when threat hunting fails
play

When threat hunting fails Identifying malvertising domains using - PowerPoint PPT Presentation

Jun 29, 2023 •247 likes •717 views

When threat hunting fails Identifying malvertising domains using lexical clustering Tucson, January 9th, 2018 Authors kitty Matt Foley David Rodriguez Dhia Mahjoub 2 Background Ad Network Profiling and Filtering Agenda Lexical Clustering

  1. When threat hunting fails Identifying malvertising domains using lexical clustering Tucson, January 9th, 2018

  2. Authors kitty Matt Foley David Rodriguez Dhia Mahjoub 2

  3. Background Ad Network Profiling and Filtering Agenda Lexical Clustering Hosting space and top talkers 3

  4. Background 4

  5. Exploit Kits Compromised Site Compromised Site Step 1. Gets lander (proxy) EK Server Malvertising Victim Ad Net. Publisher Staged Site (Ad) 5

  6. What is Malvertising Ad Networks Ad Exchanges DSPs Visitors Ad Agencies Publishers Ad Servers 6

  7. 7

  8. Ad Campaign Flow User visits publisher site Publisher Site Publisher site includes ad network javascript Compromised Ad Net. Compromised Ad Net. Examples: Tech support scam Rig Exploit Kit Fake flash/java update Ad network fingerprints and sends user to malvertisement 8

  9. Exploit Kits 9

  10. Tech Support Scams 10

  11. Fake Flash and Java Updates 11

  12. Ad Network Profiling and Filtering 12

  13. Filtering on non-residential IP Address 13

  14. Proxy Network 403 Squid Proxy Choice of region Rotating IPs 14

  15. Filtering on non-residential IP Address 403 GET Ad Network Returns a 403 Browsing with Ad Network DigitalOcean proxy 15

  16. Attempts with other VPS providers 16

  17. Attempts with other VPS providers 17

  18. 18

  19. 19

  20. Lexical Clustering 20

  21. Attention to Details 21

  22. Fake Flash and Java Updates 22

  23. 23

  24. More or Less Traveled Roads 24

  25. Consider the almighty RegeX Keywords safe content build free apple click Synonyms Typos Known UnKnown Keywords Keywords 25

  26. Consider the almighty RegeX grep “*.fake.*” 26

  27. Traffic Pattern of Fake Update Sites 27

  28. Traffic Pattern of Fake Update Sites Look for burst in traffic 28

  29. For one word, many 29

  30. Shingling Fake Flash and Java Update Trigram host name contentfreeandsafe4update {‘con’, ‘ont’, ‘nte’, ‘ten’, ‘ent’, …, ‘ate’} 30

  31. Shingling Fake Flash and Java Update Trigram host name contentfreeandsafe4update {‘con’, ‘ont’, ‘nte’, ‘ten’, ‘ent’, …, ‘ate’} MinHash LSH 31

  32. Locality Sensitive Hashing Fake Flash contentfreeandsafe4update contentfreeandforupdate 3 Domains with a lot of shingles in common content4freeandsafeupdate con tent fre and saf dat 32

  33. On to production 33

  34. Clustering Pipeline Realtime/Batch Count min-sketch Out pipeline hasher pipeline goodnewcontentssafe.download Cluster DB Analyst Dashboard 34

  35. Payday 35

  36. Fake Flash and Java Update Lexical Clustering cluster_1: cluster_2: goodnewcontentssafe.download call-mlcrosoftnw-err81711102.win goodnewfreecontentsload.date call-mlcrosoftnw-err99817109.win goodnewfreecontentall.trade call-mlcrosoftnw-err81711101.win ... ... cluster_3: cluster_4: artificialintelligencesweden.se mkto-sj220048.com artificialintelligencechip.com mkto-sj220146.com artificialintelligence.net.cm mkto-sj220162.com ... ... 36

