[00:00.000 --> 00:03.940]  This next talk is presented by the Packet Hacking Village.
[00:04.200 --> 00:07.940]  And it is absolutely my pleasure to introduce to you...
[00:07.940 --> 00:09.960]  well, I'm not going to... don't clap yet...
[00:09.960 --> 00:11.620]  Mr. Pete Hay.
[00:11.700 --> 00:16.820]  Pete Hay is Principal Security Strategist...
[00:16.820 --> 00:20.640]  oh, I'm sorry, Strategist at SimSpace.
[00:21.300 --> 00:25.800]  Yeah, he's also the founder of the CyberReport.
[00:25.800 --> 00:27.760]  Got it? Okay.
[00:27.760 --> 00:31.900]  And Pete's presentation is on the importance of arts and craft.
[00:32.740 --> 00:34.760]  By the way, I will have to say...
[00:35.420 --> 00:37.320]  arts and craft is becoming a lost art.
[00:37.320 --> 00:39.400]  I would imagine you're going to be mentioning that.
[00:39.560 --> 00:40.240]  Sadly.
[00:40.240 --> 00:41.580]  Absolutely the truth, yes.
[00:41.580 --> 00:42.680]  In ThreatOps.
[00:42.680 --> 00:45.540]  And it is now my absolute pleasure to introduce to you...
[00:45.540 --> 00:46.500]  Pete Hay!
[00:48.300 --> 00:49.580]  Thank you very much.
[00:49.580 --> 00:55.660]  I will be your guide on this next exploration of arts and crafts in ThreatOps.
[00:55.660 --> 01:00.060]  The topic comes from my personal experience, my background.
[01:00.060 --> 01:01.540]  I have to do the about me.
[01:01.540 --> 01:06.500]  I don't think I get paid all of that nothing that I get paid for doing this if I don't show you this.
[01:06.940 --> 01:11.840]  My background is I am a recovering Navy sailor.
[01:12.460 --> 01:14.480]  That's going perfectly. Excellent.
[01:14.480 --> 01:16.240]  The live demo gods are angry.
[01:18.720 --> 01:21.340]  And then I spent a bunch of time teaching after that.
[01:21.340 --> 01:23.820]  I taught JCAC, a couple of other places like that.
[01:23.820 --> 01:31.080]  And one of the things that struck me and this concept of arts and crafts started resonating as I was teaching.
[01:31.080 --> 01:37.020]  Because one of the things that's so important for learning something is having a visual medium for delivering your concepts.
[01:37.140 --> 01:42.040]  And to be completely honest, I am terrible at drawing.
[01:42.200 --> 01:45.860]  And my students, I'd draw something up there and be like, yeah, that's a laptop over there.
[01:45.860 --> 01:47.480]  And they'd say, it is?
[01:47.760 --> 01:48.900]  And I'd say, yes, I promise.
[01:48.900 --> 01:51.420]  But look, they didn't hire me for my arts and crafts skills.
[01:51.420 --> 01:53.220]  And I said that for years kind of as a joke.
[01:53.220 --> 01:57.560]  And what I realized is getting better at arts and crafts is something I desperately needed.
[01:57.560 --> 02:00.280]  Because it's such an information-dense medium.
[02:00.440 --> 02:03.260]  So on top of that, I'm, like I said, a teacher.
[02:03.260 --> 02:04.380]  I'm neurodivergent.
[02:04.380 --> 02:09.940]  And you're probably going to see a little bit of that come into play as I'm mentally up here saying, slow down.
[02:09.980 --> 02:11.180]  Slow down.
[02:11.420 --> 02:15.660]  And also, I really like the visual medium for that reason.
[02:15.660 --> 02:18.680]  Because not everybody learns the same way.
[02:18.680 --> 02:28.600]  When you're neurodivergent, you're increasingly aware that other people might also diverge from the...
[02:28.600 --> 02:32.140]  I don't want to think too hard about that.
[02:32.140 --> 02:35.600]  But other people may not interact with the world the same way that you do.
[02:36.000 --> 02:40.040]  And so for that reason, I want to teach audibly as I'm speaking.
[02:40.040 --> 02:41.620]  I want to demonstrate visually.
[02:41.620 --> 02:44.280]  I want to give people repetition, hands-on.
[02:44.280 --> 02:52.580]  And the combination of those mediums means that there's going to be a greater throughput or a greater baud rate of data transfer and more success along the way.
[02:52.580 --> 02:55.060]  So that's where this concept of arts and crafts.
[02:55.120 --> 02:58.120]  And then because you're all captive, I'm going to show you pictures of my cute family.
[02:58.240 --> 02:59.960]  And tough. You've got to deal with it.
[02:59.960 --> 03:00.940]  So there we go.
[03:01.740 --> 03:02.120]  All right.
[03:02.120 --> 03:05.560]  So Arthur Brisbane said, a picture is worth a thousand words.
[03:05.560 --> 03:12.600]  And I think that's the core concept that we're talking about today is the density of information that you can put in a visual medium.
[03:12.600 --> 03:17.960]  And so my follow-on is, well, how many words then is a good diagram actually worth?
[03:18.060 --> 03:27.340]  The reality is what I'm going to try to show you today is we can convey a great deal of information in a good diagram.
[03:27.480 --> 03:38.360]  And I'm going to be using the medium of threat intelligence and incident response and incident reports as a way of conveying that we can condense that information down and make it more accessible to people.
[03:38.360 --> 03:44.920]  And what I really like about it, and again, this kind of goes back to both the teaching and the neurodivergence, is not everyone is an expert in everything.
[03:45.120 --> 03:48.280]  And you'll be shocked to hear that I am also not an expert in everything.
[03:48.460 --> 03:56.740]  And so when you get a great picture, a great diagram, a great analogy, that helps lower the barrier of entry.
[03:56.800 --> 04:01.500]  And it's one of the things that I've really enjoyed watching change over the time that I've been in cyber.
[04:01.500 --> 04:08.220]  There was a time where there was a lot of elitism and kind of not invented here, we're red teamers or whatever, whatever, whatever.
[04:08.480 --> 04:10.840]  And I feel like that's changing for the better.
[04:10.840 --> 04:13.880]  And so I'm really excited to share this with you.
[04:14.380 --> 04:18.260]  So my concept is, first of all, diagrams.
[04:18.320 --> 04:22.000]  Diagrams are an essential part of cybersecurity knowledge management.
[04:22.200 --> 04:25.140]  Most diagrams focus on a single domain though.
[04:25.140 --> 04:30.780]  So I have some examples up here that I've taken out of Cisco reports and one of them is from a Mandiant report.
[04:30.780 --> 04:34.520]  And what you have is Cisco has this great timeline.
[04:34.520 --> 04:38.840]  Like what's the history of the APT that we might be looking at there?
[04:38.920 --> 04:45.140]  The one that I really like from Mandiant, it is actually useful, but what I love about it is, the second one there,
[04:45.140 --> 04:52.460]  is that is the history of the different tooling that APT 43 has used historically.
[04:52.560 --> 04:58.100]  And if I didn't explain that to you, there would be essentially no way to glean that from the image.
[04:58.100 --> 05:02.500]  And it's there, it's useful, it needs words surrounding it.
[05:02.900 --> 05:08.080]  And if that's what you're looking for, it can be very useful and very informative.
[05:08.460 --> 05:15.580]  But one of the things that bothers me about this a lot, and I know Mandiant is down there, so don't rat me out.
[05:15.580 --> 05:20.740]  But the X and Y axis don't mean anything in that diagram.
[05:20.740 --> 05:27.620]  And that bothers me to a great deal because there's nothing to contextualize the visual medium to help me understand what I'm looking at.
[05:27.620 --> 05:34.620]  And then finally, we have an example of what I think is a very good diagram from a Talos report on...
