Threat actors are increasingly employing evasive tactics that bypass traditional security controls, including more advanced technologies such as sandboxing. In this session, Dell SecureWorks will share examples of tactics used, their impact, what this means for organizations and new capabilities for addressing the risk posed by these threats.

1. MT 36 Detecting Evasive
Threats
Network Edition

2. Events
Opportunistic 85.7%
Exploits 12.3%
Ransomware - 1.2%
Targeted - .5%
FakeAV - .3%
A lot going on in the world

4. Motives vary

5. Motives vary

6. Motives vary

7. What industry verticals are victims?
46%
19%
12%
8%
4%
4%
4%
4%
Targeted Intrusion Victims by Industry Vertical
Manufacturing
Technology Provider
Education
Other Services
Retail
Business Services
Media
Misc. Financial
Source: Targeted Threat Responses Jan 2015 – Sept 2015

8. Threat groups
• Known Tools (Infrastructure)
• Known Targets (pre-Compromise) & Victims (post-Compromise)
• Known Techniques & Procedures (Capability)
• Known Identity
Candidate
Threat
Groups

9. TG-0416 Vertical Hopscotch
Vertical
Healthcare
Government
Technology Providers
Manufacturing
Financial
Membership Organizations
H2
2011
H1 H2
2012
H1 H2
2013
H1 H2
2014
H1 H2
2015
H1

10. How are threat groups entering networks?
29%
29%
29%
14%
Targeted Intrusion Access Vector
Phishing
Credential Abuse
Scan & Exploit
Web Exploit
Source: Targeted Threat Responses Jan 2015 – Sept 2015

11. Phishing…everyday occurrence

12. Watch your webmail…
spear phishing to corporate and personal mail
From: XXXXXXXX XXXXXXXX [mailto:xxxxxx.yyyyyyyy@zzzzzzzzz.zzz]
Sent: XXXXXXX, XXXXXXXX ##, 201X 11:01 PM
To: XXXXXXXX, XXXXXXXX
Subject: Internal Security Survey
Dear all,
Key target is finding and exploring company internal security problems in 201X.
Download the report: http://<company web domain>/download/survey.pdf
please fill the report and send to xxxxxx.yyyyyyyy@zzzzzzzzz.zzz tomorrow morning.
IT Department

13. 1. Adversary identifies websites known or suspected to be visited by designated target
2. Identified sites are probed for vulnerability
3. Adversary places exploits on one or more sites where it is likely to be accessed by targets
4. Users visit malicious website
5. Exploits are attempted against visitors. Delivery is often filtered by IP or other characteristics
6. Initial foothold malware is delivered to the victim
SitesofInterest
User Visits
Compromised
Site
Exploit used to
deliver initial
foothold malware
Strategic Web Compromise (SWC)
Identify
Vulnerable
Site & Place
Exploit

14. Scans website for available vulnerabilities
Deploys chinachopper shell
Adversary can now try to escalate privileges, dump passwords and move laterally in internal network
Identifies Struts with unpatched vulnerabilities
Exploiting weakness

15. • Exploitation of architecture and configuration
vulnerabilities
– just as effective
– just as devastating
– harder to detect
• Use available tools instead of malware
– Steal credentials
– Use existing administration tools
• Malware removed after initial intrusion
compromises credentials
Credential abuse

16. No malware? No Problem
TG-0416

17. “Transport rule found on server that
blind copies any messages with
?CMS?, ?pw?, ?pwd?, ?pass? or
?password? in the body or subject
of an email on server XYZ to email
account
company2014@outlook.com”
Living off the Land

18. Current State of Affairs
How victims learned of targeted
intrusions across their organizations:
60% Third party detected adversary
tradecraft
28%
12%
Notified by law enforcement or
government entity
Staff discovered threat actor
activity
Source: Targeted Threat Responses Jan 2015 – Sept 2015
50%
In half of of targeted intrusions,
the entry point of the threat
actors was undetermined
100%
In all intrusions, threat actors
“lived off the land” using stolen
credentials and native tools to
achieve their mission

19. • Next Generation Toolsets provide only
limited value. Tools need to be updated
with the latest Threat intelligence,
continually monitored, and run by trained
professionals.
The industry’s definition of defeat is different
from our adversary's definition of winning.

