{"id":31721,"date":"2019-10-31T21:42:43","date_gmt":"2019-10-31T18:42:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/threat-hunting-ili-kak-zashhititsya-ot-5-ugroz\/"},"modified":"2019-10-31T21:42:43","modified_gmt":"2019-10-31T18:42:43","slug":"threat-hunting-ili-kak-zashhititsya-ot-5-ugroz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/threat-hunting-ili-kak-zashhititsya-ot-5-ugroz","title":{"rendered":"Hunting Hrozieb, alebo Ako sa chr\u00e1ni\u0165 pred 5 % hrozieb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

95 % hrozieb kybernetickej bezpe\u010dnosti s\u00fa zn\u00e1me a je mo\u017en\u00e9 sa pred nimi br\u00e1ni\u0165 tradi\u010dn\u00fdmi prostriedkami ako s\u00fa antiv\u00edrusy, firewally, IDS, WAF. Ostatn\u00fdch 5 % hrozieb s\u00fa nezn\u00e1me a najnebezpe\u010dnej\u0161ie. Tieto hrozby predstavuj\u00fa 70 % rizika pre spolo\u010dnos\u0165, preto\u017ee ich odhalenie a ochrana s\u00fa ve\u013emi n\u00e1ro\u010dn\u00e9. Pr\u00edklady \u010diernych labut\u00ed<\/a><\/noindex> s\u00fa epid\u00e9mie ransomwaru WannaCry, NotPetya\/ExPetr, kryptomeny, kyberzbrane Stuxnet (ktor\u00e9 zasiahlo jadrov\u00e9 zariadenia Ir\u00e1nu) a mno\u017estvo (niekto e\u0161te pam\u00e4t\u00e1 Kido\/Conficker?) in\u00fdch \u00fatokov, proti ktor\u00fdm sa tradi\u010dn\u00fdmi prostriedkami ochrany \u0165a\u017eko br\u00e1ni. O tom, ako \u010deli\u0165 t\u00fdmto 5 % hrozb\u00e1m pomocou technol\u00f3gie Threat Hunting, by sme sa chceli porozpr\u00e1va\u0165.<\/p>\n

\"Hunting<\/a><\/noindex>
\n Neust\u00e1ly v\u00fdvoj kybernetick\u00fdch \u00fatokov si vy\u017eaduje trval\u00e9 odha\u013eovanie a reakcie, \u010do n\u00e1s nakoniec priv\u00e1dza k my\u0161lienke o nekone\u010dnej zbrojnej s\u00fa\u0165a\u017ei medzi \u00fato\u010dn\u00edkmi a obrancami. Tradi\u010dn\u00e9 ochrann\u00e9 syst\u00e9my u\u017e nie s\u00fa schopn\u00e9 zabezpe\u010di\u0165 prijate\u013en\u00fa \u00farove\u0148 ochrany, pri ktorej \u00farove\u0148 rizika neovplyv\u0148uje k\u013e\u00fa\u010dov\u00e9 ukazovatele spolo\u010dnosti (ekonomick\u00e9, politick\u00e9, reput\u00e1ciu) bez ich dodato\u010dn\u00fdch \u00faprav pre konkr\u00e9tnu infra\u0161trukt\u00faru, ale celkovo pokr\u00fdvaj\u00fa \u010das\u0165 riz\u00edk. U\u017e pri zav\u00e1dzan\u00ed a konfigur\u00e1cii modern\u00e9 ochrann\u00e9 syst\u00e9my zohr\u00e1vaj\u00fa \u00falohu \u201edobiehaj\u00facich\u201c a musia reagova\u0165 na v\u00fdzvy novej doby.<\/p>\n

\"HuntingZdroj<\/noindex><\/p>\n

Jednou z odpoved\u00ed na v\u00fdzvy s\u00fa\u010dasnosti pre \u0161pecialistu na kybernetick\u00fa bezpe\u010dnos\u0165 m\u00f4\u017ee by\u0165 technol\u00f3gia Threat Hunting. Term\u00edn Threat Hunting (\u010falej v texte \u2013 TH) sa objavil pred nieko\u013ek\u00fdmi rokmi. Technol\u00f3gia je ve\u013emi zauj\u00edmav\u00e1, ale zatia\u013e nem\u00e1 \u017eiadne v\u0161eobecne uzn\u00e1van\u00e9 \u0161tandardy a pravidl\u00e1. R\u00f4znorodos\u0165 zdrojov inform\u00e1ci\u00ed a mal\u00e9 mno\u017estvo rusk\u00fdch zdrojov inform\u00e1ci\u00ed na t\u00fato t\u00e9mu situ\u00e1ciu e\u0161te zhor\u0161uj\u00fa. V tejto s\u00favislosti sme sa v \u201eLANIT-Integr\u00e1cii\u201c rozhodli nap\u00edsa\u0165 ak\u00fdsi preh\u013ead tejto technol\u00f3gie. <\/p>\n

Aktualita<\/h2>\n

\nTechnol\u00f3gia TH sa opiera o procesy monitorovania infra\u0161trukt\u00fary. Existuj\u00fa dva hlavn\u00e9 scen\u00e1re intern\u00e9ho monitorovania \u2013 Alerting a Hunting<\/a><\/noindex>Alerting (in the style of MSSP services) is a traditional method, searching for previously developed signatures and attack indicators, and responding to them. This scenario is successfully handled by traditional signature-based protection tools. Hunting (MDR service type) is a monitoring method that answers the question, 'Where do signatures and rules come from?'. It is the process of creating correlation rules through the analysis of hidden or previously unknown indicators and signs of attack. This type of monitoring is what Threat Hunting refers to.<\/p>\n

\"Hunting
\nOnly by combining both types of monitoring do we achieve protection that approaches perfection, yet there always remains some level of residual risk.<\/p>\n

