SecureSet WarGames - Logging and Packet Capture Training

©2015 SecureSet, LLC
Active Defense
PCAP and Log DetectionTechniques
Instructor: Greg Foss
December 08, 2015

# whoami
 Greg.Foss@LogRhythm.com
 @heinzarelli
 Security OperationsTeam Lead
 Sr. Security Research Engineer
 OSCP, GAWN, GPEN, GCIH, CEH, Cyber APT

Logging and Packet Capture…

Why this content matters
 You already have everything you need for security
monitoring within your corporate infrastructure.
 Logging and Packet Capture are the cornerstones to
incident response and cyber investigations.
 Detailed evidence that can help to show what
exactly happened within an environment.
 Valuable to Operations and Security alike

How it fits into cybersecurity
 Every single computer investigation can be aided by
supporting log and packet capture data.
 If you ever want to work on an incident response
team or help monitor the security of an
organization, you must have an understand logging,
packet capture analysis and event correlation.

What you should learn tonight
 Introduction to Logging and Log Management
 Actively Detecting Attacks Using Log Data
 Introduction to Packet Capture and Net Flow
 Packet Dissection and Data Exfiltration Detection
 Packet Capture Challenge!
 http://omg.endoftheinternet.org/

Why I love this industry

Breaking into computers for a living!

It’s also fun to go hunting…

What are ‘Logs’…
 “A record of performance, events,
or day-to-day activities”
 MerriamWebster, 2015

Log Data = Log Message Meaning
 Informational – Generally benign events
 Debug – Software development
 Warning – Dependencies may be absent
 Error – Indication that something is not right
 Alert – Often security related. Highlight interesting info
 Logging and Log Management, 2012

Log Formats
 Flat File
 Database
 CSV
 Linux Syslog
 Generic Syslog
 Windows System, Event, Security, etc…

Standard Logging Locations
 Linux
 /var/log/
 Windows
 EventViewer

Log Management
 Store the logs in a centralized location
 Replicating logs across to a log management system
 Back up the logs to
ensure integrity of
the data and
maintain compliance
standards

Log Parsing (Normalization)
 To gain value from your SIEM, data must be normalized
 Varies depending on the log management solution
 Regular Expressions
 Data Categorization
 Common Event Generation
 General Classification

Endpoint Monitoring
 User Activity
 File Integrity and Hashing
 Processes Details
 Network Connections
 Registry Modification
 Document and/or Web BugTracking

Event Correlation
 Leveraging actionable
metadata allows you
to understand the full
picture.
 Key when attempting
to reconstruct a
scenario

Security Information Event Management
 Bringing it all together
 Dashboards
 Automated Alerting
 Automated Response
 Central Log Storage
 Enterprise Correlation

SIEMTools
 Commercial
 LogRhythm
 Splunk
 Open Source
 Logstash and
Kibana
 Graylog

Advanced Logging
 PowerShell
 Command Line Logging
 Extracting Logs using PowerShell
 PS C:> Get-EventLog Security
 Honeypot Event Correlation
 TTY Log Replay
 Web Bugs
 Open Source DocumentTracking and Event Correlation

Packet Capture (PCAP)

OSI Model
 Complete record of network activity : Layers 2-7

Transport Layer Protocols
 Transmission Control Protocol (TCP)
 Stateful – HTTP, SSH, SMTP, etc.
 Used to establish interactive sessions
 User Datagram Protocol (UDP)
 Stateless / Connectionless transmission model
 Easy to spoof origin
 No delivery guarantee
 Can be used to exfiltrate data via DNS

HowTo Capture NetworkTraffic
 Local
 Using tcpdump,Wireshark, NetworkMiner, Ettercap, etc.
 In-Line Device
 Often commercial but there are free tools as well.
 Mirror off Firewalls
 Split datapassed through firewalls and push to appliance.
 Offensive – MiTM, Arp Poisoning, EvilTwin, etc.

Packet Capture Appliances
 LogRhythm Network Monitor
 FreemiumVersion – https://support.logrhythm.com
 FireEye PX Series
 NetScout
 NetWitness
 Riverbed
 Etc.

NetworkTap
 A networkTap can be as simple as a hub. Hubs allow you
to see all data transmitted, as opposed to switches.
 Raspberry Pi
 Beaglebone Black
 LANTurtle
 Wi-Fi Pineapple

Capturing NetworkTraffic
 Simple Network
 Many Options

Capturing NetworkTraffic
 Basic Network, MultipleVLANs

Offensive Network Capture
 ARP Poisoning
 Convince host that our MAC is the router, traffic begans to
pass through our system.
 EvilTwinWi-Fi Attacks
 https://www.youtube.com/watch?v=86bvUV92Ek8
 We’ll talk about this more soon…
 Attack Switches, Routers, Gateways, etc.

Sniffing Packets
 Many protocols are in plain text
 Easy to understand and dissect
 HTTP, DNS, FTP,Telnet, SMTP, etc.
 TLS is becoming more prevalent
 Making traffic inspection more difficult
 HTTPS, SSH, SFTP, FTPS, etc.
 Malware often uses encrypted tunnels

Viewing Encrypted Packets
 SSL Interception Proxies
Source: https://logrhythm.com/blog/network-monitor-and-ssl-proxy-integration/

Offensive MiTM AgainstTLS / SSL
 SSLStrip – Older but still works
 https://github.com/moxie0/sslstrip
 SSLSplit –TransparentTLS/SSL Interception Proxy
 Terminates one session then creates its own
 https://github.com/droe/sslsplit
 NetRipper –Windows API Hooking
 https://github.com/NytroRST/NetRipper

Attacking Users – A Case Study

EvilTwin

EvilTwin
source: http://www.breakthesecurity.com/2014/04/evil-twin-attack-fake-wifi-hack.html

We’ve only just scratched the surface…

WantTo Learn More and Practice?
 http://www.netresec.com/?page=PcapFiles
 Publicly Available PCAP Files
 http://malware-traffic-analysis.net/
 PCAP Files and Malware Samples
 https://www.vthreat.com/
 Simulate threats, data exfiltration, etc.
 VirusTotal Professional

PCAP Challenge

Using
Log Data
toTrack
Winners


References
 Chuvakin, Anton, and Kevin Schmidt. Logging and
Log Management:The Authoritative Guide to
Dealing with Syslog, Audit Logs, Events, Alerts and
Other IT 'noise' Rockland, MA: Syngress, 2012. Print.
 Bejtlich, Richard. TheTao of Network Security
Monitoring: Beyond Intrusion Detection. Boston:
Addison-Wesley, 2005. Print.

CLOSING
 Careers in this area of security
 The work – LogRhythm is hiring!
 The rewards – Great benefits!
 How to pursue
 https://logrhythm.com/about/careers/
 greg.foss@logrhythm.com

 Provides aspiring security talent with a powerful &
direct path into cybersecurity
 “Career Promise”
 www.secureset.com/academy
 Next Denver session: January 2016

Did you know?
More than 209,000 cybersecurity jobs
in the US are unfilled.*
* www.peninsulapress.com/2015

wargames.secureset.com
wargames@secureset.com
Secure your future in Cyber!
SecureSet Academy Starts January 2016

SecureSet WarGames - Logging and Packet Capture Training

SecureSet WarGames - Logging and Packet Capture Training

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to SecureSet WarGames - Logging and Packet Capture Training

Similar to SecureSet WarGames - Logging and Packet Capture Training (20)

More from Greg Foss

More from Greg Foss (10)

Recently uploaded

Recently uploaded (20)

SecureSet WarGames - Logging and Packet Capture Training