20. XLSTrojan
Comfoo Trojan
Sajdela Trojan
Chinese Infostealer Blue
Butterfly Lingbo
Dynamer
Targeted-CG
Orsam
Leouncia
Huntah
Poison Ivy
Bifrose
Hupigon
PcClient
gh0st
Wkysol
ZWShell
Mswab
Mirage
Wykcores
Hydraq
Whitewell
Werchan
Foxjmp
Sanshell
Lostmin
Pirp
httpBrowser
And many more…
Malware doesn’t matter…
the adversaries simply don’t care
骑驴找马

22. • Endpoint security controls fail
– AV fails
– Whitelisting fails
– Novel malware persistence mechanisms
› DLL Side Loading
› DLL Search Order Hijack
› Binary modification
– Memory based exploits
– Rootkits
– Even exploitation of the security software itself!
• Network controls fail
– Encrypted binary protocols over HTTP
– Use of common ports and protocols
– Frequently burning infrastructure
– Use of public services for C2 and exfil
• Log analysis detections fail
• Mobile Machine Learning Clouds of Advanced Malware Protection fail too!
But I have a magic mobile machine learning cloud
of advanced malware protection

25. Adaptable Persistent Threat
• Not a thing, a who
• Think project management…
– Adversary has already planned for most
common defenses and responses
– Setbacks trigger planning or strategy shifts, not
abandon
• Plan to fail…
– History teaches us that controls fail
– Endpoint controls fail
– Network controls fail
– Log and SIEM analytics fail

27. How do we win?

28. Reduce time to detect
advanced threat actor activity and
reduce effort to respond
to their operations

29. Lots of oppourtunity
We win by disrupting the threat actors before they complete their mission of data exfiltration
~1 month before data loss begins
~2 weeks to data exfiltration
~6 weeks before the threat actors win

31. I.N.T.E.L.L.I.G.E.N.C.E.

33. Architecture Affects Visibility
627732;10Mar2015;3:58:15;a.a.a.a;log;vpnroute;;External;inbound;VPN-1 & FireWall-
1;;chkma;Network;4;{00000000-0000-0000-0000-000000000000};EPC
RULE;MSTerminalServices;x.x.x.17;y.y.y.136;tcp;;;;;3389;2913;;;IKE;ESP: 3DES + MD5 +
DEFLATE;x.x.x.17;;;ACMEAPT_Access;VPN-1;VPN;;;;;;;;;;;;;;;;;compromisedusername;;;;;;;;;{11111111-1111-1111-
1111-111111111111};IKE;ESP: AES-128 +
MD5;38.109.75.18;;;ACMEAPT_Internal;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;

35. How do you win?
(The first 6 hours)
• Prevent the exploit
• Detect the malware execution
• Prevent or Monitor the malware execution

36. Detect potential danger early

37. DNS Telemetry
Internal
name server
.com Root
name server
foo.com
authoritative
name server
Request: A record
evil.foo.com
Request: NS record
foo.com
Request: A record
evil.foo.com
NS Response
A Record Response
A Record
Response

38. IDS/IPS strategic and tactical detection

39. How do you win?
(The first 6 hours)
• Credential use
• Lateral movement technique
• Execution

40. 06zz.yy:28:01.727 06zz.yy:28:04.703 6 192.168.x.y 0 17 192.168.a.b 2048 1 0 4 240
06zz.yy:28:01.759 06zz.yy:28:04.735 16 192.168.a.b 0 6 192.168.x.y 0 1 0 4 240
06zz.yy:28:14.199 06zz.yy:28:14.359 6 192.168.x.y 56639 17 192.168.a.b 445 6 6 7 1456
06zz.yy:28:14.231 06zz.yy:28:14.359 16 192.168.a.b 445 6 192.168.x.y 56639 6 2 5 1198
06zz.yy:28:16.611 06zz.yy:28:17.667 6 192.168.x.y 56640 17 192.168.a.b 80 6 2 3 200
06zz.yy:28:16.643 06zz.yy:28:17.699 16 192.168.a.b 80 6 192.168.x.y 56640 6 4 3 120
06zz.yy:28:44.258 06zz.yy:29:23.330 16 192.168.a.b 445 6 192.168.x.y 56644 6 2 128 10735
06zz.yy:28:44.258 06zz.yy:29:23.522 6 192.168.x.y 56644 17 192.168.a.b 445 6 2 221 274066
06zz.yy:29:56.517 06zz.yy:29:56.837 6 192.168.x.y 56644 17 192.168.a.b 445 6 0 6 1115
06zz.yy:29:56.549 06zz.yy:29:56.645 16 192.168.a.b 445 6 192.168.x.y 56644 6 0 5 948
06zz.yy:30:13.845 06zz.yy:30:13.909 6 192.168.x.y 56644 17 192.168.a.b 445 6 4 3 264
06zz.yy:30:13.877 06zz.yy:30:13.909 16 192.168.a.b 445 6 192.168.x.y 56644 6 0 2 224
Internal netflow: What lateral movement looks like

