Hello, and welcome to Threat Intelligence with MSTICPy.
My name is Ian Hellen.
I'm a principal developer in the Microsoft Threat Intelligence Center.
In this session,
we're going to be looking at using MSTICPy to detect and understand examples of
three techniques documented in the MITRE ATT&CK taxonomy.
Firstly, attacks on valid accounts, scripted attacks with PowerShell,
and thirdly, attacks that establish persistence.
There is a companion Jupyter Notebook that we'll be using in the demos.
It also contains code that you'll need to run the examples, as well as
some supplementary code not shown in this course.
You can download this from the GitHub repo and run the
Notebook in your own python environment.
Alternatively,
the third link will run this Notebook in the free mybinder.org
service. First some background on MSTICPy.
MSTICPy started life in late 2018 as a support library
for our Jupyter Notebook development.
It's an open source Python package designed to be
used primarily in Jupyter Notebooks.
You can think of it and Jupyter Notebooks as a kind of extension to your SIEM
and SOC tools, and we'll expand on that idea in a few moments.
MSTICPy isn't a tool that you can run directly, instead it runs in
the context of a Jupyter Notebook. It's a cyber tools framework
that's installed as a Python package.
In a typical Notebook,
you would have several standard analysis and
visualization packages imported such as pandas,
numpy, and bokeh.
MSTICPy is imported in the same way and works alongside and
makes use of many of these popular packages.
It has four main components for querying,
enriching, analyzing, and visualizing data.
So how do Notebooks fit into your SOC processes?
Every SOC has its starting place in event log collection from devices,
accounts, apps, and services.
Analysis of activity recorded in these logs produces alerts in the SIEM console.
These are actioned by tier 1 analysts, or in the case of unusual
or particularly complex alerts, these may be escalated to tier 2
or tier 3 senior analysts. Notebooks sit in parallel, but
interact closely with this flow.
The entry point for a Notebook might be one of those complex alerts
that needs digging into in more depth by a senior analyst. Hunters
are specialist analysts who work primarily from threat intel reports
or other ad hoc information.
Their hunting ground is the raw event logs rather
than the investigation of alerts.
So what unique capabilities do Notebooks bring to your SOC? Firstly,
external data that may not be available in your SIEM. A
hunter or analyst may use a Notebook to fetch enrichment
data from an online external source,
especially threat intelligence data that may come from a
variety of online providers. In a Notebook,
you can apply specialized analysis and visualizations that may
not be available in your SIEM to your data.
Thirdly, workflow, you can control how you do your processing
and analysis. And finally, repeatability, you can rerun the
same Notebooks on future events.
The output from a Notebook is usually an enriched analysis that will
often feed back into the standard SOC processes in the form of enhanced
alerts or other reports. There are some prerequisites for using the
Notebook in this course. Firstly, an environment to run the Notebook in,
some knowledge of Python and Jupyter Notebooks, to have MSTICPy
installed, of course, and optionally,
API keys for threat intelligence providers and GeoIP resolution
services. You can get free accounts for many of these.
Here are some references you may find useful on Jupyter,
the Anaconda Python environment, and some of the documentation for MSTICPy.
In this module, we will be looking at using MSTICPy and Jupyter
Notebooks to detect and understand adversary activity.
We'll look at examples of the following three MITRE ATT&CK techniques. Firstly,
valid domain accounts. We'll be looking at password spray and
potentially successful logins from this kind of attack.
Secondly,
command and scripting interpreter with PowerShell looking at
obfuscation techniques and how to spot and decipher them.
Thirdly,
we'll be looking at scheduled tasks and how an attacker can secure a
persistent foothold by installing an automated back door.