1
00:00:00,880 --> 00:00:04,240
hi this is project obsidian threat

2
00:00:04,240 --> 00:00:07,279
hunting kill chain three

3
00:00:07,279 --> 00:00:11,280
the logs are gone

4
00:00:11,440 --> 00:00:12,559
who am i

5
00:00:12,559 --> 00:00:15,040
i'm extreme paper clip

6
00:00:15,040 --> 00:00:18,240
digital forensics nerd linux geek

7
00:00:18,240 --> 00:00:20,160
infosec engineer

8
00:00:20,160 --> 00:00:23,439
lifelong student of everything

9
00:00:23,439 --> 00:00:27,840
amateur history buff spice fanatic

10
00:00:27,840 --> 00:00:31,840
loads of fun

11
00:00:32,238 --> 00:00:33,760
here are the things we're going to go

12
00:00:33,760 --> 00:00:34,559
over

13
00:00:34,559 --> 00:00:36,880
we're going to go over how to develop a

14
00:00:36,880 --> 00:00:39,760
threat hunting hypothesis

15
00:00:39,760 --> 00:00:41,760
sources we could use for developing a

16
00:00:41,760 --> 00:00:44,480
threat hunting hypothesis

17
00:00:44,480 --> 00:00:45,680
research

18
00:00:45,680 --> 00:00:48,399
the methods attackers use to clear the

19
00:00:48,399 --> 00:00:50,559
windows event logs

20
00:00:50,559 --> 00:00:53,199
we're going to find data sources we need

21
00:00:53,199 --> 00:00:56,079
for a threat hunting hypothesis

22
00:00:56,079 --> 00:00:58,239
and we'll find evidence of an attacker

23
00:00:58,239 --> 00:01:00,239
clearing the logs

24
00:01:00,239 --> 00:01:03,039
and we'll answer the how of our

25
00:01:03,039 --> 00:01:04,799
hypothesis

26
00:01:04,799 --> 00:01:06,799
and finally we'll

27
00:01:06,799 --> 00:01:08,720
we'll go over how to document your

28
00:01:08,720 --> 00:01:13,760
threat hunting using a simple template

29
00:01:13,760 --> 00:01:16,159
okay a quick note

30
00:01:16,159 --> 00:01:17,280
about

31
00:01:17,280 --> 00:01:20,159
note taking

32
00:01:20,159 --> 00:01:22,000
pro tip

33
00:01:22,000 --> 00:01:24,240
during and throughout the threat hunting

34
00:01:24,240 --> 00:01:27,600
process one should take good notes

35
00:01:27,600 --> 00:01:29,520
these notes will be very useful

36
00:01:29,520 --> 00:01:31,200
throughout the engagement

37
00:01:31,200 --> 00:01:33,280
several times throughout this exercise

38
00:01:33,280 --> 00:01:35,520
i'll be sure to mention that

39
00:01:35,520 --> 00:01:38,720
some fact or discovery we find should be

40
00:01:38,720 --> 00:01:40,720
added to the notes

41
00:01:40,720 --> 00:01:41,920
this is

42
00:01:41,920 --> 00:01:45,040
generally a good habit to embrace in the

43
00:01:45,040 --> 00:01:48,640
world of information security

44
00:01:48,880 --> 00:01:52,960
okay so what is thread hunting

45
00:01:52,960 --> 00:01:54,560
many people have their own

46
00:01:54,560 --> 00:01:56,799
interpretations and definitions of this

47
00:01:56,799 --> 00:01:57,600
but

48
00:01:57,600 --> 00:02:01,520
we could say threat hunting is

49
00:02:01,520 --> 00:02:04,000
the proactive practice

50
00:02:04,000 --> 00:02:05,840
of discovery

51
00:02:05,840 --> 00:02:06,840
in

52
00:02:06,840 --> 00:02:08,399
data

53
00:02:08,399 --> 00:02:10,639
and it allows you to

54
00:02:10,639 --> 00:02:12,080
discover

55
00:02:12,080 --> 00:02:15,680
and uncover not only malicious activity

56
00:02:15,680 --> 00:02:16,400
but

57
00:02:16,400 --> 00:02:17,840
new risks

58
00:02:17,840 --> 00:02:19,760
detection methods

59
00:02:19,760 --> 00:02:22,239
or even visibility gaps that your

60
00:02:22,239 --> 00:02:27,760
organization was previously unaware of

61
00:02:28,400 --> 00:02:31,360
so question

62
00:02:31,680 --> 00:02:33,840
what guides the development of a

63
00:02:33,840 --> 00:02:36,400
hypothesis for the purpose of threat

64
00:02:36,400 --> 00:02:38,879
hunting

65
00:02:40,160 --> 00:02:42,239
here are some things to consider and

66
00:02:42,239 --> 00:02:43,680
take note of

67
00:02:43,680 --> 00:02:45,040
when building a threat hunting

68
00:02:45,040 --> 00:02:46,720
hypothesis

69
00:02:46,720 --> 00:02:48,879
the i.t environment

70
00:02:48,879 --> 00:02:50,560
what are the operating systems in the

71
00:02:50,560 --> 00:02:53,920
environment windows linux mac

72
00:02:53,920 --> 00:02:56,400
does the org have

73
00:02:56,400 --> 00:02:58,480
active directory

74
00:02:58,480 --> 00:03:00,319
what data gets logged

75
00:03:00,319 --> 00:03:02,000
windows event

76
00:03:02,000 --> 00:03:05,360
sysmon zeke

77
00:03:06,159 --> 00:03:07,280
also

78
00:03:07,280 --> 00:03:09,680
vulnerabilities does the organization

79
00:03:09,680 --> 00:03:12,959
perform vulnerability scans

80
00:03:12,959 --> 00:03:14,159
if so

81
00:03:14,159 --> 00:03:16,840
are the vulnerabilities analyzed and

82
00:03:16,840 --> 00:03:19,040
remediated are there outstanding

83
00:03:19,040 --> 00:03:20,720
vulnerabilities that still need to be

84
00:03:20,720 --> 00:03:23,359
remediated

85
00:03:24,159 --> 00:03:26,879
the mitre attack framework

86
00:03:26,879 --> 00:03:29,440
offers a wealth of great information

87
00:03:29,440 --> 00:03:31,120
that can help build a threat hunting

88
00:03:31,120 --> 00:03:32,879
hypothesis

89
00:03:32,879 --> 00:03:34,480
so

90
00:03:34,480 --> 00:03:36,480
take some time to look at the

91
00:03:36,480 --> 00:03:38,319
enterprise matrix

92
00:03:38,319 --> 00:03:40,879
and within each of the tactics are

93
00:03:40,879 --> 00:03:43,840
techniques that attackers use

94
00:03:43,840 --> 00:03:45,440
these techniques

95
00:03:45,440 --> 00:03:47,599
can be used to help inspire your threat

96
00:03:47,599 --> 00:03:50,640
hunting adventures

97
00:03:50,640 --> 00:03:52,560
also

98
00:03:52,560 --> 00:03:56,319
what can your users employees co-workers

99
00:03:56,319 --> 00:03:58,560
tell you about things they have seen in

100
00:03:58,560 --> 00:04:02,080
the environment and for the notes

101
00:04:02,080 --> 00:04:05,200
as the threat hunter we would add all of

102
00:04:05,200 --> 00:04:10,000
these sources to our notes and continue

103
00:04:10,560 --> 00:04:12,959
okay in this scenario

104
00:04:12,959 --> 00:04:16,000
we will consider the question

105
00:04:16,000 --> 00:04:17,600
what happens

106
00:04:17,600 --> 00:04:20,478
when an attacker clears the logs

107
00:04:20,478 --> 00:04:23,919
in an effort to hide their tracks

108
00:04:23,919 --> 00:04:26,160
so we should start with a very

109
00:04:26,160 --> 00:04:28,800
broad hypothesis

110
00:04:28,800 --> 00:04:31,280
