Detecting Indications of Compromise
and Decreasing Response Time
ISE 6100 – Security Project Practicum – CIO Report
Authors: Gordon Fraser, gordon.fraser@ctipc.com
Tobias Mccurry, tobiasmccurry@gmail.com
Wesley Earnest, wes.earnest@gmail.com
Advisor: Stephen Northcutt
Accepted: November 23, 2016
Abstract
GIAC Enterprises, a small to
medium sized business specializing in Fortune Cookie sayings, is faced with the
risk of its intellectual property being compromised. One of the most common vectors used by
attackers to gain access to this intellectual property via phishing emails
which lure users into executing malicious programs on their computers. To address this risk, GIAC’s CIO established
a tiger team to investigate and examine ways to streamline the incident
response process. Research shows that
only 3% of users report possible phishing emails (Verizon, 2016). Because of
this gap, the team focused on ways to automate detection. The team also looked for ways to decrease the
amount of time it takes for an analyst to respond to a suspected incident. The proposed solution combines open source
tools, Bro and Cuckoo, to analyze incoming email attachments and escalate only
the attachments that deemed suspicious to the SOC Analyst. The proposed solution also includes updates
to GIAC’s incident response procedures to quickly identify compromised systems
using indicators of compromise.
1.
Introduction
GIAC Enterprises, a small to medium sized business
specializing in Fortune Cookie sayings, is faced with the risk of its
intellectual property being compromised.
One of the most common vectors used by attackers to this data is
phishing emails which lure users into executing malicious programs on their
computers. To address this risk, GIAC’s
CIO established a tiger team to examine the following use cases:
·
Users receiving a phishing email with a
malicious attachment.
·
Users receiving a phishing email with a
malicious URL.
·
Drive-by attack resulting from a user visiting a
malicious web site.
1.1.
Current Environment
GIAC’s current detection and response processes require many
inefficient manual steps which are unnecessarily burning incident response
cycles. The current detection process
relies heavily on the end user notifying the security team of suspicious
emails. The Security Operation Center
(SOC) analyst needs to extract the suspicious attachment, upload it to the
sandbox, and wait for analysis to finish. However, research shows that only
three percent of users report possible phishing emails (Verizon, 2016). Because of this gap in the detection process,
the team focused on ways to streamline and automate previously documented
incident response steps.
The team also looked for ways to decrease the amount of
time it takes for an analyst to respond to a suspected incident. In the current process, the email administrators
notify the SOC analysts of the individuals who may have read or opened the
email. The SOC analyst would then take
whatever action was necessary. Per the
Verizon 2016 Data Breach Report (Verizon, 2016) 30% of people who receive a phishing
email open it. Only 12% of the
recipients opened the malicious attachment or clicked on the link. Quickly identifying the individuals who took
the phishing bait would significantly reduce the scope of the investigation and
time to resolution.
GIAC Enterprises recently implemented a pilot SIEM
utilizing AlienVault’s Open Source Security Information Management (OSSIM)
product to improve situational awareness and visibility by correlating log
files and security events. Based on our
team’s research and conversations with AlienVault, neither OSSIM nor
AlienVault’s commercial solution Unified Security Management (USM) is designed
to proactively examine files for malicious behavior. It can only detect the malicious activity
once the compromise has happened. To
protect GIAC’s intellectual property, a more proactive and automated solution
must be implemented to mitigate the risk posed by these use cases.
2.
Proposed Solution
Based on the scenario of a phishing email leading to
ransomware, the team focused its research efforts on points in the existing
process that could be performed proactively or automated to improve the
efficiency of the SOC Analyst’s time.
The proposed solution combines open source tools, Bro and Cuckoo, to
analyze incoming email attachments and escalate only the attachments that
deemed suspicious to the SOC Analyst.
According to AlienVault, “You cannot stop ransomware [...] detecting
[ransomware] within a timely fashion gives you the chance to respond
effectively.” (AlienVault, 2016). The
proposed solution also includes enhancements to GIAC’s incident response
procedures to handle potential incidents.
Figure 1 shows the workflow of the proof-of-concept built during this
project.
Figure 1: Proposed Solution Workflow
1) Monitor
network traffic (incoming SMTP traffic and outbound HTTP requests).
2) Parse
SMTP and HTTP traffic with Bro and extract all files (based on configured list
of MIME types) and URLs of interest.
3) Extracted
files are saved on the Bro server. A
service monitors for new files in a directory.
When a new file is detected, a script will copy the file to the Cuckoo
server for analysis.
