Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and...

28
Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation

Transcript of Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and...

Page 1: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

Tracking Threat Actors through YARA

Rules and Virus Total

Kevin Perlow- Booz Allen HamiltonAllen Swackhamer- Target Corporation

Page 2: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

YARA Rule Notification

Elasticsearch Stack Indexing/Logging

Cuckoo

Additional APIs

1

2

3

24

Automation and Collection Workflow

Page 3: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

YARA Rules - Purpose• Track Campaigns

▫ Strings

▫ Static Indicators

▫ Compilation Artifacts

▫ Opcode signatures

• Categorize Malware

▫ Family / Variants Basic YARA rule for tracking a crimeware crypter

Page 4: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

YARA Rules- Examples

Page 5: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

YARA Rules- Examples

Page 6: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

YARA Rules- Examples

Page 7: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

YARA Rules- Case Study

Page 8: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

YARA Rules- Case Study

Left: the executable path being built.

Top right: Similar sample- the GET request being made inside a try/catch function

Page 9: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

YARA Rule Notification

Elasticsearch Stack Indexing/Logging

Cuckoo

Additional APIs

1

2

3

24

Automation and Collection Workflow

Page 10: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

Notifications API

• VirusTotal or proprietary database

▫ SMTP notifications

Pull via Python IMAP library

▫ JSON notifications

Pull from REST API via Python requests library

Delete the alerts from VT after you process them

• Index and Parse into Elasticsearch

Page 11: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

Sample VirusTotal Notification

Page 12: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

IOC Extraction and Logging• Static Extraction

▫ Configuration deobfuscation and parsing▫ Strings▫ Various obfuscation techniques (olevba)▫ FLOSS – Automated deobfuscation of strings

• Dynamic Extraction▫ Sandbox

Network File system

Page 13: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

YARA Rule Notification

Elasticsearch Stack Indexing/Logging

Cuckoo

Additional APIs

1

2

3

24

Automation and Collection Workflow

Page 14: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

Elasticsearch Stack• Elasticsearch & Kibana

▫ Visualize Notification Trends First Seen Last Seen Resubmissions

▫ Export Data (Hash, Rule Name, Rule Set) Pivot through additional API’s Export to CSV/JSON or other consumable formats

Page 15: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.
Page 16: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

Cuckoo Sandbox• Automated Submission

▫ Push notifications to Cuckoo on ingest from VT▫ Output IOCs (Domains, Files, Mutexs, etc…) back to

Elasticsearch• Customizable

▫ Custom Elasticsearch reporting module• Popular Sandboxes

▫ VirusTotal▫ Malwr▫ Hybrid Analysis

Page 17: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

• Sets shard count to 1

• Compression to “best”

• Strings to “not_analyzed”

• task_id is an indexed field

• report_time is the date/time field

Cuckoo Elasticsearch

Index Template

Page 18: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

Back to the Elasticsearch Stack

• Collect Cuckoo IOCs

▫ Track by Domain, IP, Country

▫ Files written to disk

▫ Command line called

▫ Normalization of A/V Data

Page 19: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.
Page 20: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.
Page 21: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

• Files• Registry• Mutex• Directory• Resolved Hosts• Connected Hosts• Command Line• DLL Loaded• WMI Query• Target File - Hash• Target File - Name• Target File - Type• VirusTotal Signatures

Cuckoo Summary

Page 22: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.
Page 23: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

Lucene Search Query Syntax

List of hosts and files written aggregated with count

Normalized AV signatures from VT

Command line called by malware

File size and hosts connected to

Page 24: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.
Page 25: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

YARA Rule Notification

Elasticsearch Stack Indexing/Logging

Cuckoo

Additional APIs

1

2

3

24

Automation and Collection Workflow

Page 26: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

Additional APIs• VirusTotal

▫ Parent objects Emails Zip Files

▫ Network Infrastructure• CentralOps

▫ Whois▫ Physical Address

• PassiveTotal▫ PassiveDNS▫ Historical Records

Page 27: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

Recap• Built YARA rule for one dropper

• Identified 700+ files

• Automated analysis via Cuckoo

• Logging via Elasticsearch and Visualization with Kibana

• Additional pivoting via API

• Source code: https://github.com/swackhamer

Page 28: Tracking Threat Actors through YARA Rules and … · Tracking Threat Actors through YARA Rules and Virus Total Kevin Perlow- Booz Allen Hamilton Allen Swackhamer- Target Corporation.

Questions?