let's focus on that middle section of

111
00:04:31,280 --> 00:04:34,080
that question

112
00:04:34,320 --> 00:04:38,000
attacker clears the logs

113
00:04:38,000 --> 00:04:40,880
focusing on that we could make a broad

114
00:04:40,880 --> 00:04:44,080
hypothesis like

115
00:04:44,080 --> 00:04:49,520
attackers will try to cover their tracks

116
00:04:49,520 --> 00:04:52,400
this hypothesis is broad

117
00:04:52,400 --> 00:04:55,199
it only addresses the who and the what

118
00:04:55,199 --> 00:04:57,280
but not the how

119
00:04:57,280 --> 00:04:58,400
so

120
00:04:58,400 --> 00:05:01,280
for the notes as the threat hunter you

121
00:05:01,280 --> 00:05:04,320
would add your broad hypothesis here to

122
00:05:04,320 --> 00:05:07,759
your notes and continue

123
00:05:08,880 --> 00:05:11,680
so how can we develop this further into

124
00:05:11,680 --> 00:05:16,800
a specific hypothesis for our hunt

125
00:05:18,639 --> 00:05:20,160
well

126
00:05:20,160 --> 00:05:22,560
looking at our notes

127
00:05:22,560 --> 00:05:24,880
we see that

128
00:05:24,880 --> 00:05:27,280
the mitre attack framework was listed as

129
00:05:27,280 --> 00:05:29,440
one of the things we could use to help

130
00:05:29,440 --> 00:05:32,479
build a threat hunting hypothesis

131
00:05:32,479 --> 00:05:33,520
and

132
00:05:33,520 --> 00:05:36,000
how would we do that

133
00:05:36,000 --> 00:05:39,199
well a quick google search for

134
00:05:39,199 --> 00:05:43,680
mitre attack attacker covering tracks

135
00:05:43,680 --> 00:05:45,520
brings us to the following mitre attack

136
00:05:45,520 --> 00:05:47,440
page

137
00:05:47,440 --> 00:05:50,320
indicator removal on host

138
00:05:50,320 --> 00:05:55,000
technique id t1070

139
00:05:55,280 --> 00:05:57,520
let's follow that link and

140
00:05:57,520 --> 00:06:01,680
read what mitre attack says about this

141
00:06:02,400 --> 00:06:04,000
and remember in our scenario we're

142
00:06:04,000 --> 00:06:07,039
looking for information about windows

143
00:06:07,039 --> 00:06:10,560
event logs being cleared

144
00:06:10,560 --> 00:06:12,639
we can clearly see something more

145
00:06:12,639 --> 00:06:14,720
relevant to our scenario in the sub

146
00:06:14,720 --> 00:06:18,160
technique listed above it's the

147
00:06:18,160 --> 00:06:21,160
t107

148
00:06:22,319 --> 00:06:25,360
clear windows event logs

149
00:06:25,360 --> 00:06:26,960
so let's take a look at the details of

150
00:06:26,960 --> 00:06:30,318
this sub technique

151
00:06:32,160 --> 00:06:34,800
here we can see the details of the miter

152
00:06:34,800 --> 00:06:37,840
attack sub technique clear windows event

153
00:06:37,840 --> 00:06:39,520
logs

154
00:06:39,520 --> 00:06:43,039
now note the methods listed here

155
00:06:43,039 --> 00:06:45,199
windows commands

156
00:06:45,199 --> 00:06:46,840
using

157
00:06:46,840 --> 00:06:51,520
wevt util cl commands

158
00:06:51,520 --> 00:06:54,720
uh let's see there's also the event

159
00:06:54,720 --> 00:06:56,639
viewer gui

160
00:06:56,639 --> 00:06:59,280
and powershell

161
00:06:59,280 --> 00:07:02,479
so for our notes as the threat hunter we

162
00:07:02,479 --> 00:07:04,560
would add the above mitre attack

163
00:07:04,560 --> 00:07:07,759
technique the sub technique

164
00:07:07,759 --> 00:07:11,120
the attack methods listed and any source

165
00:07:11,120 --> 00:07:13,759
urls we would add this to our notes and

166
00:07:13,759 --> 00:07:16,759
continue

167
00:07:18,880 --> 00:07:20,880
using the info from

168
00:07:20,880 --> 00:07:23,280
the mitre attack sub technique that we

169
00:07:23,280 --> 00:07:25,440
just saw about the

170
00:07:25,440 --> 00:07:26,639
specific

171
00:07:26,639 --> 00:07:28,560
methods attackers will use to cover

172
00:07:28,560 --> 00:07:31,120
their tracks we can update our threat

173
00:07:31,120 --> 00:07:34,319
hunting hypothesis to be more specific

174
00:07:34,319 --> 00:07:36,000
so let's take a quick review of how we

175
00:07:36,000 --> 00:07:37,840
got here we started with a broad

176
00:07:37,840 --> 00:07:40,160
hypothesis

177
00:07:40,160 --> 00:07:42,880
and then we did some research and found

178
00:07:42,880 --> 00:07:44,960
some details from the mitre attack

179
00:07:44,960 --> 00:07:47,440
framework to enhance our broad

180
00:07:47,440 --> 00:07:49,199
hypothesis

181
00:07:49,199 --> 00:07:50,639
into a

182
00:07:50,639 --> 00:07:53,360
specific hypothesis

183
00:07:53,360 --> 00:07:57,280
so now we can make a specific hypothesis

184
00:07:57,280 --> 00:08:00,160
like attackers will try to cover their

185
00:08:00,160 --> 00:08:01,360
tracks

186
00:08:01,360 --> 00:08:04,240
using one of the following methods

187
00:08:04,240 --> 00:08:07,520
the event viewer gui

188
00:08:07,520 --> 00:08:09,800
windows commands such as

189
00:08:09,800 --> 00:08:13,120
wevt util cl

190
00:08:13,120 --> 00:08:14,800
or powershell

191
00:08:14,800 --> 00:08:17,199
so for the notes we would as the threat

192
00:08:17,199 --> 00:08:20,160
hunter we would add this these uh

193
00:08:20,160 --> 00:08:22,240
specific items

194
00:08:22,240 --> 00:08:23,759
this we would add the specific

195
00:08:23,759 --> 00:08:28,160
hypothesis to our notes and continue

196
00:08:28,160 --> 00:08:30,240
all right so let's talk about

197
00:08:30,240 --> 00:08:32,640
data sources

198
00:08:32,640 --> 00:08:34,559
it's important to know your data sources

199
00:08:34,559 --> 00:08:37,200
when conducting a threat hunt

200
00:08:37,200 --> 00:08:39,039
so

201
00:08:39,039 --> 00:08:41,599
which data sources could you

202
00:08:41,599 --> 00:08:44,800
possibly use

203
00:08:44,800 --> 00:08:46,720
and where would we find the data needed

204
00:08:46,720 --> 00:08:49,920
for our hypothesis

205
00:08:50,399 --> 00:08:52,080
let's take a look at the data sources

206
00:08:52,080 --> 00:08:55,360
available to us in splunk

207
00:08:55,360 --> 00:08:56,720
what this

208
00:08:56,720 --> 00:08:59,200
simple splunk query

209
00:08:59,200 --> 00:09:01,920
we are about to run basically does is to

210
00:09:01,920 --> 00:09:04,080
search the splunk events

211
00:09:04,080 --> 00:09:05,760
event count

212
00:09:05,760 --> 00:09:07,519
and then it's going to split the events

213
00:09:07,519 --> 00:09:10,800
by index and that's the summarize equals

214
00:09:10,800 --> 00:09:11,920
f

215
00:09:11,920 --> 00:09:14,399