  37. We need help 37

  38. Simple Flask App Dashboard 38

  39. Hosting space and top talkers 39

  40. Where are these hosted? Any patterns? ● Take 1 week’s worth of detections and their hosting space; Jan 1-7 ● Some hosters are consistently abused AS12876, FR AS14618 Amazon AWS and more Some IPs are actively hosting thousands of domains for months ● Some hosters are highly infested with shady, toxic content; dedicated? AS202023, LLHOST, RO; phishing, tech support scams, fake updates, porn 40

  41. Who is querying these domains? ● Take 1 week’s worth of detections; Jan 1-7 and user IPs ● 10 busiest hours 20000+ user IPs querying 2000+ malvertising domains ● Some top talker clusters emerge Security companies owned ranges querying hundreds of domains Some rogue networks querying hundreds of domains 41

  42. Summary 42

  43. grep “*.fake.*” Look for burst in traffic user IPs hosting IPs 43

  44. Current and NLP on misspellings and common typos Models to categorize clusters Future Work Identifying malicious file hosts using belief propagation 44

  45. Thank you Matt Foley, matfoley@cisco.com David Rodriguez, davrodr3@cisco.com Questions? Dhia Mahjoub, dmahjoub@cisco.com We are hiring 45

Recommend

What The HELK? Enabling Graph Analytics for Effective Threat Hunting HELK THP OSSEM Agenda

What The HELK? Enabling Graph Analytics for Effective Threat Hunting HELK THP OSSEM Agenda

What The HELK? Enabling Graph Analytics for Effective Threat Hunting HELK THP OSSEM Agenda Effective Threat Hunting? Current state of threat hunting programs Graph Theory Definition Origins Types Graph

1.69k views • 75 slides
The New Security Frontier: Threat Hunting, Augmented Intelligence, and Automated Response

The New Security Frontier: Threat Hunting, Augmented Intelligence, and Automated Response

The New Security Frontier: Threat Hunting, Augmented Intelligence, and Automated Response Michael Melore, CISSP IBM Cyber Security Advisor @MichaelMelore June 2018 May 2018 May 2018 Threat Hunting Workflow Cognitive Advanced Analytics

443 views • 15 slides
MRO Security Advisory Council (SAC) Webinar One Companys Path to Establishing Threat

MRO Security Advisory Council (SAC) Webinar One Companys Path to Establishing Threat

MRO Security Advisory Council (SAC) Webinar One Companys Path to Establishing Threat Intelligence and Hunting Jamie Buening, Manager, Threat Intelligence and Hunting, MISO August 21, 2019 MRO SAC Update Technical Training and Social

478 views • 45 slides
Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss

Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss

Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss Post CERT Botconf 2016 | Advanced Incident Detection and Threat Hunting using Sysmon and Splunk | Tom Ueltschi | TLP-WHITE Seite 1 C:\> whoami /all

1.34k views • 115 slides
Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss

Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss

Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss Post CERT FIRST-TC 2018 | Advanced Incident Detection and Threat Hunting using Sysmon and Splunk | Tom Ueltschi | TLP-WHITE Seite 1 C:\> whoami

1.73k views • 128 slides
Bridging Security In Intelligence: Hacking, g, Threat Hunting, g, AI, I, Behavioral Anomalies,

Bridging Security In Intelligence: Hacking, g, Threat Hunting, g, AI, I, Behavioral Anomalies,

Bridging Security In Intelligence: Hacking, g, Threat Hunting, g, AI, I, Behavioral Anomalies, and In Incident Response Dangerous Toys USB Device Impersonators USB Killers Man in the Middle Faceplates Wireless Pineapples Payload Phone

727 views • 30 slides
DNS-BASED THREAT HUNTING: learn, share and improve. repeat. Joo Collier de Mendona @sec_joao

DNS-BASED THREAT HUNTING: learn, share and improve. repeat. Joo Collier de Mendona @sec_joao

TLP WHITE DNS-BASED THREAT HUNTING: learn, share and improve. repeat. Joo Collier de Mendona @sec_joao Zurich, September 2016. $ whoami Brazilian living in Germany for a long time Since 2010 at Deutsche Telekom CERT / CDC

643 views • 27 slides
OSINT: The Secret Weapon in Hunting Nation-State Campaigns alon@intsights.com Alon Arvatz

