, most (87%) cybersecurity incidents occur within minutes, while 68% of companies take months to detect them. This is also confirmed by , which shows that most organizations take an average of 206 days to detect an incident. From our investigations, hackers can control a company's infrastructure for years without being detected. In one organization where our experts investigated a cybersecurity incident, it was found that hackers completely controlled the organization's entire infrastructure and regularly stole sensitive information .
Suppose you already have a SIEM in place that collects logs and analyzes events, and antivirus solutions are installed on endpoints. However, , just as it's impossible to implement EDR systems across the entire network, which means there will inevitably be 'blind' spots. Network Traffic Analysis (NTA) systems help address these gaps. These solutions detect malicious activity at the earliest stages of intrusion into the network, as well as during attempts to establish a foothold and escalate an attack within the network.
There are two types of NTA: some work with NetFlow, while others analyze raw traffic. The advantage of the latter systems is that they can store raw traffic records. This allows a cybersecurity specialist to verify the success of an attack, localize the threat, understand how the attack occurred, and how to prevent a similar one in the future.
We will show how NTA can identify all known attack tactics described in the knowledge base through direct or indirect signs. We will discuss each of the 12 tactics, examine techniques that can be detected through traffic, and demonstrate their detection using our NTA system.
About the ATT&CK Knowledge Base
MITRE ATT&CK is a publicly available knowledge base developed and maintained by MITRE based on the analysis of real APTs. It is a structured set of tactics and techniques used by attackers. This allows cybersecurity professionals from around the world to speak the same language. The database is constantly expanding and being updated with new knowledge.
The database identifies 12 tactics, which are divided according to stages of a cyber attack:
- initial access;
- execution;
- persistence;
- privilege escalation;
- defense evasion;
- credential access;
- discovery;
- lateral movement;
- collection;
- command and control;
- exfiltration;
- impact.
For each tactic in the ATT&CK knowledge base, there is a list of techniques that assist attackers in achieving their goals at the current stage of the attack. Since the same technique can be used at different stages, it may relate to multiple tactics.
The description of each technique includes:
- an identifier;
- a list of tactics in which it is applied;
- examples of use by APT groups;
- mitigation measures to reduce its impact;
- detection recommendations.
Cybersecurity professionals can use the knowledge from the database to structure information about current attack methods and, based on this, build an effective security system. Understanding how real APT groups operate can also serve as a source of hypotheses for proactive threat hunting within .
About PT Network Attack Discovery
We will identify the use of techniques from the ATT&CK matrix using the — Positive Technologies NTA system, designed to detect attacks at the perimeter and within the network. PT NAD covers all 12 tactics of the MITRE ATT&CK matrix to varying degrees. It is particularly strong in identifying techniques for initial access, lateral movement, and command and control, covering more than half of the known techniques and detecting their use based on direct or indirect indicators.
The system detects attacks using ATT&CK techniques through detection rules created by the team. (PT ESC), machine learning, indicators of compromise, deep analytics, and retrospective analysis. Real-time traffic analysis combined with retrospective analysis helps identify current hidden malicious activity and track the evolving vectors and timeline of attacks.
full mapping of PT NAD to the MITRE ATT&CK matrix. The picture is broad, so we suggest you review it in a separate window.
Initial Access
The tactics for gaining initial access include techniques for infiltrating the company's network. The attackers' goal at this stage is to deliver malicious code to the targeted system and ensure its further execution.
Traffic analysis with PT NAD allows for the identification of seven techniques for gaining initial access:
1. : drive-by compromise
The technique where the victim opens a website that is used by attackers to exploit the web browser and obtain access tokens for the application.
What PT NAD does: if the web traffic is unencrypted, PT NAD inspects the content of HTTP server responses. It is in these responses that exploits can be found, allowing attackers to execute arbitrary code within the browser. PT NAD automatically detects such exploits using detection rules.
Additionally, PT NAD identifies threats at the previous step. Rules and indicators of compromise trigger if a user visits a website that redirects them to a site with a bundle of exploits.
2. : exploit public-facing application
Exploitation of vulnerabilities in services that are publicly accessible from the internet.