f is for false

216
00:09:14,399 --> 00:09:17,200
then it's going to search for any index

217
00:09:17,200 --> 00:09:19,600
that's index equals

218
00:09:19,600 --> 00:09:21,440
wildcard

219
00:09:21,440 --> 00:09:23,360
then we're going to dedupe the results

220
00:09:23,360 --> 00:09:27,760
by the field index using dedupe index

221
00:09:27,760 --> 00:09:29,200
and finally we're going to

222
00:09:29,200 --> 00:09:30,800
specify the fields we want we're going

223
00:09:30,800 --> 00:09:31,760
to say

224
00:09:31,760 --> 00:09:33,519
fields index

225
00:09:33,519 --> 00:09:37,600
to just show the field index

226
00:09:37,600 --> 00:09:40,959
and looking at the results

227
00:09:41,519 --> 00:09:44,399
which of these indexes would be useful

228
00:09:44,399 --> 00:09:47,560
to us

229
00:09:50,160 --> 00:09:52,399
so with the list of sources here these

230
00:09:52,399 --> 00:09:54,800
indexes uh

231
00:09:54,800 --> 00:09:56,640
we will most likely find what we need

232
00:09:56,640 --> 00:10:00,480
within the cis1 and win event indexes

233
00:10:00,480 --> 00:10:02,640
because these data sources are going to

234
00:10:02,640 --> 00:10:06,240
show us what was happening inside a host

235
00:10:06,240 --> 00:10:08,880
so for the notes as a thread hunter we

236
00:10:08,880 --> 00:10:11,920
would add the splunk indexes sysmon and

237
00:10:11,920 --> 00:10:14,959
win event logs as data sources

238
00:10:14,959 --> 00:10:19,239
to our notes and we would continue

239
00:10:20,000 --> 00:10:22,160
so to begin our hunt we should look for

240
00:10:22,160 --> 00:10:25,760
evidence that the windows event logs

241
00:10:25,760 --> 00:10:27,680
were cleared

242
00:10:27,680 --> 00:10:30,640
a simple google search for windows event

243
00:10:30,640 --> 00:10:32,640
logs cleared

244
00:10:32,640 --> 00:10:35,360
gives us a clue a microsoft article

245
00:10:35,360 --> 00:10:36,480
about

246
00:10:36,480 --> 00:10:39,920
windows security event id1102

247
00:10:39,920 --> 00:10:43,439
so let's take a look at this article

248
00:10:43,600 --> 00:10:47,440
windows security event id 1102 the audit

249
00:10:47,440 --> 00:10:50,000
log was cleared

250
00:10:50,000 --> 00:10:52,079
in this article pay close attention to

251
00:10:52,079 --> 00:10:54,079
what microsoft

252
00:10:54,079 --> 00:10:56,480
says for security monitoring

253
00:10:56,480 --> 00:10:58,959
recommendations

254
00:10:58,959 --> 00:11:01,519
it says typically you should not see

255
00:11:01,519 --> 00:11:02,720
this event

256
00:11:02,720 --> 00:11:05,279
there is no need to manually clear the

257
00:11:05,279 --> 00:11:08,320
security event log in most cases

258
00:11:08,320 --> 00:11:10,880
we recommend monitoring this event and

259
00:11:10,880 --> 00:11:13,440
investigating why this action was

260
00:11:13,440 --> 00:11:14,399
performed

261
00:11:14,399 --> 00:11:15,920
that's interesting

262
00:11:15,920 --> 00:11:18,000
so for the notes as a threat hunter we

263
00:11:18,000 --> 00:11:20,560
would add this information about windows

264
00:11:20,560 --> 00:11:24,000
security event id1102

265
00:11:24,000 --> 00:11:26,959
including any source urls we would add

266
00:11:26,959 --> 00:11:28,480
this to our notes

267
00:11:28,480 --> 00:11:31,200
and continue

268
00:11:31,360 --> 00:11:34,560
but question

269
00:11:34,560 --> 00:11:38,000
which data sources

270
00:11:38,000 --> 00:11:41,480
should we use

271
00:11:44,560 --> 00:11:47,599
i'm gonna pause here

272
00:11:51,600 --> 00:11:54,079
be there

273
00:11:55,200 --> 00:11:57,680
yeah what's up sorry

274
00:11:57,680 --> 00:11:59,519
uh

275
00:11:59,519 --> 00:12:01,920
i might want to redo this little section

276
00:12:01,920 --> 00:12:03,519
right here because i just noticed that

277
00:12:03,519 --> 00:12:05,760
discord popped up and probably got into

278
00:12:05,760 --> 00:12:07,920
my

279
00:12:08,839 --> 00:12:11,680
screen all right um

280
00:12:11,680 --> 00:12:14,079
if you want to back up a slide and start

281
00:12:14,079 --> 00:12:16,480
yeah yeah i'm gonna do that

282
00:12:16,480 --> 00:12:19,200
i can splice it together sounds good man

283
00:12:19,200 --> 00:12:21,920
sorry about that

284
00:12:22,959 --> 00:12:24,399
okay

285
00:12:24,399 --> 00:12:27,200
i'm about to start

286
00:12:27,200 --> 00:12:28,800
just uh

287
00:12:28,800 --> 00:12:30,720
just uh

288
00:12:30,720 --> 00:12:33,519
give a three second pause and then start

289
00:12:33,519 --> 00:12:35,519
okay so i'm gonna say

290
00:12:35,519 --> 00:12:36,639
right now

291
00:12:36,639 --> 00:12:40,639
three second pause starting now

292
00:12:42,480 --> 00:12:43,680
okay

293
00:12:43,680 --> 00:12:47,440
windows security event id 1102

294
00:12:47,440 --> 00:12:50,480
the audit log was cleared

295
00:12:50,480 --> 00:12:53,680
in this article pay close attention to

296
00:12:53,680 --> 00:12:56,560
what the microsoft article says

297
00:12:56,560 --> 00:13:01,120
for security monitoring recommendations

298
00:13:01,120 --> 00:13:02,160
it says

299
00:13:02,160 --> 00:13:05,519
typically you should not see this event

300
00:13:05,519 --> 00:13:08,160
there is no need to manually clear the

301
00:13:08,160 --> 00:13:10,800
security event log in most cases we

302
00:13:10,800 --> 00:13:12,800
recommend monitoring this event and

303
00:13:12,800 --> 00:13:15,360
investigating why this action was

304
00:13:15,360 --> 00:13:16,959
performed

305
00:13:16,959 --> 00:13:18,320
interesting

306
00:13:18,320 --> 00:13:21,279
so for the notes as the threat hunter we

307
00:13:21,279 --> 00:13:23,040
should add this information about

308
00:13:23,040 --> 00:13:26,480
windows security event id 1102

309
00:13:26,480 --> 00:13:30,399
including any source urls to our notes

310
00:13:30,399 --> 00:13:33,200
and continue

311
00:13:33,360 --> 00:13:34,880
question

312
00:13:34,880 --> 00:13:39,120
which data source should we use

313
00:13:39,120 --> 00:13:42,000
looking at our notes we see that we have

314
00:13:42,000 --> 00:13:43,680
win event logs

315
00:13:43,680 --> 00:13:46,720
listed which contains the typical

316
00:13:46,720 --> 00:13:49,120
windows event logs found on a windows

317
00:13:49,120 --> 00:13:51,040
operating system

318
00:13:51,040 --> 00:13:52,959
this is listed as a data source in

319
00:13:52,959 --> 00:13:55,040
splunk so

320
