Windows MITRE ATT&CK and Event Collection

September 2019
Master Skills University Munich 2019
—
Rudy Tan
Senior Security Specialist

Joshua Ryan
Product Owner – WinCollect
Agenda
Threat Management and Incident Response 03

MITRE ATT&CK For Windows Artifacts 22

WinCollect RoadMap 25

How Can I Collect Windows Events 30

WinCollect 10 and WEC Demo 40

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 2
Threat Management and Incident Response

IBM Security / © 2019 IBM Corporation 3

 What do we mean with Cyber threat management and incident
response?
• Methodological approach to:
• Identify
• Hunt for
• Respond to

cyber threats

• Threat identification means that you react to an alert informing you about an incident
• SIEM notifies you when it finds artifacts of an incident
• The search for artifacts is guided by threat intel produced by the threat hunters
• Threat hunting means that you become pro-active in identifying incidents
• That you know what you want to protect. Its value, weaknesses, and how it normally works
• That you use your threat intelligence to guide your hunting
• That you know how your adversaries (might) accomplish their goals. That is to know your threat landscape
• Respond to an incidents and threats means that you can:
• Prepare to identify an attack
• Identify the impact of an attack
• Contain the incident in a controlled manner
• Eradicate the possibilities for the adversary to continue or re-start the attack
• Recover the business as usual
• Learn from the attack, how it became an incident, and what the total impact was. The lessons learned are used to better
prepare for an attack
IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 4
Implications for a SOC
• The Security Operations Center recommended authorizations are:
• Perform continuous monitoring (Identification)
• Vulnerability assessment (Identification)
• Configuration monitoring (Identification)
• Help Desk or 3rd party alerting (Identification)
• Penetration testing (Hunt for)
• Security awareness exercises (Hunt for)
• IOC and threat modeling (Hunt for)
• Execute incident response steps including digital forensics (Respond to). Taking machines or
business offline, isolate, monitor and study adversary behavior, rebuild machines, pay ransom.
• Use any security alerting software like QRadar SIEM, XGS
• Setup honeypots and tripwires (Identification and Hunt for)
• Building a SOC like this is costly and most of the responsibilities can be done best by IBM Managed
Security Services. But lack of organization’s business drivers and specific specialization related to
organization’s environment maybe a reason to consider a hybrid SOC solution.

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 5
The SOC maturity levels according to IBM

The ultimate goal is to have

F3EAD implemented:
• Find (Use Intelligence)
• Fix (Identify)
• Finish (IR)
• Exploit (Gather Data)
• Analyze (Create
Intelligence)
• Disseminate (Share
Intelligence)
SOC Maturity level and organization
Maturity levels mapped to technical countermeasures
• Tier 1: Firewalls, Anti Virus, Proxy

• Tier 2 : Tier 1 plus Audit Logs, Vulnerability management, Security Awareness Programs

• Tier 2.5 : Tier 2 plus NIPS, NIDS, HIDS, Inline Anti Virus (Email attachments, on the wire anti virus
checking)

• Tier 3 : Tier 2.5 plus DEP, Tarpit, DNS Redirect, HoneyPot

The above mentioned technical security measurements list is not exhaustive and is based on the
original CKC courses of defensive measures IT matrix. The mapping itself is arbitrary.

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 8
Maturity levels mapped to SOC operations
• Tier 1: DDOS, Scanning, Data exfiltration, suspicious connections and communications, use of
suspicious services or protocols, Virus infections

• Tier 2 : Tier 1 plus IT Security Management Standards: Logon/Logoff activity, System modifications,
Account management, Privilege escalations, Vulnerability scanning, Asset creation/deletion, Audit
modification, User Behavior

• Tier 2.5 : Tier 2 plus Internal threat detection based on common attacks strategies and known
attack techniques

• Tier 3 : Tier 2.5 plus Threat hunting. Threat Intelligence feeds, Attack campaign detection, Threat
modeling, Hypothetical attack-activity analysis, penetration testing, purple team exercises

