Instructor: Endpoint detection 2 2
and response configuration. 3 3
Now, like any other automated intrusion detection, 4 4
endpoint detection response requires tuning 5 5
to reduce your false positives 6 6
because these rules that we use can actually 7 7
start generating a lot of false positives for us. 8 8
And if they do, that starts distracting our analysts 9 9
and buries them in information, 10 10
so they can't identify what's real. 11 11
So one of the ways we can do this 12 12
is we can take something that we think is malware 13 13
and we can share it with other people in the community. 14 14
By working together with different community 15 15
and industry portals we can share that information 16 16
and that threat intelligence and we can 17 17
all learn from each other, this will help us 18 18
develop better signatures 19 19
and therefore, reduce our false positives. 20 20
One such tool is called VirusTotal. 21 21
Now, VirusTotal is going to inspect 22 22
your items with over 70 different antivirus scanners, 23 23
and URL and domain blacklisting services. 24 24
In addition to a myriad of other tools 25 25
they have to extract signals from the study content. 26 26
This allows VirusTotal to get more information 27 27
about more malware, and they share that 28 28
with all the different antivirus companies 29 29
so we can develop better signatures 30 30
and get them out to you faster. 31 31
Now, one note about VirusTotal, 32 32
before you upload a file there 33 33
you need to make sure your organization is okay with it. 34 34
The reason I say this is because if you have been infected 35 35
with malware and you take that and submit it 36 36
to VirusTotal to let the rest of the community know 37 37
the attackers also monitor VirusTotal. 38 38
And so, they would know that their malware is now known 39 39
and they might then change their techniques again. 40 40
And so, this is something you have to think about. 41 41
It's more of a risk versus reward. 42 42
But, in general, VirusTotal is a great thing to use 43 43
and it is free to be a part of their community, 44 44
and be able to submit things and get results back. 45 45
And this will help you figure out 46 46
if you have a piece of malware on your hands, 47 47
or if it's just a file that looks a little suspicious. 48 48
Now another thing you can do with your malware samples 49 49
is you can actually submit them to your antivirus company, 50 50
or your cyber threat intelligence vendor. 51 51
If you have a subscription with 52 52
a cyber threat intelligence vendor, like FireEye, 53 53
or Semantic, or Microsoft, or somebody like that 54 54
they would actually like you to send them their samples 55 55
because they can use that to build better rules 56 56
and protect you and their other customers better. 57 57
Now, your organization may also need to create 58 58
your own custom malware signature or detection rules. 59 59
Now, this is only done in very certain circumstances 60 60
and depending on the type of organization you work for. 61 61
Most organizations don't have to really get 62 62
too in depth in making custom signatures. 63 63
But depending on your use case, you may be asked to do this. 64 64
If you are, you need to be able to make 65 65
your signatures work with other programs though. 66 66
And to do this you can make sure 67 67
that you're using a certain scheme. 68 68
One of the most common ones out there 69 69
is Malware Attribute Enumeration and Characterization Scheme 70 70
or MAEC, as it's pronounced. 71 71
Now, MAEC is a standardized language 72 72
for sharing structured information about malware. 73 73
And it is complementary to STIX 74 74
and TAXII to improve the automated sharing 75 75
of threat intelligence between people. 76 76
So if your organization wants to share it 77 77
with somebody else, putting it in this format 78 78
is going to be a great thing to do 79 79
'cause both of you can talk in that same format 80 80
because it's using STIX and TAXII. 81 81
Now, another thing we can use is what's called Yara. 82 82
Now, Yara is a multi-platform program 83 83
that runs on Windows, Linux, and Mac OS X 84 84
and allows you to identify, classify 85 85
and describe malware samples. 86 86
Now, Yara creates these things called Yara rules. 87 87
And a Yara rule is a test for matching 88 88
certain string combinations within a given data source. 89 89
And that data source can be a binary file, 90 90
a log file, a packet capture, or even an email. 91 91
Now what you do is you create this rule 92 92
that looks something like this. 93 93
Here is a Yara rule set that was created 94 94
by somebody back in 2015, and you can see the format here. 95 95
The rule is called backdoor, and then it has some metadata, 96 96
a description about what it is, in this case, 97 97
an auto-generated rule called filebackdoor.exe. 98 98
It tells you who the author was. 99 99
In this case, it was an auto-generated rule by the software. 100 100
The reference was not set, that reference could be 101 101
something like a Mitre attack number. 102 102
And then, we have the date it was created 103 103
and the hash value for this rule. 104 104
That gives it the integrity to know nothing's been changed. 105 105
And then, you see all the different strings. 106 106
These are different strings that it's looking for. 107 107
Based on these strings, these are the things that it found 108 108
and it's going to use those to detect other copies 109 109
of this malware as it goes across the network 110 110
and as it goes through that data set. 111 111
This is how you generate a rule. 112 112
Now again, for the exam, you don't have 113 113
to write your own Yara rules. 114 114
I'm just showing this to you because this is 115 115
something you will use in the real world 116 116
when you do your threat hunting. 117 117
I have a lot of friends who still work 118 118
in the incident response and threat hunting world 119 119
and they use Yara a lot. 120 120
By creating these rules, they're able 121 121
to search for basically that needle 122 122
in a haystack of what they're looking for. 123 123
Most often, they'll set these up against a packet capture 124 124
because they'll have a network sniffer set up 125 125
like Security Onion, they'll be grabbing 126 126
all that data off the network and running it 127 127
through Yara to see if they're going to get 128 128
any hits on what they're looking for. 129 129
Particularly a piece of malware 130 130
to verify an infection has occurred.