00:13:55,040 --> 00:13:56,959
let's go search for this event within

321
00:13:56,959 --> 00:13:59,920
our splunk data

322
00:13:59,920 --> 00:14:01,839
because for this search we're going to

323
00:14:01,839 --> 00:14:05,040
search the win event logs index

324
00:14:05,040 --> 00:14:06,240
in splunk

325
00:14:06,240 --> 00:14:10,639
for event dot code 1102 and we'll see if

326
00:14:10,639 --> 00:14:13,600
we get any results

327
00:14:14,240 --> 00:14:15,279
we do

328
00:14:15,279 --> 00:14:17,839
so we get 26 events here discovered

329
00:14:17,839 --> 00:14:18,800
showing

330
00:14:18,800 --> 00:14:19,920
proof

331
00:14:19,920 --> 00:14:23,120
that the windows event logs were cleared

332
00:14:23,120 --> 00:14:25,760
so for the notes as the threat hunter we

333
00:14:25,760 --> 00:14:29,040
would add this broad splunk query

334
00:14:29,040 --> 00:14:31,040
including the date time specified for

335
00:14:31,040 --> 00:14:32,240
the query

336
00:14:32,240 --> 00:14:34,160
as well as some details about the

337
00:14:34,160 --> 00:14:37,760
results to our notes and continue

338
00:14:37,760 --> 00:14:38,880
so

339
00:14:38,880 --> 00:14:41,519
let's alter this splunk query to make it

340
00:14:41,519 --> 00:14:42,399
look

341
00:14:42,399 --> 00:14:44,320
more presentable

342
00:14:44,320 --> 00:14:45,600
so what we're going to do is we'll

343
00:14:45,600 --> 00:14:49,360
search the win event logs index

344
00:14:49,360 --> 00:14:53,760
for event code event dot code 1102

345
00:14:53,760 --> 00:14:56,320
and we'll use rename

346
00:14:56,320 --> 00:14:58,800
to rename the long field

347
00:14:58,800 --> 00:15:03,199
win log dot user underscore data subject

348
00:15:03,199 --> 00:15:04,560
username

349
00:15:04,560 --> 00:15:06,000
as simply

350
00:15:06,000 --> 00:15:07,040
user

351
00:15:07,040 --> 00:15:10,079
because that's much nicer right

352
00:15:10,079 --> 00:15:11,920
and then we'll arrange the results in

353
00:15:11,920 --> 00:15:14,560
the query using table

354
00:15:14,560 --> 00:15:16,320
and we'll specify the fields we want

355
00:15:16,320 --> 00:15:18,160
displayed time

356
00:15:18,160 --> 00:15:21,600
host name event code when log

357
00:15:21,600 --> 00:15:22,880
task

358
00:15:22,880 --> 00:15:24,320
user

359
00:15:24,320 --> 00:15:26,240
and then we're going to sort the results

360
00:15:26,240 --> 00:15:28,880
by time from oldest at the top to newest

361
00:15:28,880 --> 00:15:30,880
at the bottom

362
00:15:30,880 --> 00:15:34,000
that's just my preference honestly

363
00:15:34,000 --> 00:15:35,759
okay wow

364
00:15:35,759 --> 00:15:37,440
interesting results

365
00:15:37,440 --> 00:15:39,600
here we can see evidence of the windows

366
00:15:39,600 --> 00:15:42,480
event logs being cleared on several

367
00:15:42,480 --> 00:15:44,000
hosts

368
00:15:44,000 --> 00:15:46,399
also it's interesting to note that the

369
00:15:46,399 --> 00:15:48,560
search results here

370
00:15:48,560 --> 00:15:51,040
did not specify

371
00:15:51,040 --> 00:15:53,040
they didn't show

372
00:15:53,040 --> 00:15:54,959
if the event logs

373
00:15:54,959 --> 00:15:57,920
were cleared via the event

374
00:15:57,920 --> 00:16:00,480
event viewer gui

375
00:16:00,480 --> 00:16:02,240
windows command

376
00:16:02,240 --> 00:16:03,240
such as

377
00:16:03,240 --> 00:16:06,560
wevt util cl

378
00:16:06,560 --> 00:16:09,600
or powershell but in any case we see

379
00:16:09,600 --> 00:16:10,800
that the window

380
00:16:10,800 --> 00:16:13,040
windows event logs

381
00:16:13,040 --> 00:16:15,839
were cleared so for the notes

382
00:16:15,839 --> 00:16:17,920
as a thread hunter we would add this

383
00:16:17,920 --> 00:16:20,560
specific splunk query

384
00:16:20,560 --> 00:16:22,639
including the date time specified for

385
00:16:22,639 --> 00:16:24,160
the query

386
00:16:24,160 --> 00:16:26,639
as well as some details about the

387
00:16:26,639 --> 00:16:28,639
results to our notes and we would

388
00:16:28,639 --> 00:16:31,120
continue

389
00:16:31,120 --> 00:16:32,560
okay

390
00:16:32,560 --> 00:16:34,480
so are we done

391
00:16:34,480 --> 00:16:35,440
did we

392
00:16:35,440 --> 00:16:36,880
accomplish

393
00:16:36,880 --> 00:16:39,839
what we set out to do

394
00:16:39,839 --> 00:16:41,680
some would say yes

395
00:16:41,680 --> 00:16:44,240
they're not entirely wrong we did find a

396
00:16:44,240 --> 00:16:47,279
way to detect when the windows event

397
00:16:47,279 --> 00:16:50,000
logs were cleared

398
00:16:50,000 --> 00:16:52,639
but what if we wanted to find the source

399
00:16:52,639 --> 00:16:54,240
of this activity

400
00:16:54,240 --> 00:16:56,800
what if we wanted to find which command

401
00:16:56,800 --> 00:16:59,759
or commands the attacker made of you

402
00:16:59,759 --> 00:17:01,120
might have used

403
00:17:01,120 --> 00:17:03,360
to clear the logs what if we wanted to

404
00:17:03,360 --> 00:17:06,720
find the answer to how the attackers

405
00:17:06,720 --> 00:17:09,919
cleared the windows event logs

406
00:17:09,919 --> 00:17:12,640
let's explore further to answer those

407
00:17:12,640 --> 00:17:15,120
questions

408
00:17:15,599 --> 00:17:19,039
okay looking at our notes we can see in

409
00:17:19,039 --> 00:17:21,760
our specific hypothesis that one of the

410
00:17:21,760 --> 00:17:24,240
methods attackers use to cover their

411
00:17:24,240 --> 00:17:26,959
tracks is by using the

412
00:17:26,959 --> 00:17:29,679
wevt util

413
00:17:29,679 --> 00:17:32,400
cl command

414
00:17:32,400 --> 00:17:34,720
we should search for this command

415
00:17:34,720 --> 00:17:36,880
in our splunk data

416
00:17:36,880 --> 00:17:38,799
but how do we do that how would we find

417
00:17:38,799 --> 00:17:41,360
a specific windows command

418
00:17:41,360 --> 00:17:44,720
that was executed on a host

419
00:17:44,720 --> 00:17:47,520
well let's just google

420
00:17:47,520 --> 00:17:50,880
log windows command line and see what it

421
00:17:50,880 --> 00:17:53,360
gives us and one of the first results is

422
00:17:53,360 --> 00:17:55,360
a microsoft article

423
00:17:55,360 --> 00:17:58,480
command line process auditing so let's

424
00:17:58,480 --> 00:18:00,480
take a look

425
00:18:00,480 --> 00:18:02,640
reading the microsoft article

426
00:18:02,640 --> 00:18:05,400
it mentions audit event id

427
00:18:05,400 --> 00:18:07,200
468.