[05:34.620 --> 05:42.400]  and I'm actually a new unknown actor that's attacking Ukrainian and Polish government entities.
[05:42.400 --> 05:47.660]  And what they're showing is the timeline of the behavior of a piece of malware.
[05:47.660 --> 05:54.340]  That initially, at the first stage, it is some kind of lure, whether it be PowerPoint or Excel.
[05:54.340 --> 06:00.900]  And then from there, you get different outputs. And the idea is they're showing you a flow, a logical flow of what takes place.
[06:00.960 --> 06:04.280]  I like some of these things. I dislike some of these things.
[06:04.280 --> 06:10.720]  And so what I've tried to do is put it together in a way where we can use the X and Y axes effectively.
[06:11.080 --> 06:13.920]  And here's the thing. There's a risk with that.
[06:13.920 --> 06:18.760]  And as we know, there's a rule that there must be an XKCD that covers this concept.
[06:18.780 --> 06:20.020]  There is.
[06:20.020 --> 06:24.220]  There are 14 competing standards. I think I've shown you three of them.
[06:25.660 --> 06:32.280]  So obviously, I'm the guy to create the new one, the one standard to rule them all.
[06:32.680 --> 06:34.780]  And what's the outcome of that?
[06:36.500 --> 06:38.000]  15 competing standards.
[06:38.000 --> 06:42.560]  So my goal is not actually... I've had this in mind from the beginning.
[06:42.560 --> 06:45.020]  So my goal is not to create the one perfect standard.
[06:45.020 --> 06:52.380]  What I want to do is, like so many things, I want to give you a tool that you can put in your repertoire and break it out at the correct time.
[06:52.580 --> 06:57.240]  I think you'll find that what I'm showing you is really, really good for things like executive summaries.
[06:57.540 --> 07:00.100]  Maybe if you're familiar with the term bottom line up front.
[07:00.300 --> 07:02.800]  That sort of thing. This visualization is going to do that.
[07:02.800 --> 07:09.880]  And then the beauty of it is, depending on how you present it, you can actually put a lot more information for people to zoom in closer and get more detail.
[07:09.900 --> 07:11.500]  So we'll go over that in just a moment.
[07:11.500 --> 07:14.520]  Everybody ready? Loose? Good? Me too.
[07:14.980 --> 07:19.680]  All right. So how do we organize the data? First of all, great question. Very glad you asked. Appreciate it.
[07:19.780 --> 07:22.780]  You all are really on top of it. And I appreciate your engagement.
[07:23.860 --> 07:26.320]  So what I'm doing, I call this a threat matrix.
[07:26.860 --> 07:32.460]  Mostly because it sounds cool and because I'm going to use a lot of geometry, not geography. That would be different.
[07:33.140 --> 07:37.760]  Geometry related terms and it kind of seemed to go together, so deal with it.
[07:38.240 --> 07:40.840]  I've spent some time in marketing. I'm sorry. I apologize.
[07:40.840 --> 07:45.120]  So the matrix idea is we have two axes.
[07:45.520 --> 07:50.600]  And on the first one, I'm going to use, excuse me, on the X axis, a timeline.
[07:50.600 --> 07:54.560]  Why a timeline? Because shockingly, it's not there on lots of things.
[07:54.560 --> 08:01.360]  So we kind of have it in threat intelligence in terms of fate, like Mandiant, threat attack life cycle.
[08:01.540 --> 08:06.060]  We have, I see a lot of people looking like this. I apologize. There's a better view coming soon.
[08:06.400 --> 08:07.720]  Save your necks.
[08:07.720 --> 08:15.380]  But we have this idea of maybe, we want to say tactics, right? The columns in the MITRE ATT&CK framework.
[08:15.900 --> 08:21.700]  And there is kind of a sequencing, kind of a timeline, but it's not guaranteed to be accurate.
[08:21.700 --> 08:29.100]  And when we want to understand actual behaviors, actual TTPs associated with a threat actor, we need sequencing.
[08:29.100 --> 08:34.400]  And time is the method that I chose for sequencing the behaviors of a threat actor in this case.
[08:35.880 --> 08:40.820]  So first of all, the X axis timeline, like I said, and I have a couple of examples.
[08:40.820 --> 08:43.660]  This is what an attack's timeline looks like in a Talos report.
[08:43.840 --> 08:47.800]  There's another example of a timeline in terms of looking at a single binary.
[08:47.920 --> 08:50.800]  And I think I mentioned earlier that they tend to be domain focused.
[08:50.800 --> 08:55.640]  So in this case, the domain is history. In this case, the domain is the behavior of a given binary.
[08:55.860 --> 09:01.060]  And over here, you have a completely illegible layer of the MITRE ATT&CK framework,
[09:01.060 --> 09:03.420]  which is both the strength and the weakness of the framework.
[09:03.500 --> 09:07.320]  It can cover a lot of things. On the other hand, it also covers a lot of things.
[09:07.320 --> 09:09.180]  So it takes up a lot of space, right?
[09:10.000 --> 09:12.060]  So there are at times...
[09:13.040 --> 09:15.240]  Apparently, I need to just stop pacing. I don't know.
[09:16.720 --> 09:21.840]  I'm going to generate some kind of tick as I try and figure out what I have to do to make that not turn black.
[09:22.020 --> 09:27.060]  So the idea being that there is a lot of information conveyed there, but there's not a...
[09:27.060 --> 09:30.060]  You'll notice in the MITRE ATT&CK layers, there is no...
[09:30.700 --> 09:33.140]  The hip bone is connected to the thigh bone.
[09:33.140 --> 09:36.140]  Technique A leads directly into technique B.
[09:36.460 --> 09:42.420]  And so when we're talking about detection engineering or designing TTP-related detections or responses,
[09:42.420 --> 09:45.400]  though the techniques are valuable and important,
[09:45.400 --> 09:52.480]  it is difficult to put them together and have them coalesce into a response action or a detection that one can employ.
[09:53.120 --> 09:57.940]  And so, again, I'm proposing using time or sequencing, however you prefer to think of it,
[09:57.940 --> 10:00.440]  as a manner of conveying that visually.
[10:01.780 --> 10:05.180]  And then, of course, yep, timeline. There we go.
[10:07.020 --> 10:11.240]  The other thing I have is the y-axis, which I'm calling artifact planes.
[10:11.820 --> 10:15.560]  The idea being I want to cluster things based on where you find them.
[10:15.980 --> 10:21.480]  So I started with host, network, in terms of the planes.
[10:21.480 --> 10:24.000]  You can subdivide them to your heart's content.
[10:24.300 --> 10:29.180]  I'm not going to stop you. There's no, you know, artifact plane police, I promise.
[10:29.580 --> 10:34.200]  But my thought is I've divided them into places where I commonly find things,
[10:34.200 --> 10:36.620]  internal and external network artifacts.
[10:36.840 --> 10:41.000]  On a host, you might have things that are resident in memory and have other things that are resident on disk.
[10:41.000 --> 10:42.800]  So I subdivide that way.
[10:42.820 --> 10:47.220]  You could do cloud. You could have, like, network, compute, store,
[10:47.220 --> 10:51.660]  all locations that you would have logs or artifacts indicating behaviors.
[10:51.840 --> 10:54.080]  Because that's the core. We want to get to the artifacts related to the behaviors
[10:54.080 --> 10:56.820]  and visually represent all of the above.
[10:57.360 --> 11:00.360]  All right. So then we break those down into nodes.
[11:00.840 --> 11:04.460]  What are the nodes? Well, it's the thing that relates to it.
[11:04.480 --> 11:11.220]  The really important thing is commonly when you have a log, it relates to a thing.