OSINT: The Secret Weapon in Hunting Nation-State Campaigns alon@intsights.com Alon Arvatz

DETECT . ANALYZE . REMEDIATE OSINT: The Secret Weapon in Hunting Nation-State Campaigns alon@intsights.com Alon Arvatz +972-545444313 1 1 1 What People Think 2 True or False? Threat intelligence Nation-state actors Commercial threat

247 views • 24 slides
Hunting Manufactures and distributes products that enable the extraction of oil and gas Hunting

Hunting Manufactures and distributes products that enable the extraction of oil and gas Hunting

Hunting Manufactures and distributes products that enable the extraction of oil and gas Hunting PLC Global Footprint 2 2009 Corporate Highlights Completed three acquisitions 47.3m Sale of Hunting Energy France 11.1m Year end

857 views • 37 slides
Cyber Security, Threat Hunting and Defense Challenge in Taiwan Academic Network NCHC/TWCSIRT

Cyber Security, Threat Hunting and Defense Challenge in Taiwan Academic Network NCHC/TWCSIRT

Cyber Security, Threat Hunting and Defense Challenge in Taiwan Academic Network NCHC/TWCSIRT Research Fellow Yi-Lang Tsai 1 Google Me. Yi-Lang Tsai ( ) Research Fellow , NCHC (National Center for High-performance

781 views • 49 slides
DESIGN, SIMULATIONS AND ANALYSIS OF AN AIR LAUNCH ROCKET FOR HUNTING LOW EARTH ORBIT'S SPACE

DESIGN, SIMULATIONS AND ANALYSIS OF AN AIR LAUNCH ROCKET FOR HUNTING LOW EARTH ORBIT'S SPACE

DESIGN, SIMULATIONS AND ANALYSIS OF AN AIR LAUNCH ROCKET FOR HUNTING LOW EARTH ORBIT'S SPACE DEBRIS HAMED GAMAL MOHAMED G. ABDELHADY Contents A concept for hunting unburnt space debris 1. Space Debris and the major threat of unburnt debris

294 views • 28 slides
Community benefits from trophy hunting: realities vs pretence by Dr Louise de Waal - EMS

Community benefits from trophy hunting: realities vs pretence by Dr Louise de Waal - EMS

Community benefits from trophy hunting: realities vs pretence by Dr Louise de Waal - EMS Foundation Slide 2 It is generally accepted that the greatest threat to wildlife and nature conservation is the ever- increasing footprint of the human

428 views • 10 slides
Waterfowl Hunting for Beginners by John Martsh R-3 Program Manager Hunting Techniques: Spot and

Waterfowl Hunting for Beginners by John Martsh R-3 Program Manager Hunting Techniques: Spot and

Waterfowl Hunting for Beginners by John Martsh R-3 Program Manager Hunting Techniques: Spot and Stalk Hunting Techniques: Decoying Hunting Techniques: Pass Shooting Gauge Sizes Choke extracted from muzzle Choke lengths and wall diameters

783 views • 29 slides
Hunting and detecting APTs using Sysmon and PowerShell logging TOM UELTSCHI BOTCONF 2018 C:>

Hunting and detecting APTs using Sysmon and PowerShell logging TOM UELTSCHI BOTCONF 2018 C:>

Hunting and detecting APTs using Sysmon and PowerShell logging TOM UELTSCHI BOTCONF 2018 C:> whoami /all Tom Ueltschi Swiss Post CERT / SOC / CSIRT since 2007 (over 11 years!) Focus & Interests: Malware Analysis, Threat Intel,

1.45k views • 115 slides
Assessment What is Threat Assessment Threat assessment is the process of gathering

Assessment What is Threat Assessment Threat assessment is the process of gathering

Threat Assessment What is Threat Assessment Threat assessment is the process of gathering information to understand the threat of violence posed by a person. Threat management is the process of developing and executing plans to mitigate

