{"id":31721,"date":"2019-10-31T21:42:43","date_gmt":"2019-10-31T18:42:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/threat-hunting-ili-kak-zashhititsya-ot-5-ugroz\/"},"modified":"2019-10-31T21:42:43","modified_gmt":"2019-10-31T18:42:43","slug":"threat-hunting-ili-kak-zashhititsya-ot-5-ugroz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/threat-hunting-ili-kak-zashhititsya-ot-5-ugroz","title":{"rendered":"Hrozby P\u0159edstavov\u00e1n\u00ed, neboli Jak se chr\u00e1nit p\u0159ed 5 % hrozeb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

95% hrozeb informa\u010dn\u00ed bezpe\u010dnosti jsou zn\u00e1m\u00e9 a lze se proti nim br\u00e1nit tradi\u010dn\u00edmi prost\u0159edky, jako jsou antivirov\u00e9 programy, firewally, IDS a WAF. Ostatn\u00edch 5% hrozeb jsou nezn\u00e1m\u00e9 a nejnebezpe\u010dn\u011bj\u0161\u00ed. Tyto p\u0159edstavuj\u00ed 70% rizika pro podnik, proto\u017ee je velmi obt\u00ed\u017en\u00e9 je odhalit a je\u0161t\u011b obt\u00ed\u017en\u011bj\u0161\u00ed se proti nim br\u00e1nit. P\u0159\u00edklady \u010dern\u00fdch labut\u00ed<\/a><\/noindex> jsou epidemie ransomwaru WannaCry, NotPetya\/ExPetr, kryptom\u011bnov\u00ed t\u011b\u017ea\u0159i, kybernetick\u00e9 zbran\u011b Stuxnet (kter\u00e9 zas\u00e1hly jadern\u00e9 objekty Ir\u00e1nu) a mnoho (pamatuje si je\u0161t\u011b n\u011bkdo Kido\/Conficker?) dal\u0161\u00edch \u00fatok\u016f, proti nim\u017e se klasick\u00fdmi ochrann\u00fdmi prost\u0159edky t\u011b\u017eko br\u00e1n\u00ed. O tom, jak \u010delit t\u011bmto 5% hrozeb pomoc\u00ed technologie Threat Hunting, bychom cht\u011bli hovo\u0159it.<\/p>\n

\"Hrozby<\/a><\/noindex>
\n Nep\u0159etr\u017eit\u00fd v\u00fdvoj kybernetick\u00fdch \u00fatok\u016f vy\u017eaduje st\u00e1l\u00e9 odhalov\u00e1n\u00ed a protiopat\u0159en\u00ed, co\u017e n\u00e1s nakonec dov\u00e1d\u00ed k my\u0161lence o nekone\u010dn\u00e9m z\u00e1vodu ve zbrojen\u00ed mezi \u00fato\u010dn\u00edky a obran\u00e1\u0159i. Klasick\u00e9 ochrann\u00e9 syst\u00e9my ji\u017e nejsou schopny zajistit p\u0159ijatelnou \u00farove\u0148 ochrany, p\u0159i kter\u00e9 \u00farove\u0148 rizika neovliv\u0148uje kl\u00ed\u010dov\u00e9 ukazatele spole\u010dnosti (ekonomick\u00e9, politick\u00e9, reputaci) bez jejich \u00faprav pro konkr\u00e9tn\u00ed infrastrukturu, i kdy\u017e celkov\u011b pokr\u00fdvaj\u00ed \u010d\u00e1st rizik. Ji\u017e v pr\u016fb\u011bhu zav\u00e1d\u011bn\u00ed a konfigurace se modern\u00ed ochrann\u00e9 syst\u00e9my st\u00e1vaj\u00ed pozadu a mus\u00ed reagovat na v\u00fdzvy nov\u00e9 doby.<\/p>\n

\"HrozbyZdroj<\/noindex><\/p>\n

Jedn\u00edm z odpov\u011bd\u00ed na v\u00fdzvy sou\u010dasnosti pro specialistu na informa\u010dn\u00ed bezpe\u010dnost m\u016f\u017ee b\u00fdt technologie Threat Hunting. Term\u00edn Threat Hunting (d\u00e1le v textu \u2014 TH) se objevil p\u0159ed n\u011bkolika lety. Technologie je zaj\u00edmav\u00e1, ale zat\u00edm nem\u00e1 \u017e\u00e1dn\u00e9 obecn\u011b uzn\u00e1van\u00e9 standardy a pravidla. Tak\u00e9 situaci zt\u011b\u017euje r\u016fznorodost zdroj\u016f informac\u00ed a mal\u00e9 mno\u017estv\u00ed rusk\u00fdch zdroj\u016f informac\u00ed na toto t\u00e9ma. Vzhledem k tomu jsme v \u201eLANIT-Integrace\u201c se rozhodli napsat p\u0159ehled t\u00e9to technologie. <\/p>\n

Aktu\u00e1lnost<\/h2>\n

\nTechnologie TH se op\u00edr\u00e1 o procesy monitorov\u00e1n\u00ed infrastruktury. Existuj\u00ed dva hlavn\u00ed sc\u00e9n\u00e1\u0159e intern\u00edho monitorov\u00e1n\u00ed \u2013 Alerting a Hunting<\/a><\/noindex>. Alerting (MSSP-type services) is a traditional method that searches for previously developed signatures and indicators of attacks and responds to them. This scenario is successfully executed by traditional signature-based security tools. Hunting (an MDR-type service) is a monitoring method that answers the question 'Where do signatures and rules come from?'. It is the process of creating correlation rules by analyzing hidden or previously unknown indicators and signs of an attack. This type of monitoring is precisely related to Threat Hunting.<\/p>\n

\"Hrozby
\nOnly by combining both types of monitoring do we achieve protection that is close to ideal, but there is always some level of residual risk.<\/p>\n

\"HrozbyProtection using two types of monitoring<\/i><\/p>\n

And here\u2019s why TH (and hunting in general!) will become more relevant:<\/p>\n