[11:11.460 --> 11:14.080]  And you have, so for instance, I'll use Sysmon.
[11:14.080 --> 11:19.060]  We have lots of different event IDs that indicate the behavior of a process.
[11:19.240 --> 11:21.800]  But we don't coalesce that down into the process.
[11:21.800 --> 11:24.520]  The process did this, the process did that, the process did that.
[11:24.520 --> 11:26.500]  The process related with something in this way.
[11:26.500 --> 11:30.580]  And that's what I'm proposing we actually graphically represent up there, I promise.
[11:32.180 --> 11:32.800]  See?
[11:35.080 --> 11:37.020]  So what sorts of nodes do we have?
[11:37.020 --> 11:40.100]  Well, you see, there's an email up there, and I used an email picture for this.
[11:40.100 --> 11:43.640]  You could draw boxes as well. And if I were drawing, I assure you, I would.
[11:43.640 --> 11:47.720]  Sometimes I'll do circles. They kind of even look like circles when I draw them.
[11:48.160 --> 11:53.700]  So whatever it is you want to represent, there's a medium, there's a manner that you can represent it.
[11:53.700 --> 11:59.820]  So examples, file servers, host, endpoint, infrastructure, email, attachments, links, web servers, domains.
[11:59.820 --> 12:01.620]  Those are all things you might find in the network.
[12:01.880 --> 12:06.260]  In the host, you might find a host, by the way. Those exist.
[12:06.260 --> 12:10.060]  We should know stuff about them. Addressing, domain names, et cetera.
[12:10.060 --> 12:12.020]  IP addresses, MACs.
[12:12.520 --> 12:18.100]  Then on that host, there may be processes, user context, registry files, name pipes, et cetera.
[12:18.100 --> 12:20.120]  Fair enough? Following along?
[12:20.120 --> 12:22.240]  Cool, cool, cool. We'll get to the fun stuff soon, I promise.
[12:23.720 --> 12:26.080]  All right. Network plane.
[12:26.600 --> 12:31.640]  Another couple of things that I've done here is one of the things I realized as I was looking at this in terms of artifacts,
[12:31.640 --> 12:33.740]  there are certain places where you get a lot of artifacts.
[12:33.860 --> 12:37.160]  And I don't really want to draw a line for every single artifact.
[12:37.280 --> 12:38.900]  That's where I drew these triangles.
[12:38.900 --> 12:41.620]  I'm trying to represent the relationship.
[12:41.700 --> 12:45.980]  So if in one being a C2 session, essentially over time...
[12:46.940 --> 12:48.540]  Sorry, my hands got big there.
[12:48.540 --> 12:52.360]  Over time, that process communicated with a single endpoint.
[12:52.360 --> 12:54.980]  So it's kind of like many connections to one endpoint.
[12:54.980 --> 12:57.320]  That's what that shape of the triangle is trying to represent.
[12:57.900 --> 13:01.560]  On the other hand, we're talking about enumeration on the local network.
[13:01.560 --> 13:06.520]  So again, you'll notice that's all combined in the internal network artifact plane.
[13:06.520 --> 13:08.460]  It's finding multiple hosts.
[13:08.460 --> 13:13.280]  And it's one host scanning multiple endpoints, multiple IPs, et cetera.
[13:13.320 --> 13:15.840]  Different shaped triangle. Fair enough.
[13:15.980 --> 13:19.220]  I love how you're all coming along with me because you basically have no choice.
[13:20.500 --> 13:21.840]  All right. Host plane.
[13:21.840 --> 13:23.240]  Same kind of idea.
[13:23.240 --> 13:26.760]  I subdivided it into memory and file system artifacts.
[13:26.760 --> 13:29.940]  You notice I put the registry on the line between the two because, you know,
[13:29.940 --> 13:32.020]  sometimes it's in memory, sometimes it's on disk.
[13:32.020 --> 13:33.360]  That made sense to me.
[13:33.400 --> 13:34.260]  Do what you want.
[13:34.260 --> 13:36.560]  You can represent these things however you wish, right?
[13:38.680 --> 13:40.540]  No artifact police here.
[13:41.160 --> 13:44.520]  And again, we have processes, files being written to disk,
[13:44.520 --> 13:48.480]  and you can see the writes, reads, loads, et cetera, being the lines connecting them.
[13:50.280 --> 13:52.300]  All right. How do I use it?
[13:52.520 --> 13:54.580]  Again, y'all are really on top of things.
[13:54.580 --> 13:56.180]  I appreciate it. Great question.
[13:56.880 --> 13:59.000]  I really appreciate you being here with me for this.
[14:00.320 --> 14:03.840]  So I've actually got a couple of use cases, and I'm going to stop pacing now
[14:04.400 --> 14:06.640]  and sit down and walk through them with you.
[14:07.020 --> 14:09.120]  Just so you know, I'm going to use Miro for a lot of this
[14:09.120 --> 14:12.480]  because, again, you remember the part where I covered I'm bad at drawing,
[14:12.480 --> 14:14.460]  so we're going to let the computer draw for me.
[14:14.880 --> 14:17.480]  So what I'm going to do is I'm going to sit down, I'm going to swipe over to Miro,
[14:17.480 --> 14:19.780]  and I'm going to walk through Royal Ransomware,
[14:20.400 --> 14:22.960]  and that one we're going to actually dive a little bit into the weeds.
[14:23.320 --> 14:25.700]  It's going to be literally function level.
[14:25.920 --> 14:27.540]  There will be assembly on there.
[14:27.540 --> 14:30.860]  And the beauty of it is I don't have to memorize all of it,
[14:30.860 --> 14:32.700]  so I'm going to show you how to use comments and things like that
[14:32.700 --> 14:35.520]  to make it really, really easy to operationalize that threat intelligence,
[14:35.520 --> 14:39.260]  to show the flow of the program, the binary in that case.
[14:39.540 --> 14:42.840]  For Talos, the Talos report, it's Euro Trooper,
[14:42.840 --> 14:46.820]  and we're going to examine how it is that Euro Trooper conducts themselves.
[14:46.820 --> 14:49.480]  We're actually going to visually see their behaviors,
[14:49.480 --> 14:51.280]  and we're actually going to talk about a use case
[14:51.960 --> 14:55.620]  where with Euro Trooper, they have a single dependency,
[14:55.620 --> 14:59.220]  though they have multiple lures and fishing techniques,
[14:59.220 --> 15:04.020]  they have a single central point when it comes to their getting from stage 1 to stage 2.
[15:04.160 --> 15:07.960]  And if I were designing detections and response actions,
[15:07.960 --> 15:09.580]  this is what I would target.
[15:09.740 --> 15:12.830]  And I think it becomes very visually obvious,
[15:13.180 --> 15:16.340]  and it's funny because sometimes I think threat intel,
[15:16.340 --> 15:20.260]  operationalizing threat intel and designing behavior-based hunts and response actions
[15:20.260 --> 15:22.340]  is viewed as difficult,
[15:22.340 --> 15:27.540]  and in this case, you're going to see identifying what needs to be hunted on or responded to
[15:27.540 --> 15:29.500]  becomes pretty easy visually.
[15:30.060 --> 15:32.520]  And then finally, I've got two more things,
[15:32.520 --> 15:34.740]  and we'll kind of see how we're doing on time on that,
[15:34.740 --> 15:39.220]  but there's a new attacker against Ukraine and Poland.
[15:39.220 --> 15:41.240]  That report came out from Talos last week,
[15:41.240 --> 15:44.080]  and I wanted to do something really, really fresh,
[15:44.080 --> 15:47.920]  mostly because I was doing it anyway, and I thought it would be fun to share with you,
[15:47.920 --> 15:50.880]  and show you how the visualization comes together.
[15:50.880 --> 15:54.820]  And the thing that's interesting about this one is Talos hasn't really finished their report.
