Thanks for waiting, everybody. First off, really quick, this is a non-important warning. If you're an expert, just leave. Seriously, you're not going to offend me. Don't, you know, stay here.
Basically, what I want to talk about is data forensics, incident response, and open source
tools, or, excuse me, open source intelligence tools. And if you saw Rhett's talk, go eat
and bring me some beer or cider or something, because I'm pretty nervous standing up here
right now. And if you're a noob and you know it, clap your hands.
All right.
So, as I said, this talks about DFIR automation orchestration tools for open source intelligence
and reconnaissance. And since Jay Haddix had the slide of basically doing OSN like a boss
or something like that, I had to switch my slide. Didn't know that he actually had that,
so I switched it to collecting evidence like a robot.
Typical disclaimer. Opinions are mine or borrowed and may not represent my employer.
They're really just concepts.
And opinions are nothing more. I'm not a lawyer.
Who am I? Okay. So, my name is Tyler Rohrbaugh. I have 14 years in cyber. Yes. You know.
I said cyber. Primarily, my work's been in vendors, consulting, and contracting. And
I've tried stuff in a variety of different areas, but I'm not an expert in anything at
all. Okay.
So that's why I said.
If you're a noob, this is great for you, because I'm definitely a noob. This is also
my first talk. So.
Okay. So, if you guys have been in any of the other talk for OSN, there's
a lot of tools that exist. There's DataSploit and Tree.io, which was talked about. NetGlobe,
Recon, NG, Palantir, which is a very big one. But, you know, there's a lot of tools that
exist, but it's very expensive. Maltego, Hunchly, which I think is pretty new. And there's
a really cool website called Awesome OSN on GitHub, if you haven't already seen it. It's
pretty useful. It's got a lot of information. And then, from that standpoint, you can just
keep going and going and going. And part of this talk goes actually about that, is
that, from what I've seen about a lot of OSN gathering, you either have pen testing or,
like, human int or open source intelligence gathering for people and things like that.
And the thing is, is that some of it, there's a process, and some of it, there's not. I've
seen a lot of different talks. I've seen a lot of different people over the years talk
about things. And I'm really interested in feedback around a process. What I mean is
not just a manual step process, but is it possible to basically break this down into
a playbook or be able to do something where you can do this in a step-by-step process
that can be automated to some degree. And I'm not talking, like, use tool one, tool
two, tool three, tool four, et cetera. I'm talking be able to automate it, end to end,
and then basically break up in pieces where you can't actually automate it.
So, who in here knows much about data forensics? Anybody? Cool. Okay. So the reason why you
want to use data forensics instant response tactics for open source intelligence is it
allows you to understand and reduce your attack service. You can gain awareness of threat
actors.
Answer, answer, response to investigations.
Now, are you doing this today?
Just wondering.
Okay.
So that's what I said.
Experts, you know, just, you know, go ahead and bounce out.
Or you can just use it for fun.
And everybody's seen this.
Everybody's probably done this stuff.
But in my case, it was, you know, like getting to know your CEO.
And everybody's seen this kind of information.
That's actually my CEO for the company I work for.
And at the very last minute, I was told not to basically put his information out there,
which is understandable.
And a lot of other targets that I went to go after said the same thing.
So the next thing is something that's kind of interesting to me.
And I don't know how many of you think about this.
But when it comes to pen testing, it's one thing.
You go out and you start basically gathering.
And reconnaissance, you start gathering intel around a particular target.
And then after that, you start, you know, determining what kind of information you can use to exploit, et cetera, et cetera, et cetera.
But for me, the question is, if you're in OSN land and you started doing, gathering information about an individual,
and they were your friend or something like that, could you automate a way to respond to them and help them out?
And that may sound kind of weird.
But what I mean by that is to be able to say, hey, here's some information out there on you.
You might want to check that out.
And do that in a way that's, you know, basically do that in a way that allows them to kind of improve themselves or whatever, right?
So for me, I want to just point up a quick thing.
I want to compare the differences between attacking response and OSN.
So how many of you are basically do pen testing?
Okay.
Just got a handful.
How many of you are new to all of this?
Okay.
Cool.
All right.
Next slide.
How many of you, incident response, you're pretty much the only person to raise your hand for that part?
Okay.
So you'll obviously rip a hole through this next slide.
But basically, I kind of looked at it from a lot of different places.
I've studied CEH.
I've studied a bunch of different things.
And I wanted to put this into a process that kind of made sense that also seems that, like, everybody breaks it down into.
And so basically from an attacking side, you have planning and reconnaissance.
Threat modeling and vulnerability analysis, exploitation, and then you process that information.
You start to do lateral movement within a network, et cetera, et cetera, et cetera.
You persist, and then you report.
Okay.