\"HuntingProtection using two types of monitoring<\/i><\/p>\n

Here\u2019s why TH (and hunting as a whole!) will become increasingly relevant:<\/p>\n

\"HuntingThreats, protection tools, risks.<\/i> Zdroj<\/a><\/noindex><\/p>\n

95% of all threats are already well-known<\/a><\/noindex>. These include types such as spam, DDoS, viruses, rootkits, and other classic malware. Protection from these threats can be achieved using the same classic protection means.<\/p>\n

In any project execution 20% of the time is spent on 80% of the work<\/a><\/noindex>, while the remaining 20% of the work takes 80% of the time. Similarly, among the entire threat landscape, 5% of new-type threats will account for 70% of the company's risk. In a company where information security management processes are organized, we can manage 30% of the risk posed by known threats, either by avoiding it (for example, avoiding wireless networks altogether), accepting it (by implementing necessary protection tools), or transferring it (for instance, to the shoulders of the integrator). However, protecting against zero-day vulnerabilities<\/a><\/noindex>, APT attacks, phishing, supply chain attacks<\/a><\/noindex>, cyber espionage, and national operations, as well as many other attacks, is already much more challenging. The consequences of these 5% of threats will be significantly more serious (the average loss for a bank from the buhtrap group is 143 million<\/a><\/noindex>), than the consequences of spam or viruses, which antivirus software can protect against.<\/p>\n

Almost everyone faces 5% of these threats. Recently, we encountered an open-source solution that uses an application from the PEAR (PHP Extension and Application Repository) repository. The attempt to install this application through pear install failed because webov\u00e1 str\u00e1nka<\/a><\/noindex> bol nebol dostupn\u00fd (teraz je na \u0148om u\u017e umiestnen\u00e1 nahr\u00e1dzaj\u00faca str\u00e1nka), musel som ho nain\u0161talova\u0165 z GitHubu. A doslova predned\u00e1vnom sa uk\u00e1zalo, \u017ee PEAR sa stal obe\u0165ou \u00fatoku cez dod\u00e1vate\u013esk\u00fd re\u0165azec<\/a><\/noindex>.<\/p>\n

\"Hunting<\/p>\n

M\u00f4\u017eeme si tie\u017e spomen\u00fa\u0165 na \u00fatok vyu\u017e\u00edvaj\u00faci CCleaner<\/a><\/noindex>, epid\u00e9mii ransomv\u00e9ru NePetya prostredn\u00edctvom aktualiza\u010dn\u00e9ho modulu pre program na spracovanie da\u0148ov\u00fdch spr\u00e1v M.E.Doc<\/a><\/noindex>. Hrozby sa st\u00e1vaj\u00fa \u010doraz sofistikovanej\u0161\u00edmi a vznik\u00e1 logick\u00e1 ot\u00e1zka \u2013 \u201eAko teda \u010deli\u0165 t\u00fdmto 5 % hrozieb?\u201c<\/p>\n

Defin\u00edcia Threat Hunting<\/h2>\n

\nTak\u017ee, Threat Hunting \u2014 proces proakt\u00edvneho a iterat\u00edvneho p\u00e1trania a odha\u013eovania pokro\u010dil\u00fdch hrozieb, ktor\u00e9 nemo\u017eno odhali\u0165 tradi\u010dn\u00fdmi prostriedkami ochrany. Medzi pokro\u010dil\u00e9 hrozby patr\u00ed napr\u00edklad tak\u00e9to \u00fatoky ako APT, \u00fatoky na 0-day zranite\u013enosti, Living off the Land a podobne.<\/p>\n

Taktie\u017e sa to d\u00e1 preformulova\u0165, \u017ee TH \u2013 to je proces overovania hypot\u00e9z. Je to preva\u017ene manu\u00e1lny proces s prvkami automatiz\u00e1cie, v r\u00e1mci ktor\u00e9ho analytik, opieraj\u00fac sa o svoje znalosti a kvalifik\u00e1ciu, preber\u00e1 ve\u013ek\u00e9 objemy inform\u00e1ci\u00ed v h\u013eadan\u00ed znakov kompromit\u00e1cie, zhoduj\u00facich sa s p\u00f4vodne stanovenou hypot\u00e9zou o pr\u00edtomnosti ur\u010ditej hrozby. Jeho osobitnos\u0165ou je rozmanitos\u0165 zdrojov inform\u00e1ci\u00ed.<\/p>\n

Je potrebn\u00e9 poznamena\u0165, \u017ee Threat Hunting \u2013 to nie je nejak\u00fd softv\u00e9rov\u00fd alebo hardv\u00e9rov\u00fd produkt. Nie s\u00fa to upozornenia, ktor\u00e9 m\u00f4\u017eete vidie\u0165 v nejakom rie\u0161en\u00ed. Nie je to proces vyh\u013ead\u00e1vania IOC (identifik\u00e1torov kompromit\u00e1cie). A to nie je nejak\u00e1 pas\u00edvna aktivita, ktor\u00e1 prebieha bez \u00fa\u010dasti analytikov IT bezpe\u010dnosti. Threat Hunting \u2013 predov\u0161etk\u00fdm je to proces.<\/p>\n

S\u00fa\u010dasti Threat Hunting<\/h2>\n

\n\"Hunting
\nTri hlavn\u00e9 s\u00fa\u010dasti Threat Hunting: d\u00e1ta, technol\u00f3gie, \u013eudia.<\/p>\n

D\u00e1ta (\u010do?)<\/b>, vr\u00e1tane Big Data. R\u00f4zne pr\u00fady dopravy, inform\u00e1cie o predt\u00fdm vykonan\u00fdch APT, anal\u00fdza, \u00fadaje o pou\u017e\u00edvate\u013eskej aktivite, sie\u0165ov\u00e9 \u00fadaje, inform\u00e1cie od zamestnancov, inform\u00e1cie na darknete a mnoh\u00e9 \u010fal\u0161ie.<\/p>\n