[15:54.820 --> 15:58.460]  They did kind of an initial report, and we can show you what we know up to that point,
[15:58.460 --> 16:00.900]  and then we see the dropper in the second stage,
[16:00.900 --> 16:04.360]  and then they're kind of like, well, we haven't really done all the analysis beyond this,
[16:04.360 --> 16:10.160]  but we get the ability to defend because, again, there's that chain of dependency.
[16:10.160 --> 16:11.900]  And if you can break that chain of dependency,
[16:12.700 --> 16:19.700]  then you have a viable technique kind of irrespective of what follows in stage three and four of this attack.
[16:19.700 --> 16:21.940]  There's also something that really bothers me.
[16:21.940 --> 16:27.480]  You hear this phrase commonly that the defender has to be right all the time,
[16:27.480 --> 16:29.620]  and the attacker only has to be right once.
[16:29.700 --> 16:32.720]  And my good friend Bobby is sitting right over there, and he's a red teamer.
[16:32.720 --> 16:38.940]  And I've heard him cuss a lot at certain times, and that's because it's not that easy for red team.
[16:38.940 --> 16:40.600]  They don't have to just be right once.
[16:40.600 --> 16:46.960]  There are a lot of things that have to go right in order for an exploit operation to be successful.
[16:46.960 --> 16:53.160]  And so really what we're going to do is we're going to try and identify those connections that are vulnerable to a defense action
[16:53.160 --> 16:57.240]  and kind of kick the chair out from underneath them and make Bobby start cussing again,
[16:57.240 --> 17:00.680]  which is a good thing any time I can make it happen.
[17:01.540 --> 17:06.460]  And then if we may be able to get into examining using this for incident response,
[17:06.460 --> 17:07.920]  we'll just see how that goes with time.
[17:08.500 --> 17:09.840]  All right, buckle up.
[17:09.920 --> 17:16.940]  So with Royal Ransomware, what I've done here is, and again, I want to make sure that nobody is thinking I'm telling you,
[17:16.940 --> 17:19.740]  I'm doing research for myself. This is not. This came from a Talos report.
[17:19.900 --> 17:22.220]  The link is in the attachments on this.
[17:22.700 --> 17:27.760]  What I am doing is I am standing on the backs of giants in this, and I'm just trying to make it more accessible to others.
[17:28.520 --> 17:32.580]  So first thing I do is I add a comment that has the link to the content.
[17:32.580 --> 17:34.440]  This is where you can find the original research.
[17:34.560 --> 17:36.220]  You're more than welcome to look it up yourself.
[17:36.920 --> 17:41.160]  And again, that's going to kind of back up everything that I have to say about this going on.
[17:41.160 --> 17:47.740]  So you'll notice we have three planes here, local network, host memory artifacts, and host file system artifacts.
[17:47.980 --> 17:54.860]  And it's kind of quiet outside of the host memory artifacts until we get to the point where the ransomware starts encrypting,
[17:54.860 --> 17:56.400]  and then it gets real busy real quick.
[17:56.680 --> 17:57.980]  So we'll start.
[17:58.240 --> 18:00.300]  What is the method? Well, it's phishing.
[18:00.480 --> 18:04.560]  We don't have a lot of detail on how it happens because there are a lot of different Royal campaigns,
[18:04.560 --> 18:07.460]  and so I'm not going to belabor the point on how that might get there.
[18:07.460 --> 18:12.420]  We're going to start with an executable, getting written to disk, getting clicked on.
[18:12.420 --> 18:15.180]  You'll notice the parent process here is explorer.exe.
[18:15.180 --> 18:18.780]  That means one of you people clicked on it.
[18:20.160 --> 18:21.160]  Somebody did.
[18:21.580 --> 18:24.560]  And then we have Royal ransomware running on the system, right?
[18:25.540 --> 18:28.080]  Because, again, does it really matter how it got there?
[18:28.100 --> 18:34.060]  In this case, at this point, we are trying to look at the function level, how this ransomware actually behaves.
[18:34.060 --> 18:37.180]  Not as important to know how it got there when that's what we're examining.
[18:37.540 --> 18:40.220]  So the first thing we have, we start exploring functions.
[18:40.220 --> 18:42.460]  And you'll notice there's a lot of detail here.
[18:42.460 --> 18:43.880]  So I put it in comments.
[18:44.060 --> 18:47.680]  Why? Because if I wanted to do an overview, I can zoom out right here and say,
[18:47.680 --> 18:51.080]  all right, it does a couple of things, and then it tries to delete the shadow file.
[18:51.080 --> 18:52.540]  That's what's happening down here.
[18:52.660 --> 18:57.540]  One of the really interesting things that happens is this function calls command.exe,
[18:57.540 --> 18:59.340]  tries to delete the shadow file.
[18:59.340 --> 19:03.380]  The command line is very specific, very signatureable, very defendable.
[19:03.380 --> 19:09.140]  And by the way, Royal isn't the only malware family that tries to delete the shadow file in the exact same way.
[19:09.380 --> 19:16.760]  So if you were to use this technique, if you were to build a defense against an executable running command,
[19:16.760 --> 19:20.140]  trying to delete the shadow file with this exact set of switch options,
[19:20.140 --> 19:22.860]  which is probably a little hard for you all to read down there,
[19:22.860 --> 19:27.840]  but that's Windows system 32 vs. admin.exe delete shadows all quiet,
[19:27.840 --> 19:33.400]  you would not only successfully defend against Royal ransomware, but other ransomware families as well.
[19:33.400 --> 19:35.880]  This is one of those points of coalescence.
[19:36.040 --> 19:42.680]  Why? Because ransomware has to delete shadow files in order to be successful in preventing restoration, right?
[19:43.000 --> 19:46.900]  So, shockingly, there are a finite number of ways to do that,
[19:46.900 --> 19:51.340]  and this is an excellent place to identify and focus defenses around.
[19:51.820 --> 19:59.660]  Next, we could get into this and talk about every single aspect of what each function is doing,
[19:59.660 --> 20:05.640]  and I'm not going to do this for this talk, because the talk is not about Royal ransomware as excited as I would get about diving into that,
[20:05.640 --> 20:07.160]  because again, it's not my research.
[20:07.280 --> 20:11.200]  What I'm doing here is showing you how you can convey what is taking place.
[20:11.440 --> 20:16.500]  So first of all, at one point, it splits into an encryption slash network thread,
[20:16.500 --> 20:19.580]  and then it starts scanning the network for other vulnerable machines,
[20:19.580 --> 20:21.480]  other machines that it could potentially encrypt.
[20:21.480 --> 20:24.960]  I think we can all agree that's pretty bad, and we would like to prevent that.
[20:25.280 --> 20:30.380]  The other thing that happens is it spins up separate multithreaded note writing.
[20:30.380 --> 20:34.000]  It has to write its ransom notes, and it multithreads that as well.
[20:35.120 --> 20:39.620]  And then finally, it actually starts enumerating SMB shares,
[20:39.620 --> 20:41.920]  which again is an identifiable behavior.
[20:41.940 --> 20:45.260]  You could build time-based detections on SMB enumeration.
[20:45.260 --> 20:52.460]  You could take a look at how many SMB requests an individual process is doing at a given time.
[20:52.460 --> 20:55.060]  It almost doesn't matter. The point is we know it does this.
[20:55.060 --> 20:59.000]  It's something that it probably shouldn't be doing, especially in that limited user context,
[20:59.000 --> 21:01.200]  and we could build a detection around this pretty simply.
[21:02.440 --> 21:15.240]  The next thing it does is when it finds those machines that have SMB shares that it can do encryption of,
[21:16.220 --> 21:19.140]  You'll notice it's multithreaded. None of that is surprising.