41. How do you win?
• Tactical and Strategic detection of webshells

42. Internal netflow: What network exploration looks like
06xx.yy:22:17.523 06xx.yy:22:17.523 6 192.168.x.y 60616 17 192.168.1.0 137 17 0 1 78
06xx.yy:22:17.523 06xx.yy:22:17.523 6 192.168.x.y 60616 17 192.168.1.1 137 17 0 1 78
06xx.yy:22:17.523 06xx.yy:22:17.523 6 192.168.x.y 60616 17 192.168.1.2 137 17 0 1 78
06xx.yy:22:17.555 06xx.yy:22:17.555 6 192.168.x.y 60616 17 192.168.1.3 137 17 0 1 78
06xx.yy:22:17.555 06xx.yy:22:17.555 6 192.168.x.y 60616 17 192.168.1.4 137 17 0 1 78
06xx.yy:22:17.555 06xx.yy:22:17.555 6 192.168.x.y 60616 17 192.168.1.5 137 17 0 1 78
06xx.yy:22:17.587 06xx.yy:22:17.587 6 192.168.x.y 60616 17 192.168.1.6 137 17 0 1 78
06xx.yy:22:17.587 06xx.yy:22:17.587 6 192.168.x.y 60616 17 192.168.1.7 137 17 0 1 78
06xx.yy:22:17.587 06xx.yy:22:17.587 6 192.168.x.y 60616 17 192.168.1.8 137 17 0 1 78
06xx.yy:22:17.619 06xx.yy:22:17.619 6 192.168.x.y 60616 17 192.168.1.10 137 17 0 1 78
06xx.yy:22:17.619 06xx.yy:22:17.619 6 192.168.x.y 60616 17 192.168.1.11 137 17 0 1 78
(more or less sequentially mapping the environment)
06xx.yy:42:45.159 06xx.yy:42:49.159 9 192.168.x.y 60616 0 192.168.253.78 137 17 0 1 78
06xx.yy:42:45.159 06xx.yy:42:49.159 9 192.168.x.y 60616 0 192.168.253.79 137 17 0 1 78
06xx.yy:42:45.167 06xx.yy:42:49.171 9 192.168.x.y 60616 0 192.168.253.80 137 17 0 1 78
06xx.yy:42:45.179 06xx.yy:42:49.179 9 192.168.x.y 60616 0 192.168.253.81 137 17 0 1 78
06xx.yy:42:45.191 06xx.yy:42:49.191 9 192.168.x.y 60616 0 192.168.253.82 137 17 0 1 78
06xx.yy:42:47.063 06xx.yy:42:47.063 9 192.168.x.y 60616 0 192.168.253.255 137 17 0 1 78
Scanned ~65k IPs in rapid succession…

43. How do you win?
• Without significant tripwires, data exfiltration of sensitive intellectual property
occurred in 6 weeks
• With proper visibility, the threat actors could have been detected at least 6 different
ways within the first 6 hours of the intrusion

44. Placeholder:
iSensor Slide Showing China Chopper Commands

45. Exfil
• Top talkers
• Outbound flows
• Firewall/Proxy monitoring

46. Redefine winning

47. Redefine winning

48. The optimal security continuum
Threat
Intelligence
People Process
Technology

49. Context to answer the questions that matter
What is it? Is it really a threat?
Did it succeed? What happened next?
Who was behind it? What are their intentions?
Did they achieve their objectives yet?
How did they get in, where are they, how do I get them out and prevent them
from winning?
What should I do next?
Intelligence on threat actors
Ability to collect telemetry and apply that intelligence
in the network and at the endpoint
Analytics beyond malware and signatures

50. Who has the first question?

51. Thanks!