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 9
TIER 1 and 2 IBM Security products and tools
Tier 1
• IBM Products: QRadar SIEM, X-Force Threat Intelligence, QNI, Product Professional Specialist
• Tools: QRadar out-of-the-box (offense) rules and reports. Implementation and basic configuration
services
• Customization: Network Hierarchy, Host Discovery, protocol and services whitelisting, connections
whitelisting (geographical), Log Source integration of network devices and anti-virus software

Tier 2
• IBM Products: Tier 1 plus QVM, QRM, UBA, Resilient, Identity Access Management, Guardium, PPS
IT Security Consultancy, and all tools that CIS recommends for security operations and
management.
• Tools: Tier 1 plus IT Security Management Standard, IT Security Policies IT Security Architectures,
Playbooks for IT Security Baseline Use Cases
• Customization: Tier 1 plus, (custom) log source integration, log source hardening, implementation
of IT Security Baseline Audit Policies: Authentication, Authorization, Account Management,
Privilege Escalation, System Modification, Audit Modification, Log Archiving, User Behavior,
Vulnerable Asset Detection, Network Device Modification

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 10
TIER 2.5 and 3 IBM Security products and tools
Tier 2.5
• IBM Products: Tier 2 plus XGS, BigFix, DNS Analyzer, i2, QRadar Incident Forensic, MAAS 360, X-
Force Exchange, X-Force Red
• Tools: Tier 2 plus Threat Models, Threat analysis tools, Attack libraries, Attack Techniques,
Indicators of Compromise feeds
• Customization: Tier 2 plus, (custom) log source integration, Indicators Of Compromise feed
integration

Tier 3
• IBM Products: Tier 2.5 plus Directory Integrator, AppScan source code analyzer
• Tools: Tier 2.5 plus Metasploit, Purple Team, Coding and Reverse Engineering skills
• Customization: Tier 2.5 plus integration of Indicators of Concern feeds from same industry,
suppliers, and dark web

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 11
Cyber attack models used for identifying, hunting and responding
Your best defense against attacks becoming incidents is to know the strategies and techniques your
adversary (usually) exploits. There are two major attack models that are now considered to be industry
standards.
Cyber Kill Chain Advanced Persistent Threat (Extension to Lockheed MITRE ATT@CK (Adversarial Tactics, Techniques and Common Knowledge)
Martin’s Cyber Kill Chain)
• PRE-ATT&CK category
• Mandiant (FireEye) APT 1 phases
• Conduct social engineering
– Initial reconnaissance
• ATT&CK categories (Collection and Exfiltration not included)
– Initial compromise
– Initial Access
– Establish foothold
– Execution
– Escalate privileges
– Persistence
– Internal reconnaissance
– Privilege Escalation
– Lateral movement
– Defense Evasion
– Maintain presence
– Credential Access
– Complete mission
– Discovery

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 – Lateral Movement 12
MITRE ATT@CK and CKC

The MITRE ATT@CK categories are mostly post-exploit

phase

Graphic taken from Finding cyber threats with ATT@CK

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 13
MITRE ATT@CK and QRadar rules

QRadar Advisor With Watson enables you to load the

QRadar-Mitre content package. With this package you
can map QRadar rules to MITRE categories/tactics,
which could help you to get a better idea how the
attack has proceeded.

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 14
Attack strategy model: Diamond model
• Used to plot an attack strategy and identify an adversary with the objective to optimize the defense and
response

• A single step in an attack is represented by a Diamond event which has at least the following attributes:
• Adversary: the attacker
• Infrastructure: communication means to use a capability
• Capability, Tactics, Techniques, and Processes
• Victim: target assets and people

• Ideally an ‘encyclopedia’ exists where observed Capability i/c with Infrastructure and Victim, leads to
known activity groups that imply a recommendation for identification and incident response

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 15
Intelligence driven identification
• Lessons learned from incident response are turned into IOCs for improved identification, for example by
QRadar SIEM

• This also applies to lessons learned from penetration and Red Teaming exercises. In general from threat
hunting

• IR assumes that the adversary uses a CKC-like strategy which guides them to search and identify incident
artifacts and categorize them, using the MITRE ATT@CK categories

• These artifacts turned into IOCs can then be used in QRadar SIEM to identify and categorize a new incident

• Adversary behavior ideally is used to optimize defenses, identification (UBA, CRE Rules, i2, Resilient) , and
responses
SIEM: IR: Containment,
Identificatio Eradication,
Forensics
n