[21:19.280 --> 21:25.740]  And again, I have details broken out on exactly what you can find for every single function that's present and what it's doing.
[21:26.220 --> 21:28.800]  If you want to go to that depth, you absolutely can.
[21:28.800 --> 21:32.180]  If you want to talk over it from a broad level, you can do that as well.
[21:32.360 --> 21:35.120]  And then finally, we get to the tail end, and what do you see?
[21:35.120 --> 21:39.860]  You'll notice again those triangles. I put them in red because they're very bad here.
[21:39.860 --> 21:44.320]  Again, a highly effective communication medium, right? Red equals bad.
[21:45.620 --> 21:49.420]  So here what we see is locally lots of read-writes.
[21:49.780 --> 21:52.400]  Is that something we could do from a detection standpoint?
[21:52.400 --> 21:57.840]  Like read-writes, using crypto libraries, those sorts of things over and over again?
[21:57.840 --> 21:59.080]  Yes, absolutely.
[21:59.420 --> 22:02.940]  And you know, it's funny, I was talking to some guys from Halcyon.ai,
[22:02.940 --> 22:06.340]  and that's one of the many things that they do to prevent ransomware.
[22:06.340 --> 22:08.140]  That's the bread and butter of their business.
[22:08.640 --> 22:16.480]  Same thing, those remote read-writes with crypto involved, probably a bad thing as well.
[22:16.740 --> 22:22.340]  So again, the point being that if I needed to explain in general what royal ransomware does,
[22:22.340 --> 22:26.120]  whether it be at a function level, I can do this function level.
[22:26.120 --> 22:29.800]  If I wanted to, I could collapse each of these functions down into a descriptor,
[22:29.800 --> 22:33.340]  like hey, this is what's happening, this binary is reaching out and touching the network,
[22:33.340 --> 22:37.060]  it's doing some SMB enumeration, it's doing some local file writing and encryption.
[22:37.060 --> 22:40.940]  All of those aspects can be communicated effectively with the method.
[22:41.560 --> 22:42.940]  That's the whole point.
[22:43.960 --> 22:47.760]  So next, I'm going to take a look at the Eurotrooper.
[22:47.820 --> 22:51.440]  And I apparently zoomed way, way in on Eurotrooper.
[22:51.440 --> 22:55.720]  I really like Eurotrooper because we're now talking about a campaign.
[22:56.080 --> 22:57.600]  What's the campaign look like?
[22:57.600 --> 23:01.320]  Well, what I've tried to do here is give you that thousand foot view.
[23:01.320 --> 23:05.880]  Enough details to understand what's going on, not so much detail that people start nodding off.
[23:07.300 --> 23:08.680]  So far, so good.
[23:09.080 --> 23:12.780]  All right, so in this, the campaign starts with a phishing email.
[23:13.020 --> 23:15.160]  And in this case, there is something very specific.
[23:15.160 --> 23:19.380]  They call it noda.rar, this campaign, use that over and over again.
[23:19.760 --> 23:23.040]  We'll pause now for a word from our sponsor, Panasonic.
[23:24.680 --> 23:25.460]  All right.
[23:27.380 --> 23:30.080]  And now, so what happens?
[23:30.080 --> 23:33.120]  Noda.rar gets downloaded, I put Outlook here, does it really matter?
[23:33.120 --> 23:34.920]  No, it could be anybody, don't care.
[23:35.360 --> 23:38.940]  Email, email client, noda.rar gets written.
[23:38.940 --> 23:41.100]  You notice I've drawn this very long.
[23:41.100 --> 23:44.220]  The reason I've drawn it very long is things are happening sequentially.
[23:44.220 --> 23:46.380]  That file is being accessed.
[23:46.480 --> 23:50.180]  And what you actually see is a write, you see a read, and then much later on you see a delete.
[23:50.180 --> 23:55.700]  So I made the file long because, again, I'm just trying to show sequencing and who's doing what and when.
[23:56.800 --> 24:00.560]  So we have, again, 7-zip with the parent process of Explorer.
[24:00.560 --> 24:03.700]  That means that, again, Phyllis clicked on it.
[24:04.320 --> 24:07.000]  And, you know, poor Phyllis, she didn't know any better.
[24:07.000 --> 24:08.720]  She's just trying to do her job out there.
[24:09.220 --> 24:11.320]  And now a link file has been downloaded.
[24:11.320 --> 24:22.860]  And because of the lure, and this one is, again, targeting, if I recall correctly, targeting largely Ukraine and Poland and, you know, no idea who it might be.
[24:22.940 --> 24:28.960]  But, you know, some people have been targeting them with a number of different rats in recent days, shockingly.
[24:28.960 --> 24:35.980]  And this has a commonality in all of their campaigns, and it is a link file.
[24:36.120 --> 24:39.660]  That they use a link file, and that link file is going to launch Mishta.
[24:41.220 --> 24:47.580]  And Mishta is going to, once again, and you'll notice parent process of Explorer yet again.
[24:47.580 --> 24:49.260]  So, again, a click on the link file.
[24:49.380 --> 24:55.800]  Mishta is going to reach out to the Internet and download, and you'll notice I do have the actual domain here.
[24:55.800 --> 24:59.500]  Because this is from the actual threat intelligence.
[24:59.940 --> 25:04.140]  That they're going to that particular domain, I see laptops opening, I might not, but your call.
[25:05.160 --> 25:12.200]  That's the domain they go to, and from there they download an HTA file, which is going to provide instructions for Mishta for what it's going to do next.
[25:12.200 --> 25:15.320]  Then it's going to follow those, execute those instructions.
[25:15.440 --> 25:22.060]  And those instructions include downloading, spawning a PowerShell process that's going to download file.pdf.
[25:22.060 --> 25:24.980]  This particular campaign downloaded from the same place.
[25:24.980 --> 25:33.680]  The next thing that's going to happen is another separate PowerShell process is going to launch, and it's going to download this lsax.exe.
[25:33.680 --> 25:41.700]  And then another PowerShell executable will launch, and that will delete the noda.rar.
[25:42.020 --> 25:47.200]  So, here's my point about points of congruence and about things coalescing.
[25:47.200 --> 25:54.060]  There is a dependency for everything right of this on essentially that link file and Mishta.
[25:54.060 --> 25:56.800]  And in particular, Mishta touching the Internet.
[25:57.280 --> 26:02.680]  So, if I were a defender, I might look at whoever's running my enterprise IT and say,
[26:02.680 --> 26:10.040]  Hey, y'all use Mishta to touch the Internet for any reason? No? Good.
[26:10.120 --> 26:12.860]  And we're going to deploy a response action that's going to disallow it.
[26:12.860 --> 26:14.480]  Lots of different ways of doing that.
[26:17.920 --> 26:20.380]  I feel haunted, I'm going to be honest with you.
[26:21.280 --> 26:22.880]  So, there are lots of different ways of doing that.
[26:22.880 --> 26:28.420]  The point being that the entire Euro Trooper campaign is dependent upon that one thing.
[26:28.420 --> 26:31.820]  Kick out that leg of the milk stool and the whole thing comes crashing down.
[26:32.060 --> 26:33.420]  Plus, it's funny.
[26:34.580 --> 26:36.180]  All right, so what else happens?
[26:36.640 --> 26:37.620]  What else happens?
[26:37.620 --> 26:42.620]  Well, the PowerShell is going to download and execute that lsax.
[26:42.820 --> 26:49.240]  And lsax is going to reach out and download a servicehost.exe and spawn that as a child process.
[26:50.700 --> 26:52.020]  SpoolServe.exe.
[26:52.020 --> 26:54.120]  And SpoolServe is going to launch.
[26:54.300 --> 26:56.900]  And SpoolServe is going to do some C2.
