SecureSet WarGames - Logging and Packet Capture Training

©2015 SecureSet, LLC

Active Defense

PCAP and Log Detection Techniques

Instructor: Greg FossDecember 08, 2015


# whoami

[email protected]

@heinzarelli

Security Operations Team Lead

Sr. Security Research Engineer

OSCP, GAWN, GPEN, GCIH, CEH, Cyber APT


Logging and Packet Capture…


Why this content matters

You already have everything you need for security monitoring within your corporate infrastructure.

Logging and Packet Capture are the cornerstones to incident response and cyber investigations.

Detailed evidence that can help to show what exactly happened within an environment.

Valuable to Operations and Security alike


How it fits into cybersecurity

Every single computer investigation can be aided by supporting log and packet capture data.

If you ever want to work on an incident response team or help monitor the security of an organization, you must have an understand logging, packet capture analysis and event correlation.


What you should learn tonight

Introduction to Logging and Log Management

Actively Detecting Attacks Using Log Data

Introduction to Packet Capture and Net Flow

Packet Dissection and Data Exfiltration Detection

Packet Capture Challenge!

http://omg.endoftheinternet.org/


Why I love this industry


Breaking into computers for a living!


It’s also fun to go hunting…


TITLE


Logging


What are ‘Logs’…

“A record of performance, events,or day-to-day activities”

Merriam Webster, 2015


Log Data = Log Message Meaning

Informational – Generally benign events

Debug – Software development

Warning – Dependencies may be absent

Error – Indication that something is not right

Alert – Often security related. Highlight interesting info

Logging and Log Management, 2012


Log Formats

Flat File

Database

CSV

Linux Syslog

Generic Syslog

Windows System, Event, Security, etc…


Standard Logging Locations

Linux

/var/log/

Windows

Event Viewer


Log Management

Store the logs in a centralized location

Replicating logs across to a log management system

Back up the logs to ensure integrity of the data and maintain compliance standards


Log Parsing (Normalization)

To gain value from your SIEM, data must be normalized

Varies depending on the log management solution

Regular Expressions

Data Categorization

Common Event Generation

General Classification


Endpoint Monitoring

User Activity

File Integrity and Hashing

Processes Details

Network Connections

Registry Modification

Document and/or Web Bug Tracking


Event Correlation

Leveraging actionable metadata allows you to understand the full picture.

Key when attempting to reconstruct a scenario


Security Information Event Management

Bringing it all together

Dashboards

Automated Alerting

Automated Response

Central Log Storage

Enterprise Correlation


SIEM Tools

Commercial LogRhythm

Splunk

Open Source Logstash and

Kibana

Graylog


Advanced Logging

PowerShell

Command Line Logging

Extracting Logs using PowerShell PS C:\> Get-EventLog Security

Honeypot Event Correlation

TTY Log Replay

Web Bugs

Open Source Document Tracking and Event Correlation


DEMO


TITLE


Packet Capture (PCAP)


OSI Model Complete record of network activity : Layers 2-7


Transport Layer Protocols

Transmission Control Protocol (TCP)

Stateful – HTTP, SSH, SMTP, etc.

Used to establish interactive sessions

User Datagram Protocol (UDP)

Stateless / Connectionless transmission model

Easy to spoof origin

No delivery guarantee

Can be used to exfiltrate data via DNS


How To Capture Network Traffic

Local

Using tcpdump, Wireshark, NetworkMiner, Ettercap, etc.

In-Line Device

Often commercial but there are free tools as well.

Mirror off Firewalls

Split datapassed through firewalls and push to appliance.

Offensive – MiTM, Arp Poisoning, Evil Twin, etc.


Packet Capture Appliances

LogRhythm Network Monitor Freemium Version – https://support.logrhythm.com

FireEye PX Series

NetScout

NetWitness

Riverbed

Etc.


Network Tap

A network Tap can be as simple as a hub. Hubs allow you to see all data transmitted, as opposed to switches.

Raspberry Pi

Beaglebone Black

LAN Turtle

Wi-Fi Pineapple


Capturing Network Traffic

Simple Network

Many Options


Capturing Network Traffic Basic Network, Multiple VLANs


Offensive Network Capture

ARP Poisoning

Convince host that our MAC is the router, traffic begans to pass through our system.

Evil Twin Wi-Fi Attacks

https://www.youtube.com/watch?v=86bvUV92Ek8

We’ll talk about this more soon…

Attack Switches, Routers, Gateways, etc.


Sniffing Packets

Many protocols are in plain text

Easy to understand and dissect

HTTP, DNS, FTP, Telnet, SMTP, etc.

TLS is becoming more prevalent

Making traffic inspection more difficult

HTTPS, SSH, SFTP, FTPS, etc.

Malware often uses encrypted tunnels


Viewing Encrypted Packets SSL Interception Proxies

Source: https://logrhythm.com/blog/network-monitor-and-ssl-proxy-integration/


Offensive MiTM Against TLS / SSL

SSLStrip – Older but still works

https://github.com/moxie0/sslstrip

SSLSplit – Transparent TLS/SSL Interception Proxy

Terminates one session then creates its own

https://github.com/droe/sslsplit

NetRipper – Windows API Hooking

https://github.com/NytroRST/NetRipper


Attacking Users – A Case Study


Evil Twin


Evil Twin

source: http://www.breakthesecurity.com/2014/04/evil-twin-attack-fake-wifi-hack.html


DEMO


We’ve only just scratched the surface…


Want To Learn More and Practice?

http://www.netresec.com/?page=PcapFiles

Publicly Available PCAP Files

http://malware-traffic-analysis.net/

PCAP Files and Malware Samples

https://www.vthreat.com/

Simulate threats, data exfiltration, etc.

VirusTotal Professional


PCAP Challenge


UsingLog Datato TrackWinners


References Chuvakin, Anton, and Kevin Schmidt. Logging and

Log Management: The Authoritative Guide to Dealing with Syslog, Audit Logs, Events, Alerts and Other IT 'noise' Rockland, MA: Syngress, 2012. Print.

Bejtlich, Richard. The Tao of Network Security Monitoring: Beyond Intrusion Detection. Boston: Addison-Wesley, 2005. Print.


CLOSING

Careers in this area of security

The work – LogRhythm is hiring!

The rewards – Great benefits!

How to pursue

https://logrhythm.com/about/careers/

[email protected]


Provides aspiring security talent with a powerful & direct path into cybersecurity

“Career Promise”

www.secureset.com/academy

Next Denver session: January 2016

http://www.secureset.com/academy


Did you know?More than 209,000 cybersecurity jobs

in the US are unfilled.*

* www.peninsulapress.com/2015


wargames.secureset.com

[email protected]

Secure your future in Cyber!SecureSet Academy Starts January 2016

http://wargames.secureset.com/

mailto:[email protected]

SecureSet WarGames - Logging and Packet Capture Training

Technology

Transcript of SecureSet WarGames - Logging and Packet Capture Training