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 16
External IOCs
• Types of IOCs:
• HUMINT: Human Source
• SIGINT: Signal. Including electronic and cyber intelligence. E.g. MITRE ATT@CK techniques
• OSINT: Open Source. E.g. X-Force
• IMINT: Imagery
• MASINT: Measurement and signature. E.g Sound, radio-activity, light waves, etc
• GEOINT: Geospatial

• QRadar portfolio allows to use HUMINT, SIGINT, OSINT, IMINT, and GEOINT

• MITRE ATT@CK Techniques may contain IOCs that can be detected through QRadar SIEM. By definition re-
active

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 17
CKC phases and defensive measures
Detect Deny Disrupt Degrade Deceive or
Destroy
Reconnaissance Web Analytics Firewall ACL

Weaponization NIDS NIPS

Delivery Security Awareness Proxy and Web In-line AV

programs filter
Exploitation HIDS Patch management DEP Windows
Defender ATP DEP: Data Extraction Prevention

Installation HIDS 'chroot' jail AV Continues EDR: Endpoint Detection and

Application monitoring Response should also be
Whitelisting
applied from Delivery phase
Firewall ACL
Command and NIDS Firewall ACL NIPS Tarpit Continues
downwards, and from Detect to
Control monitoring Disrupt defensive tactics
DNS redirect
Actions on Audit log Audit Log Network Continues Governance Continues
Objectives Segmentation monitoring monitoring
System Hardening Application Honeypot
whitelisting

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 19
IBM Security products and the CKC defensive measures
Detect Deny Disrupt Degrade Deceive or
Destroy
Reconnaissance i2 Watson UBA X-Force SIEM QRM
SIEM QNI
Weaponization QVM SIEM XGS SIEM
Delivery SIEM SIEM
Exploitation SIEM QVM SIEM
Installation SIEM SIEM QNI QRM SIEM SIEM QNI
Command and QNI SIEM XGS UBA SIEM QRM QNI SIEM XGS QNI SIEM UBA SIEM QNI
Control X-Force UBA
Actions on SIEM UBA QNI SIEM QRM SIEM RESILIENT SIEM QNI
Objectives SIEM

This matrix is a work in progress as detection and prevention techniques and tools evolve.
QVM and SIEM help to detect in the weaponization phase because you can find vulnerabilities and
detect exploitations while the vulnerabilities are still being fixed or patched

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 21
MITRE ATT@CK for Windows artifacts
Preparation
teaser version
Windows hardening

• CIS hardening CIS Benchmark for Microsoft Windows 10

• Chapters 17-1 to 17-9 contain recommendations on audit configuration
• Other chapters contain system configuration recommendations and suggestion how to
audit/check if the current configuration meets the recommendation
• Take your pick of hardening recommendations that fit the companies policies and use
PolicyAnalyzer provided by Microsoft to regularly check the configuration. This tool
checks settings that are also suggested by the CIS benchmarks

• Windows 10 1703 and higher Threat Protection Threat protection guide, explains in detail the
windows security settings recommendation

• Windows auditing information on Advanced security audit policy settings webpages

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 23
Windows baselining: Know what is normal
• Process tree: Check for process artifacts that seem unusual.
• System.exe #Instances: 1, User Account: Local System, Parent: None
• Smss.exe #Instances: 1, User Account: Local System, Parent: System.exe
• Wininit.exe #Instances: 1, User Account: Local System, Parent: smss.exe (not visible)
• RuntimeBroker.exe #Instances: multiple, User Account: Logged on user, Parent: svchost.exe
• Takhostw.exe #Instances: multiple, User Account: logged on user and locals service accounts, Parent: svchost.exe
• Winlogon.exe #Instances: multiple, User Account: Local System, Parent: smss.exe (not visible)
• Csrss.exe #Instances: two or more, User Account: Local System, Parent: smss.exe (not visible)
• Services.exe, #Instances: 1, User Account: Local System, Parent: wininit.exe
• Svchost.exe, #Instances: at least 10, User Account: Local System/Network Service/Local Service/Logged on user, Parent:
services.exe
• Lsaiso.exe, #Instances: max 1, User Account: Local System, Parent: wininit.exe
• Lsass.exe, #Instances: 1, User Account: Local System, Parent: wininit.exe
• Explorer.exe, #Instances: multiple for every interactive logon, User Account: interactive logged on account, Parent: userinit.exe
(not visible)

• AutoStart: Check the frequently used autostart configuration locations like the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run for entries that should not be there.