[26:56.900 --> 27:00.300]  And that's where you actually get to your final stage of your implant.
[27:00.300 --> 27:05.800]  And you get actual APT-like behavior with C2, XFIL, etc.
[27:06.000 --> 27:11.580]  Point being, there's an incredible dependency in this particular campaign on one thing.
[27:11.580 --> 27:13.980]  And that one thing being link files and Mishta.
[27:13.980 --> 27:20.040]  And between those two, you can do a combination of network defenses, host defenses saying,
[27:20.040 --> 27:22.600]  hey, Mishta.exe is not allowed to touch the internet.
[27:22.600 --> 27:26.040]  You could say we're not allowing link files to launch Mishta.
[27:26.040 --> 27:30.800]  There are all kinds of different ways that one could go about defending against this particular campaign.
[27:31.040 --> 27:32.900]  And I want to emphasize this.
[27:32.900 --> 27:39.920]  That doesn't involve copying and pasting the IOCs that I have in this report into various tools.
[27:39.920 --> 27:41.100]  Fair enough?
[27:41.420 --> 27:42.220]  Cool.
[27:42.220 --> 27:46.340]  I see some nodding. It's always good.
[27:46.380 --> 27:48.860]  And it wasn't off this time. It's excellent.
[27:49.640 --> 27:58.600]  All right. And then the last thing I want to talk to you about, like I mentioned, is this new report that I saw.
[27:58.600 --> 28:02.500]  Again, I used comments pretty heavily to show where the original source was.
[28:02.500 --> 28:06.800]  This is another Cisco Talos blog that was out, I think, the 7th of August.
[28:06.800 --> 28:14.920]  In this, what I really like about this one is there are a couple of different ways this can go.
[28:15.100 --> 28:23.560]  And so what I'm going to show you is multiple campaigns with minimal difference in actual overall behavior,
[28:23.560 --> 28:28.320]  despite having different hashes, different files, different lures, et cetera.
[28:28.320 --> 28:31.900]  So in this case, their lure is this is targeting Ukraine and Poland,
[28:31.900 --> 28:37.300]  and they've got PPTs targeting Ukraine, military orgs specifically,
[28:37.300 --> 28:42.620]  and then there are Excel lures from the Ukraine State Treasury.
[28:42.800 --> 28:51.620]  So two different lures, different behaviors, kind of, but if you actually look at how it executes, pretty similar.
[28:51.620 --> 28:54.600]  So we have now a mail client downloading and writing the file.
[28:54.600 --> 28:56.980]  It doesn't really matter which file it is. It's written to disk.
[28:56.980 --> 28:59.700]  And both of them contain VBA script.
[28:59.700 --> 29:04.220]  So that VBA is going to, it actually contains a lot of information.
[29:04.220 --> 29:08.080]  So as PowerPoint or Excel, doesn't really matter which one, again,
[29:08.080 --> 29:10.500]  whichever one it is, it's going to start running that VBA,
[29:10.500 --> 29:14.860]  unless, of course, you all have policies in place to prohibit those sorts of things.
[29:15.740 --> 29:16.820]  Good talk.
[29:17.240 --> 29:20.660]  So then that runs, and it does two writes.
[29:20.720 --> 29:22.740]  There's no download in this case.
[29:22.740 --> 29:27.920]  By the way, here's another use of a link file, again, targeted against Ukraine.
[29:27.920 --> 29:31.940]  Would we maybe say maybe there's some familiarity there, maybe there's some commonality?
[29:31.940 --> 29:35.120]  Who knows? It might just be people not wanting to rob from the poor.
[29:35.120 --> 29:39.980]  If link files are being successful, and, you know, Will Ferrell is saying, you know,
[29:39.980 --> 29:44.360]  so hot right now, then we jump in on that action and go with what works.
[29:44.980 --> 29:47.060]  That was my meme reference. I promised one.
[29:47.940 --> 29:53.460]  So link file, and then the other thing that is, again, contained within that VBA in a data blob,
[29:53.460 --> 29:57.880]  it's actually broken up so you won't find the binary if they're scanning for the binaries,
[29:57.960 --> 30:02.480]  a couple of different blobs to make up the binary, which is an executable or DLL.
[30:03.180 --> 30:10.900]  That is, they then use redsurf32.exe or run DLL32.exe to launch that,
[30:10.900 --> 30:14.660]  and whichever one it is downloads an image.
[30:14.660 --> 30:16.500]  By the way, I'm going to zoom in right here.
[30:16.500 --> 30:23.760]  This is the actual image that on the end of that image, and it's not steganography, guys.
[30:24.060 --> 30:26.980]  I know some of us are excited because we're like, finally, it's here.
[30:26.980 --> 30:30.680]  It's just data on the end of the image. It's not, you know, encapsulated in the image.
[30:30.680 --> 30:32.740]  It's just extra data on the end of the JPEG.
[30:33.020 --> 30:35.240]  But it contains a binary.
[30:35.800 --> 30:40.120]  That binary is going to download, decrypt, and run.
[30:40.580 --> 30:42.400]  Sorry, back to our sponsor.
[30:43.020 --> 30:45.480]  It's going to download, decrypt, and run in memory.
[30:46.420 --> 30:48.860]  And here's the really interesting part.
[30:49.740 --> 30:52.860]  Cisco's like, anyway, we're kind of done with our analysis at this point.
[30:52.860 --> 30:56.680]  And if you read their blog, they're like, that's because our decryptor broke on this.
[30:56.680 --> 31:01.180]  So we know from some other reporting and some callbacks,
[31:01.180 --> 31:07.120]  we're pretty sure that what follows up is either Cobalt Strike or Agent Tesla.
[31:07.540 --> 31:14.300]  But we can't prove that, so they actually stopped their early threat bulletin at that point
[31:14.300 --> 31:16.980]  until they could prove more, which I, A, respect.
[31:16.980 --> 31:21.380]  And, B, I'm very grateful they didn't wait until they had it perfect to spit this out.
[31:21.420 --> 31:23.380]  Because people have to defend.
[31:23.520 --> 31:26.200]  And guess what? We've got enough here to do some defense.
[31:26.440 --> 31:29.980]  Because what's our point of congruence?
[31:30.620 --> 31:33.420]  It's the VBA running in PowerShell or Excel.
[31:33.420 --> 31:35.560]  It doesn't really matter which one it is.
[31:35.560 --> 31:41.340]  Or you could say it's that it's register 32 or run DLL 32 downloading from the Internet.
[31:41.340 --> 31:45.240]  Another thing that's highly signatureable and highly preventable.
[31:45.820 --> 31:49.900]  So this is at the core of my concept, and it looks like I do have enough time,
[31:49.900 --> 31:53.100]  so I'll go actually take a look at this from an incident response standpoint.
[31:53.980 --> 31:59.260]  That means I was talking faster, and that means that the neurodivergence was in full effect.
[31:59.260 --> 32:02.100]  So I'm glad that everybody's still here with me.
[32:02.580 --> 32:06.600]  So let's go ahead and take a look at what this looks like in an incident response.
[32:06.600 --> 32:11.160]  So first of all, you may be asking, what happens if there are multiple hosts compromised?
[32:11.160 --> 32:14.120]  Great question. It can be handled a bunch of different ways.
[32:14.160 --> 32:19.020]  This is one example where I showed on the timeline multiple hosts being compromised.
[32:19.020 --> 32:21.600]  There's actually a third host down below, but I couldn't figure out a good way
[32:21.600 --> 32:24.760]  to make it even slightly legible and on a single pane.
[32:26.280 --> 32:28.800]  And you'll notice that the timeline still continues.
[32:28.800 --> 32:32.300]  The hosts can continue their behavior, but there are multiple hosts compromised.
