Over the past few days I've had the pleasure of attending the Sans ThreatHunting Summit. I thought, not only was this a terrific event, but also gave me the opportunity to see how others in our community are tackling problems that we all are dealing with. I was able to look at the things I am doing and see if there are ways that I can improve or things that I can incorporate into my current processes. The summit speakers and attendees also helped me spark new ideas as well as things I would like to dig into more.
One of the thoughts I had during the summit was when Alex Pinto (@alexcpsec) and Rob Lee (@RobertMLee) were discussing machine learning. I believe ML may be hard to implement into a detection strategy, unless it’s for a very narrow and specific use case. As the scope widens, the accuracy of your results may suffer. What would happen though if we start building models based on a wider scope, but built them in a way that would cluster with other models? Would we be able to cluster the results of these different models in a way may then highlight an attacker performing different actions during an intrusion. I’m spit balling here, but as an example:
- A model looking at all flow data for anomalous network patterns between machines.
- A model that is looking for anomalous authentication patterns.
Can the results of these 2 models then be clustered by src ip or dest ip (or some other attribute) and the cluster would be a higher fidelity event than the results of each individual model? I’m not sure as I don’t have a lot of experience with ML, so just throwing that out there.
Rick McElroy (@InfoSecRick) was also talking about something similar during his keynote. Analysts need context when they are looking at events as it’s often very hard to classify something as malicious until you have aditional supporting evidence (I summarized). I believe we can often build multiple points of context into our our alerting though. By building visibility around triggers (actions), regardless of how noisy they may be individually, we can then generate alerts where there are multiple data points and therefore produce higher fidelity alerts while reducing the overall number. An example may be:
- Powershell initiating a http request.
- First seen non alpha-numeric character pattern.
- Multiple flags where the flag is 3 characters or less
By being able to generate an alert on any of the 3 characteristics, but not doing so until I have met a threshold of 2 or more, I have dramatically increased the fidelity of the alert. Or we could generate a suspicious powershell event based on any 1 of the 3 occurring and send an alert when and additional suspicious action on the host has been identified within a certain time frame. An executable being written to a Temp directory may be an example (or any other detection you may have that will map to the host). The cool thing about this is that you can start to dynamically see behaviors vs singular events.
ATT&CK was discussed quite a bit throughout the summit (@likethecoins and @its_a_feature_). This is such a cool framework. Analysts can wrap their heads around the things that they can (and should) be hunting for. I’m curious how many companies have adopted this framework and are using it to build and validate their detection. If you start building the visibility around the types of things listed in ATT&CK, can you then start clustering events generated and map them through the framework? The more data points that map, does that raise the confidence of the behavior, machine in question or user associated with the events?
My flight was delayed today, so I’ve been sitting at the airport for the last several hours. This is a quick post, but I wanted to get these thoughts jotted down while I had some time.