\"HrozbyThreats, protection tools, risks.<\/i> Zdroj<\/a><\/noindex><\/p>\n

95% of all threats are already well-studied<\/a><\/noindex>. These include types such as spam, DDoS, viruses, rootkits, and other classic malware. Protection against these threats can be done with the same traditional security tools.<\/p>\n

During the execution of any project 20% of the time is spent on 80% of the work<\/a><\/noindex>, while the remaining 20% of the work takes 80% of the time. Similarly, among the entire threat landscape, 5% of new-type threats will account for 70% of the risk for the company. In a company where information security management processes are organized, 30% of the risk of known threats can be managed in one way or another, avoiding (abandoning wireless networks altogether), accepting (implementing necessary protective measures), or transferring (for example, to the integrator) that risk. However, to protect against zero-day vulnerabilities<\/a><\/noindex>, APT attacks, phishing, supply chain attacks<\/a><\/noindex>, cyber espionage, and national operations, as well as from many other attacks is already much more complicated. The consequences of these 5% threats will be significantly more serious (the average loss amount for the bank from the buhtrap group is 143 million<\/a><\/noindex>), than the consequences of spam or viruses, from which antivirus software protects us.<\/p>\n

Nearly everyone faces 5% of threats. Recently, we had to install an open-source solution that uses an application from the PEAR repository (PHP Extension and Application Repository). The attempt to install this application via pear install was unsuccessful because the site<\/a><\/noindex> byl nedostupn\u00fd (nyn\u00ed na n\u011bm ji\u017e vis\u00ed z\u00e1st\u011brka), musel jsem ho nainstalovat z GitHubu. A doslova ned\u00e1vno se uk\u00e1zalo, \u017ee PEAR se stal ob\u011bt\u00ed \u00fatoku p\u0159es dodavatelsk\u00fd \u0159et\u011bzec<\/a><\/noindex>.<\/p>\n

\"Hrozby<\/p>\n

M\u016f\u017eeme tak\u00e9 vzpomenout \u00fatok na z\u00e1klad\u011b CCleaner<\/a><\/noindex>, epidemii \u0161ifrovac\u00edho viru NePetya prost\u0159ednictv\u00edm modulu aktualizace programu pro da\u0148ovou evidenci M.E.Doc<\/a><\/noindex>. Hrozby se st\u00e1vaj\u00ed st\u00e1le sofistikovan\u011bj\u0161\u00edmi a vznik\u00e1 logick\u00e1 ot\u00e1zka \u2013 \"Jak tedy \u010delit t\u011bmto 5% hrozeb?\"<\/p>\n

Definice Threat Hunting<\/h2>\n

\nTak\u017ee Threat Hunting \u2013 je proces proaktivn\u00edho a iterativn\u00edho vyhled\u00e1v\u00e1n\u00ed a objevov\u00e1n\u00ed pokro\u010dil\u00fdch hrozeb, kter\u00e9 nelze odhalit tradi\u010dn\u00edmi prost\u0159edky ochrany. Mezi pokro\u010dil\u00e9 hrozby pat\u0159\u00ed nap\u0159\u00edklad \u00fatoky typu APT, \u00fatoky na 0-day zranitelnosti, Living off the Land a tak d\u00e1le.<\/p>\n

Lze tak\u00e9 p\u0159eformulovat, \u017ee TH \u2013 je proces ov\u011b\u0159ov\u00e1n\u00ed hypot\u00e9z. Je to p\u0159ev\u00e1\u017en\u011b ru\u010dn\u00ed proces s prvky automatizace, v n\u011bm\u017e analytik, op\u00edraje se o sv\u00e9 znalosti a kvalifikaci, pros\u00e9v\u00e1 velk\u00e9 objemy informac\u00ed p\u0159i hled\u00e1n\u00ed znak\u016f kompromitace, odpov\u00eddaj\u00edc\u00edch prvotn\u011b definovan\u00e9 hypot\u00e9ze o p\u0159\u00edtomnosti ur\u010dit\u00e9 hrozby. Jeho charakteristick\u00fdm rysem je rozmanitost zdroj\u016f informac\u00ed.<\/p>\n

Je t\u0159eba poznamenat, \u017ee Threat Hunting \u2013 to nen\u00ed \u017e\u00e1dn\u00fd softwarov\u00fd nebo hardwarov\u00fd produkt. Nen\u00ed to alert, kter\u00fd m\u016f\u017eete vid\u011bt v n\u011bjak\u00e9m \u0159e\u0161en\u00ed. Nen\u00ed to proces vyhled\u00e1v\u00e1n\u00ed IOC (identifik\u00e1tor\u016f kompromitace). A to nen\u00ed \u017e\u00e1dn\u00e1 pasivn\u00ed \u010dinnost, kter\u00e1 prob\u00edh\u00e1 bez \u00fa\u010dasti analytik\u016f kybernetick\u00e9 bezpe\u010dnosti. Threat Hunting \u2013 to je p\u0159edev\u0161\u00edm proces.<\/p>\n

Slo\u017eky Threat Hunting<\/h2>\n

\n\"Hrozby
\nT\u0159i hlavn\u00ed slo\u017eky Threat Hunting: data, technologie, lid\u00e9.<\/p>\n

Data (co?)<\/b>, v\u010detn\u011b Big Data. R\u016fzn\u00e9 toky provozu, informace o d\u0159\u00edve proveden\u00fdch APT, analytika, data o u\u017eivatelsk\u00e9 aktivit\u011b, s\u00ed\u0165ov\u00e1 data, informace od zam\u011bstnanc\u016f, informace na dark webu a mnoho dal\u0161\u00edho.<\/p>\n

Technologie (jak?)<\/b> zpracov\u00e1n\u00ed t\u011bchto dat \u2013 v\u0161echny mo\u017en\u00e9 zp\u016fsoby zpracov\u00e1n\u00ed t\u011bchto dat, v\u010detn\u011b strojov\u00e9ho u\u010den\u00ed.<\/p>\n

