Standardized Threat Indicators Indicator Export Adversary Analysis (Pivoting)

1. Standardized Threat Indicators • Indicator Export • Adversary Analysis (Pivoting) • Private and Community Incident Correlation • ThreatConnect Intelligence Research Team (TCIRT) • Community Notifications

2. Slide Sections • Using Address Indicators with SecurityCenter • Using File Indicators with SecurityCenter • Using Host Indicators with SecurityCenter • Using URL Indicators with SecurityCenter • Using File Indicators with Nessus

3. Using Address Indicators with SecurityCenter • Step 1 – Extract Address Indicators • Step 2 – Create a Watchlistfrom Address Indicators • Step 3 – Filter Events by Watchlist • Step 4 – (Optional) Create Query for 3D Tool • Step 5 – Save Asset List of All Addresses • Step 6 – Perform Audit Analysis Using Asset List • Step 7 – Perform Event Analysis Using Asset List • Step 8 – (Optional) Create List of Internal Addresses • Step 9 – (Optional) Nessus Audit of Internal Addresses

4. Step 1 – Extract Address Indicators

5. Step 2 – Create a Watchlistfrom Address Indicators

6. Step 3 – Filter Events by Watchlist Inbound or outbound

7. Step 4 – (Optional) Create Query for 3D Tool

9. Step 5 – Save Asset List of All Addresses

10. Step 6 – Perform Audit Analysis Using Asset List Recommended Reading – Predicting Attack Paths

11. Step 7 – Perform Event Analysis Using Asset List Recommended Reading – Tenable Event Correlation

12. Step 8 – (Optional) Create List of Internal Addresses Only

13. Step 9 – (Optional) Nessus Audit of Internal Addresses

14. Using File Indicators with SecurityCenter • Step 1 – Extract Hashes • Step 2 – Upload Hashes to Scan Policy • Step 3 – Perform a Scan Using Credentials • Step 4 – Review Scan Results • Step 5 – Save Asset List of Infected Hosts • Step 6 – Perform Audit Analysis Using Asset List • Step 7 – Perform Event Analysis Using Asset List • Step 8 – (Optional) Use Asset List with 3D Tool

15. Step 1 – Extract Hashes

16. Step 2 – Upload Hashes to Scan Policy

17. Step 3 – Perform a Scan Using Credentials Recommended Reading – Nessus Credential Checks for UNIX and Windows

18. Step 4 – Review Scan Results

19. Step 5 – Save Asset List of Infected Hosts

20. Step 6 – Perform Audit Analysis Using Asset List Recommended Reading – Predicting Attack Paths

21. Step 7 – Perform Event Analysis Using Asset List Recommended Reading – Tenable Event Correlation

22. Step 8 – (Optional) Use Asset List with 3D Tool

24. Using Host Indicators with SecurityCenter • Step 1 – Filter Events by Host • Step 2 – Perform Further Analysis Recommended Reading – Using Log Correlation Engine to Monitor DNS

25. Step 1 – Filter Events by Host

26. Step 2 – Perform Further Analysis See slides for “Using ThreatConnect Address Indicators” steps 5 through 9 Filtering by the domain summary event before saving the asset list will get you a list of only those hosts that performed a DNS lookup for the host indicator.

27. Using URL Indicators with SecurityCenter • Step 1 – Divide Host and Location from URL • Step 2 – Filter Events by Host • Step 3 – Save Asset List • Step 4 – Filter Events by Location • Step 5 – Perform Further Analysis

28. Step 1 – Divide Host and Location from URL

29. Step 2 – Filter Events by Host Use web-access in Type filter Use Host in Syslog Text filter

30. Step 3 – Save Asset List

31. Step 4 – Filter Events by Location Use Asset List in Source Asset filter Use Location in Syslog Text filter

32. Step 5 – Perform Further Analysis See slides for “Using ThreatConnect Address Indicators” steps 5 through 9 We will be creating a second and final asset list to use for further analysis. Verify the URL is matched correctly by looking at the web-access details in Step 4. Steps 1 through 4 perform an intersection; however, it’s by host.

33. Using File Indicators with Nessus • Step 1 – Extract Hashes • Step 2 – Use Windows Malware Scan Wizard • Step 3 – Perform Scan and Review Results

34. Step 1 – Extract Hashes

35. Step 2 – Use Windows Malware Scan Wizard

36. Step 3 – Perform Scan and Review Results