What PT NAD does: conducts deep inspection of network packet content, identifying signs of anomalous activity. In particular, there are rules that allow detecting attacks on major content management systems (CMS), web interfaces of network equipment, and attacks on mail and FTP servers.
3. : external remote services
The use of remote access services by attackers to connect to internal network resources from outside.
What PT NAD does: as the system recognizes protocols not by port numbers but by the content of packets, users of the system can filter traffic to identify all remote access protocol sessions and verify their legitimacy.
4. : spearphishing attachment
This refers to the notorious practice of sending phishing attachments.
What PT NAD does: automatically extracts files from traffic and checks them against compromise indicators. Executable files in attachments are identified by rules analyzing the content of email traffic. In a corporate environment, such an attachment is considered anomalous.
5. : spearphishing link
The use of phishing links. This technique involves attackers sending a phishing email containing a link, which, when clicked, downloads malware. Typically, the link is accompanied by text crafted according to social engineering principles.
What PT NAD does: detects phishing links using compromise indicators. For example, in the PT NAD interface, we observe a session where there was an HTTP connection to a link listed in the phishing-urls.
Connection to the link from the phishing-urls compromise indicators list
6. : trusted relationship
Access to the victim's network through third parties with whom the victim has established trusted relationships. Attackers may compromise a trusted organization and connect to the target network through it. They use VPN connections or domain trust relationships, which can be identified through traffic analysis.
What PT NAD does: analyzes application protocols and saves the parsed fields to a database, allowing an information security analyst to find all suspicious VPN connections or cross-domain connections in the database using filters.
7. : valid accounts
The use of standard, local, or domain credentials to authenticate to external and internal services.
What PT NAD does: automatically extracts credentials from HTTP, FTP, SMTP, POP3, IMAP, SMB, DCE/RPC, SOCKS5, LDAP, Kerberos logs. Generally, these include the username, password, and an indication of successful authentication. If they were used, they will be displayed in the corresponding session card.
Execution
Execution tactics include techniques that attackers use to execute code on compromised systems. Running malicious code helps attackers establish persistence and expand access to remote systems within the network by moving internally.
PT NAD allows for the identification of 14 techniques used by attackers to execute malicious code.
1. : CMSTP (Microsoft Connection Manager Profile Installer)
This tactic involves attackers preparing a specialized malicious installation INF file for the built-in Windows utility CMSTP.exe (Connection Manager Profile Installer). CMSTP.exe takes the file as a parameter and installs a service profile for remote connection, allowing it to be used to load and execute dynamically linked libraries (*.dll) or scriptlets (*.sct) from remote servers.
What PT NAD does: automatically detects the transfer of specially formatted INF files in HTTP traffic. Additionally, it detects the transfer of malicious scriptlets and dynamically linked libraries from a remote server via the HTTP protocol.
2. : command-line interface
Interacting with the command-line interface. The command-line interface can be accessed locally or remotely, for example, using remote access utilities.
What PT NAD does: automatically detects the presence of shells based on responses to the launch commands of various command-line utilities such as ping, ifconfig.
3. : component object model and distributed COM
Using COM or DCOM technologies to execute code on local or remote systems while moving through the network.
What PT NAD does: detects suspicious DCOM calls that attackers typically use to launch programs.
4. : exploitation for client execution
Exploitation of vulnerabilities to execute arbitrary code on a workstation. The most useful exploits for attackers are those that allow code execution on remote systems, as they enable unauthorized access. This technique can be implemented through methods such as malicious email distributions, exploit-laden websites for browsers, and remote exploitation of application vulnerabilities.
What PT NAD does: During the analysis of email traffic, PT NAD checks for executable files in attachments. It automatically extracts Office documents from emails that may contain exploits. Attempts to exploit vulnerabilities are visible in the traffic, which PT NAD detects automatically.
5. : mshta
The use of the mshta.exe utility, which executes Microsoft HTML applications (HTA) with a .hta extension. Since mshta processes files bypassing browser security settings, attackers can use mshta.exe to execute malicious HTA files, JavaScript, or VBScript.
What PT NAD does: .hta files for execution via mshta are also transmitted over the network — this is visible in the traffic. PT NAD automatically detects the transmission of such malicious files. It captures the files, and the information about them can be viewed in the session card.