332 views • 15 slides
THE LEGALITY OF TIGER FARMING, TROPHY HUNTING AND CANNED HUNTING UNDER INTERNATIONAL LAW Cecil

THE LEGALITY OF TIGER FARMING, TROPHY HUNTING AND CANNED HUNTING UNDER INTERNATIONAL LAW Cecil

THE LEGALITY OF TIGER FARMING, TROPHY HUNTING AND CANNED HUNTING UNDER INTERNATIONAL LAW Cecil the Lion, Hwange National Park, Zimbabwe, 2013 Yann Prisner-Levyne WILD FAUNA= NATURAL RESOURCES UNDER INTERNATIONAL LAW Principle of permanent

400 views • 21 slides
Indigenous Hunting Rights in British Columbia By: Liam Robertson Broken Down Firearm

Indigenous Hunting Rights in British Columbia By: Liam Robertson Broken Down Firearm

Indigenous Hunting Rights in British Columbia By: Liam Robertson Broken Down Firearm Licensing (Briefly) Hunting on Traditional Territory Hunting off Traditional Territory Applying for a FWID and BCEID Metis Hunting in BC

377 views • 13 slides
10 Reasons Why Compliance Fails Sinead OConnor www.aicp.im Ten reasons why compliance fails

10 Reasons Why Compliance Fails Sinead OConnor www.aicp.im Ten reasons why compliance fails

10 Reasons Why Compliance Fails Sinead OConnor www.aicp.im Ten reasons why compliance fails Sinead OConnor Head of Regulatory & Compliance services Lack of leadership Compliance comply dont they? What do the rules actually

482 views • 13 slides
Phases of Disaster Despair Threat Threat Phase: Small events serve as a warning or threat to

Phases of Disaster Despair Threat Threat Phase: Small events serve as a warning or threat to

Honeymoon Threat Restoration Rescue Phases of Disaster Despair Threat Threat Phase: Small events serve as a warning or threat to normal living. A disaster has not yet oc- curred, but there is a sense of impending doom. Individual

604 views • 6 slides
Partridge driven hunt El Vedat The hunting territory: It is in the middle of Anoia, in

Partridge driven hunt El Vedat The hunting territory: It is in the middle of Anoia, in

TABAKOV TROPHY HUNTING Partridge driven hunt El Vedat The hunting territory: It is in the middle of Anoia, in Catalonia that the hunting area of El Vedat is situated, only 45mn of Barcelona. The territory extends on more than 3000 ha of

385 views • 10 slides
What Does This Advanced Threat Landscape Look Like? Advanced Threat Landscape

What Does This Advanced Threat Landscape Look Like? Advanced Threat Landscape

DDoS & Modern Threat Motives Dan Holden Director, ASERT What Does This Advanced Threat Landscape Look Like? Advanced Threat Landscape Geo-poli:cal More defenses ? App/Content t a

1.13k views • 44 slides
Riflescopes for Long-range Hunting March, 2020 LONG-RANGE HUNTING Rapidly gaining in

Riflescopes for Long-range Hunting March, 2020 LONG-RANGE HUNTING Rapidly gaining in

Riflescopes for Long-range Hunting March, 2020 LONG-RANGE HUNTING Rapidly gaining in popularity; Several Youtube channels (THLR.NO, EuLRH) have attracted a considerable number of followers; A riflescope is a must-have ; Often

649 views • 11 slides
Communities under Threat Dr Marjorie Jobson Khulumani Support Group The Story of South Africa

Communities under Threat Dr Marjorie Jobson Khulumani Support Group The Story of South Africa

Crime in Post Apartheid South Africa: Communities under Threat Dr Marjorie Jobson Khulumani Support Group The Story of South Africa A story of more of less organised brutality and disastrous social divisions from the time of the hunting

327 views • 32 slides
Angled Spotting Scopes March, 2020 ANGLED SPOTTING SCOPES FOR HUNTING Appropriate for hunting

Angled Spotting Scopes March, 2020 ANGLED SPOTTING SCOPES FOR HUNTING Appropriate for hunting

Angled Spotting Scopes March, 2020 ANGLED SPOTTING SCOPES FOR HUNTING Appropriate for hunting in the mountains No need to overstretch the neck while using it Can be used without a tripod The user simply puts the scope on the top of

229 views • 9 slides

More recommend