Technol\u00f3gie (ako?)<\/b> spracovania t\u00fdchto d\u00e1t \u2013 v\u0161etky mo\u017en\u00e9 sp\u00f4soby spracovania t\u00fdchto d\u00e1t, vr\u00e1tane strojov\u00e9ho u\u010denia.<\/p>\n

\u013dudia (kto?)<\/b> \u2013 t\u00ed, ktor\u00ed maj\u00fa ve\u013ek\u00e9 sk\u00fasenosti s anal\u00fdzou r\u00f4znych \u00fatokov, rozvinut\u00fa intu\u00edciu a schopnos\u0165 odhali\u0165 \u00fatok. Zvy\u010dajne ide o analytikov informa\u010dnej bezpe\u010dnosti, ktor\u00ed musia ma\u0165 schopnos\u0165 generova\u0165 hypot\u00e9zy a nach\u00e1dza\u0165 ich potvrdenie. T\u00edto analytici s\u00fa k\u013e\u00fa\u010dov\u00fdm \u010dl\u00e1nkom procesu.<\/p>\n

Model PARIS<\/h2>\n

\nAdam Beitman popisuje<\/a><\/noindex> model PARIS pre ide\u00e1lny proces TH. N\u00e1zov akoby nazna\u010duje zn\u00e1me pamiatky vo Franc\u00fazsku. Tento model je mo\u017en\u00e9 vn\u00edma\u0165 z dvoch perspekt\u00edv \u2013 zhora a zdola.<\/p>\n

V procese lovu na hrozby, pohybuj\u00fac sa pod\u013ea modelu zdola nahor, sa budeme zaobera\u0165 mnoh\u00fdmi d\u00f4kazmi \u0161kodlivej aktivity. Ka\u017ed\u00fd d\u00f4kaz m\u00e1 tak\u00fa mieru ako d\u00f4veryhodnos\u0165 \u2013 charakteristika, ktor\u00e1 odr\u00e1\u017ea v\u00e1hu tohto d\u00f4kazu. Existuj\u00fa \"nevyvr\u00e1tite\u013en\u00e9\", priame d\u00f4kazy \u0161kodlivej aktivity, na z\u00e1klade ktor\u00fdch m\u00f4\u017eeme okam\u017eite dosiahnu\u0165 vrchol pyram\u00eddy a vytvori\u0165 faktick\u00e9 upozornenie o presne zn\u00e1mom napadnut\u00ed. A existuj\u00fa nepriame d\u00f4kazy, ktor\u00fdch s\u00fahrn n\u00e1s tie\u017e m\u00f4\u017ee privies\u0165 k vrcholu pyram\u00eddy. Ako v\u017edy, nepriame doklady s\u00fa omnoho po\u010detnej\u0161ie ne\u017e priame, a preto ich treba triedi\u0165 a analyzova\u0165, vykon\u00e1va\u0165 \u010fal\u0161ie vy\u0161etrovania a ide\u00e1lne to automatizova\u0165.<\/p>\n

\"HuntingModel PARIS.<\/i> Zdroj<\/a><\/noindex><\/p>\n

Horn\u00e1 \u010das\u0165 modelu (1 a 2) je zalo\u017een\u00e1 na technol\u00f3giach automatiz\u00e1cie a r\u00f4znej analytike, zatia\u013e \u010do doln\u00e1 \u010das\u0165 (3 a 4) na \u013eu\u010foch so \u0161pecifickou kvalifik\u00e1ciou, ktor\u00ed riadia proces. Model je mo\u017en\u00e9 pova\u017eova\u0165 za pohyb zhora nadol, kde v hornej modrej \u010dasti m\u00e1me upozornenia od tradi\u010dn\u00fdch ochrann\u00fdch prostriedkov (antiv\u00edrus, EDR, firewall, signat\u00fary) s vysokou mierou d\u00f4very a d\u00f4veryhodnosti, a ni\u017e\u0161ie ukazovatele (IOC, URL, MD5 a in\u00e9), ktor\u00e9 maj\u00fa ni\u017e\u0161iu mieru d\u00f4veryhodnosti a vy\u017eaduj\u00fa \u010fal\u0161ie presk\u00famanie. A najni\u017e\u0161ia a najhrub\u0161ia \u00farove\u0148 (4) \u2013 generovanie hypot\u00e9z, vytv\u00e1ranie nov\u00fdch scen\u00e1rov \u010dinnosti tradi\u010dn\u00fdch ochrann\u00fdch prostriedkov. T\u00e1to \u00farove\u0148 nie je obmedzen\u00e1 iba na uveden\u00e9 zdroje hypot\u00e9z. \u010c\u00edm je \u00farove\u0148 ni\u017e\u0161ia, t\u00fdm vy\u0161\u0161ie s\u00fa po\u017eiadavky na kvalifik\u00e1ciu analytika.<\/p>\n

Je ve\u013emi d\u00f4le\u017eit\u00e9, aby analytici nielen overovali kone\u010dn\u00fd s\u00fabor vopred definovan\u00fdch hypot\u00e9z, ale aby neust\u00e1le pracovali na generovan\u00ed nov\u00fdch hypot\u00e9z a mo\u017enost\u00ed ich overenia.<\/p>\n

