Strengthening Threat Hunting Programs - Part 2: Risk Hunting

-

 


This is the second part of my threat hunting blog series. Please click here for the first part.

Introduction

It was once put to me that, much like hunting in the wilderness, so much of what matters is not the last pursuit of target, but the long stalk. It is crucial to learn to read the land and the patterns of the local wildlife as well as the predators. Understanding the lay of the land is as important as it was for our hunter-gatherer ancestors as it is to hunting threats in your organisation’s network.

To increase the overall security posture of an organisation as an in-house security or managed security service provider (MSSP) you need to learn what is normal and what is abnormal in that organisation. You must understand what that organisation’s current policies around software downloads are, website filtering, vulnerability patching, remote login abilities, or file access permissions, among other controls (or lack thereof).

The types of risky behaviour you will naturally uncover as a threat hunter can include, but is not limited to, the activities of the users you are responsible for protecting, who do things such as downloading potentially dangerous software or visiting unsafe websites and clicking on things they should not. These are the sorts of risky behaviours that that are likely to lead to malware infections, if left unchecked.

Risk Hunting (Threat Hunting Lite)

The interesting thing about threat hunting is that, ideally, you don’t come across any signs of malicious behaviour often or, even better, at all. Therefore, if you’re never finding anything to escalate you may have to augment your hunting program to increase your scope from only threats to risks.

In my viewing, risk hunting involves performing a type of proactive attack surface review by checking internal and external security posture instead of checking only for signs of malicious activities in the environment. Risk hunting would be more ‘left-of-boom’ as my US colleagues who’ve served in the military may like to say.

To introduce this concept of risk hunting in a threat hunting context, I want to use some examples I gathered from the Curated Intelligence community, which consists of in-house CTI teams, CTI analysts for vendors, detection engineers, full-time threat hunters, analysts at MSSP, as well as digital forensics and incident response (DFIR) consultants.

In these examples, let’s use a threat hunting specialist called Hunter. The important thing to remember these are all based on real-world examples, sometimes with hard lessons learned.

Risk Hunting Example 1

An adversary has been reportedly mass exploiting an Internet-facing networking device.

Hunter uses CTI sources to identify this campaign. Hunter then checks if their organisation uses the device, as well as if it is patched and for any indicators of attack (IOAs) or indicators of compromise (IOCs). While performing checks for the networking device, Hunter finds that an employee has installed an unrecognised VPN client on their workstation.

Hunter then escalates the endpoint with the unauthorised VPN client installed on it to another infosec team for removal, due to non-compliance with security policy.

Usage of VPNs without a proper justification of why it’s there is a clear risk to Hunter’s organisation, but no signs of malicious activity were technically found.

Risk Hunting Example 2

An adversary has been reportedly leveraging a misconfiguration in a collaborative chatting application that enables users to receive messages from external senders directly.

Hunter uses CTI sources to learn about this campaign. Hunter then checks if that misconfiguration impacts the collaborative chatting application used in their organisation by escalating it to another infosec team for remediation.

The misconfiguration presented a clear risk to the organisation due to there being an active campaign leveraging it in the wild. Leaving it in that state leaves them open to attack.

Risk Hunting Example 3

An adversary has been reportedly hosting their payloads on file-sharing web services as well as performing data exfiltration to them (such as DropMeFile, Mega[.]nz, or pCloud).

Hunter looks for internet connections to these websites. Hunter found Discord.exe on an employee’s workstation connecting to the Discord Content Delivery Network (CDN).

Hunter escalates the application for removal. While having legitimate use, it is not currently threat, but it poses a significant risk related to receiving malicious files, phishing links, or can be used for data exfiltration.

Risk Hunting Example 4

An adversary has reportedly stolen credentials from scheduled tasks.

Hunter looks for scheduled tasks created with plaintext credentials. Hunters finds out that an IT sysadmin has created a scheduled task with plaintext credentials using their Domain Admin account.

Hunter escalates the risky scheduled task to the IT sysadmin. While no adversary has been found in the network, this is a highly risky practice that lacks security considerations. If an adversary was able to gain initial access and move laterally, they could gain the highest-level privileges by simply uncovering the scheduled task.

Risk Hunting Example 5

An adversary has been reportedly brute forcing non-production legacy test tenants.