• Check DLL and executable location and hashes

• Scheduled tasks. Check at.exe or schtasks.exe for unexpected scheduled tasks

For the above, start using sysinternals autoruns(c).exe

• Network usage. Any anomalies regarding port usage

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 24

• WMI usage. Use powershell Get-WMIObject command to baseline the valid consumers or start monitoring command-line auditing.
WinCollect Roadmap

IBM Security / © 2019 IBM Corporation 25

Disclaimer
Please Note:

IBM’s statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at
IBM’s sole discretion.

Information regarding potential future products is intended to outline our general product direction and it should
not be relied on in making a purchasing decision.

The information mentioned regarding potential future products is not a commitment, promise, or legal obligation
to deliver any material, code or functionality. Information about potential future products may not be
incorporated into any contract. The development, release, and timing of any future features or functionality
described for our products remains at our sole discretion.

IBM Security / © 2019 IBM Corporation 26

Road to WinCollect 10
WinCollect 7.2.9
• 6 month maintenance release cycle

WinCollect 10
• Phase I – Late 2019
• Standalone deployment first
• Phase II & III Future 2020

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 27
WinCollect 10 Goals
Deliver a product that addresses customer use cases and is easier to support and develop.

Proposed Features
• New WinCollect Agent Manager App
• Auto tuning
• Advanced Filtering
• Updated Configuration Console
• No .Net Dependency
• Streaming Event Data to the cloud
• AWS Kinesis / Microsoft Event Hub

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 28
WinCollect 10 First Look
New Standalone Agent – Configuration Console

Features
• Agent Health and Statistics
• Simplified Management of Agent
• No .Net Dependency
• Access to log and debugging in realtime
• Port Connection Tests
• Remote Event Log Access Check

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 29
How Can I Collect Windows Events

IBM Security / © 2019 IBM Corporation 30

Collection Options
Managed vs Standalone

Qradar Appliance Qradar Appliance

8413 for Management

514 for Syslog 514 for Syslog

WinCollect Agent WinCollect Agent

tion tion
o llec o llec
C C
ote ote
Rem Rem

IBM Security / © 2019 IBM Corporation 31

Collect Specific Windows Events

A very basic Xpath query to grab Powershell and WMI events.

<QueryList>
<Query Id="0" Path="Microsoft-Windows-PowerShell/Operational">
<Select Path="Microsoft-Windows-PowerShell/Operational">*</Select>
<Select Path="Microsoft-Windows-WMI-Activity/Operational">*</Select>
</Query>
</QueryList>

IBM Security / © 2019 IBM Corporation 32

WinCollect 7.2.x & XPath Command Line Installs
With WinCollect 7.2.7 or greater:
wincollect-7.2.9-82.x64.exe /s /v"/qn LOG_SOURCE_AUTO_CREATION_ENABLED=True
LOG_SOURCE_AUTO_CREATION_PARAMETERS=""Component1.AgentDevice=DeviceWindowsLog&Component1.Action=create&Component1.LogSourceNam
e=Windows+7+64bit+Workstation&Component1.LogSourceIdentifier=W7X64-
2&Component1.Dest.Name=Console&Component1.Dest.Hostname=172.18.136.158&Component1.Dest.Port=514&Component1.Dest.Protocol=TCP&Compon
ent1.Log.Security=true&Component1.Log.System=true&Component1.Log.Application=true&Component1.Log.DNS+Server=false&Component1.Log.File+Replic
ation+Service=false&Component1.Log.Directory+Service=false&Component1.RemoteMachinePollInterval=5000&Component1.EventRateTuningProfile=High
+Event+Rate+Server&Component1.MinLogsToProcessPerPass=1250&Component1.MaxLogsToProcessPerPass=1875&Component1.CustomQuery.Base64=P
FF1ZXJ5TGlzdD4NCiAgPFF1ZXJ5IElkPSIwIiBQYXRoPSJNaWNyb3NvZnQtV2luZG93cy1TeXNtb24vT3BlcmF0aW9uYWwiPg0KICAgIDxTZWxlY3QgUGF0aD0iT
Wljcm9zb2Z0LVdpbmRvd3MtU3lzbW9uL09wZXJhdGlvbmFsIj4qPC9TZWxlY3Q+DQogIDwvUXVlcnk+DQo8L1F1ZXJ5TGlzdD4="""