Lid\u00e9 (kdo?)<\/b> \u2013 ti, kte\u0159\u00ed maj\u00ed bohat\u00e9 zku\u0161enosti s anal\u00fdzou r\u016fzn\u00fdch \u00fatok\u016f, rozvinutou intuici a schopnost odhalit \u00fatok. Obvykle se jedn\u00e1 o analytiky informa\u010dn\u00ed bezpe\u010dnosti, kte\u0159\u00ed mus\u00ed m\u00edt schopnost generovat hypot\u00e9zy a nach\u00e1zet jejich potvrzen\u00ed. Jsou hlavn\u00ed sou\u010d\u00e1st\u00ed procesu.<\/p>\n

Model PARIS<\/h2>\n

\nAdam Beitman popisuje<\/a><\/noindex> model PARIS pro ide\u00e1ln\u00ed proces TH. N\u00e1zev jakoby nazna\u010duje zn\u00e1mou pam\u00e1tku ve Francii. Tento model lze pova\u017eovat ve dvou sm\u011brech \u2013 ze shora a zdola.<\/p>\n

V procesu lovu na hrozby, pohybuj\u00edc\u00ed se po modelu zdola nahoru, se setk\u00e1me s mno\u017estv\u00edm d\u016fkaz\u016f o \u0161kodliv\u00e9 aktivit\u011b. Ka\u017ed\u00fd d\u016fkaz m\u00e1 takovou m\u00edru, jako je d\u016fv\u011bra \u2013 charakteristika, kter\u00e1 odr\u00e1\u017e\u00ed v\u00e1hu tohoto d\u016fkazu. Existuj\u00ed \"\u017eelezn\u00e9\", p\u0159\u00edm\u00e9 d\u016fkazy \u0161kodliv\u00e9 aktivity, na jejich\u017e z\u00e1klad\u011b m\u016f\u017eeme okam\u017eit\u011b dos\u00e1hnout vrcholu pyramidy a vytvo\u0159it skute\u010dn\u00e9 upozorn\u011bn\u00ed na p\u0159esn\u011b zn\u00e1mou infekci. A existuj\u00ed nep\u0159\u00edm\u00e9 d\u016fkazy, jejich\u017e sou\u010det n\u00e1s tak\u00e9 m\u016f\u017ee dov\u00e9st k vrcholu pyramidy. Jak u\u017e to b\u00fdv\u00e1, nep\u0159\u00edm\u00fdch d\u016fkaz\u016f je mnohem v\u00edce ne\u017e p\u0159\u00edm\u00fdch, a proto je t\u0159eba je t\u0159\u00eddit a analyzovat, prov\u00e1d\u011bt dal\u0161\u00ed v\u00fdzkumy a ide\u00e1ln\u011b to automatizovat.<\/p>\n

\"HrozbyModel PARIS.<\/i> Zdroj<\/a><\/noindex><\/p>\n

Horn\u00ed \u010d\u00e1st modelu (1 a 2) je zalo\u017eena na technologi\u00edch automatizace a r\u016fznorod\u00e9 analytice, zat\u00edmco doln\u00ed \u010d\u00e1st (3 a 4) na lidech s ur\u010ditou kvalifikac\u00ed, kte\u0159\u00ed \u0159\u00edd\u00ed proces. Model lze pova\u017eovat za pohyb z hora dol\u016f, kde v horn\u00ed modr\u00e9 \u010d\u00e1sti m\u00e1me upozorn\u011bn\u00ed od tradi\u010dn\u00edch ochrann\u00fdch prost\u0159edk\u016f (antivirus, EDR, firewall, podpisy) s vysok\u00fdm stupn\u011bm d\u016fv\u011bry a spolehlivosti, a n\u00ed\u017ee ukazatele (IOC, URL, MD5 a dal\u0161\u00ed), kter\u00e9 maj\u00ed ni\u017e\u0161\u00ed stupe\u0148 d\u016fv\u011bry a vy\u017eaduj\u00ed dodate\u010dn\u00e9 prozkoum\u00e1n\u00ed. A nejspodn\u011bj\u0161\u00ed a nejtlust\u0161\u00ed \u00farove\u0148 (4) \u2013 generov\u00e1n\u00ed hypot\u00e9z, vytv\u00e1\u0159en\u00ed nov\u00fdch sc\u00e9n\u00e1\u0159\u016f fungov\u00e1n\u00ed tradi\u010dn\u00edch ochrann\u00fdch prost\u0159edk\u016f. Tato \u00farove\u0148 nen\u00ed omezena pouze na uveden\u00e9 zdroje hypot\u00e9z. \u010c\u00edm ni\u017e\u0161\u00ed je \u00farove\u0148, t\u00edm vy\u0161\u0161\u00ed po\u017eadavky jsou kladeny na kvalifikaci analytika.<\/p>\n

Je velmi d\u016fle\u017eit\u00e9, aby analytici neprov\u011b\u0159ovali pouze kone\u010dn\u00fd soubor p\u0159edem definovan\u00fdch hypot\u00e9z, ale st\u00e1le pracovali na generov\u00e1n\u00ed nov\u00fdch hypot\u00e9z a mo\u017enost\u00ed jejich ov\u011b\u0159ov\u00e1n\u00ed.<\/p>\n

Model dosp\u011blosti pou\u017e\u00edv\u00e1n\u00ed TH<\/h2>\n

\nV ide\u00e1ln\u00edm sv\u011bt\u011b je TH kontinu\u00e1ln\u00ed proces. Av\u0161ak proto\u017ee ide\u00e1ln\u00ed sv\u011bt neexistuje, analyzujeme model dosp\u011blosti<\/a><\/noindex> a metody z pohledu lid\u00ed, proces\u016f a pou\u017e\u00edvan\u00fdch technologi\u00ed. Pod\u00edv\u00e1me se na model ide\u00e1ln\u00edho sf\u00e9rick\u00e9ho TH. Existuje 5 \u00farovn\u00ed pou\u017e\u00edv\u00e1n\u00ed t\u00e9to technologie. Prozkoum\u00e1me je na p\u0159\u00edkladu evoluce konkr\u00e9tn\u00ed analytick\u00e9 skupiny.<\/p>\n

