Staff Picks for Splunk Security Reading November 2020

Ryan Kovar

@meansec

aHR0cHM6Ly9vcGVuLnN
wb3RpZnkuY29tL2FsYnVt
LzdGVktNZWw0ZW9vbzFVaFJwT
zJ3dUg=

Easily Identify Malicious Servers on the Internet with JARM by John Althouse

Damn you, John Althouse. I already had a huge nerd crush on you for JA3, and now you break out JARM? For those not familiar with it, JARM is a way to actively scan the internet and create server fingerprints. Why do you care? Because by doing so, you can proactively determine malicious servers. Maybe you scan the whole internet and make a giant list (please note, IANAL). Possibly you do a SOAR action of doing a JARM scan against suspicious domains or IPs? Perhaps you are a malware researcher, and you want to find every instance listening for Cobalt Strike callbacks? It's all possible using JARM. I'm not sure what internet scanning repositories like censys.io or zetalytics.com have collected this data yet, but you can already find it getting added to Zmap/Zgrab, so you know it's getting big.

Dave Herrald

@dherrald

aHR0cHM6Ly9zb3Vu
ZGNsb3VkLmNvbS
9udW1iZXItc3RhdGlvbi
1yZWNvcmRpbmdz

Testing adversary technique variations with AtomicTestHarnesses by Michael Haag, Matt Graeber

This month I call your attention to the Atomic TestHarnesses project, the latest project brought to the community by the talented folks at Red Canary. This blog post explains how the new project helps blue-ish teamers answer such questions as "How resilient are my detection hypotheses to evasion?" and "How do we define sufficient coverage?" Designed to complement existing frameworks like MITRE ATT&CK, Atomic Red Team, and Invoke-Atomic, Atomic TestHarnesses looks like it will become essential tooling for adversary simulation and detection engineering.

Matt Toth

@willhackforfood

aHR0cHM6Ly93d
3cuYmJjLmNvbS9uZX
dzL21hZ2F6aW5lLTI
0OTEwMzk3

From humble banking trojan, to big time malware by Dan Goodin

When Emotet first came on the malware scene, it was only a trojan built to steal banking credentials. Today though, it is "one of the most prevalent ongoing threats" in cybersecurity. As Emotet has evolved, it has moved from stealing banking credentials, to being used to attack government systems in Canada, France, and many nations. The success of Emotet comes from the breadth of tactics it uses to infect, and spread, including using powershell for fileless infections, being able to spread via wireless networks, as well as stealing credentials and using those to spread. Recognizing which tactics and techniques adversaries, and malware, use when trying to land and expand in your environment is key in defending against them.

Tim Frazier

@timfrazier1

b399744b58226d
03b43665c0e978b
00b324a4ddbd1fa636
c74a51fb65c20556d

Microsoft's Kubernetes Threat Matrix: Here's What's Missing by Gadi Naor

I've been watching the threat landscape around Kubernetes really evolve quite a bit this year. Because the technology and its usage is evolving and growing rapidly, a wider variety of attacker TTPs are emerging. In the absence of a MITRE ATT&CK matrix specifically for Kubernetes, Microsoft proposed one via a blog in April which was a great start to getting some of the terminology straight. Barely six months later, @GadiNaor has made a great contribution to improving Microsoft's initial effort via this DarkReading article where he fills in some gaps in light of new attacker TTPs.

John Stoner

@stonerpsu

Li4uIC4uLi4gLS0tIC4uLS
AuLS4uIC0uLgouLS
0gLgouLS0uIC4uL
SAtCi0gLi4uLiAuLiAu
Li4KLi4gLS4gLSAtLS
0KLS4uLiAtLS0gL
SAuLi4gLi4tLS4u

The CostaRicto Campaign: Cyber-Espionage Outsourced by The BlackBerry Research and Intelligence Team

During the course of a month, a number of things hit the always growing inbox. As I was trying to stay current, the weekly intelligence summary from Digital Shadows caught my eye with the headline "APT cyber-mercenaries doing dirty work for paying clients." The newsletter is quite good, but it does require you to register with an email address to receive it, so I didn't want to provide a required registration item as my pick. That said, the report referenced work that the BlackBerry team had recently posted to their ThreatVector blog around the associated campaign and this article is the one I would like to highlight for you this month! When you stop and think about it, this idea of outsourcing your APT is a natural extension when there is a specific talent set available in an ever expanding market. The ability to have a "trusted" entity perform the dirty work of an organization or even nation-state while maintaining plausible deniability can be desirable. Blackberry's analysis found targets across the world and distributed across many vertical markets, though many were financials. Blackberry provides a set of indicators and a technical breakdown of their findings in their blog to round it out. If you want to learn more about the emergence of these for hire groups, the Digital Shadows intelligence summary mentions three additional groups discovered in 2020, so if you want to learn more, you may want to consider signing up for their weekly summary!