428
00:18:07,200 --> 00:18:12,240
so what is this audit event id 4688

429
00:18:12,240 --> 00:18:14,480
let's find out

430
00:18:14,480 --> 00:18:16,799
quick google search for

431
00:18:16,799 --> 00:18:20,799
audit event id 4 6 8 8

432
00:18:20,799 --> 00:18:25,039
leads us to an article titled 468

433
00:18:25,039 --> 00:18:27,679
a new process has been created

434
00:18:27,679 --> 00:18:30,240
so let's take a look

435
00:18:30,240 --> 00:18:33,039
okay one of the fields we see

436
00:18:33,039 --> 00:18:37,679
in this windows security event id 468

437
00:18:37,679 --> 00:18:39,120
is the

438
00:18:39,120 --> 00:18:42,799
process command line field

439
00:18:42,799 --> 00:18:44,240
great

440
00:18:44,240 --> 00:18:47,039
so it appears we can search splunk for

441
00:18:47,039 --> 00:18:49,640
the windows security event id

442
00:18:49,640 --> 00:18:54,080
4688 and we can specify the value

443
00:18:54,080 --> 00:18:56,720
we are looking for in the process

444
00:18:56,720 --> 00:18:59,200
command line field

445
00:18:59,200 --> 00:19:01,600
right

446
00:19:01,600 --> 00:19:03,280
for the notes here

447
00:19:03,280 --> 00:19:05,440
as a threat hunter we would add this

448
00:19:05,440 --> 00:19:07,760
information we have found about windows

449
00:19:07,760 --> 00:19:12,160
security event ii id 4688

450
00:19:12,160 --> 00:19:15,280
including any source urls to our notes

451
00:19:15,280 --> 00:19:18,160
and continue

452
00:19:18,160 --> 00:19:20,080
okay let's take a look

453
00:19:20,080 --> 00:19:23,760
at windows security event id

454
00:19:23,760 --> 00:19:25,120
in splunk

455
00:19:25,120 --> 00:19:28,640
and see what the process command line

456
00:19:28,640 --> 00:19:30,480
field is going to show us

457
00:19:30,480 --> 00:19:32,559
so this is just a simple search we'll

458
00:19:32,559 --> 00:19:34,080
just search

459
00:19:34,080 --> 00:19:37,200
the win event logs index for

460
00:19:37,200 --> 00:19:42,480
event dot code four six eight eight

461
00:19:43,600 --> 00:19:46,240
ah bummer

462
00:19:46,240 --> 00:19:48,880
so looking at the results we don't find

463
00:19:48,880 --> 00:19:50,480
any data

464
00:19:50,480 --> 00:19:54,000
for the process command line field

465
00:19:54,000 --> 00:19:58,720
in windows security event id 4688

466
00:19:58,720 --> 00:20:00,799
so for the notes as a thread hunter we

467
00:20:00,799 --> 00:20:03,520
would add this specific splunk query

468
00:20:03,520 --> 00:20:05,840
including the date time specified for

469
00:20:05,840 --> 00:20:08,080
the query

470
00:20:08,080 --> 00:20:09,840
as well as some details about the

471
00:20:09,840 --> 00:20:14,000
results to our notes and continue

472
00:20:14,400 --> 00:20:17,200
so we didn't find any command line data

473
00:20:17,200 --> 00:20:21,760
in the windows security event id 468.

474
00:20:21,760 --> 00:20:24,080
why

475
00:20:25,919 --> 00:20:29,360
well according to the microsoft article

476
00:20:29,360 --> 00:20:31,120
previously mentioned

477
00:20:31,120 --> 00:20:34,559
about a new process has been created

478
00:20:34,559 --> 00:20:37,200
if you scroll down a bit and read

479
00:20:37,200 --> 00:20:40,559
it says you must enable

480
00:20:40,559 --> 00:20:44,240
administrative templates system audit

481
00:20:44,240 --> 00:20:46,480
process creation include

482
00:20:46,480 --> 00:20:52,400
command line in process creation events

483
00:20:52,400 --> 00:20:52,770
so

484
00:20:52,770 --> 00:20:54,080
[Music]

485
00:20:54,080 --> 00:20:56,640
you need to enable this in group policy

486
00:20:56,640 --> 00:20:59,440
to include command line

487
00:20:59,440 --> 00:21:03,840
in the process creation events

488
00:21:04,559 --> 00:21:07,520
so now what are we dead in the water

489
00:21:07,520 --> 00:21:10,080
is there anything else we can do to find

490
00:21:10,080 --> 00:21:11,520
what commands

491
00:21:11,520 --> 00:21:15,679
the attacker used to clear the logs

492
00:21:15,679 --> 00:21:18,159
okay checking our notes

493
00:21:18,159 --> 00:21:20,559
we take a look and recall that we made

494
00:21:20,559 --> 00:21:21,440
note

495
00:21:21,440 --> 00:21:24,000
of the two data sources cis one and one

496
00:21:24,000 --> 00:21:26,400
event logs

497
00:21:26,400 --> 00:21:28,000
so let's go take a look at the sysmon

498
00:21:28,000 --> 00:21:30,159
data

499
00:21:30,159 --> 00:21:31,600
question

500
00:21:31,600 --> 00:21:34,960
which sysmon id could possibly show us

501
00:21:34,960 --> 00:21:38,400
the command line details

502
00:21:39,919 --> 00:21:43,120
a quick google search for sysmon event

503
00:21:43,120 --> 00:21:45,440
showing command line

504
00:21:45,440 --> 00:21:47,360
leads us to an article about sysmon

505
00:21:47,360 --> 00:21:49,200
event id 1

506
00:21:49,200 --> 00:21:52,320
process creation

507
00:21:53,280 --> 00:21:55,280
okay we see in this article that it

508
00:21:55,280 --> 00:22:00,240
lists the fields in sysmon event id one

509
00:22:00,240 --> 00:22:03,840
and two interesting fields pop up here

510
00:22:03,840 --> 00:22:05,200
command line

511
00:22:05,200 --> 00:22:08,159
and parent command line

512
00:22:08,159 --> 00:22:10,320
so for the notes as a threat hunter we

513
00:22:10,320 --> 00:22:12,080
would add this information we've

514
00:22:12,080 --> 00:22:13,440
discovered about

515
00:22:13,440 --> 00:22:15,760
sysmon event id 1

516
00:22:15,760 --> 00:22:18,480
including any source urls we would add

517
00:22:18,480 --> 00:22:22,240
this to our notes and continue

518
00:22:23,200 --> 00:22:25,039
yay

519
00:22:25,039 --> 00:22:27,440
okay all is not lost

520
00:22:27,440 --> 00:22:30,880
we have sysmon event id one process

521
00:22:30,880 --> 00:22:33,280
creation which shows us the command line

522
00:22:33,280 --> 00:22:36,720
as well as the parent command line

523
00:22:36,720 --> 00:22:38,799
okay let's take a look at sysmon event

524
00:22:38,799 --> 00:22:42,080
id 1 in splunk

525
00:22:42,080 --> 00:22:44,400
we'll search the system on index for

526
00:22:44,400 --> 00:22:47,120
event code 1.