Model zrelosti vyu\u017e\u00edvania TH<\/h2>\n

\nV ide\u00e1lnom svete je TH nepretr\u017eit\u00fd proces. Ke\u010f\u017ee ide\u00e1lny svet neexistuje, po\u010fme analyzova\u0165 model zrelosti<\/a><\/noindex> a met\u00f3dy z poh\u013eadu \u013eud\u00ed, procesov a pou\u017eit\u00fdch technol\u00f3gi\u00ed. Pozrime sa na model dokonal\u00e9ho gu\u013eat\u00e9ho TH. Existuje 5 \u00farovn\u00ed vyu\u017e\u00edvania tejto technol\u00f3gie. Presk\u00famame ich na pr\u00edklade evol\u00facie ur\u010dit\u00e9ho t\u00edmu analytikov.<\/p>\n

\u00darovne zrelosti<\/b>
\n\u013dudia<\/b>
\nProcesy<\/b>
\nTechnol\u00f3gie<\/b><\/p>\n

\u00darove\u0148 0<\/b>
\nAnalytici SOC
\n24\/7
\nTradi\u010dn\u00e9 n\u00e1stroje:<\/p>\n

Tradi\u010dn\u00fd
\nS\u00fabor alertov
\nPas\u00edvne monitorovanie
\nIDS, AV, sandboxing,<\/p>\n

Bez TH<\/i>
\nPr\u00e1ca s alertami<\/p>\n

prostriedky signat\u00farnej anal\u00fdzy, d\u00e1ta Threat Intelligence.<\/p>\n

\u00darove\u0148 1<\/b>
\nAnalytici SOC
\nJednorazov\u00fd TH
\nEDR<\/p>\n

Experiment\u00e1lny
\nZ\u00e1kladn\u00e9 znalosti forenziky
\nH\u013eadanie IOC
\n\u010ciasto\u010dn\u00e9 pokrytie d\u00e1t od sie\u0165ov\u00fdch zariaden\u00ed<\/p>\n

Experimentovanie s TH<\/i>
\nDobr\u00fd preh\u013ead o sie\u0165ach a aplik\u00e1ci\u00e1ch<\/p>\n

\u010ciasto\u010dn\u00e1 aplik\u00e1cia<\/p>\n

\u00darove\u0148 2<\/b>
\n\u010casov\u00e9 zamestnanie
\nSprinty
\nEDR<\/p>\n

Pravideln\u00e9
\nStredn\u00e9 znalosti forenziky
\nT\u00fd\u017ede\u0148 za mesiac
\nPln\u00e1 aplik\u00e1cia<\/p>\n

Do\u010dasn\u00fd TH<\/i>
\nVynikaj\u00face znalosti siet\u00ed a aplik\u00e1ci\u00ed
\nPravideln\u00fd TH
\nPln\u00e1 automatiz\u00e1cia vyu\u017e\u00edvania d\u00e1t EDR<\/p>\n

\u010ciasto\u010dn\u00e9 vyu\u017eitie roz\u0161\u00edren\u00fdch funkci\u00ed EDR<\/p>\n

\u00darove\u0148 3<\/b>
\nDedikovan\u00fd t\u00edm TH
\n24\/7
\n\u010ciastkov\u00e1 schopnos\u0165 overova\u0165 hypot\u00e9zy TH<\/p>\n

Prevent\u00edvny
\nVynikaj\u00face znalosti forenziky a malv\u00e9ru
\nPrevent\u00edvny TH
\nPln\u00e9 vyu\u017eitie roz\u0161\u00edren\u00fdch funkci\u00ed EDR<\/p>\n

\u0160pecifick\u00e9 pr\u00edpady TH<\/i>
\nVynikaj\u00face znalosti \u00fato\u010diacej strany
\n\u0160pecifick\u00e9 pr\u00edpady TH
\nPln\u00e9 pokrytie d\u00e1t od sie\u0165ov\u00fdch zariaden\u00ed<\/p>\n

Konfigur\u00e1cia na mieru<\/p>\n

\u00darove\u0148 4<\/b>
\nDedikovan\u00fd t\u00edm TH
\n24\/7
\nPln\u00e1 schopnos\u0165 overova\u0165 hypot\u00e9zy TH<\/p>\n

Ved\u00faci
\nVynikaj\u00face znalosti forenziky a malv\u00e9ru
\nPrevent\u00edvny TH
\n\u00darove\u0148 3, plus:<\/p>\n

Vyu\u017e\u00edvanie TH<\/i>
\nVynikaj\u00face znalosti \u00fato\u010diacej strany
\nOverovanie, automatiz\u00e1cia a verifik\u00e1cia hypot\u00e9z TH
\ntesn\u00e1 integr\u00e1cia zdrojov d\u00e1t;<\/p>\n

Schopnos\u0165 sk\u00faman\u00ed<\/p>\n

v\u00fdvoj na mieru a nekonven\u010dn\u00e9 vyu\u017eitie API.<\/p>\n

\u00darovne zrelosti TH z poh\u013eadu \u013eud\u00ed, procesov a technol\u00f3gi\u00ed<\/i><\/p>\n

\u00darove\u0148 0:<\/b> tradi\u010dn\u00fd, bez vyu\u017eitia TH. Be\u017en\u00ed analytici pracuj\u00fa so \u0161tandardn\u00fdm s\u00faborom alertov v pas\u00edvnom monitorovan\u00ed s pou\u017eit\u00edm \u0161tandardn\u00fdch n\u00e1strojov a technol\u00f3gi\u00ed: IDS, AV, sandboxy, prostriedky signat\u00farnej anal\u00fdzy.<\/p>\n

\u00darove\u0148 1:<\/b> experiment\u00e1lny, s vyu\u017eit\u00edm TH. T\u00edto analytici so z\u00e1kladn\u00fdmi znalos\u0165ami forenziky a dobr\u00fdmi znalos\u0165ami siet\u00ed a aplika\u010dnej \u010dasti m\u00f4\u017eu uskuto\u010dni\u0165 jednorazov\u00fd Threat Hunting prostredn\u00edctvom vyh\u013ead\u00e1vania indik\u00e1torov kompromit\u00e1cie. K n\u00e1strojom sa prid\u00e1vaj\u00fa EDR s \u010diasto\u010dn\u00fdm pokryt\u00edm d\u00e1t z sie\u0165ov\u00fdch zariaden\u00ed. N\u00e1stroje sa pou\u017e\u00edvaj\u00fa \u010diasto\u010dne.<\/p>\n