Hunter performs a check to find out the asset inventory of the Azure tenants the organisation owns. Hunter finds a legacy test tenant that does not confirm with organisational standards and policies, such as enforcing multi-factor authentication (MFA) on all accounts and a lack of logging.

Hunter escalates the legacy test tenant to engineering and recommends either decommissioning the tenant or making it comply with the organisation’s current security policies.

Final considerations

Hunting for threats and risks can be performed by multiple teams. While some Security Operations Centers (SOCs) may have embedded Threat Hunting teams other organisations have dedicated Detection Engineering and Threat Hunting (DEATH) teams. I know of organisations that have a Cyber Threat Intelligence (CTI) team that is standalone from a SOC or Security Engineering team that also performs threat hunting duties.

In other cases, across the cybersecurity industry, you will see dedicated monitoring and threat hunting teams (think CrowdStrike’s Overwatch team and Falcon Complete server) that performs constant reviews of endpoint logs specific related to endpoint detection and response (EDR) sensors. This is typical for managed security service providers (MSSPs). But they are only seeing one part of the picture.

In-house hunting teams will often have access to many types of tools and logs, which may get ingested all into a SIEM or SOAR platform. This can include Firewall logs, Web Proxy logs, Endpoint logs, Cloud logs, Identity and Access Management logs, and Email Gateway logs, among others.

Conclusion

While risk management is an altogether different discipline from CTI and threat hunting, having the resources to track, plan, and mitigate risks will depend on the maturity of an organisation.

To begin this process as a threat hunting team, however, you will need to define what can be considered a risk, create processes related performing risk assessments, create a risk register to track all you have discovered, and ultimately begin to understand your organisation’s risk appetite.

Popular posts from this blog

Raspberry Robin: A global USB malware campaign providing access to ransomware operators

-
Image
Logo credit: RedCanary Ever since it first appeared in late 2021, the Raspberry Robin malware campaign has been propagating globally. A number of threat intelligence reports by vendors such as RedCanary (who named it) and Microsoft (who track it as DEV-0856/Storm-0856) have covered the malware campaign in great detail.  In fact, the list of blogs I do recommend to read to catch up on this threat are as follows: https://redcanary.com/blog/raspberry-robin https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity https://blog.sekoia.io/raspberry-robins-botnet-second-life/ https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/ https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/ https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/ https://blogs.cisco.com/security/raspberry-robin-highly-evasive-worm-sprea...
Read more

Lessons from the iSOON Leaks

-
Image
  Introduction A Chinese Ministry of Public Security (MPS) contractor called  iSOON (also known as Anxun Information) that  specializes in network penetration research and related services has had its data leaked to GitHub. Based on the level of detail, leaked chat logs, amount of data, and corroboration from overlaps indicators of compromise (IOCs), there is a high level of confidence it is legit. Preliminary findings from less than one week since the leak revealed that it contains unprecedented insights into how the Chinese MPS operates by using Chinese commercial surveillance vendors and what their technical capabilities are. The Chinese MPS is China’s internal security service that primarily focuses on  internal and border security, counter-terrorism, surveillance. The MPS is comparable to the  Russian FSB, the US DHS or the UK’s MI5. The most interesting findings have come from iSOON’s product whitepapers and confidential slide deck presentations given to t...
Read more

The Ransomware Tool Matrix

-
Image
Introduction Ransomware attacks are becoming increasingly damaging, but one thing remains consistent: the tools these cybercriminals rely on. The Ransomware Tool Matrix is a comprehensive resource that sheds light on the tactics, techniques, and procedures (TTPs) commonly used by ransomware and extortionist gangs. This repository provides defenders with actionable intelligence on the tools frequently leveraged by adversaries, thanks to the insights shared publicly by the US Cybersecurity and Infrastructure Security Agency (CISA)'s #StopRansomware advisories and The DFIR Report's publications, among others. This repository offers straightforward insights from compiled open source intelligence (OSINT) research that can be directly applied to threat hunting, detection engineering, and incident response operations. Project Background As defenders, we can turn the tables by exploiting a crucial flaw committed by ransomware gangs: tool reuse. Many ransomware gangs repeatedly rely on ...
Read more