Saltar al contenido principal
CargarIdioma (ES)Atención al cliente
EmpresarialesMóvilRedes socialesMarketingTecnologíaArte y fotografíaEmpleoDiseñoEducaciónPresentaciones y charlas públicasGobierno y org. sin ánimo de lucroAtención sanitariaInternetDerechoLiderazgo y gestiónMotorIngenieríaSoftwareReclutamiento y RR. HH.Venta al por menorVentasServiciosCienciasPYMES y liderazgoAlimentaciónMedio ambienteEconomía y finanzasDatos y análisisRelaciones con inversoresDeportesMeditaciónNoticias y políticaViajesDesarrollo personalSector inmobiliarioEntretenimiento y humorSalud y medicinaDispositivos y hardwareEstilo de vida
Deepak Kumar (D3) , profile picture
Subido porDeepak Kumar (D3)
5,937 vistas

Threat Intelligence

The document discusses the principles and practices of digital forensics and threat intelligence, emphasizing the importance of understanding threats from various actors, including cybercriminals and nation-state actors. It outlines the types of threat intelligence, including strategic, tactical, and operational, and highlights the need for organizations to protect their critical assets. Additionally, it introduces methodologies like the MITRE ATT&CK framework and tools for threat intelligence sharing and analysis.

Educación◦
Temas relacionados:
Cyber Threat Intelligence• Incident Response• Cyber-Security•
Descargado 138 veces
EVERY CRIME LEAVES A TRAIL OF EVIDENCE D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE
DISCLAIMER Different organisations are subject to different laws and regulations. This resource is for educational and research purposes only. Do not attempt to violate the law with anything contained here. Neither the author of this material, nor anyone else affiliated in any way, is liable for your actions. Some information from the internet and some of personal experience; doesn’t want to hurt anybody ☺ D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE
“If you know the enemy and know yourself, you need not fear the result of a hundred battles” - Sun Tzu D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE
D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE
• National Security • Critical National Infrastructure • Cyber-Warfare • Computer Crime • Organized Crime • Identity Theft • Extortion • Non-State Actors • Terrorists • Political Activists D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE Threat & Threat Agents Non-Hostile • Reckless employee • Untrained employee • Partners Hostile • eCrime • Nation-state cyber warrior • Industrial espionage • … Intent: Fun, Theft, Disruption, Reputation, Espionage …
Anything likely to cause damage or danger + Ability to acquire and apply knowledge and skills = Threat Intelligence D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE
D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE “Gartner defines threat intelligence as "Threat intelligence is evidence- based knowledge (e.g., context, mechanisms, indicators, implications and action-oriented advice) about existing or emerging menaces or hazards to assets." – Gartner Mail Metadata Malware Phish Spoof Activity Audit activities Click trace TI Sources GeoIP Threat indicators DLP hits Machine infections Information Insight/Analysis Again, What is Threat Intelligence?
Strategic: Broader trends typically meant for a non technical audience Tactical: Outlines of tactics, techniques, and procedures of threat actors for a more technical audience Operational: Technical details about specific attacks and campaigns Solution Integrate with machine learning that connect dots and provide context on indicators of compromise (IOCs) and tactics, techniques and procedures (TTPs) of threat actor D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE Threat Intel Categories
D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE • Phishing Detection • Incident Response Knowledge Base • Vulnerability Prioritisation • Fraud Detection • Forensics RCA (root cause analysis) • Brand Monitoring Use case examples Threat Analysis Collection Processing Analysis & ProductionValidation Dissemination Projection
D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE What am I trying to protect? Have you identified your crown jewels and how they are both protected and at risk? Do you know who/what you are protecting it from? Do you have a plan for protecting your assets from actors or risk identified?
D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE Internally Generated Analysis • IOC hunters – Vendor • End Point Protection • Security Operation • Vulnerability Management Information Sharing • Sectoral – Financial services, public sector • Geographic – local CERT • NIS Directive Organisation Specific • Your “Organisation” information • Social media • Boards • Dark web • Customer or organisation phishing campaigns Generic External • Open source • Subscription based - X-Force, Digital Shadows, Deepsight • Raw e.g. XSS, JSON, TXT • Indicators of compromise (IOCs) • Tactics techniques and procedures TTPs Operational Information & Intel Feeds
D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE TLP – Traffic Light Protocol What is TLP? A set of designations to ensure that sensitive information is shared with the correct audience and that the recipient (s) understand if and how the information can be disseminated. Who Uses TLP? US-CERT, public and private sector organizations within: US, Australia, Canada, Finland, France, Germany, Hungary, India, Italy, Japan, Netherlands, New Zealand, Norway, Sweden, Switzerland and the United Kingdom.
Threat Intel Platform (TIP) Open Source: • CRITs • Soltra • MANTIS • MISP • OTX etc PS: Only for educational purposes For More: 1. https://github.com/hslatman/awesome-threat-intelligence 2. https://www.senki.org/operators-security-toolkit/open-source-threat-intelligence-feeds/
D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE HELK : Enabling Advanced Analytics Capabilities Hunting ELK (Elasticsearch, Logstash, Kibana) : https://github.com/Cyb3rWard0g/HELK
D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE Kill Chain Analysis MITRE ATT&CK MATRIX Recon Weaponise Delivery Exploitation Installation C2 Actions & Objectives ➢ Task: Identify the Attackers’ Step by Step Process ➢ Goal: Disrupting Attackers’ operations ▪ Motivation ▪ Preparation ▪ Configuration ▪ Packaging ▪ Mechanism of Delivery ▪ Infection Vector ▪ Technical or human? ▪ Applications affected ▪ Method & Characteristics ▪ Persistence ▪ Characteristic s of change ▪ Acquiring additional components ▪ Communication between victim & adversary ▪ What the adversary does when they have control of the system MITRE ATT&CK: ▪ Active Scanning ▪ Passive Scanning ▪ Determine Domain & IP Address Space ▪ Analyze Third-Party IT Footprint MITRE ATT&CK: ▪ Malware ▪ Scripting ▪ Service Execution MITRE ATT&CK: ▪ Spearphishing Attachment/Link ▪ Exploit Public- Facing Application ▪ Supply Chain Compromise MITRE ATT&CK: ▪ Local Job Scheduling ▪ Scripting ▪ Rundll32 MITRE ATT&CK: ▪ Application Shimming ▪ Hooking ▪ Login Items MITRE ATT&CK: ▪ Data Obfuscation ▪ Domain Fronting ▪ Web Service MITRE ATT&CK: ▪ Email Collection ▪ Data from Local System/Network Share
USE CASE : IP Theft o Employee Resigned o Joined New Company o Data theft o Type of data (pdf, xlsx) o Browser history cleared o No data in Recycle bin o Formatted USB ✓ Forensics Imaging (Physical If required) ✓ Timeline ✓ Machine (Laptop/Desktop) : User info (SID) ✓ Data Recovery (Specific data formats) ✓ Mail Check (pst,ost, lotus etc) ✓ SIEM/DLP logs (Data copied) ✓ Firewall (3rd party URL data uploaded) D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE Q U E S T I O N A N S W E R
D3pak@Protonmail.com Resources : D3pakblog.wordpress.com D3PAK KUMAR (D3) DIGITAL FORENSICS | CYBER INTELLIGENCE Thank You