\u00darove\u0148 2:<\/b> periodick\u00fd, do\u010dasn\u00fd TH. T\u00fdm ist\u00fdm analytikom, ktor\u00ed u\u017e zdokonalili svoje vedomosti v oblasti forenziky, siet\u00ed a aplika\u010dnej \u010dasti, sa ukladaj\u00fa povinnosti pravideln\u00e9ho cvi\u010denia (sprintu) Threat Hunting, povedzme, t\u00fd\u017ede\u0148 za mesiac. K n\u00e1strojom sa prid\u00e1va kompletn\u00e9 sk\u00famanie \u00fadajov zo sie\u0165ov\u00fdch zariaden\u00ed, automatiz\u00e1cia anal\u00fdzy \u00fadajov z EDR a \u010diasto\u010dn\u00e9 vyu\u017eitie roz\u0161\u00edren\u00fdch funkci\u00ed EDR.<\/p>\n

\u00darove\u0148 3:<\/b> prevent\u00edvny, \u010dast\u00e9 pr\u00edpady TH. Na\u0161i analytici sa organizovali do vy\u010dlenenej t\u00edmu, z\u00edskali vynikaj\u00face znalosti o forenzike a malv\u00e9re, ako aj vedomosti o met\u00f3dach a taktik\u00e1ch \u00fato\u010diacich str\u00e1n. Proces sa u\u017e realizuje v re\u017eime 24\/7. T\u00edm je schopn\u00fd \u010diasto\u010dne overova\u0165 hypot\u00e9zy TH, plne vyu\u017e\u00edvaj\u00fac pokro\u010dil\u00e9 mo\u017enosti EDR s \u00fapln\u00fdm pokryt\u00edm d\u00e1t z sie\u0165ov\u00fdch zariaden\u00ed. Taktie\u017e s\u00fa analytici schopn\u00ed konfigurova\u0165 n\u00e1stroje pod\u013ea vlastn\u00fdch potrieb.<\/p>\n

\u00darove\u0148 4:<\/b> l\u00eddersk\u00fd, vyu\u017eitie TH. Ten ist\u00fd t\u00edm z\u00edskal schopnosti v oblasti v\u00fdskumu, schopnos\u0165 generova\u0165 a automatizova\u0165 proces overovania hypot\u00e9z TH. Teraz sa k n\u00e1strojom pridala tesn\u00e1 integr\u00e1cia d\u00e1tov\u00fdch zdrojov, v\u00fdvoj softv\u00e9ru pod\u013ea potrieb a netradi\u010dn\u00e9 vyu\u017eitie API.<\/p>\n

Techniky Threat Hunting<\/h2>\n

\n\"HuntingZ\u00e1kladn\u00e9 techniky Threat Hunting<\/i><\/p>\n

K technik\u00e1m<\/a><\/noindex> TH v porad\u00ed zrelosti vyu\u017e\u00edvanej technol\u00f3gie patria: z\u00e1kladn\u00e9 vyh\u013ead\u00e1vanie, \u0161tatistick\u00e1 anal\u00fdza, techniky vizualiz\u00e1cie, jednoduch\u00e9 agreg\u00e1cie, strojov\u00e9 u\u010denie a bayesovsk\u00e9 met\u00f3dy. <\/p>\n

Najjednoduch\u0161ia met\u00f3da, z\u00e1kladn\u00e9 vyh\u013ead\u00e1vanie, sa pou\u017e\u00edva na obmedzenie oblasti v\u00fdskumu pomocou ur\u010dit\u00fdch dopytov. \u0160tatistick\u00e1 anal\u00fdza sa aplikuje napr\u00edklad na vytvorenie typick\u00e9ho pou\u017e\u00edvate\u013esk\u00e9ho alebo sie\u0165ov\u00e9ho spr\u00e1vania vo forme \u0161tatistick\u00e9ho modelu. Techniky vizualiz\u00e1cie sa pou\u017e\u00edvaj\u00fa na zobrazenie a zjednodu\u0161enie anal\u00fdzy d\u00e1t vo forme grafov a diagramov, na ktor\u00fdch je ove\u013ea jednoduch\u0161ie odhali\u0165 vzory v vzorke. Technika jednoduch\u00fdch agreg\u00e1ci\u00ed pod\u013ea k\u013e\u00fa\u010dov\u00fdch pol\u00ed sa pou\u017e\u00edva na optimaliz\u00e1ciu vyh\u013ead\u00e1vania a anal\u00fdzy. \u010c\u00edm vy\u0161\u0161ej \u00farovne zrelosti dosiahne v organiz\u00e1cii proces TH, t\u00fdm relevantnej\u0161ie sa st\u00e1va vyu\u017e\u00edvanie algoritmov strojov\u00e9ho u\u010denia. Tieto algoritmy s\u00fa tie\u017e \u0161iroko pou\u017e\u00edvan\u00e9 pri filtrovan\u00ed spamu, odha\u013eovan\u00ed \u0161kodliv\u00e9ho prenosu a detekcii podvodn\u00fdch aktiv\u00edt. Pokro\u010dilej\u0161\u00ed typ algoritmov strojov\u00e9ho u\u010denia s\u00fa bayesovsk\u00e9 met\u00f3dy, ktor\u00e9 umo\u017e\u0148uj\u00fa klasifik\u00e1ciu, zmen\u0161ovanie rozmernosti vzorky a tematick\u00e9 modelovanie.<\/p>\n