\u00darovn\u011b dosp\u011blosti<\/b>
\nLid\u00e9<\/b>
\nProcesy<\/b>
\nTechnologie<\/b><\/p>\n

\u00darove\u0148 0<\/b>
\nAnalytici SOC
\n24\/7
\nTradi\u010dn\u00ed n\u00e1stroje:<\/p>\n

Tradi\u010dn\u00ed
\nSada alert\u016f
\nPasivn\u00ed monitoring
\nIDS, AV, sandboxing,<\/p>\n

Bez TH<\/i>
\nPr\u00e1ce s alerty<\/p>\n

n\u00e1stroje pro anal\u00fdzu signatur, data Threat Intelligence.<\/p>\n

\u00darove\u0148 1<\/b>
\nAnalytici SOC
\nJednor\u00e1zov\u00fd TH
\nEDR<\/p>\n

Experiment\u00e1ln\u00ed
\nZ\u00e1kladn\u00ed znalosti forenzn\u00ed anal\u00fdzy
\nVyhled\u00e1v\u00e1n\u00ed IOC
\n\u010c\u00e1ste\u010dn\u00e9 pokryt\u00ed dat od s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed<\/p>\n

Experimenty s TH<\/i>
\nDobr\u00fd p\u0159ehled o s\u00edt\u00edch a aplika\u010dn\u00ed \u010d\u00e1sti<\/p>\n

\u010c\u00e1ste\u010dn\u00e9 aplikace<\/p>\n

\u00darove\u0148 2<\/b>
\nDo\u010dasn\u00e1 \u010dinnost
\nSprinty
\nEDR<\/p>\n

Periodick\u00e1
\nPr\u016fm\u011brn\u00e9 znalosti forenzn\u00ed anal\u00fdzy
\nT\u00fdden za m\u011bs\u00edc
\n\u00dapln\u00e9 pou\u017eit\u00ed<\/p>\n

Do\u010dasn\u00fd TH<\/i>
\nV\u00fdborn\u00e9 znalosti s\u00edt\u00ed a aplika\u010dn\u00ed \u010d\u00e1sti
\nPravideln\u00fd TH
\n\u00dapln\u00e1 automatizace pou\u017e\u00edv\u00e1n\u00ed dat EDR<\/p>\n

\u010c\u00e1ste\u010dn\u00e9 vyu\u017eit\u00ed pokro\u010dil\u00fdch funkc\u00ed EDR<\/p>\n

\u00darove\u0148 3<\/b>
\nVy\u010dlen\u011bn\u00fd t\u00fdm TH
\n24\/7
\n\u010c\u00e1ste\u010dn\u00e1 schopnost testovat hypot\u00e9zy TH<\/p>\n

Preventivn\u00ed
\nV\u00fdborn\u00e9 znalosti forenzn\u00ed anal\u00fdzy a malware
\nPreventivn\u00ed TH
\n\u00dapln\u00e9 vyu\u017eit\u00ed pokro\u010dil\u00fdch funkc\u00ed EDR<\/p>\n

P\u0159\u00edpadov\u00e9 studie TH<\/i>
\nV\u00fdborn\u00e9 znalosti \u00fato\u010dn\u00e9 strany
\nP\u0159\u00edpadov\u00e9 studie TH
\n\u00dapln\u00e9 pokryt\u00ed dat od s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed<\/p>\n

Konfigurace podle pot\u0159eb<\/p>\n

\u00darove\u0148 4<\/b>
\nVy\u010dlen\u011bn\u00fd t\u00fdm TH
\n24\/7
\n\u00dapln\u00e1 schopnost testovat hypot\u00e9zy TH<\/p>\n

Veden\u00ed
\nV\u00fdborn\u00e9 znalosti forenzn\u00ed anal\u00fdzy a malware
\nPreventivn\u00ed TH
\n\u00darove\u0148 3, plus:<\/p>\n

Pou\u017e\u00edv\u00e1n\u00ed TH<\/i>
\nV\u00fdborn\u00e9 znalosti \u00fato\u010dn\u00e9 strany
\nTestov\u00e1n\u00ed, automatizace a verifikace hypot\u00e9z TH
\n\u00fazk\u00e1 integrace zdroj\u016f dat;<\/p>\n

Abychom byli schopni v\u00fdzkumu<\/p>\n

v\u00fdvoj podle pot\u0159eb a nestandardn\u00ed pou\u017eit\u00ed API.<\/p>\n

\u00darovn\u011b dosp\u011blosti TH z pohledu lid\u00ed, proces\u016f a technologi\u00ed<\/i><\/p>\n

\u00darove\u0148 0:<\/b> tradi\u010dn\u00ed, bez pou\u017eit\u00ed TH. B\u011b\u017en\u00ed analytici pracuj\u00ed s b\u011b\u017enou sadou alert\u016f v pasivn\u00edm monitoringu pomoc\u00ed standardn\u00edch n\u00e1stroj\u016f a technologi\u00ed: IDS, AV, sandboxing, n\u00e1stroje pro anal\u00fdzu signatur.<\/p>\n

\u00darove\u0148 1:<\/b> experiment\u00e1ln\u00ed, vyu\u017e\u00edvaj\u00edc\u00ed TH. Ti sam\u00ed analytici se z\u00e1kladn\u00edmi znalostmi forenziky a dobrou znalost\u00ed s\u00edt\u00ed a aplika\u010dn\u00ed \u010d\u00e1sti mohou prov\u00e9st jednor\u00e1zov\u00e9 Threat Hunting prost\u0159ednictv\u00edm vyhled\u00e1v\u00e1n\u00ed indik\u00e1tor\u016f kompromitace. K n\u00e1stroj\u016fm se p\u0159id\u00e1vaj\u00ed EDR s \u010d\u00e1ste\u010dn\u00fdm pokryt\u00edm dat z s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed. N\u00e1stroje se pou\u017e\u00edvaj\u00ed \u010d\u00e1ste\u010dn\u011b.<\/p>\n