In WinCollect 7.2.x, you need to convert the Xpath query to Base64.

IBM Security / © 2019 IBM Corporation 33

WinCollect 10 XPath Command Line Install
With WinCollect 10:

msiexec.exe /l*v WC_install.log /qb /i WinCollect-10.18.12-15.x64.msi INSTALLDIR="C:\Program Files\IBM\WinCollect\" WC_SCRIPT="C:\Users\josh\Desktop\update_config.xml"

IBM Security / © 2019 IBM Corporation 34

Managed & Standalone For Your Consideration
Log source management
• Making changes to hundreds or thousands of log sources?
• Decommissioned machines, cleaning up stale log sources?
Deployment
• How are you going to install all these agents?
• How and who is going to manage all these agents?

IBM Security / © 2019 IBM Corporation 35

Windows Event Forwarding
What is it?
• Windows Event Forwarding (WEF) is a log forwarding solution integrated within modern
versions of Microsoft Windows.
• Windows Event Forwarding allows for event logs to be sent, either via a push or pull
mechanism, to one or more centralized Windows Event Collector (WEC) servers
• WEF is agent-free, and uses already existing Microsoft code for both Workstations and
Server operating systems.
• WEF supports mutual authentication and encryption through Kerberos (in a domain), or
can be extended through the usage of TLS (additional authentication or for non-domain-
joined machines).
• WEF has a rich XML-based language to control which event IDs are submitted, suppress
noisy events, batch events together, and configure submission frequency. Subscription
XML supports a subset of XPath, which simplifies the process of writing expressions to
select the events you’re interested in.

IBM Security / © 2019 IBM Corporation 36

WEC Limitations
• Load balancing
• Troubleshooting
• Learning curve

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 37
Windows Event Forwarding Diagram

Qradar Appliance WEC Server with WinCollect

Desired endpoints, “Source computers”

Domain Controller
38

IBM Security / © 2019 IBM Corporation

What Makes WEC + WinCollect Beneficial?
• No Need for excessive agent installs
• WC 7.2.9 --Many to 1 WEC log source
• WC 7.2.9 – Additional WEC filtering

IBM Security / © 2019 IBM Corporation / Master Skills University Munich 2019 39
Demo Time

IBM Security / © 2019 IBM Corporation 40

Demo Overview
• WinCollect 10 Install
• Install WC10 with WMI and Powershell Filters
• Deploying WEC
• Create your WEC server and group policy
• Create your client subscription
• Install WinCollect on your collector(s)

IBM Security / © 2019 IBM Corporation 41

Thank you

Follow us on: © Copyright IBM Corporation 2019. All rights reserved. The information contained in these materials is provided for
informational purposes only, and is provided AS IS without warranty of any kind, express or implied. Any statement of
direction represents IBM’s current intent, is subject to change or withdrawal, and represent only goals and objectives.
ibm.com/security IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines
Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks
or service marks of others.

securityintelligence.com
ibm.com/security/community
Statement of Good Security Practices: IT system security involves protecting systems and information through
prevention, detection and response to improper access from within and outside your enterprise. Improper access can
result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your
systems, including for use in attacks on others. No IT system or product should be considered completely secure and no
single product, service or security measure can be completely effective in preventing improper use or access. IBM
systems, products and services are designed to be part of a lawful, comprehensive security approach, which will
necessarily involve additional operational procedures, and may require other systems, products or services to be most

xforce.ibmcloud.com effective. IBM does not warrant that any systems, products or services are immune from, or will make your enterprise
immune from, the malicious or illegal conduct of any party.

@ibmsecurity

youtube/user/ibmsecuritysolutions