Model diamantu a strat\u00e9gie TH<\/h2>\n

\nSergio Kaltagirone, Andrew Pendergast a Christopher Betz vo svojej pr\u00e1ci \u201eModel diamantu anal\u00fdzy naru\u0161en\u00ed<\/a><\/noindex>\u201c uk\u00e1zali hlavn\u00e9 k\u013e\u00fa\u010dov\u00e9 zlo\u017eky ka\u017edej zlej aktivity a z\u00e1kladn\u00e9 vz\u0165ahy medzi nimi.<\/p>\n

\"HuntingModel diamantu pre zl\u00fa aktivitu<\/i><\/p>\n

V s\u00falade s t\u00fdmto modelom existuj\u00fa 4 strat\u00e9gie Threat Hunting, ktor\u00e9 sa opieraj\u00fa o pr\u00edslu\u0161n\u00e9 k\u013e\u00fa\u010dov\u00e9 zlo\u017eky.<\/p>\n

1. Strat\u00e9gia zameran\u00e1 na obe\u0165. Predpoklad\u00e1me, \u017ee obe\u0165 m\u00e1 protivn\u00edkov, a t\u00ed bud\u00fa dod\u00e1va\u0165 \"mo\u017enosti\" cez elektronick\u00fa po\u0161tu. H\u013ead\u00e1me d\u00e1ta nepriate\u013ea v po\u0161te. H\u013ead\u00e1me odkazy, pr\u00edlohy at\u010f. H\u013ead\u00e1me potvrdenie tejto hypot\u00e9zy po\u010das ur\u010dit\u00e9ho obdobia (mesa\u010dne, dva t\u00fd\u017edne), ak sme nena\u0161li, hypot\u00e9za sa neosved\u010dila.<\/p>\n

2. Strat\u00e9gia zameran\u00e1 na infra\u0161trukt\u00faru. Existuje nieko\u013eko met\u00f3d vyu\u017e\u00edvania tejto strat\u00e9gie. V z\u00e1vislosti od pr\u00edstupu a vidite\u013enosti s\u00fa niektor\u00e9 z nich jednoduch\u0161ie ako in\u00e9. Napr\u00edklad monitorujeme servery dom\u00e9nov\u00fdch mien zn\u00e1me pre hos\u0165ovanie zl\u00fdch dom\u00e9n. Alebo vykon\u00e1vame proces sledovania v\u0161etk\u00fdch nov\u00fdch registr\u00e1ci\u00ed dom\u00e9nov\u00fdch mien na z\u00e1klade zn\u00e1meho vzoru, ktor\u00fd pou\u017e\u00edvaj\u00fa protivn\u00edci.<\/p>\n

3. Strat\u00e9gia zameran\u00e1 na pr\u00edle\u017eitosti. Okrem strat\u00e9gie zameranej na obe\u0165, ktor\u00fa pou\u017e\u00edvaj\u00fa v\u00e4\u010d\u0161ina sie\u0165ov\u00fdch ochrann\u00fdch syst\u00e9mov, existuje strat\u00e9gia zameran\u00e1 na pr\u00edle\u017eitosti. Je druhou najpopul\u00e1rnej\u0161ou a s\u00fastred\u00ed sa na identifik\u00e1ciu mo\u017enost\u00ed poskytnut\u00fdch protivn\u00edkom, konkr\u00e9tne \u201emalv\u00e9rom\u201c a mo\u017enos\u0165 vyu\u017eitia legit\u00edmnych n\u00e1strojov, ako s\u00fa psexec, powershell, certutil a \u010fal\u0161ie.<\/p>\n

4. Strat\u00e9gia zameran\u00e1 na protivn\u00edka. Pr\u00edstup zameran\u00fd na protivn\u00edka sa s\u00fastre\u010fuje na samotn\u00e9ho protivn\u00edka. Sem patr\u00ed vyu\u017eitie verejn\u00fdch inform\u00e1ci\u00ed z otvoren\u00fdch zdrojov (OSINT), zbieranie \u00fadajov o protivn\u00edku, jeho technik\u00e1ch a met\u00f3dach (TTP), anal\u00fdza predch\u00e1dzaj\u00facich incidentov, \u00fadaje o hrozb\u00e1ch a podobne.<\/p>\n

Zdroje inform\u00e1ci\u00ed a hypot\u00e9z v TH<\/h2>\n

\n\"HuntingNiektor\u00e9 zdroje inform\u00e1ci\u00ed pre Threat Hunting<\/i><\/p>\n

Zdroje inform\u00e1ci\u00ed m\u00f4\u017eu by\u0165 ve\u013emi mnoh\u00e9. Ide\u00e1lny analytik by mal umie\u0165 z\u00edskava\u0165 inform\u00e1cie zo v\u0161etk\u00e9ho, \u010do je okolo neho. Typick\u00fdmi zdrojmi v prakticky akejko\u013evek infra\u0161trukt\u00fare bud\u00fa \u00fadaje zo zabezpe\u010dovac\u00edch prostriedkov: DLP, SIEM, IDS\/IPS, WAF\/FW, EDR. Typick\u00fdmi zdrojmi inform\u00e1ci\u00ed bud\u00fa aj r\u00f4zne indik\u00e1tory kompromit\u00e1cie, slu\u017eby Threat Intelligence, \u00fadaje CERT a OSINT. \u010ealej je mo\u017en\u00e9 vyu\u017ei\u0165 inform\u00e1cie z dark webu (napr\u00edklad, ak n\u00e1hle existuje objedn\u00e1vka na hacknutie e-mailovej schr\u00e1nky ved\u00faceho organiz\u00e1cie, alebo ak je slu\u017eobne akt\u00edvny kandid\u00e1t na pracovn\u00fa poz\u00edciu sie\u0165ov\u00e9ho in\u017einiera), inform\u00e1cie z\u00edskan\u00e9 od HR (recenzie na kandid\u00e1ta z predch\u00e1dzaj\u00faceho zamestnania), inform\u00e1cie od bezpe\u010dnostn\u00fdch slu\u017eieb (napr\u00edklad, v\u00fdsledky kontroly dod\u00e1vate\u013ea).<\/p>\n