THREAT COMPASS - Blueliv...Threat Compass Threat Context provides security teams with continuously updated and intuitive information around threat actors, campaigns, IOCs, malware,

THREAT COMPASS - Blueliv...Threat Compass Threat Context provides security teams with continuously updated and intuitive information around threat actors, campaigns, IOCs, malware,

2020 CYBERSECURITY THREAT TRENDS OUTLOOK2020 CYBERSECURITY THREAT TRENDS OUTLOOK Nine ways threat actors will make waves in 2020 1This report is for informational purposes only, and

2020 CYBERSECURITY THREAT TRENDS OUTLOOK2020 CYBERSECURITY THREAT TRENDS OUTLOOK Nine ways threat actors will make waves in 2020 1This report is for informational purposes only, and

Threat Hunting y simulación de ataques · 2020. 4. 21. · Energy . Possible actors . APT32, APT33, APT34, Dragonfly, Magic Hound, Threat Group- 3390 APT32 is a threat group that

Threat Hunting y simulación de ataques · 2020. 4. 21. · Energy . Possible actors . APT32, APT33, APT34, Dragonfly, Magic Hound, Threat Group- 3390 APT32 is a threat group that

How Do Threat Actors Move Deeper Into Your Network?

How Do Threat Actors Move Deeper Into Your Network?

yara Documentation

yara Documentation

Threat Perception, Non-State Actors, and U.S. Military ...

Threat Perception, Non-State Actors, and U.S. Military ...

Journey to Threat Intelligence Analysis and Management · Threat Intelligence Analysis and Management offers a universal ... of threats, including actors, tactics, techniques, procedures,

Journey to Threat Intelligence Analysis and Management · Threat Intelligence Analysis and Management offers a universal ... of threats, including actors, tactics, techniques, procedures,

Cyber Threat Intelligence: What Vendors are NOT telling you!•“Details of the motivations, intent, and capabilities of internal and external threat actors. Threat intelligence includes

Cyber Threat Intelligence: What Vendors are NOT telling you!•“Details of the motivations, intent, and capabilities of internal and external threat actors. Threat intelligence includes

CYBER THREAT ACTORS: HACKONOMICS · 2020. 8. 12. · Extensive literature exists on cyber threat actors. Applying economic analysis to threat actor modelling. – Cost-benefit framework:

CYBER THREAT ACTORS: HACKONOMICS · 2020. 8. 12. · Extensive literature exists on cyber threat actors. Applying economic analysis to threat actor modelling. – Cost-benefit framework:

Yara Fertilizers

Yara Fertilizers

Assessing Targeted Attacks in Incident Response Threat ... · PDF fileAssessing Targeted Attacks in Incident Response Threat Correlation ... Indicators, Actors • Ensure ... Assessing

Assessing Targeted Attacks in Incident Response Threat ... · PDF fileAssessing Targeted Attacks in Incident Response Threat Correlation ... Indicators, Actors • Ensure ... Assessing

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

Cinderella yara pensa

Cinderella yara pensa

CYBER THREAT ACTORS: HACKONOMICS...‘Hackonomics’ Economic perspective of hacking Profile cyber threat actors behaviour: - Case study approach to profiling Create threat actor matrix

CYBER THREAT ACTORS: HACKONOMICS...‘Hackonomics’ Economic perspective of hacking Profile cyber threat actors behaviour: - Case study approach to profiling Create threat actor matrix

Identifying Mobile Malware and Key Threat Actors … Proactive Cyber Threat Intelligence By ... current CTI processes reactively look at malware in cyberspace, ... trends and evolution

Identifying Mobile Malware and Key Threat Actors … Proactive Cyber Threat Intelligence By ... current CTI processes reactively look at malware in cyberspace, ... trends and evolution

Input from Yara to the public consultation on Ireland’s ...agri-i.ie/wp-content/uploads/2017/06/Yara... · •Yara produces several hundred different crop nutrition products •Yara

Input from Yara to the public consultation on Ireland’s ...agri-i.ie/wp-content/uploads/2017/06/Yara... · •Yara produces several hundred different crop nutrition products •Yara

Calcinit YARA

Calcinit YARA

Threat Landscape Snapshot Landscape Snapshot Re… · access trojans and password stealers, nationstate threat actors have been linked to attacks against - government, health and

Threat Landscape Snapshot Landscape Snapshot Re… · access trojans and password stealers, nationstate threat actors have been linked to attacks against - government, health and

Operationalizing Threat Intelligence to Battle Persistent Actors

Operationalizing Threat Intelligence to Battle Persistent Actors

Threat Compass - Blueliv · Today’s threat landscape is becoming more and more volatile. Malicious actors use ever-more sophisticated techniques to attack organizations large and

Threat Compass - Blueliv · Today’s threat landscape is becoming more and more volatile. Malicious actors use ever-more sophisticated techniques to attack organizations large and