SANS 2013

Hunting and Sniper Forensics

• Jason Lawrence
• Thursday, March 14th, 8:15pm - 9:15pm

For years security analysts and practitioners have claimed that: "There are two types of companies in this country, those who know they've been hacked, and those who don't know they've been hacked."

Assuming this assertion is correct, companies need to start approaching incident response in a different way. Incident response teams will need to hunt down the adversary in their network and with sniper precision "take them out". The time has come for a more proactive approach to incident handling and response. To that end this talk will explore the art behind hunting down the "Advanced Persistent Threat" lurking in our networks. Once the adversary has been located phase two of this approach will kick in, and with the precision of a trained sniper, the incident responder will collect the evidence needed to determine the sources of the breach. Furthermore, with sniper forensics the incident handler will not need to sift through Terabytes upon Terabytes of evidence. This limited scoping of the evidence to be collected will enable the response team to focus on the adversary's next target of exploitation.

The first step of this approach is to "hunt"; this process scans through the network searching for deviations from the norm. These deviations can be in the form of auto-run programs that are not part of the corporate gold build for workstations. Other possible indicators include, but are not limited to, workstations communicated directly with one another or irregular DNS queries. Once these deviations have been identified it is time to focus on the hunt and start profiling the adversary's activities on the network.

This talk will walk through both of these phases exposing the audience to a repeatable defensible methodology. This begins with knowing what is normal in your environment and what is a deviation. Many of the most recent breaches took many months to detect; this lack of detection does not necessarily indicate a lack in security controls or compliance. According to Sun Tzu in the Art of War:

"If you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you do not know your enemies but do know yourself, you will win one and lose one; if you do not know your enemies nor yourself, you will be imperiled in every single battle."

To that end it is crucial to know your networks and systems, understand and learn the adversary's TTP, hunt down and remove the enemies lurking in your network.

About Jason Lawrence

Jason works for the Dell SecureWorks Corporate Incident Response Team (CIRT) as a Security Analysis Senior Advisor focusing on internal incident response and digital forensics. He has developed processes and procedures to reduce incident impact and cost.

Jason also serves as the President of the Atlanta chapter of the HTCIA and on the board for directors of the Atlanta chapter of the ISSA.

On his off hours Jason enjoys teaching SANS Forensics curriculum as part of the SANS Mentor program. He holds a masterâs degree in information security and assurance (MSISA), and numerous security certifications such as: GCFA, GCIH, G2700, CISSP, CHFI, CEH and CISA.

Jason firmly believes that the only way to truly be secure is by educating others, and he lives by this principle. Furthermore, if you take the time and listen, you can learn from anyone, mostly from your students.