Now, any pen testing people can clarify that's kind of summarized, right?
Okay.
From a response standpoint, you do the same kind of thing.
You start to plan or prepare.
You identify and you contain, and then you remediate, and then you recover, and then you basically learn and disseminate that information out to the team.
Does that sound about right?
Just curious?
Cool.
And OSN is kind of like that, right?
Plan, prepare, identify, and collect.
Process the information.
Do analysis on it.
Determine how you're going to deal with the production of that information, who you're going to give it to.
And, you know, learn and disseminate that information.
But it seems like everything's a five-step process.
What happened to 12 steps?
Does anybody have a beer?
I'm, like, really egging for one right now.
So why use a data forensic incident response automation orchestration tool?
Because it's built to gather evidence.
If you've used any kind of DFIR tool, they're really built around that.
It's case management.
It's built around gathering evidence.
Maltego does this, of course.
And it does it pretty well.
And the big guys like Palantir, I think, do that.
But the other thing that DFIR tools do really well...
...is they can integrate with a ton of shit out of the box.
That, to me, is really useful.
Unfortunately, for my demo, you're not going to see quite much for that at the moment.
But new tools can easily be added.
You can pull data from one place to another, which is pretty cool.
So you can ingest information into these new types of DFIR tools.
And then you can push into other systems from one centralized place.
A lot of the OSN tools, it's a lot about ingestion.
But it's not a lot about going out and doing anything after the fact.
And why else?
Because we need to automate or die, right?
There's no snake oil reason.
Well...
Because playbooks make it easy to automate.
How many of you know what a playbook is?
Okay, cool.
So you don't know much about data forensics and its response, but you know a lot about playbooks.
Hmm.
Okay.
Well, the next question it would be is...
You've seen a lot of these DFIR tools then, right?
So...
Obviously, there's Demisto.
That's who I work with.
There's the Hive project.
There's LogRhythm.
The Hive project's also open source.
Demisto's product line is partially open source.
Their content's open source.
There's Phantom.
And they're, I believe...
Some of their stuff's open source as well.
There's Swimlane, Resolent, Simplify, CyberTourage, and Command, I think, just got acquired not too long ago by Rapid7.
So that might be something to check out, too.
All of those have automation frameworks built in.
And most of them are in Python or JavaScript and allow you to kind of start gluing in all of these tools right in the frameworks.
Or, excuse me, into their ecosystem and things like that.
So, I have a question for everybody here.
This...
I'm trying to really make this a little bit more...
More interactive.
What is the standard of building a playbook?
Does anybody here know?
So, everybody's heard of playbooks.
They've seen them.
Everybody knows what a playbook is.
But has anybody here heard of the standard?
Well, I actually found one.
There is a standard.
The ICD standard says...
And this is from, like, John Hopkins University or some shit.
Oh.
Has anybody in the room ever read, like, incident response policies?
It's more legal-speak than it is actually what you need to do.
And that's kind of what this standard says.
And I'm not trying to diss on it or anything like that.
Yes, I said diss.
I'm that day and age.
But basically, when I look at that, I was like, this is really academic for really explaining what a playbook does.
Because it's really just a step-by-step process to glue shit together.
Okay?
That's it.
So, the thing is...
The thing is that when you have...
Like, Maltego has transformations.
But can you glue those together, you know, from end to end is what I'm asking here.
Can you actually take Maltego transformations?
Or can you take, like, Palantir?
I've seen it.
I've played with it.
But I don't know it well enough to know.
Can you glue, you know, tasks together from that and take the information and start to do things with it?
Is that something that's possible?
I don't know.
So, that's kind of what I'm asking.
So, this is an example of a playbook.
And it's not...
This is in a graphical form.
You could write it down.
An incident response plan should be written down.
And you should have several of them.
I've actually gone out and written some.
Embarrassingly enough.
And the thing is, is that some of those plans are not specific enough to what you really need to do.
Okay?
So, I mean, for example, how exhaustive are your incident response...
Excuse me.
Your incident response plans today?
Are they pretty exhaustive?
Are they book deep and they explain, okay, for example, if something happens, social media started going out,
what you're supposed to do about that?
Or do they just really say, well, contact Joe?
Or contact Bob?
Or contact Lacey?
Or anything like that?
Is that kind of what you hear or see?
Anybody?
Okay.
Well, before we begin, and like I said, I've got some bugs.
That's going on right now.
I had to reboot a server.
So I'm just going to show you kind of the process and the tool a little bit.
And then what I will do after this is I'll make a video or I'll get a team of people to make me, you know, basically make a video of the process that I want to go through.
And the other thing that I'm trying to do is really go back to the community and gain process information for different strategies that they would use for OSN gathering of information.
Okay?
That's kind of why I'm here.
