From SOC to Analyst: bridging automated and manual analyses - PowerPoint PPT Presentation

From SOC to Analyst: bridging automated and manual analyses Practical Considerations and Issues July, 10th 2017 Raphaël Rigo

Typical (ideal) workflow of a malware sample reverser binary SOC CERT “special” malware malware SOC Security Operations Center CERT Computer Emergency Response Team “Special” malware • Unknown, Targeted, Complex • Anything not handled automatically ? Our tools • Tools for automated malware analysis and triage, for SOC & CERT (bnew) • Tools for manual analysis by reverser – including our own, BinCAT R. Rigo :: From SOC to Analyst: bridging automated and manual analyses

Links to the seminar issues The end of the chain “When automated processing ends/fails/is not sufficient” Overall issue • Sometimes a human is needed • = ⇒ what be done to help the human be more efficient ? End goals for the analyst • IOCs • automated tools for families to integrate in the SOC chain: • static unpackers • config extractors R. Rigo :: From SOC to Analyst: bridging automated and manual analyses

Analyst view Which information from the automated process (SOC) can be presented to the analyst ? • generically unpacked sample • interesting code parts (in IDA) ? : • potential crypto loops (cf. IDAScope, crypton) • deobfuscated/decrypted strings • annotated trace (cf. pTra, MazeWalker) • visualization methods: bitmaps, dynamic graphs, etc. Helpful properties: • resolve indirect calls (C++ !) • dead code (no need to reverse) R. Rigo :: From SOC to Analyst: bridging automated and manual analyses

Challenges (helping the analyst) Special cases for “usual” malwares: • complex packers: VMProtect-ed packed samples • obfuscation Other complex (“unusal”) cases: • implants/rootkits (harder to analyse dynamically): • Secure boot bypass (SMM code ?) • jailbreaks • rootkits (drivers) • embedded/network devices exploits/implants • vulnerability and exploit analysis: • need to analyse complex software behaviour • understand vulnerability to create efficient signatures • all in memory code (no imports, everything dynamic) R. Rigo :: From SOC to Analyst: bridging automated and manual analyses

Room for improvements: tooling Manual reversing • interactive • integrated into IDA (for low level properties) • easy to install / use Ex: Ponce, IDAscope, BinCAT ;) For automated (static) handling • scriptable (of course) • versatile/expressive • OS agnostic Ex: Miasm R. Rigo :: From SOC to Analyst: bridging automated and manual analyses

BinCAT • demo • slides R. Rigo :: From SOC to Analyst: bridging automated and manual analyses