527
00:22:47,120 --> 00:22:49,039
okay important note here

528
00:22:49,039 --> 00:22:50,799
this simple

529
00:22:50,799 --> 00:22:53,600
query this simple splunk query

530
00:22:53,600 --> 00:22:55,200
is only

531
00:22:55,200 --> 00:22:56,799
a query to see

532
00:22:56,799 --> 00:22:59,440
what the command line data looks like

533
00:22:59,440 --> 00:23:02,400
from sysmon event id 1.

534
00:23:02,400 --> 00:23:04,240
the actual values that we see in the

535
00:23:04,240 --> 00:23:06,640
command line in this specific search

536
00:23:06,640 --> 00:23:09,679
here these results they don't matter

537
00:23:09,679 --> 00:23:11,520
understand we just want to verify that

538
00:23:11,520 --> 00:23:15,120
we can see command line data

539
00:23:15,679 --> 00:23:18,080
and here's what we get

540
00:23:18,080 --> 00:23:19,840
we can clearly see

541
00:23:19,840 --> 00:23:22,320
data for the command line and parent

542
00:23:22,320 --> 00:23:25,679
command line fields and sysmon event id1

543
00:23:25,679 --> 00:23:26,960
great

544
00:23:26,960 --> 00:23:28,960
now that we've verified that we can see

545
00:23:28,960 --> 00:23:33,200
command line values in sysmon event id 1

546
00:23:33,200 --> 00:23:36,640
let's search for the specific command w

547
00:23:36,640 --> 00:23:39,360
evt util cl

548
00:23:39,360 --> 00:23:43,520
listed in our specific hypothesis

549
00:23:43,520 --> 00:23:45,360
okay we're going to

550
00:23:45,360 --> 00:23:48,799
run a splunk search in the cismond index

551
00:23:48,799 --> 00:23:52,640
looking for event dot code one

552
00:23:52,640 --> 00:23:56,080
and we're going to specify

553
00:23:56,080 --> 00:23:59,520
process dot command line

554
00:23:59,520 --> 00:24:01,120
contains

555
00:24:01,120 --> 00:24:02,480
the command

556
00:24:02,480 --> 00:24:06,640
w evt util

557
00:24:06,640 --> 00:24:09,120
cl

558
00:24:11,200 --> 00:24:12,720
nothing

559
00:24:12,720 --> 00:24:14,320
bummer

560
00:24:14,320 --> 00:24:15,679
okay

561
00:24:15,679 --> 00:24:18,159
so for the node says the threat hunter

562
00:24:18,159 --> 00:24:20,320
we would add this splunk query including

563
00:24:20,320 --> 00:24:22,960
the date time specified for the query

564
00:24:22,960 --> 00:24:25,360
as well as any details about the results

565
00:24:25,360 --> 00:24:29,039
to our notes and continue

566
00:24:30,559 --> 00:24:32,480
so again

567
00:24:32,480 --> 00:24:35,039
are we dead in the water

568
00:24:35,039 --> 00:24:38,159
is there nothing else we can do to find

569
00:24:38,159 --> 00:24:40,559
what commands the attacker used to clear

570
00:24:40,559 --> 00:24:43,200
the logs

571
00:24:44,480 --> 00:24:46,559
checking our notes

572
00:24:46,559 --> 00:24:48,640
we take a look and recall that we made

573
00:24:48,640 --> 00:24:51,679
note in our specific hypothesis that

574
00:24:51,679 --> 00:24:54,320
attackers have also been

575
00:24:54,320 --> 00:24:56,320
known to use

576
00:24:56,320 --> 00:24:59,039
powershell so let's move on to

577
00:24:59,039 --> 00:25:01,039
powershell

578
00:25:01,039 --> 00:25:02,880
so question

579
00:25:02,880 --> 00:25:04,400
how could we find

580
00:25:04,400 --> 00:25:08,000
a way to clear the windows event logs

581
00:25:08,000 --> 00:25:10,960
using powershell

582
00:25:11,919 --> 00:25:14,559
a simple google search for powershell

583
00:25:14,559 --> 00:25:16,720
clear event logs

584
00:25:16,720 --> 00:25:19,039
results in a link to a microsoft article

585
00:25:19,039 --> 00:25:19,919
about

586
00:25:19,919 --> 00:25:21,039
a

587
00:25:21,039 --> 00:25:24,640
clear event log commandlet

588
00:25:24,640 --> 00:25:28,120
let's take a look

589
00:25:28,240 --> 00:25:31,679
this powershell commandlet

590
00:25:31,679 --> 00:25:35,919
clears all entries from specified event

591
00:25:35,919 --> 00:25:41,640
logs on the local or remote computers

592
00:25:42,240 --> 00:25:44,240
so for the notes here as the threat

593
00:25:44,240 --> 00:25:46,559
hunter we would add this information

594
00:25:46,559 --> 00:25:48,559
we've discovered about powershell

595
00:25:48,559 --> 00:25:51,520
commandlet clear event log

596
00:25:51,520 --> 00:25:53,679
including any source urls we would add

597
00:25:53,679 --> 00:25:56,559
this to our notes and continue

598
00:25:56,559 --> 00:25:59,360
this is interesting so

599
00:25:59,360 --> 00:26:01,840
could an attacker use powershell this

600
00:26:01,840 --> 00:26:04,960
powershell commandlet clear event log as

601
00:26:04,960 --> 00:26:07,679
a method to clear the logs

602
00:26:07,679 --> 00:26:09,279
sure

603
00:26:09,279 --> 00:26:11,279
let's dive into splunk and hunt for any

604
00:26:11,279 --> 00:26:12,559
evidence

605
00:26:12,559 --> 00:26:15,520
of this commandment

606
00:26:15,600 --> 00:26:17,840
okay let's search this powershell

607
00:26:17,840 --> 00:26:19,840
command in splunk we're going to search

608
00:26:19,840 --> 00:26:20,799
the

609
00:26:20,799 --> 00:26:25,200
sysmon index for event.code

610
00:26:25,200 --> 00:26:27,760
and we're going to search for process

611
00:26:27,760 --> 00:26:30,640
dot command line containing

612
00:26:30,640 --> 00:26:34,080
clear event log

613
00:26:36,080 --> 00:26:38,640
21 events

614
00:26:38,640 --> 00:26:40,159
now we have proof

615
00:26:40,159 --> 00:26:42,240
that the attacker used the powershell

616
00:26:42,240 --> 00:26:43,840
commandment

617
00:26:43,840 --> 00:26:45,279
clear event log

618
00:26:45,279 --> 00:26:47,039
as a method

619
00:26:47,039 --> 00:26:51,879
to wipe the windows event logs

620
00:26:53,200 --> 00:26:55,440
this is the how

621
00:26:55,440 --> 00:26:57,520
to our hypothesis

622
00:26:57,520 --> 00:26:59,520
so for the notes

623
00:26:59,520 --> 00:27:02,240
as the threat hunter we would add this

624
00:27:02,240 --> 00:27:04,320
specific splunk query

625
00:27:04,320 --> 00:27:06,320
including date time specified for the

626
00:27:06,320 --> 00:27:07,360
query

627
00:27:07,360 --> 00:27:10,400
as well as any details about the results

628
00:27:10,400 --> 00:27:13,919
to our notes and continue

629
00:27:14,400 --> 00:27:16,320
let's make this splunk query more

630
00:27:16,320 --> 00:27:18,559
presentable

631
00:27:18,559 --> 00:27:19,679
what we're going to do is we're going to

632
00:27:19,679 --> 00:27:22,080
search the sysmond index for event code

633
00:27:22,080 --> 00:27:23,279
1

634
00:27:23,279 --> 00:27:26,240
again specify the process dot command

635