\u00darove\u0148 2:<\/b> Pravideln\u00fd, do\u010dasn\u00fd TH. T\u011bm stejn\u00fdm analytik\u016fm, kte\u0159\u00ed ji\u017e vylep\u0161ili sv\u00e9 znalosti v oblasti forenziky, s\u00edt\u00ed a praktick\u00e9 \u010d\u00e1sti, se ukl\u00e1d\u00e1 povinnost pravideln\u011b se v\u011bnovat (sprint) Threat Hunting, \u0159ekn\u011bme, jednu t\u00fdden za m\u011bs\u00edc. K n\u00e1stroj\u016fm se p\u0159id\u00e1v\u00e1 \u00fapln\u00e9 prozkoum\u00e1n\u00ed dat ze s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed, automatizace anal\u00fdzy dat z EDR a \u010d\u00e1ste\u010dn\u00e9 vyu\u017eit\u00ed pokro\u010dil\u00fdch funkc\u00ed EDR.<\/p>\n

\u00darove\u0148 3:<\/b> preventivn\u00ed, \u010dast\u00e9 p\u0159\u00edpady TH. Na\u0161i analytici se vytvo\u0159ili v specializovan\u00fd t\u00fdm, z\u00edskali vynikaj\u00edc\u00ed znalosti forenziky a malwaru, stejn\u011b tak znalosti o metod\u00e1ch a taktik\u00e1ch \u00fato\u010d\u00edc\u00ed strany. Proces u\u017e prob\u00edh\u00e1 v re\u017eimu 24\/7. T\u00fdm je schopen \u010d\u00e1ste\u010dn\u011b ov\u011b\u0159ovat hypot\u00e9zy TH, p\u0159i\u010dem\u017e zcela vyu\u017e\u00edv\u00e1 roz\u0161\u00ed\u0159en\u00e9 mo\u017enosti EDR s pln\u00fdm pokryt\u00edm dat z s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed. Tak\u00e9 analytici jsou schopni konfigurovat n\u00e1stroje podle sv\u00fdch pot\u0159eb.<\/p>\n

\u00darove\u0148 4:<\/b> vedouc\u00ed, vyu\u017eit\u00ed TH. Ten sam\u00fd t\u00fdm z\u00edskal schopnost prov\u00e1d\u011bn\u00ed v\u00fdzkumu, um\u011bn\u00ed generovat a automatizovat proces ov\u011b\u0159ov\u00e1n\u00ed hypot\u00e9z TH. Nyn\u00ed k n\u00e1stroj\u016fm p\u0159ibyla \u00fazk\u00e1 integrace datov\u00fdch zdroj\u016f, v\u00fdvoj softwaru podle pot\u0159eb a nestandardn\u00ed vyu\u017eit\u00ed API.<\/p>\n

Techniky Threat Hunting<\/h2>\n

\n\"HrozbyZ\u00e1kladn\u00ed techniky Threat Hunting<\/i><\/p>\n

K technik\u00e1m<\/a><\/noindex> TH podle zralosti pou\u017e\u00edvan\u00e9 technologie pat\u0159\u00ed: z\u00e1kladn\u00ed vyhled\u00e1v\u00e1n\u00ed, statistick\u00e1 anal\u00fdza, vizualiza\u010dn\u00ed techniky, jednoduch\u00e9 agregace, strojov\u00e9 u\u010den\u00ed a bayesovsk\u00e9 metody. <\/p>\n

Nejjednodu\u0161\u0161\u00ed metodou je z\u00e1kladn\u00ed vyhled\u00e1v\u00e1n\u00ed, kter\u00e9 se pou\u017e\u00edv\u00e1 k omezen\u00ed prostoru v\u00fdzkumu pomoc\u00ed ur\u010dit\u00fdch dotaz\u016f. Statistick\u00e1 anal\u00fdza se nap\u0159\u00edklad pou\u017e\u00edv\u00e1 k vytvo\u0159en\u00ed typick\u00fdch vzor\u016f u\u017eivatelsk\u00e9ho nebo s\u00ed\u0165ov\u00e9ho chov\u00e1n\u00ed ve form\u011b statistick\u00e9ho modelu. Vizualiza\u010dn\u00ed techniky se pou\u017e\u00edvaj\u00ed k n\u00e1zorn\u00e9mu zobrazen\u00ed a zjednodu\u0161en\u00ed anal\u00fdzy dat ve form\u011b graf\u016f a diagram\u016f, na kter\u00fdch se mnohem snadn\u011bji zachycuj\u00ed vzorce ve vzorku. Technika jednoduch\u00fdch agregac\u00ed podle kl\u00ed\u010dov\u00fdch pol\u00ed se pou\u017e\u00edv\u00e1 k optimalizaci vyhled\u00e1v\u00e1n\u00ed a anal\u00fdzy. \u010c\u00edm vy\u0161\u0161\u00ed \u00farove\u0148 zralosti proces\u016f TH v organizaci dosahuje, t\u00edm relevantn\u011bj\u0161\u00ed se st\u00e1v\u00e1 pou\u017eit\u00ed algoritm\u016f strojov\u00e9ho u\u010den\u00ed. Ty se tak\u00e9 \u0161iroce pou\u017e\u00edvaj\u00ed p\u0159i filtrov\u00e1n\u00ed spamu, odhalov\u00e1n\u00ed \u0161kodliv\u00e9ho provozu a detekci podvodn\u00fdch \u010dinnost\u00ed. Vysp\u011blej\u0161\u00ed typ algoritm\u016f strojov\u00e9ho u\u010den\u00ed jsou bayesovsk\u00e9 metody, kter\u00e9 umo\u017e\u0148uj\u00ed klasifikaci, redukci dimenzionality vzorku a tematick\u00e9 modelov\u00e1n\u00ed.<\/p>\n