4) Cuckoo
server has a directory that is being watched for new files to analyze. When a new file is detected in the directory,
Cuckoo analyzes the file and generates a text output.
5) A
script parses the Cuckoo output. If no
outbound network connectivity is detected, the file is considered benign and
discarded. If outbound network
connectivity is detected, then the file requires further analysis. An Analyst Report text file is created and
sent to the Bro server.
6) On
the Bro server, a script runs for each Analyst Report file which parses the Bro
logs for the details of the HTTP connection or the SMTP email (to/from/subject)
and appends a set of Powershell scripts to the Analyst Report file.
7) The
Powershell scripts can be used to search through the Exchange server mailboxes
based on:
a. Messages
that contain either the same sender, subject, or attachment.
b. Archive
and/or delete the message containing the suspect file.
8) Notify
SOC analyst of the new Analyst Report for further review and initiate the
incident response process if necessary.
9) Create
a ticket in OSSIM to track the analysis of the suspicious file or URL, and any
remediation effort.
2.1.
Streamlining Incident Response Process
To efficiently streamline the incident response process, the
team identified three sources of network data to include DNS logs, netflows,
and full packet capture. PassiveDNS logs DNS requests and responses. The nfdump suite of tools helps capture the netflow
data, which is a summary of network traffic. Tcpdump is used to collect full
packet captures.
3.
Use Case Validation
The team constructed a lab environment to conduct
simulated attacks. To test the first use case, a phishing email with a
malicious attachment, an email was sent with a word document that contained a
Visual Basic script that executed a malicious payload that connected back to
the attacker’s machine. The second and third use cases, a phishing email with a
malicious URL and drive-by attack, was tested by sending an email that
contained a link to a web site that compromised the browser, connected back to
the attacker, downloaded and executed a malicious payload.
The Analyst Report was generated due to the outbound
connection initiated by the word document and separately the drive-by attack.
Bro appended details from the original vector and the Analyst Report to help
with eradication portion of the incident response process. The eradication phase
was validated by using the Powershell scripts generated from the details
provided in the steps above. These scripts removed the malicious emails from
any users’ inboxes.
Given the indicators of compromise from the Analyst Report,
we quickly identified the systems that were compromised. This would support the incident response team
during triage and allow them to focus their efforts on those systems which pose
the most risk to the organization. During testing, full network traffic was
captured for analysis.
4.
Conclusion
This new workflow provides a much more comprehensive
solution to dealing both phishing emails and attachments and files downloaded
via HTTP. Bro and Cuckoo working
together showed promise in detecting potentially malicious files. Using the DNS logs, netflow data, and full
packet captures proved valuable in streamlining the identification of
compromised systems.
4.1.
Future Enhancements
There are several aspects within this proof-of-concept
that could be enhanced during future phases of this project. First, this proof-of-concept is currently
only able to rule out benign files based on the absence of outbound network
connectivity. If only 3% of suspect
files are currently being reported by end users, it is likely that promoting
this new process to production will substantially increase the SOC analyst’s
workload. Further research is needed to
improve the quality of detection capabilities in Cuckoo. One such approach may be YARA. YARA is a tool that could be integrated with
Cuckoo to identify and classify malware (YARA, 2016).
Integration with Exchange is another area where the
process could be further streamlined. Removing the manual process of the
identifying users that received the email via Powershell would be beneficial. Execution
of the Powershell scripts could be automated and the output included in the Analyst
Report.
The integration with OSSIM could also be enhanced to
provide the SOC analyst with additional visibility into the environment by
creating custom plugins and correlation directives with the log data from Bro,
Cuckoo, and Exchange. Creation of incident tickets could be automated to help
raise awareness to a possible incident.
Like all intrusion detection systems, this new process is
still limited to the traffic it can monitor.
Encrypted files, secure email, and HTTPS websites would require SSL/TLS
termination at the border for the network monitoring tools such as Bro and
nfdump to work.
References
AlienVault. (2016) Detect Ransomeware Before It’s
Too Late with AlienVault USM. Retrieved
October 13, 2016, from https://www.alienvault.com/forms/webcast-thank-you/detect-ransomware-before-its-too-late-with-alienvault-usm
Verizon. (2016) 2016 Data Breach Investigations
Report. Retrieved October 5, 2016, from www.verizonenterprise.com/resources/reports/rp_DBIR_2016_Report_en_xg.pdf
YARA. (2016) YARA in
a nutshell. Retrieved October 7, 2016 from http://virustotal.github.io/yara/