What I'm here to do is kind of explain.
Okay, you have playbooks.
Everybody understands them.
Maybe I'm a noob and I just don't know.
And that's certainly possible.
But what I'd like to see is ways, a process to go through that says, okay, here's what you can do.
And I want to build that out so that I can automate that from multiple different tools that are out there.
And if you've seen, like, Intrigue.
Intrigue is a great tool.
It has a lot of different integrations.
Maltego's got a lot of different integrations.
But what I want to see is playbooks.
It's on how to actually use those integrations.
And for me, I have ideas, but I'm going to start pulling people on both sides, from the pen testing side, from the data forensics incident response community, and from the open source intelligence community, and start to actually gather information around those playbooks.
Because to me, that allows you to automate things end to end, or at least to the point where a person gets information not just in one place, but is able to take action on it.
I think that's something.
I think that's something with OSN data.
It's like, well, you create a report, and you just hand it to somebody.
I don't know.
That's kind of what I've seen.
So before we get started, let's ask a couple basic questions.
And the reason I said this is for noobs and stuff is because, for me, I've gone through a lot of online stuff.
I've gone through a lot of reading and things like that.
And I was like, okay, I need to kind of process this in a way that I can kind of break it down to my simple terms.
I'm like Forrest Gump.
Slow.
So I have to break things down really slowly, right?
So planning.
The big thing is you want to start out and you want to ask the question of is, do we have a plan, purpose, or target?
Now, out of all the talks I've seen in general and books I've read and things like that, there seems to be a lot of bouncing around when it comes to having a plan for the purpose of what you're trying to do with a target.
Unless you have a mission or goal.
Or what you're trying to do with the information.
And so that, to me, is something that's like, okay, having an idea for what you're going to do with the information, I think, is much bigger than what you're trying to target or what the purpose is of what you're trying to target, if that makes any bit of sense.
Then you want to identify what kind of information are we going to collect, like I said.
What's the kind of information you want to go for?
Is this ethical or legal?
As you can see, I've got a really big flaw in my slide there.
And how we're going to process the information and what tools.
Who can collaborate and do analysis with you on it?
And so this is a big piece of why I'm trying to show you this type of tool that does data forensics and answer response for OSN is because, has anybody here done OSN on CTF and things like that?
Basically.
How do you collaborate today, right now?
Do you use any kind of tool right now to collaborate, like Slack, for the CTFs or anything like that?
Okay, so if you use Slack, then this is kind of a quick demo, okay?
How long do we have to investigate?
Well, I have about five minutes, so I've got to hurry.
And I'm going to show you a quick example demo, okay?
So, this is the tool of the company I work for.
It's called DEMISTO.
And if you want a really fun project, you can go to DEMISTO.com.
There's a little tiny QR code over there in the left-hand corner that would be kind of cool to take home and look at.
It's a nice open source intelligence, you know, fun thing to do.
Anyway, so the way this tool works is it has integrations and everything is pretty much command line driven or it's driven by playbooks.
And a simple playbook, like I was trying to show, is, if I can get the load.
And this code is going to be input.
Well, basically, let me see if I can get any of these to load.
On the outside, you see here, you have settings, automations, playbooks, indicators, reports, dashboards, jobs, incidents.
And what ends up happening?
And as you go through and you create a new incident,
you start to associate it to a playbook.
And from that point, then, what happens is
it allows you to assign that incident to somebody,
just like a data forensic incident response tool does today,
allows you to assign a case to somebody,
or like if it was a JIRA ticket,
or if it was a different type of ticketing system
or case management system.
From that point, though, what's neat about this tool,
it's not loading at the moment,
but is that you can go and actually, from the incident,
you can start to invite people in
and collaborate on a goal or a mission
or on a particular topic
or the type of target that you're trying to go after.
I'm sorry, I don't have a connection at the moment.
Well, that's it, right?
I mean, that's pretty much all I've got.
So what I will tell you is this.
If you want to check the tool out,
you can go on demisto.com.
It's free.
It's downloadable.
The content's open source.
And from there, you can start to look at,
there's a ton of videos out there online about this.
And I'll put together a video that'll show
actually a full demonstration end-to-end
of how to use this for open source intelligence.
Does that sound reasonable?
Yeah, it's called demisto, D-E-M-I-S-T-O.com.
We also have a community
for about 1,400 different data forensics
and incident response people today on Slack.
And if anybody wants to connect with me afterwards,
just let me know, and I'll get you a free copy
and all that stuff and set up.
But I do want to show a video of this,
and I'm sorry that it's not,
you know, I'm not able to connect right now at this moment.
But that's it.
That's all I have.
Thank you.
Thank you.
Thank you.
Thank you.
Thank you.
Thank you.
Thank you.
Wait for the package to come.