Diamantov\u00fd model a strategie TH<\/h2>\n

\nSergio Kaltagirone, Andrew Pendergast a Christopher Betz ve sv\u00e9 pr\u00e1ci \u201eDiamantov\u00fd model anal\u00fdzy naru\u0161en\u00ed<\/a><\/noindex>\u201c uk\u00e1zali hlavn\u00ed kl\u00ed\u010dov\u00e9 slo\u017eky jak\u00e9koli \u0161kodliv\u00e9 \u010dinnosti a z\u00e1kladn\u00ed spojen\u00ed mezi nimi.<\/p>\n

\"HrozbyDiamantov\u00fd model pro \u0161kodlivou \u010dinnost<\/i><\/p>\n

Podle tohoto modelu existuj\u00ed 4 strategie Threat Hunting, kter\u00e9 se op\u00edraj\u00ed o odpov\u00eddaj\u00edc\u00ed kl\u00ed\u010dov\u00e9 slo\u017eky.<\/p>\n

1. Strategie zam\u011b\u0159en\u00e1 na ob\u011b\u0165. P\u0159edpokl\u00e1d\u00e1me, \u017ee ob\u011b\u0165 m\u00e1 protivn\u00edky, kte\u0159\u00ed budou poskytovat \"p\u0159\u00edle\u017eitosti\" prost\u0159ednictv\u00edm e-mailu. Hled\u00e1me data nep\u0159\u00edtele v e-mailu. Hled\u00e1me odkazy, p\u0159\u00edlohy atd. Hled\u00e1me potvrzen\u00ed t\u00e9to hypot\u00e9zy po ur\u010ditou dobu (m\u011bs\u00edc, dva t\u00fddny); pokud jsme nena\u0161li nic, hypot\u00e9za se neosv\u011bd\u010dila.<\/p>\n

2. Strategie zam\u011b\u0159en\u00e1 na infrastrukturu. Existuje n\u011bkolik metod pro vyu\u017eit\u00ed t\u00e9to strategie. V z\u00e1vislosti na p\u0159\u00edstupu a viditelnosti jsou n\u011bkter\u00e9 z nich snaz\u0161\u00ed ne\u017e jin\u00e9. Nap\u0159\u00edklad monitorujeme servery dom\u00e9nov\u00fdch jmen zn\u00e1m\u00fdch pro hostov\u00e1n\u00ed \u0161kodliv\u00fdch dom\u00e9n. Nebo prov\u00e1d\u00edme proces sledov\u00e1n\u00ed v\u0161ech nov\u00fdch registrac\u00ed dom\u00e9nov\u00fdch jmen na z\u00e1klad\u011b zn\u00e1m\u00e9ho vzoru pou\u017e\u00edvan\u00e9ho protivn\u00edkem.<\/p>\n

3. Strategie zam\u011b\u0159en\u00e1 na p\u0159\u00edle\u017eitosti. Krom\u011b strategie zam\u011b\u0159en\u00e9 na ob\u011bti, kterou pou\u017e\u00edv\u00e1 v\u011bt\u0161ina s\u00ed\u0165ov\u00fdch obr\u00e1nc\u016f, existuje strategie zam\u011b\u0159en\u00e1 na p\u0159\u00edle\u017eitosti. Ta je druh\u00e1 nejpopul\u00e1rn\u011bj\u0161\u00ed a soust\u0159ed\u00ed se na detekci p\u0159\u00edle\u017eitost\u00ed od protivn\u00edka, konkr\u00e9tn\u011b \u201emalwaru\u201c a mo\u017enost\u00ed, jak by protivn\u00edk mohl pou\u017e\u00edt legitimizovan\u00e9 n\u00e1stroje, jako jsou psexec, powershell, certutil a dal\u0161\u00ed.<\/p>\n

4. Strategie zam\u011b\u0159en\u00e1 na protivn\u00edka. P\u0159\u00edstup orientovan\u00fd na protivn\u00edka se soust\u0159ed\u00ed na samotn\u00e9ho protivn\u00edka. Zahrnuje pou\u017eit\u00ed ve\u0159ejn\u011b dostupn\u00fdch informac\u00ed (OSINT), sb\u011br dat o protivn\u00edkovi, jeho technik\u00e1ch a metod\u00e1ch (TTP), anal\u00fdzu ji\u017e prob\u011bhl\u00fdch incident\u016f, \u00fadaje Threat Intelligence atd.<\/p>\n

Zdroje informac\u00ed a hypot\u00e9z ve TH<\/h2>\n

\n\"HrozbyN\u011bkter\u00e9 zdroje informac\u00ed pro Threat Hunting<\/i><\/p>\n

Existuje velk\u00e9 mno\u017estv\u00ed zdroj\u016f informac\u00ed. Ide\u00e1ln\u00ed analytik by m\u011bl b\u00fdt schopen z\u00edsk\u00e1vat informace ze v\u0161eho, co je kolem. Typick\u00fdmi zdroji v t\u00e9m\u011b\u0159 jak\u00e9koli infrastruktu\u0159e budou \u00fadaje z ochrann\u00fdch prost\u0159edk\u016f: DLP, SIEM, IDS\/IPS, WAF\/FW, EDR. Dal\u0161\u00edmi b\u011b\u017en\u00fdmi zdroji informac\u00ed pak budou r\u016fzn\u00e9 indik\u00e1tory kompromitace, slu\u017eby Threat Intelligence, \u00fadaje CERT a OSINT. Nav\u00edc je mo\u017en\u00e9 vyu\u017e\u00edt informace z dark webu (nap\u0159\u00edklad, kdy\u017e se n\u00e1hle objev\u00ed popt\u00e1vka po hacknut\u00ed e-mailov\u00e9 schr\u00e1nky vedouc\u00edho organizace, nebo pokud se aktivita uchaze\u010de na pozici s\u00ed\u0165ov\u00e9ho in\u017een\u00fdra jasn\u011b uk\u00e1\u017ee), informace z\u00edskan\u00e9 od HR (hodnocen\u00ed uchaze\u010de z p\u0159edchoz\u00edho pracovi\u0161t\u011b), informace od bezpe\u010dnostn\u00ed slu\u017eby (nap\u0159\u00edklad v\u00fdsledky kontroly kontrahenta).<\/p>\n