00:27:26,240 --> 00:27:29,520
line containing clear event log and

636
00:27:29,520 --> 00:27:31,760
we're going to use rename to rename the

637
00:27:31,760 --> 00:27:35,520
long process dot command line field

638
00:27:35,520 --> 00:27:38,640
as just command

639
00:27:38,640 --> 00:27:40,399
then we're going to organize the results

640
00:27:40,399 --> 00:27:43,360
in a nice table using table

641
00:27:43,360 --> 00:27:46,720
and we'll specify the fields we want

642
00:27:46,720 --> 00:27:48,960
and finally we're going to sort by time

643
00:27:48,960 --> 00:27:50,880
with the oldest on top to newest on the

644
00:27:50,880 --> 00:27:53,200
bottom

645
00:27:55,120 --> 00:27:57,520
looks great

646
00:27:57,520 --> 00:27:59,279
so for our notes

647
00:27:59,279 --> 00:28:02,000
again as a threat hunter we would add

648
00:28:02,000 --> 00:28:04,559
this specific splunk query

649
00:28:04,559 --> 00:28:06,640
including the date time specified for

650
00:28:06,640 --> 00:28:08,080
the query

651
00:28:08,080 --> 00:28:10,240
as well as any details about the results

652
00:28:10,240 --> 00:28:12,000
to our notes

653
00:28:12,000 --> 00:28:15,240
and continue

654
00:28:16,320 --> 00:28:18,320
so

655
00:28:18,320 --> 00:28:20,640
how can we document the final results of

656
00:28:20,640 --> 00:28:23,120
the hunt

657
00:28:24,960 --> 00:28:27,679
perhaps you'll see now how important it

658
00:28:27,679 --> 00:28:30,240
is to take copious notes throughout the

659
00:28:30,240 --> 00:28:32,320
thread hunting process

660
00:28:32,320 --> 00:28:34,480
we can take

661
00:28:34,480 --> 00:28:36,559
our notes we can document the final

662
00:28:36,559 --> 00:28:38,000
results

663
00:28:38,000 --> 00:28:39,760
of the hunt

664
00:28:39,760 --> 00:28:41,520
and we can use our notes to fill in the

665
00:28:41,520 --> 00:28:44,320
details of a threat hunting template and

666
00:28:44,320 --> 00:28:47,039
this process can be repeated using new

667
00:28:47,039 --> 00:28:50,559
hypothesis in the future

668
00:28:52,159 --> 00:28:54,720
for this threat hunting exercise that we

669
00:28:54,720 --> 00:28:57,200
just did

670
00:28:57,200 --> 00:28:59,919
it would make sense to break these

671
00:28:59,919 --> 00:29:02,480
results into three separate threat

672
00:29:02,480 --> 00:29:04,960
hunting templates

673
00:29:04,960 --> 00:29:06,000
windows

674
00:29:06,000 --> 00:29:07,919
we'll name it like this windows event

675
00:29:07,919 --> 00:29:12,320
logs cleared via event viewer gui which

676
00:29:12,320 --> 00:29:14,559
will address the windows security event

677
00:29:14,559 --> 00:29:17,559
id1102

678
00:29:17,760 --> 00:29:20,240
windows event logs cleared via windows

679
00:29:20,240 --> 00:29:21,679
command

680
00:29:21,679 --> 00:29:24,480
which will address the windows command

681
00:29:24,480 --> 00:29:27,440
wevt util cl

682
00:29:27,440 --> 00:29:30,960
and also windows event logs cleared via

683
00:29:30,960 --> 00:29:32,320
powershell

684
00:29:32,320 --> 00:29:34,799
clear event log which will address the

685
00:29:34,799 --> 00:29:37,918
powershell commandlet

686
00:29:38,720 --> 00:29:40,720
to document these threat hunting

687
00:29:40,720 --> 00:29:44,080
exercises we can use this simple threat

688
00:29:44,080 --> 00:29:46,399
hunting template

689
00:29:46,399 --> 00:29:48,720
it contains

690
00:29:48,720 --> 00:29:50,480
a title

691
00:29:50,480 --> 00:29:51,919
date created

692
00:29:51,919 --> 00:29:54,240
our hypothesis

693
00:29:54,240 --> 00:29:56,240
miter attack

694
00:29:56,240 --> 00:29:59,679
miter sub technique

695
00:29:59,840 --> 00:30:02,080
uh

696
00:30:02,080 --> 00:30:05,440
simulation details if any

697
00:30:05,440 --> 00:30:09,360
proposed search query are

698
00:30:09,360 --> 00:30:11,279
the the limitations

699
00:30:11,279 --> 00:30:13,360
and observation notes that we can kind

700
00:30:13,360 --> 00:30:15,919
of summarize and expand on

701
00:30:15,919 --> 00:30:18,720
and finally our hunt findings with any

702
00:30:18,720 --> 00:30:20,960
recommendations

703
00:30:20,960 --> 00:30:23,200
and then we'll have a proposed detection

704
00:30:23,200 --> 00:30:25,520
title if any

705
00:30:25,520 --> 00:30:28,799
and a proposed detection query

706
00:30:28,799 --> 00:30:30,240
and what it's going to look like would

707
00:30:30,240 --> 00:30:33,440
be something like this

708
00:30:33,440 --> 00:30:37,039
so here using our notes to guide us

709
00:30:37,039 --> 00:30:38,720
we can create the title

710
00:30:38,720 --> 00:30:43,679
windows event logs cleared via event gui

711
00:30:43,679 --> 00:30:45,440
we put in the date

712
00:30:45,440 --> 00:30:47,679
our hypothesis

713
00:30:47,679 --> 00:30:50,880
mitre tactic

714
00:30:50,880 --> 00:30:54,240
miter sub technique

715
00:30:55,440 --> 00:30:57,600
simulation details if any in this case

716
00:30:57,600 --> 00:31:00,080
there's none

717
00:31:00,399 --> 00:31:02,840
proposed search

718
00:31:02,840 --> 00:31:04,799
query and

719
00:31:04,799 --> 00:31:07,679
hunter limitations observation notes

720
00:31:07,679 --> 00:31:09,600
here's where we can summarize from our

721
00:31:09,600 --> 00:31:10,640
notes

722
00:31:10,640 --> 00:31:13,200
so for this i put

723
00:31:13,200 --> 00:31:16,080
the proposed search query did find

724
00:31:16,080 --> 00:31:18,720
evidence of windows event logs getting

725
00:31:18,720 --> 00:31:21,760
cleared but the results were broad

726
00:31:21,760 --> 00:31:24,640
the search query was improved to display

727
00:31:24,640 --> 00:31:28,000
the relevant data in a readable format

728
00:31:28,000 --> 00:31:30,880
and also put here it's important to note

729
00:31:30,880 --> 00:31:32,960
that the search results did not

730
00:31:32,960 --> 00:31:36,159
specifically show if the windows event

731
00:31:36,159 --> 00:31:38,320
logs were cleared via

732
00:31:38,320 --> 00:31:39,760
event

733
00:31:39,760 --> 00:31:42,399
viewer gui

734
00:31:42,399 --> 00:31:44,880
so it would be prudent to test this in a

735
00:31:44,880 --> 00:31:47,760
simulation to verify that windows

736
00:31:47,760 --> 00:31:51,679
security event id 1102 would still be

737
00:31:51,679 --> 00:31:53,679
triggered no matter what method an

738
00:31:53,679 --> 00:31:57,919
attacker used gui command powershell

739
00:31:57,919 --> 00:32:00,799
so for the hunt findings for this

740
00:32:00,799 --> 00:32:02,399
uh i wrote

741
00:32:02,399 --> 00:32:05,840