[32:32.300 --> 32:37.480]  The other thing from an incident response, and you may be thinking it's odd
[32:37.480 --> 32:39.860]  that I'm tying incident response and threat intel together,
[32:39.860 --> 32:44.200]  but what I would point out is that threat intel is just somebody else's incident response, right?
[32:44.480 --> 32:48.360]  That's just not yours, which is ideal. It's a great place to learn from.
[32:48.520 --> 32:51.960]  In fact, I think many would argue it's better to learn from others' mistakes than their own.
[32:51.960 --> 32:54.680]  That's not my method, but many people employ that.
[32:56.280 --> 32:59.740]  So in this case, we start from the initial alert.
[32:59.740 --> 33:04.560]  So in this case, an initial alert would be process injection taking place.
[33:04.700 --> 33:09.240]  In this case, I've got really good example names, so I'm just calling it Trojan.exe.
[33:09.240 --> 33:11.040]  It's just a placeholder for Trojan.
[33:11.140 --> 33:14.860]  And we've got services.exe being injected into.
[33:14.880 --> 33:19.000]  From this point, we now need to figure out what has happened, right?
[33:19.000 --> 33:22.700]  So bear with me and imagine that not everything is populated here right now.
[33:22.700 --> 33:24.980]  We're actually conducting an incident response.
[33:25.060 --> 33:29.280]  So you basically have two directions you can move, left and right, from that alert.
[33:29.280 --> 33:31.760]  I'm moving back to source and trying to figure out where it is.
[33:31.760 --> 33:34.920]  I'm moving forward and trying to scope the effects that I experienced.
[33:35.480 --> 33:37.880]  Either one is fine with me. They both have their benefits.
[33:37.880 --> 33:39.920]  If you go backwards, you can kick off threat hunts.
[33:39.920 --> 33:46.560]  That may be more effective in defending your business continuity operations from the risk and prevent it from spreading.
[33:46.560 --> 33:51.420]  One of my favorite things is if this is sitting in an inbox and we're part of a campaign,
[33:52.000 --> 33:55.600]  I get that in this case, poor Phyllis. I hope nobody here is named Phyllis.
[33:55.600 --> 33:58.060]  That's not them. It's other Phyllis. Different Phyllis.
[33:58.060 --> 34:03.160]  But this poor person has clicked on this link and we now have an incident going on.
[34:03.160 --> 34:09.360]  But I'd sure like to know if it's sitting in 30 more inboxes and I've got 30 more potential incidents sitting in my email.
[34:09.360 --> 34:19.500]  So we might prioritize going backwards to origin and finding artifacts that we can remove to protect our business more effectively.
[34:19.760 --> 34:25.140]  Conversely, you may be concerned about what is the scope of this and we need to triage what's happening right now.
[34:25.160 --> 34:27.600]  I've seen playbooks that emphasize both.
[34:27.600 --> 34:30.380]  I've seen playbooks that emphasize one over the other.
[34:30.540 --> 34:36.900]  I've seen playbooks that say you should have one analyst go one direction and one analyst go the other way and, you know, meet in the middle, right?
[34:37.480 --> 34:41.840]  All of those, I think they're good arguments in favor of and that's not my talk today.
[34:41.900 --> 34:46.620]  So what we're going to do is we're just going to walk through what it looks like to go backwards first and then I'll go forward second.
[34:46.840 --> 34:51.680]  So going backwards, I'm going to say, listen, I've got a process. I know it's doing something that we find suspicious.
[34:51.680 --> 34:57.220]  I need to scope it and I want to know where it came from, which means I'm looking for the create process.
[34:57.220 --> 35:02.800]  Whether that be Sysmon Event ID 1 or CrowdStrike or whatever, it doesn't really matter.
[35:02.800 --> 35:03.940]  I need to know where it came from.
[35:04.040 --> 35:07.260]  Who's its parent process? In this case, we find that it's Explorer.
[35:07.260 --> 35:09.980]  All right, great. Now, where did the file come from, the image load?
[35:11.000 --> 35:13.380]  Well, that's Trojan.exe sitting on disk.
[35:13.380 --> 35:16.660]  What do you think I'm going to follow up next? All right, where did it come from on disk?
[35:16.760 --> 35:17.800]  What is it doing?
[35:18.860 --> 35:21.100]  And we're going to look at, what are we going to do?
[35:21.100 --> 35:25.740]  We now have a file name and a path and a location.
[35:25.940 --> 35:30.420]  And so we have a new query that we can run and say, where's the file write?
[35:30.420 --> 35:33.600]  What is the parent process on the file write? What's the command line on that? Et cetera.
[35:33.600 --> 35:37.360]  In this case, we're blaming it on Outlook again, and that's where it came from.
[35:37.360 --> 35:41.240]  Now, I have the ability to, am I going to go into email logs?
[35:41.240 --> 35:42.840]  Are we going to look at this in network traffic?
[35:42.960 --> 35:47.620]  Am I going to say, no, I'm a host analyst and I'm going to call a grown-up and have them do that on the email side of things?
[35:47.620 --> 35:52.480]  All of those are, again, viable based on whatever your organization does and how you implement it.
[35:52.640 --> 35:56.580]  So, the diagram, but the diagram still gets populated.
[35:56.580 --> 36:07.460]  And the beauty is, when we have the file, we now have something discreet and huntable to determine if we've got, again, 20 more incipient incidents sitting in our enterprise that we don't know about.
[36:07.740 --> 36:13.860]  I think one of the big challenges facing, this is a personal opinion, so you can take it, it's worth the paper it's written on.
[36:13.860 --> 36:19.160]  But I think one of the big challenges we have is much too much of cybersecurity is linear.
[36:19.160 --> 36:23.220]  We're waiting for a full report before a threat hunt gets kicked off.
[36:23.220 --> 36:26.920]  We're waiting for IOCs to be generated before detection engineering occurs.
[36:26.920 --> 36:38.660]  One of the things I really like about if you are capturing your artifacts in a diagram like that, it means that when your SOC supervisor, who has, in my opinion, the hardest job I can think of,
[36:38.660 --> 36:46.440]  because you've got all these people, all these different things going on, and you're trying to figure out what's in a person's head, knowledge management is extremely difficult in this industry.
[36:47.240 --> 36:57.980]  You now have a method for looking over their shoulder and getting an understanding of where they are currently looking at this incident, how well scoped it is, maybe even how far along they are.
[36:57.980 --> 37:04.000]  Can you task another person to help them out and say, hey, you know what, ignore that network stuff, I've got a guy, we'll hook that up.
[37:04.000 --> 37:10.760]  These are the sorts of ways that it can be beneficial to an enterprise in live, in use.
[37:11.520 --> 37:14.180]  You'll notice they have run key persistence.
[37:14.540 --> 37:22.260]  That's one of those things that we might want to look at in general, just we know that Trojan.exe, what all did it do?
[37:22.260 --> 37:28.360]  Look for event ID3, network connections, where was anything downloaded, a second stage, et cetera.
[37:28.360 --> 37:30.220]  These are all actions we can take.
[37:30.220 --> 37:36.700]  And the cool thing is if we find that second stage download, now we've got yet another IOC we can pass over to detection engineering.
[37:36.700 --> 37:50.300]  And we can go ahead and, again, if there are 30 more of these sitting in 30 more inboxes, if we do nothing more than deny list secondary.infection.com, I hope you already have that blocked.
[37:50.620 --> 37:58.580]  But we can deny list that, and so even if somebody does click on that in an inbox, now there's no second stage, hopefully.
[37:58.580 --> 38:04.000]  And you should be able to, again, lower the risk profile of your organization.
[38:04.880 --> 38:06.900]  So now let's talk about going forward.