Ale ne\u017e za\u010dnete vyu\u017e\u00edvat v\u0161echny dostupn\u00e9 zdroje, je nezbytn\u00e9 m\u00edt alespo\u0148 jednu hypot\u00e9zu.<\/p>\n

\"HrozbyZdroj<\/a><\/noindex><\/p>\n

Aby bylo mo\u017en\u00e9 hypot\u00e9zy prov\u011b\u0159ovat, je nejprve nutn\u00e9 je formulovat. A pro to, abyste formulovali mno\u017estv\u00ed kvalitn\u00edch hypot\u00e9z, je nutn\u00e9 uplatnit syst\u00e9mov\u00fd p\u0159\u00edstup. Proces generov\u00e1n\u00ed hypot\u00e9z je podrobn\u011bji pops\u00e1n v \u010dl\u00e1nku<\/a><\/noindex>, pro z\u00e1kladn\u00ed proces formulace hypot\u00e9z je velmi pohodln\u00e9 p\u0159evz\u00edt tuto sch\u00e9mu.<\/p>\n

Hlavn\u00edm zdrojem hypot\u00e9z bude matice ATT&CK<\/b> (Adversarial Tactics, Techniques and Common Knowledge). Je to vlastn\u011b znalostn\u00ed b\u00e1ze a model pro hodnocen\u00ed chov\u00e1n\u00ed \u00fato\u010dn\u00edk\u016f, kte\u0159\u00ed realizuj\u00ed sv\u00e9 aktivity na posledn\u00edch kroc\u00edch \u00fatoku, obvykle popisovan\u00e9ho pomoc\u00ed konceptu Kill Chain. To znamen\u00e1 v f\u00e1z\u00edch po proniknut\u00ed \u00fato\u010dn\u00edka do intern\u00ed s\u00edt\u011b podniku nebo na mobiln\u00ed za\u0159\u00edzen\u00ed. P\u016fvodn\u011b znalostn\u00ed b\u00e1ze obsahovala popis 121 taktik a technik pou\u017e\u00edvan\u00fdch p\u0159i \u00fatoku, z nich\u017e ka\u017ed\u00e1 je podrobn\u011b pops\u00e1na ve form\u00e1tu Wiki. Pro generov\u00e1n\u00ed hypot\u00e9z je vhodn\u00e1 r\u016fznorod\u00e1 analytika Threat Intelligence. Zejm\u00e9na stoj\u00ed za zm\u00ednku v\u00fdsledky anal\u00fdzy infrastruktury a test\u016f na proniknut\u00ed \u2013 to jsou nejcenn\u011bj\u0161\u00ed data, kter\u00e1 n\u00e1m mohou poskytnout pevn\u00e9 hypot\u00e9zy, proto\u017ee se op\u00edraj\u00ed o konkr\u00e9tn\u00ed infrastrukturu s jej\u00edmi konkr\u00e9tn\u00edmi nedostatky.<\/p>\n

Proces ov\u011b\u0159ov\u00e1n\u00ed hypot\u00e9z<\/h2>\n

\nSerg\u011bj Soldatov uvedl dobrou sch\u00e9ma<\/a><\/noindex> s podrobn\u00fdm popisem procesu, ilustruje proces ov\u011b\u0159ov\u00e1n\u00ed hypot\u00e9z TH v konkr\u00e9tn\u00edm syst\u00e9mu. Uvedu hlavn\u00ed etapy s kr\u00e1tk\u00fdm popisem.<\/p>\n

\"HrozbyZdroj<\/a><\/noindex> <\/p>\n

Etapa 1: TI Farm<\/b><\/p>\n

V t\u00e9to f\u00e1zi je t\u0159eba vymezit objekty<\/b> (anal\u00fdzou spolu se v\u0161emi daty o hrozb\u00e1ch) p\u0159id\u011blen\u00edm \u0161t\u00edtk\u016f jejich charakteristik\u00e1m. Je to soubor, URL, MD5, proces, utilita, ud\u00e1lost. P\u0159i jejich proch\u00e1zen\u00ed syst\u00e9my Threat Intelligence je t\u0159eba p\u0159i\u0159adit \u0161t\u00edtky. To znamen\u00e1, \u017ee tato str\u00e1nka byla zaznamen\u00e1na v CNC v ur\u010dit\u00e9m roce, tento MD5 byl spojen s n\u011bjak\u00fdm malwarem, tento MD5 byl sta\u017een ze str\u00e1nky, kter\u00e1 distribuovala malware.<\/p>\n

Etapa 2: P\u0159\u00edpady<\/b><\/p>\n

Ve druh\u00e9 f\u00e1zi se d\u00edv\u00e1me na interakci mezi t\u011bmito objekty a odhalujeme vz\u00e1jemn\u00e9 vazby mezi v\u0161emi t\u011bmito objekty. Z\u00edsk\u00e1v\u00e1me ozna\u010den\u00e9 syst\u00e9my, kter\u00e9 d\u011blaj\u00ed n\u011bco \u0161patn\u00e9ho.<\/p>\n

Etapa 3: Analytik<\/b><\/p>\n

Ve t\u0159et\u00ed f\u00e1zi je z\u00e1le\u017eitost p\u0159ed\u00e1na zku\u0161en\u00e9mu analytikovi, kter\u00fd m\u00e1 obrovsk\u00e9 zku\u0161enosti s anal\u00fdzou, a ten vyn\u00e1\u0161\u00ed rozsudek. Rozeb\u00edr\u00e1 na bajty, co, odkud, jak, pro\u010d a za jak\u00fdm \u00fa\u010delem tento k\u00f3d d\u011bl\u00e1. Tento objekt byl malwarem, tento po\u010d\u00edta\u010d byl infikov\u00e1n. Odhaluje spojen\u00ed mezi objekty, ov\u011b\u0159uje v\u00fdsledky b\u011bhu p\u0159es p\u00edskovi\u0161t\u011b.<\/p>\n

