@meansec) (@splunk), Senior Security Architect, Splunk

Bios:
Dave Herrald(@daveherrald), Staff Security Strategist, Splunk
Dave Herrald is a veteran security technologist. He holds a
number of security certifications including the GIAC GSE #79. Dave works on Splunk's Security Practice team, and rides bikes and skis for sanity.

Ryan Kovar(@meansec) (@splunk), Senior Security Architect, Splunk
Ryan Kovar worked at DARPA detecting and mitigating advanced threats. He has since moved onto Splunk as a security strategist
where he helps with incident response, hunting, and solving fun problems.

Видео Hunting Hidden Empires with TLS - Certified Hypotheses - SANS Cyber Threat Intelligence Summit 2018 канала SANS Digital Forensics and Incident Response