6. : PowerShell
The use of PowerShell to gather information and execute malicious code.
What PT NAD does: when PowerShell is used by attackers remotely, PT NAD detects this using rules. It identifies keywords from the PowerShell language that are most often used in malicious scripts and the transmission of PowerShell scripts over the SMB protocol.
7. : scheduled task
The use of the Windows Task Scheduler and other utilities to automatically run programs or scripts at specified times.
What PT NAD does: attackers typically create such tasks remotely, making these sessions visible in the traffic. PT NAD automatically detects suspicious activities related to the creation and modification of tasks using the RPC interfaces ATSVC and ITaskSchedulerService.
8. : scripting
The execution of scripts to automate various actions of attackers.
What PT NAD does: detects the transmission of scripts over the network, even before their execution. It identifies script content in raw traffic and detects network transmissions of files with extensions corresponding to popular scripting languages.
9. : service execution
Executing an executable file, command line instructions, or a script through interaction with Windows services, such as the Service Control Manager (SCM).
What PT NAD does: inspects SMB traffic and detects interaction with SCM based on rules for creating, modifying, and starting a service.
The technique for launching services can be implemented using the PSExec command execution utility. PT NAD analyzes the SMB protocol and detects the use of PSExec when it utilizes the PSEXESVC.exe file or the standard service name PSEXECSVC to execute code on a remote machine. The user needs to check the list of executed commands and the legitimacy of remote command execution from the node.
The attack card in PT NAD displays data on the tactics and techniques used according to the ATT&CK matrix, so the user can understand at what stage the attackers are, their objectives, and what countermeasures to take.
Triggering of the rule regarding the use of the PSExec utility, which may indicate an attempt to execute commands on a remote machine.
10. : third-party software
A technique whereby attackers gain access to remote administration software or corporate software deployment systems and use them to launch malicious code. Examples of such software include SCCM, VNC, TeamViewer, HBSS, Altiris.
Moreover, this technique is particularly relevant due to the mass transition to remote work and, consequently, the connection of numerous unsecured home devices through questionable remote access channels.
What PT NAD does: automatically detects such software operations in the network. For instance, rules are triggered on connections via the VNC protocol and the activity of the EvilVNC trojan, which secretly installs a VNC server on the victim's host and automatically starts it. PT NAD also automatically identifies the TeamViewer protocol, assisting the analyst in using filters to find all such sessions and verify their legitimacy.
11. : user execution
A technique where the user launches files that may lead to code execution. This could occur, for instance, if they open an executable file or run an office document with a macro.
What PT NAD does: detects such files even at the stage of transfer, prior to their execution. Information about them can be studied in the session card where they were transmitted.
12. : Windows Management Instrumentation
The use of the WMI tool, which enables local and remote access to Windows system components. With WMI, attackers can interact with local and remote systems and perform various tasks, such as gathering information for reconnaissance and remotely executing processes during lateral movement.
What PT NAD does: since interactions with remote systems via WMI are visible in the traffic, PT NAD automatically detects network requests for establishing WMI sessions and checks the traffic for the transmission of scripts that utilize WMI.
13. : Windows Remote Management
The use of a service and protocol in Windows that allows users to interact with remote systems.
What PT NAD does: detects network connections established using Windows Remote Management. Such sessions are automatically detected by rules.
14. : XSL (Extensible Stylesheet Language) script processing
The XSL markup language is used to describe the processing and visualization of data in XML files. To support complex operations, the XSL standard includes support for embedded scripts in various languages. These languages allow arbitrary code execution, leading to the bypassing of whitelist-based security policies.
What PT NAD does: identifies the transfer of such files over the network, meaning even before their execution. It automatically detects the transmission of XSL files and files with anomalous XSL markup over the network.
In the following materials, we will explore how the NTA system PT Network Attack Discovery identifies other tactics and techniques used by attackers according to MITRE ATT&CK. Stay tuned!
Authors:
- Anton Kute pov, an expert from the security center (PT Expert Security Center) of Positive Technologies
- Natalia Kazankova, product marketer at Positive Technologies
Source: habr.com
