Endpoint Detection and Response – Tec-Bite IT Security Blog

About the job

We live in a time where data is the new tulips, the new gold, the new crude oil. The rush for our data is unbroken and sometimes takes on alarming proportions. Think of the gold rushes of the 19th century; instead of gold, today the data of users from all kinds of apps and services is mined. Billions are generated annually through the procurement, processing, and resale of our data. And what does this have to do with Endpoint Detection and Response (EDR)? Just like with some of the rather questionable excesses of data collection frenzy by certain apps (a current example here: www.heise.de/ct/artikel/Wie-Avast-die-Daten-seiner-Kunden-verkaufte-4657290.html), a proper EDR system naturally needs as much data as possible. In this case, however, it serves a noble purpose – namely the detection of attacks on the corporate network. Actually, not only for that. If you already have the data, it can of course also be used for other useful things like vulnerability management or IT hygiene. More on that later. From collecting to threat hunting However, collecting the data is not enough. It must also be analysed. Keyword: threat hunting. The premise here is that an attacker is already lurking on the systems. With targeted search criteria, one wants to track down the culprit. And this is where it gets tricky: what exactly should be searched for? The idea of an EDR solution is basically to discover unknown suspicious activities. Things that (NextGen) AV solutions did not initially detect and block. But how do you find the unknown? Answer: by not only searching directly for something specific, which an AV solution already does, but for indicators of an attack. The reactive method: Indicators of Compromise These Indicators of Compromise (IOC) consist of: Hash values IP addresses Domains Host artifacts (e.g. suspicious services, files or registry keys) suspicious network traffic specialised tools An interesting article on the topic of indicators can be found here: detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html. It deals with the "Pyramid of Pain", which in my opinion clearly shows how difficult it is to use the different types of IOCs when hunting. Source: detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html, accessed on 09.04.2020 But where do you get these IOCs from? One possibility is to tap directly into threat intelligence feeds, which also means automatic updates. One possible source for such feeds is MISP (www.misp.software/index.html). Another possibility is to create IOCs yourself. There are also web tools for this, such as IOC Bucket (www.iocbucket.com/openioceditor). Whichever way you work with IOCs, the catch is that it is a reactive method. Essentially the same method as pattern updates in conventional AV solutions. IOCs can be compared to evidence preservation in a criminal case. Securing the evidence always comes after the crime. We are not in Minority Report. The proactive method – Indicators of Attack To respond to this challenge, Indicators of Attack (IOAs) come into play. IOAs offer a proactive way of tracking. This should ideally prevent or at least minimise damage. Typical IOAs include: Unusually high number of logins on a server Activities on computers or in the network at unusual times Changes in the communication behaviour of a computer, e.g. increased communication to specific IPs or domains Port scans New running services on individual computers Newly created local accounts on computers Unusual process activities, e.g. deleting volume shadow copies Tactics, Techniques and Procedures (TTPs) A colleague has already written a worthwhile blog article on TTPs here: www.tec-bite.ch/mitre-attack-angriff-ist-die-beste-verteidigung/ How to do threat hunting without your own hunters With IOCs and IOAs you thus have the means to help you in the search. But how do you search now? Especially in SMEs, dedicated SOC teams are often not available, so specialists are simply lacking. It is all the more important that it is possible for less experienced hunters to use these tools. In the end, it is not only a question of know-how, time also plays a big role. If I already have enough daily business in my IT team today, an EDR system is of little use to me. If I have the data but cannot use it, it is pointless. For this case, manufacturers offer a service like Managed SOC. This way, you can benefit from the advantages of an EDR system without additional effort. As a pioneer in the use of IOAs, CrowdStrike (www.avantec.ch/loesungen/avantec-newcomers/#crowdstrike) sets new standards with its Falcon platform. The GUI is clear and understandable and offers pre-generated reports and useful hunting queries as aids. Here is a query that returns all PowerShell downloads as a result: event_simpleName=ProcessRollup2 FileName=powershell.exe (CommandLine=*Invoke-WebRequest* OR CommandLine=*Net.WebClient* OR CommandLine=*Start-BitsTransfer*) | table ComputerName UserName FileName CommandLine The result in the GUI: Practical: every search performed remains in the search history and can be easily reused from there: The queries are based on Splunk’s Search Processing Language. To avoid going too deep in this article, I would like to refer here to the corresponding "How to Hunt for Threat Activity with Falcon Endpoint Protection" article by CrowdStrike. It can be found here: www.crowdstrike.com/blog/tech-center/hunt-threat-activity-falcon-endpoint-protection/. What else an EDR can do As mentioned at the beginning, an EDR system is not only suitable for threat hunting but also offers other useful functions such as IT hygiene or vulnerability management. IT hygiene basically means knowing what applications I have on which computers, which versions these applications have, which accounts are used on which systems and what privileges they have there. If we want to stick with the CrowdStrike example, there is the Falcon Discover module for this: If I now know which applications I have in which versions on my systems, it would also be practical to know if I possibly have open security vulnerabilities. This is exactly where vulnerability management comes into play. The CrowdStrike Falcon platform offers the Spotlight module for this. As with the Discover module, Spotlight provides a comfortable overview of open vulnerabilities: The vulnerabilities are then listed with the CVE IDs from MITRE. Like the TTPs, CVEs (Common Vulnerabilities and Exposures) are now used as a standard by most security solution manufacturers. With the information from Spotlight, I as a system admin can then install the missing patches on my systems with WSUS or SCCM, or other patch management systems, and thus close the gaps. Conclusion In conclusion, it can be said that the topic of threat hunting is not without challenges. For effective hunting, besides the right tools, solid expertise is also necessary. Since most companies lack this expertise, it is advisable at least initially to rely on a managed service. This way, you can immediately benefit from enhanced protection and at the same time expand your own know-how without pressure. Attentive readers may have noticed that I have not yet addressed the response part of Endpoint Detection and Response. I will cover this in my next article. The article Endpoint Detection and Response – those who (properly) search, find! first appeared on Tec-Bite.