Hackers are getting stealthier and successfully breaching even the best laid defenses. Industry reports continue to show that attacker dwell time continues to plague organizations.
The facts are clear, reducing the dwell time of attacks dramatically reduces the impact a successful breach has on your company and the cost of a breach (see figure below). In fact organizations that are able to contain a breach in less than 30 days paid nearly $1 million less in total breach costs.
Proactive threat hunting is quickly becoming a must for any organization that’s serious about protecting itself and its bottom line. But where do you start? We’ve assembled a list of the top 6 host indicators of compromise that every organization needs to be looking for to find hidden malware and APTs that threaten the security of your systems and data.
Top 6 host indicators of compromise you need to hunt:
- Start with the beachhead. In most situation where there is long term breach, there is a beachhead; the system attackers use to get into and maintain access to the network. This is the primary thing you want to find. Hackers generally install an implant such as a Remote Access Tool (RAT), rootkit, or backdoor on the beachhead system. It’s often the one system in the network that’s not being monitored, due to non-compliance or attacker manipulation, and serves as the attacker’s continuing access point. They then traverse the rest of the network with stolen administrative credentials (aka “living off the land”), to reduce the possibility of being found by defensive monitoring and antivirus. As identifying malicious user behavior can be challenging, it’s often better to search for this beachhead system. A full exam using Forensic State Analysis (FSA) is a quick and scalable way to look for beachheads and the implants on them.
- Implants, Remote Access Tools and Backdoors. The current malware trend is fileless and does not touch disk, so you need to look in volatile memory for injections and in-memory manipulations of common processes. Finding and analyzing injections and fileless malware in volatile memory is only accomplished using a Forensic State Analysis approach (true FSA includes live volatile memory analysis). While a behavior-based approach can sometimes be effective, it can easily fool an analyst since the behavior and connections will trace back to the injected process (e.g. Internet Explorer), which may be incorrectly categorized as a false positive.
- Persistence mechanisms. If the implant isn’t active in memory, then it needs to be triggered to run in the future via a persistence mechanism. Examples include an autostart location in the registry, boot process redirection, or scheduled tasks / cronjob. If the malware is dormant, you won’t get any behavior indication or host events, so you will need to enumerate common persistence locations and analyze any commands, code, or files referenced. While there are hundreds of autostart locations in Windows, start your hunt for persistence mechanisms with scheduled tasks and the registry run keys, which are the most common. Understand that most endpoint security software (both legacy and ’next-gen‘) do not analyze persistence mechanisms, instead relying on periodic whole disk scans. Today, not all persistence mechanisms reference files on disk so these legacy approaches are not as effective anymore.
- Execution artifacts. Look for execution artifacts on the endpoint from Prefetch, Superfetch or Amcache, depending on the version of OS being analyzed. These are copies of executables or a register of executables that have run in the past. While this can be useful to find malware, a good technique to find credential misuse is to identify patterns of common administrative tools like net.exe, wmic.exe, cmd.exe, and powershell.exe. If you find executables like these ran in quick succession, it’s a good indicator that someone has used admin credentials to enumerate the internal network environment or conduct lateral movement.
- Manipulation of the Host OS. When an adversary is looking to maintain access to a system, one technique they use is to reduce the security posture of that system. For example, they might disable the endpoint security software, reduce/disable security logging, or even change remote authentication requirements to easily come back to that system at a later time. Hunt for non-compliant systems that don’t have your full security stack enabled as it might be a sign you have an unauthorized user with an all access pass. In addition, a sweep of systems looking at their earliest and last security log entry might find an outlier where logging has been tampered with.
- Outliers. Because beachheads and malicious user behavior is often aberrant and different from most of the network, identifying outliers is extremely effective in finding beachheads and malicious user behavior that evade automated or signature-based categorization. Data stacking techniques allow you to take a set of data, such as all running executables across every endpoint of a particular OS, and stack them to look for outliers that are unique or have a low occurrence rate. For example, if 900 Windows 7 systems have one version of iexplorer.exe, and one (1) wWndows 7 system has another that doesn’t match the same path or file hash, you should look into why the one is different than the others. Sorting subpages in access logs on a web server by least occurrence might show you that one IP accessing a malicious webshell on your site. Ultimately, persistent attackers prefer not to propagate through entire networks – they choose only one or two, so they can minimize exposure and remain hidden. Data stacking and outlier identification help us use this fact against them.
Automating the hunt for compromises
Ready to start hunting but overwhelmed by the skill or resources needed to start tackling this list? We don’t think relying solely on human detection is effective or scalable – some level of automation is required to hunt in an enterprise size network. Based on our in-depth experience as real-world hunters we learned that only way to detect hidden compromises is to use automation to create a repeatable process that can scale and keep ahead of growing threats. It’s this principle that lead us to create Infocyte HUNT.
The Infocyte HUNT platform uses an automated Forensic State Analysis (FSA) process to hunt for indications of compromise on hosts and provide definitive proof. It sweeps thousands of endpoints, spending a couple minutes on each host evaluating the entire state of the system, the operating system, and its’ processes to conclusively validate their state.
At the highest level, Infocyte HUNT digs deep into an endpoint to validate:
- What is actively running?
- What is triggered to run (through a persistence mechanism)?
- The integrity of the OS
In validating the integrity of the OS, Infocyte identifies many manipulations of the operating system (OS) and its’ processes, i.e., what a rootkit does to hide its presence, or what an insider threat might do to disable the system's security controls. This will reveal things like an OS configuration setting, or an API call being hooked by a rogue/hidden process within volatile memory, i.e., rootkit.
This is starkly different from the behavior analysis techniques used by Endpoint Detection and Response (EDR) or User Behavior Analytics (UBA) products - which only record/analyze the changes to a system or network as events, e.g., a new process spawning, a registry key change, or a user elevating privileges. FSA digs much deeper.
Perhaps the most important aspect of ensuring the state analysis of a compromised machine is successful is being able to bypass anti-forensics techniques. This is accomplished by going underneath higher-level Operating System APIs, and working directly with volatile memory structures - both of which Infocyte HUNT does.
With Infocyte HUNT’s FSA methodology you can iteratively and effectively sweep all endpoints to find entrenched threats and beachheads hiding on any of your endpoints so you can quickly close the door on them and reduce the overall impact on your business.