Security

October 10, 2017

3 Minute Read

Playbook: Investigating Phishing Attachments with McAfee

By Splunk

Starting with just one successful phishing email, an attacker can quickly hide, pivot, persist, and exfiltrate from our networks. Shouldn’t our defensive systems have the same level of flexibility and automation?

Martin Ohl from McAfee answered those questions and more when he submitted this playbook to the Phantom Community. The playbook allows us to leverage McAfee Advanced Threat Defense (ATD), McAfee OpenDXL, and a suite of other McAfee and non-McAfee products for a wide-ranging investigation using both on-premises and cloud services.

The use case behind this playbook involves a suspected phishing email attachment as the trigger, but the same investigation workflow could be used for any potentially malicious file found entering the network, such as a file uploaded or downloaded using HTTP(S) or FTP, a file transferred in on a USB stick, or a file on a computer that is joining the network.

Details

File Detonation

This first step is what allows us to do more than just hunt for other observations of the attachment file hash. McAfee ATD attempts to unpack the file, record any intermediate hashes as it mutates and expands, and extract any IP addresses used during execution. At the end, we get a verdict that is crucial to understanding how likely it is that the file is malicious. We use that to determine whether we should continue our investigation, because we are assuming that investigating every file attachment will lead to too many false positives.

Pivoting on Indicators

If the ATD verdict indicates a malicious attachment, we launch into a wide array of investigative actions. The IP addresses are investigated with geolocation and reputation services to enrich our understanding of how they are used. The hashes observed by ATD are used to do an internal hunt using McAfee Active Response (MAR). MAR looks for the hashes in filesystems, Windows registries, network traffic, and live processes. Any sightings are used to create informative tickets for further analysis and remediation.

OpenDXL Integration Points

The OpenDXL actions used in this playbook are highly-flexible integration points. The way those messages are received and used will vary depending on what is on the other side of the message bus. For example, if McAfee Threat Intelligence Exchange (TIE) is used to ingest the hashes and IP addresses sent out from this playbook then the TIE policy will be compared against the indicator to determine the appropriate response. Any number of other McAfee or non-McAfee systems could also be listening on the OpenDXL message bus.

Phantom Apps Used

McAfee Advanced Threat Defense (ATD)

Playbook Workflow

This playbook was designed to be set to active mode and run automatically when a potential phishing email with an attachment is ingested with the label “Email.” Other types of file ingestions would require minor playbook changes.

Detonate the file in McAfee ATD
If the verdict states that the file is probably not malicious, just send an email to an administrator and finish
Push any IP addresses identified in the ATD detonation to the OpenDXL message fabric
Enrich the investigation with the reputation of any IP addresses found in the detonation to inform any further analysis
Query MaxMind for a geolocation of any IP addresses found in the detonation to enrich the investigation
Use OpenDXL to connect to MAR, hunting for the existence of the detected hashes on any endpoints within the enterprise
Push any hashes that were identified by MAR to OpenDXL with the context gathered during the playbook run
Open a ticket with a well-formatted message including the context gathered
Send a notification email with the same formatted message used in the ticketing step

Conclusion and Next Steps

Note that this is an example playbook. As mentioned earlier, you can easily customize this playbook to cover additional use cases and tailor the workflow to your needs.

You can download this playbook from either the Phantom Community or access it via the Phantom Platform. The platform automatically synchronizes Phantom Community Playbooks to your installation, if configured. If you don’t currently use the Phantom Platform, we invite you to download the free Community Edition today.

----------------------------------------------------
Thanks!
Philip Royer

Splunk

The world’s leading organizations trust Splunk to help keep their digital systems secure and reliable. Our software solutions and services help to prevent major issues, absorb shocks and accelerate transformation. Learn what Splunk does and why customers choose Splunk.

Security 7 Min Read

Machine Learning in Security: NLP Based Risky SPL Detection with a Pre-trained Model

The Splunk Threat Research Team shares a closer look at a hunting analytic and two machine learning-based detections that help find users running highly suspicious risky SPL commands.

Security 2 Min Read

Identifying Phishing Sites in Your Events

Security 2 Min Read

Get Started with Splunk for Security: Splunk Security Essentials

Splunk Security Essentials (SSE) is now part of the Splunk security portfolio and fully supported with an active Splunk Cloud or Splunk Enterprise license. Start using SSE and apply prescriptive guidance and deploy pre-built security detections in your Splunk environment.

About Splunk

The Splunk platform removes the barriers between data and action, empowering observability, IT and security teams to ensure their organizations are secure, resilient and innovative.

Founded in 2003, Splunk is a global company — with over 7,500 employees, Splunkers have received over 1,020 patents to date and availability in 21 regions around the world — and offers an open, extensible data platform that supports shared data across any environment so that all teams in an organization can get end-to-end visibility, with context, for every interaction and business process. Build a strong data foundation with Splunk.

Learn more about Splunk