Ale predt\u00fdm, ne\u017e za\u010dneme pou\u017e\u00edva\u0165 v\u0161etky dostupn\u00e9 zdroje, je potrebn\u00e9 ma\u0165 aspo\u0148 jednu hypot\u00e9zu.<\/p>\n

\"HuntingZdroj<\/a><\/noindex><\/p>\n

Na to, aby sme overili hypot\u00e9zy, je potrebn\u00e9 ich najprv predlo\u017ei\u0165. A aby sme mohli predklada\u0165 ve\u013ea kvalitn\u00fdch hypot\u00e9z, je potrebn\u00e9 pou\u017ei\u0165 syst\u00e9mov\u00fd pr\u00edstup. Podrobnej\u0161ie je proces generovania hypot\u00e9z pop\u00edsan\u00fd v \u010dl\u00e1nku<\/a><\/noindex>, ako z\u00e1kladn\u00fd pre proces predkladania hypot\u00e9z je ve\u013emi vhodn\u00e9 vzia\u0165 t\u00fato sch\u00e9mu.<\/p>\n

Hlavn\u00fdm zdrojom hypot\u00e9z bude matica ATT&CK<\/b> (Adversarial Tactics, Techniques and Common Knowledge). V podstate ide o datab\u00e1zu znalost\u00ed a model na hodnotenie spr\u00e1vania \u00fato\u010dn\u00edkov, ktor\u00ed realizuj\u00fa svoje aktivity v posledn\u00fdch f\u00e1zach \u00fatoku, obvykle op\u00edsan\u00e9ho pomocou pojmu Kill Chain. Teda v etap\u00e1ch po prenikan\u00ed \u00fato\u010dn\u00edka do vn\u00fatornej siete podniku alebo na mobiln\u00e9 zariadenie. P\u00f4vodne datab\u00e1za obsahovala opis 121 taktik a techn\u00edk pou\u017e\u00edvan\u00fdch pri \u00fatoku, pri\u010dom ka\u017ed\u00e1 z nich je podrobne op\u00edsan\u00e1 vo form\u00e1te Wiki. R\u00f4znorod\u00e1 analytika Threat Intelligence je dobr\u00fdm zdrojom na generovanie hypot\u00e9z. Osobitne treba poznamena\u0165 v\u00fdsledky anal\u00fdzy infra\u0161trukt\u00fary a testov na prenikanie \u2013 to s\u00fa najcennej\u0161ie \u00fadaje, ktor\u00e9 n\u00e1m m\u00f4\u017eu poskytn\u00fa\u0165 presn\u00e9 hypot\u00e9zy, preto\u017ee sa opieraj\u00fa o konkr\u00e9tnu infra\u0161trukt\u00faru s jej konkr\u00e9tnymi nedostatkami.<\/p>\n

Proces overovania hypot\u00e9z<\/h2>\n

\nSergej Soldatov predstavil dobr\u00fd diagram<\/a><\/noindex> s podrobn\u00fdm opisom procesu, ilustruje proces overovania hypot\u00e9z TH v konkr\u00e9tnom syst\u00e9me. Uvediem hlavn\u00e9 etapy s kr\u00e1tkym popisom.<\/p>\n

\"HuntingZdroj<\/a><\/noindex> <\/p>\n

Etapa 1: TI Farm<\/b><\/p>\n

V tejto etape je potrebn\u00e9 identifikova\u0165 objekty<\/b> (anal\u00fdzou spolu so v\u0161etk\u00fdmi \u00fadajmi o hrozb\u00e1ch) s priraden\u00edm im zna\u010diek ich charakterist\u00edk. Ide o s\u00fabor, URL, MD5, proces, utilitu, udalos\u0165. Pri ich prechode syst\u00e9mami Threat Intelligence je potrebn\u00e9 priradi\u0165 zna\u010dky. To znamen\u00e1, \u017ee t\u00e1to str\u00e1nka bola zaznamenan\u00e1 v CNC v ur\u010ditom roku, tento MD5 bol spojen\u00fd s takou malwarom, tento MD5 sa s\u0165ahoval z webu, ktor\u00fd distribuoval malv\u00e9r.<\/p>\n

Etapa 2: Pr\u00edpady<\/b><\/p>\n

V druhej etape sledujeme interakcie medzi t\u00fdmito objektmi a odha\u013eujeme s\u00favislosti medzi v\u0161etk\u00fdmi t\u00fdmito objektmi. Z\u00edskavaj\u00fa sa prehl\u00e1sen\u00e9 syst\u00e9my, ktor\u00e9 robia nie\u010do zl\u00e9.<\/p>\n

Etapa 3: Analytik<\/b><\/p>\n

V tretej etape sa z\u00e1le\u017eitos\u0165 odovzd\u00e1va sk\u00fasen\u00e9mu analytikovi, ktor\u00fd m\u00e1 obrovsk\u00e9 sk\u00fasenosti v anal\u00fdze, on a vyn\u00e1\u0161a verdikt. Rozober\u00e1 na \u00farovni bajtov, \u010do, odkia\u013e, ako, pre\u010do a \u010d\u00edm sa tento k\u00f3d vykon\u00e1va. Tento objekt bol \u0161kodliv\u00fd, tento po\u010d\u00edta\u010d bol infikovan\u00fd. Odha\u013euje spojenia medzi objektmi, kontroluje v\u00fdsledky prechodu cez pieskovisko.<\/p>\n