windows event 1102 is wonderful for

742
00:32:05,840 --> 00:32:07,519
detecting when

743
00:32:07,519 --> 00:32:09,679
windows event logs are cleared

744
00:32:09,679 --> 00:32:11,679
and the query developed below should be

745
00:32:11,679 --> 00:32:14,480
made into detection

746
00:32:14,480 --> 00:32:18,559
so here's the proposed detection title

747
00:32:18,559 --> 00:32:21,120
alert windowsevent1102

748
00:32:21,120 --> 00:32:24,000
the audit log was cleared

749
00:32:24,000 --> 00:32:25,120
and

750
00:32:25,120 --> 00:32:27,760
finally here we have the specific

751
00:32:27,760 --> 00:32:31,679
proposed detection query

752
00:32:33,440 --> 00:32:36,080
the second one

753
00:32:36,080 --> 00:32:38,799
is again using our notes

754
00:32:38,799 --> 00:32:41,600
we create a title windows event logs

755
00:32:41,600 --> 00:32:44,399
cleared via windows command

756
00:32:44,399 --> 00:32:47,760
w evt util cl

757
00:32:47,760 --> 00:32:51,519
the date hypothesis

758
00:32:51,760 --> 00:32:54,640
miter tactic miter sub technique and

759
00:32:54,640 --> 00:32:57,200
note for these sub techniques for these

760
00:32:57,200 --> 00:32:58,320
three

761
00:32:58,320 --> 00:33:00,720
threat hunting templates

762
00:33:00,720 --> 00:33:03,039
i'm adding some extra info at the end in

763
00:33:03,039 --> 00:33:05,120
parentheses so for this one i put via

764
00:33:05,120 --> 00:33:06,640
windows command

765
00:33:06,640 --> 00:33:11,279
w evt util cl

766
00:33:11,279 --> 00:33:14,320
there was no simulation details

767
00:33:14,320 --> 00:33:17,279
i put in my proposed search query

768
00:33:17,279 --> 00:33:19,360
and for hunter limitation observation

769
00:33:19,360 --> 00:33:20,320
notes

770
00:33:20,320 --> 00:33:21,279
have

771
00:33:21,279 --> 00:33:23,519
the proposed search query did not

772
00:33:23,519 --> 00:33:26,000
produce any valuable results

773
00:33:26,000 --> 00:33:28,080
however it would be prudent to run a

774
00:33:28,080 --> 00:33:30,159
simulation test

775
00:33:30,159 --> 00:33:32,640
using this command and build the

776
00:33:32,640 --> 00:33:34,559
detection

777
00:33:34,559 --> 00:33:37,200
in the hunt findings

778
00:33:37,200 --> 00:33:39,440
although the query did not produce

779
00:33:39,440 --> 00:33:42,080
results i believed that i believe the

780
00:33:42,080 --> 00:33:44,399
developed query should be made into a

781
00:33:44,399 --> 00:33:46,399
detection because attackers could

782
00:33:46,399 --> 00:33:49,039
possibly use the command to clear the

783
00:33:49,039 --> 00:33:52,000
windows log events

784
00:33:52,000 --> 00:33:53,919
windows event logs

785
00:33:53,919 --> 00:33:56,640
so proposed detection title for this one

786
00:33:56,640 --> 00:34:01,760
is alert windows command wevt util cl

787
00:34:01,760 --> 00:34:04,320
used to clear windows event logs and

788
00:34:04,320 --> 00:34:05,600
then

789
00:34:05,600 --> 00:34:07,440
finally here we have the proposed

790
00:34:07,440 --> 00:34:10,399
detection query with my specific

791
00:34:10,399 --> 00:34:12,639
splunk query

792
00:34:12,639 --> 00:34:15,199
okay third one here

793
00:34:15,199 --> 00:34:17,599
again using our notes to guide us create

794
00:34:17,599 --> 00:34:18,879
a title

795
00:34:18,879 --> 00:34:20,399
windows event

796
00:34:20,399 --> 00:34:23,119
logs cleared via powershell

797
00:34:23,119 --> 00:34:25,760
clear event log

798
00:34:25,760 --> 00:34:27,359
we have the date

799
00:34:27,359 --> 00:34:29,280
our hypothesis

800
00:34:29,280 --> 00:34:31,040
miter tactic

801
00:34:31,040 --> 00:34:34,320
miter sub technique again notice here at

802
00:34:34,320 --> 00:34:37,359
the end i put in parentheses i added via

803
00:34:37,359 --> 00:34:40,879
powershell clear event log

804
00:34:40,879 --> 00:34:44,079
no simulation details

805
00:34:44,079 --> 00:34:46,719
the proposed search query

806
00:34:46,719 --> 00:34:48,560
and for the hunter limitations

807
00:34:48,560 --> 00:34:51,679
observation notes i wrote

808
00:34:51,679 --> 00:34:54,079
the proposed search query produced

809
00:34:54,079 --> 00:34:55,119
evidence

810
00:34:55,119 --> 00:34:57,440
that the powershell commandlet clear

811
00:34:57,440 --> 00:35:00,240
event log was used but the results were

812
00:35:00,240 --> 00:35:03,119
broad the search query was improved to

813
00:35:03,119 --> 00:35:05,520
display the relevant data in a readable

814
00:35:05,520 --> 00:35:06,720
format

815
00:35:06,720 --> 00:35:10,320
see proposed detection query

816
00:35:10,320 --> 00:35:11,920
okay so for hunt

817
00:35:11,920 --> 00:35:14,000
findings

818
00:35:14,000 --> 00:35:17,200
use the powershell use of the powershell

819
00:35:17,200 --> 00:35:20,160
commandlet clear event log

820
00:35:20,160 --> 00:35:22,480
should be monitored for any suspicious

821
00:35:22,480 --> 00:35:24,960
behavior and so the proposed detection

822
00:35:24,960 --> 00:35:28,320
query should be made into a detection

823
00:35:28,320 --> 00:35:30,960
proposed detection title alert

824
00:35:30,960 --> 00:35:34,480
powershell clear event log executed

825
00:35:34,480 --> 00:35:36,320
and then of course

826
00:35:36,320 --> 00:35:39,760
my specific splunk search

827
00:35:39,760 --> 00:35:41,280
so

828
00:35:41,280 --> 00:35:44,240
one final thing i'd like to mention here

829
00:35:44,240 --> 00:35:46,480
there are many different ways one could

830
00:35:46,480 --> 00:35:48,640
conduct their thread hunting there's no

831
00:35:48,640 --> 00:35:50,880
one way to do it

832
00:35:50,880 --> 00:35:51,839
but

833
00:35:51,839 --> 00:35:54,400
this has just been a simple methodical

834
00:35:54,400 --> 00:35:56,240
way to approach it

835
00:35:56,240 --> 00:35:57,920
in the end we have our threat hunting

836
00:35:57,920 --> 00:36:01,280
results documented in a simple template

837
00:36:01,280 --> 00:36:04,480
and shared with our team

838
00:36:06,480 --> 00:36:07,359
and

839
00:36:07,359 --> 00:36:08,640
that's it

840
00:36:08,640 --> 00:36:10,000
so

841
00:36:10,000 --> 00:36:10,839
thank

842
00:36:10,839 --> 00:36:14,240
you thank you thank you and feel free to

843
00:36:14,240 --> 00:36:16,000
join in on the conversation with the

844
00:36:16,000 --> 00:36:17,200
blue team

845
00:36:17,200 --> 00:36:19,920
the blue team village

846
00:36:19,920 --> 00:36:22,079
on discord there's the discord server

847
00:36:22,079 --> 00:36:24,560
right there

848
00:36:24,640 --> 00:36:27,839
thank you very much