V\u00fdsledky pr\u00e1ce analytika jsou p\u0159ed\u00e1v\u00e1ny d\u00e1le. Digital Forensics zkoum\u00e1 obrazy, Malware Analysis zkoum\u00e1 nalezen\u00e9 \u201et\u011bla\u201c, a t\u00fdm Incident Response m\u016f\u017ee vyrazit na m\u00edsto a prozkoumat n\u011bco u\u017e tam. V\u00fdsledkem pr\u00e1ce bude potvrzen\u00e1 hypot\u00e9za, zji\u0161t\u011bn\u00fd \u00fatok a cesty k jeho potla\u010den\u00ed.<\/p>\n

\"HrozbyZdroj<\/a><\/noindex>
\n \u00a0<\/p>\n

Z\u00e1v\u011bry<\/h2>\n

\nThreat Hunting je pom\u011brn\u011b mlad\u00e1 technologie, schopn\u00e1 efektivn\u011b \u010delit p\u0159izp\u016fsoben\u00fdm, nov\u00fdm a nestandardn\u00edm hrozb\u00e1m, kter\u00e1 m\u00e1 velk\u00e9 perspektivy vzhledem k rostouc\u00edmu po\u010dtu takov\u00fdch hrozeb a slo\u017eitosti firemn\u00ed infrastruktury. Pot\u0159ebuje t\u0159i slo\u017eky \u2013 data, n\u00e1stroje a analytiky. P\u0159\u00ednos Threat Huntingu nen\u00ed omezen pouze na prevenci hrozeb. Je t\u0159eba si uv\u011bdomit, \u017ee p\u0159i vyhled\u00e1v\u00e1n\u00ed se pono\u0159ujeme do na\u0161\u00ed infrastruktury a jej\u00edch slab\u00fdch m\u00edst o\u010dima specialisty na bezpe\u010dnost a m\u016f\u017eeme tato m\u00edsta d\u00e1le pos\u00edlit.<\/p>\n

Prvn\u00ed kroky, kter\u00e9 by podle na\u0161eho n\u00e1zoru m\u011bly b\u00fdt u\u010din\u011bny k zah\u00e1jen\u00ed procesu TH ve va\u0161\u00ed organizaci.<\/p>\n

    \n
  1. Postarat se o ochranu koncov\u00fdch bod\u016f a s\u00ed\u0165ov\u00e9 infrastruktury. Zajistit viditelnost (NetFlow) a kontrolu (firewall, IDS, IPS, DLP) v\u0161ech proces\u016f ve va\u0161\u00ed s\u00edti. Zn\u00e1t svou s\u00ed\u0165 od hrani\u010dn\u00edho routeru a\u017e po posledn\u00ed host.<\/li>\n
  2. Prozkoumat MITRE ATT&CK<\/a><\/noindex>.<\/li>\n
  3. Prov\u00e1d\u011bt pravideln\u00e9 penetra\u010dn\u00ed testy aspo\u0148 kl\u00ed\u010dov\u00fdch extern\u00edch zdroj\u016f, analyzovat jejich v\u00fdsledky, ur\u010dit hlavn\u00ed c\u00edle \u00fatoku a uzav\u0159\u00edt jejich zranitelnosti.<\/li>\n
  4. Zav\u00e9st syst\u00e9m Threat Intelligence s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem (nap\u0159. MISP, Yeti) a prov\u00e1d\u011bt anal\u00fdzu log\u016f sou\u010dasn\u011b s n\u00edm.<\/li>\n
  5. Implementovat platformu pro reakci na incidenty (IRP): R-Vision IRP, The Hive, sandbox pro anal\u00fdzu podez\u0159el\u00fdch soubor\u016f (FortiSandbox, Cuckoo).<\/li>\n
  6. Automatizovat rutinn\u00ed procesy. Anal\u00fdza log\u016f, zakl\u00e1d\u00e1n\u00ed incident\u016f, informov\u00e1n\u00ed person\u00e1lu \u2013 obrovsk\u00e9 pole pro automatizaci.<\/li>\n
  7. Nau\u010dit se efektivn\u011b spolupracovat s in\u017een\u00fdry, v\u00fdvoj\u00e1\u0159i a technickou podporou na spole\u010dn\u00e9 pr\u00e1ci na incidentech.<\/li>\n
  8. Dokumentovat cel\u00fd proces, kl\u00ed\u010dov\u00e9 body, dosa\u017een\u00e9 v\u00fdsledky, aby se k nim pozd\u011bji mohlo vr\u00e1tit nebo sd\u00edlet tyto \u00fadaje s kolegy;<\/li>\n
  9. Pamatovat na soci\u00e1ln\u00ed str\u00e1nku: bu\u010fte v obraze o tom, co se d\u011bje s va\u0161imi zam\u011bstnanci, koho p\u0159ij\u00edm\u00e1te do pr\u00e1ce a komu d\u00e1v\u00e1te p\u0159\u00edstup k informa\u010dn\u00edm zdroj\u016fm organizace.<\/li>\n
  10. Bu\u010fte v obraze o trendech v oblasti nov\u00fdch hrozeb a zp\u016fsobech ochrany, zvy\u0161ujte svou \u00farove\u0148 technick\u00e9 gramotnosti (v\u010detn\u011b pr\u00e1ce s IT slu\u017ebami a subsyst\u00e9my), nav\u0161t\u011bvujte konference a komunikujte s kolegy.<\/li>\n<\/ol>\n

    \nJsem p\u0159ipraven projednat organizaci procesu TH v koment\u00e1\u0159\u00edch.<\/p>\n

    Nebo p\u0159ij\u010fte k n\u00e1m pracovat!<\/b><\/p>\n