[38:06.900 --> 38:16.020]  As we go forward, I think one of the more challenging parts of an investigation is when you do move forward, because when you go backwards, it's like a Sudoku.
[38:16.020 --> 38:21.780]  There are only so many artifacts, and everything has to happen, and everything has to mean something.
[38:21.780 --> 38:27.840]  So you're kind of filling in the blanks in the Sudoku, saying, well, I know this, and so the hip bone's connected to the thigh bone.
[38:27.840 --> 38:28.880]  So where's the thigh bone?
[38:28.880 --> 38:29.420]  What does it look like?
[38:29.420 --> 38:30.920]  I know how to write my query for that.
[38:31.120 --> 38:37.360]  When you talk about what's coming next, there are kind of an infinite number of things that a binary can do.
[38:37.420 --> 38:43.300]  But we know certain things are higher risk factors, higher risk thresholds than others.
[38:43.300 --> 38:45.320]  So we're going to look for network connection.
[38:45.320 --> 38:45.920]  Why?
[38:45.920 --> 38:47.480]  Because C2 is likely.
[38:47.480 --> 38:49.600]  We're going to look for X fill, because it's likely.
[38:49.600 --> 38:54.020]  We're going to look for file writes.
[38:54.020 --> 39:01.540]  We're going to look for, like I said, multiple file writes, read writes, close, and encryption.
[39:02.720 --> 39:06.640]  So this is where I think the analytic art very much comes in.
[39:06.720 --> 39:12.580]  And the beauty is, as you start populating this, you now have the ability to say, oh, I've looked for this.
[39:12.580 --> 39:17.200]  Somebody can come look over your shoulder and be like, hey, man, did you look for network connections?
[39:17.240 --> 39:18.100]  Like, oh, you know what?
[39:18.100 --> 39:19.240]  No, I'm a host guy.
[39:19.240 --> 39:21.060]  I didn't think about that network-y stuff.
[39:21.060 --> 39:22.280]  I could probably look into that.
[39:22.280 --> 39:23.480]  Let me do that.
[39:23.480 --> 39:27.240]  It gives you, again, a visual medium to communicate.
[39:27.520 --> 39:36.480]  I think in cybersecurity, where a lot of the challenge lies is in that coordination, collaboration, delegation, and prioritization.
[39:36.760 --> 39:46.160]  And this gives you an information-dense medium to convey your status and to seek out help from that SME when you need it, to enable collaboration.
[39:46.160 --> 39:48.060]  As somebody says, no, no, no, you know what?
[39:48.500 --> 39:50.180]  I'll take the network stuff.
[39:50.260 --> 39:52.140]  He's going to take the email stuff.
[39:52.140 --> 39:55.560]  She's going to do the forward triage.
[39:55.560 --> 39:57.340]  And you're going to run it back to source.
[39:58.140 --> 40:02.300]  That's the purpose of how I would use this in an incident response.
[40:02.680 --> 40:14.420]  And, again, I just want to point out that the beauty of it is, when you find those connections and if you see an exploit being thrown across the wire, let's say, for lateral movement, that's something that takes place.
[40:14.420 --> 40:17.560]  I have it here in the internal network as an IOC.
[40:17.560 --> 40:20.880]  The CVE is something that you could track and document.
[40:21.040 --> 40:24.620]  And then the beauty is you can say, all right, now I do need help.
[40:24.660 --> 40:26.620]  I'm going to break glass, pull lever, and say, you know what?
[40:26.620 --> 40:27.740]  We've got lateral movement.
[40:27.960 --> 40:33.060]  I'm going to keep running this one to ground because we want to stop this from spreading any further.
[40:33.060 --> 40:49.160]  But I'm going to need Josh to jump in and Jamie to jump in to hunt on these machines to do the incident investigation on those machines while we task other people to do further hunting and work better to collaborate and coordinate as we defend our enterprise.
[40:49.320 --> 40:53.040]  So that is at the core of how I use it.
[40:53.040 --> 40:55.060]  I added a couple of acknowledgments.
[40:55.480 --> 40:58.480]  First of all, like I said, this is not my research.
[40:59.040 --> 41:01.040]  This comes from threat intel.
[41:01.040 --> 41:10.560]  One of the things that I want to point out and part of the reason why I like doing it this way is I actually have open on another tab some of these reports.
[41:10.960 --> 41:13.440]  And they are not short.
[41:14.020 --> 41:16.060]  Some of them are very, very long.
[41:16.740 --> 41:21.900]  And especially like this Euro Trooper one, there are very few pretty, pretty pictures, and I like those.
[41:22.600 --> 41:27.120]  And so I can scroll and scroll and scroll or you can do what most people do.
[41:27.120 --> 41:30.620]  I believe that when you use threat intel, you do one of three things.
[41:30.620 --> 41:37.460]  The first thing is you pop it open and you read the executive summary and you say, oh, not what I'm interested in and move on.
[41:37.540 --> 41:39.360]  Or you got enough out of it and you move on.
[41:39.580 --> 41:43.180]  The second thing you do is what I do, which is scroll down and look for the picture.
[41:43.840 --> 41:47.700]  So I'm going to scroll down and this is the one I particularly like.
[41:47.880 --> 41:50.180]  And I'll jump in and be like, is that interesting enough?
[41:50.440 --> 41:50.660]  Good.
[41:50.660 --> 41:52.320]  I didn't have to read that boring executive summary.
[41:52.320 --> 41:52.860]  I see nodding.
[41:52.860 --> 41:53.900]  That's always a good sign.
[41:54.260 --> 41:56.220]  Anyone who agrees with me, I, of course, think is brilliant.
[41:56.220 --> 41:58.980]  So you can nod and I'll be like, man, sharp crowd.
[41:58.980 --> 42:02.900]  And then the final thing is perhaps the most common thing.
[42:02.900 --> 42:04.060]  And what's that going to be?
[42:05.660 --> 42:06.620]  There it is.
[42:06.620 --> 42:08.460]  Scroll to the bottom and look for the IOCs, right?
[42:09.140 --> 42:10.600]  And let's see.
[42:10.600 --> 42:12.620]  Oh, look, there's a GitHub repository right there.
[42:12.620 --> 42:16.620]  I'm going to jump in, copy and paste like a gentleman, and move on with my day.
[42:17.680 --> 42:28.000]  This is really long, but it only took me about 25 minutes to turn this report into the visual that I showed you of Euro Trooper, which is this one right here.
[42:30.840 --> 42:34.200]  I really like being able to consume Intel this way.
[42:34.200 --> 42:42.060]  In terms of teaching an executive or briefing an executive committee or senior leadership or a new person saying, you know what?
[42:42.060 --> 42:42.700]  This is what we saw.
[42:42.700 --> 42:43.840]  This happened to us.
[42:43.840 --> 42:44.760]  Rough day.
[42:45.300 --> 42:49.780]  And now we've got a repository of information for that new person.
[42:49.780 --> 43:01.800]  And like I said, knowledge management, we have a very strong verbal history in terms of oral tradition in terms of how we pass on knowledge.
[43:01.820 --> 43:07.700]  And this gives us an opportunity to move it into another medium so that we can convey it.
[43:07.700 --> 43:09.780]  And as people come in, they can learn.
[43:09.800 --> 43:12.860]  We can kind of train up the next generation of defenders.
[43:13.180 --> 43:17.240]  And as we all know, a generation in cyber is like, you know, 45 minutes, right?
[43:17.860 --> 43:21.180]  Anyway, I'm going to stop here and take questions.
[43:21.180 --> 43:24.100]  If anybody wants to jump in, there's a microphone right there.
[43:24.100 --> 43:24.900]  Thank you.
[43:25.840 --> 43:29.460]  And now comes my favorite part, which is stump the chump.
[43:29.460 --> 43:30.120]  So I'm in.