V\u00fdsledky pr\u00e1ce analytika s\u00fa n\u00e1sledne odovzd\u00e1van\u00e9 \u010falej. Digital Forensics sk\u00fama obrazy, Malware Analysis sk\u00fama n\u00e1jden\u00e9 \u201etela\u201c, a t\u00edm Incident Response m\u00f4\u017ee vycestova\u0165 na miesto a nie\u010do tam presk\u00fama\u0165. V\u00fdsledkom pr\u00e1ce bude potvrden\u00e1 hypot\u00e9za, zisten\u00fd \u00fatok a sp\u00f4soby, ako mu \u010deli\u0165.<\/p>\n

\"HuntingZdroj<\/a><\/noindex>
\n \u00a0<\/p>\n

Zhrnutie<\/h2>\n

\nThreat Hunting je relat\u00edvne mlad\u00e1 technol\u00f3gia, schopn\u00e1 efekt\u00edvne \u010deli\u0165 prisp\u00f4soben\u00fdm, nov\u00fdm a netradi\u010dn\u00fdm hrozb\u00e1m, ktor\u00e1 m\u00e1 ve\u013ek\u00e9 perspekt\u00edvy vzh\u013eadom na rast po\u010dtu tak\u00fdchto hrozieb a zlo\u017eitosti firemnej infra\u0161trukt\u00fary. Na to s\u00fa potrebn\u00e9 tri zlo\u017eky \u2013 d\u00e1ta, n\u00e1stroje a analytici. Pr\u00ednos Threat Hunting sa neobmedzuje len na predch\u00e1dzanie realiz\u00e1cii hrozieb. Netreba zab\u00fada\u0165, \u017ee pri h\u013eadan\u00ed sa pon\u00e1rame do vlastnej infra\u0161trukt\u00fary a jej slab\u00fdch miest z poh\u013eadu analytika-\u0161pecialistu v oblasti bezpe\u010dnosti a m\u00f4\u017eeme tieto miesta dodato\u010dne posilni\u0165.<\/p>\n

Prv\u00e9 kroky, ktor\u00e9, pod\u013ea n\u00e1\u0161ho n\u00e1zoru, treba urobi\u0165, aby sme polo\u017eili z\u00e1klady procesu TH vo vlastnej organiz\u00e1cii.<\/p>\n

    \n
  1. Postara\u0165 sa o ochranu koncov\u00fdch bodov a sie\u0165ovej infra\u0161trukt\u00fary. Postara\u0165 sa o vidite\u013enos\u0165 (NetFlow) a kontrolu (firewall, IDS, IPS, DLP) v\u0161etk\u00fdch procesov vo va\u0161ej sieti. Pozna\u0165 svoju sie\u0165 od hrani\u010dn\u00e9ho routera a\u017e po posledn\u00fd hostite\u013e.<\/li>\n
  2. Presk\u00fama\u0165 MITRE ATT&CK<\/a><\/noindex>.<\/li>\n
  3. Vykon\u00e1va\u0165 pravideln\u00fd pentest aspo\u0148 k\u013e\u00fa\u010dov\u00fdch vonkaj\u0161\u00edch zdrojov, analyzova\u0165 jeho v\u00fdsledky, vyzdvihn\u00fa\u0165 hlavn\u00e9 ciele \u00fatoku a uzavrie\u0165 ich zranite\u013enosti.<\/li>\n
  4. Implementova\u0165 syst\u00e9m Threat Intelligence s otvoren\u00fdm zdrojov\u00fdm k\u00f3dom (napr\u00edklad MISP, Yeti) a vykon\u00e1va\u0165 anal\u00fdzu protokolov spolo\u010dne s n\u00edm.<\/li>\n
  5. Zavies\u0165 platformu pre reagovanie na incidenty (IRP): R-Vision IRP, The Hive, pieskovisko na anal\u00fdzu podozriv\u00fdch s\u00faborov (FortiSandbox, Cuckoo).<\/li>\n
  6. Automatizova\u0165 rutinn\u00e9 procesy. Anal\u00fdza protokolov, zakladanie incidentov, informovanie person\u00e1lu \u2013 obrovsk\u00e9 pole pre automatiz\u00e1ciu.<\/li>\n
  7. Nau\u010di\u0165 sa efekt\u00edvne spolupracova\u0165 s in\u017einiermi, v\u00fdvoj\u00e1rmi, technickou podporou na spolo\u010dnej pr\u00e1ci na incidentoch.<\/li>\n
  8. Dokumentova\u0165 cel\u00fd proces, k\u013e\u00fa\u010dov\u00e9 body, dosiahnut\u00e9 v\u00fdsledky, aby sa k nim nesk\u00f4r mohlo vr\u00e1ti\u0165 alebo to zdie\u013ea\u0165 s kolegami;<\/li>\n
  9. Pam\u00e4tajte na soci\u00e1lnu str\u00e1nku: bu\u010fte informovan\u00ed o tom, \u010do sa deje s va\u0161imi zamestnancami, koho prij\u00edmate na pr\u00e1cu a komu d\u00e1vate pr\u00edstup k informa\u010dn\u00fdm zdrojom organiz\u00e1cie.<\/li>\n
  10. By\u0165 informovan\u00fd o trendoch v oblasti nov\u00fdch hrozieb a sp\u00f4soboch ochrany, zvy\u0161ova\u0165 svoju \u00farove\u0148 technickej gramotnosti (vr\u00e1tane pr\u00e1ce s IT slu\u017ebami a podsystemami), nav\u0161tevova\u0165 konferencie a komunikova\u0165 s kolegami.<\/li>\n<\/ol>\n

    \nR\u00e1d prediskutujem organiz\u00e1ciu procesu TH v koment\u00e1roch.<\/p>\n

    Alebo pr\u00eddite k n\u00e1m pracova\u0165!<\/b><\/p>\n