A9 Development: A blog by Agrajag9

Last night one of my CTI sharing groups was discussing a report from FireEye regarding APT29 and domain fronting ( https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html ) when we all realized we had no clue who APT29 is in our own internal systems.  One member finally shared this mess: https://www.google.com/url?sa=t&source=web&rct=j&url=https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/edit&ved=0ahUKEwjNhd-novjSAhVBC2MKHYglAgoQFghIMAQ&usg=AFQjCNFe0KMzzgH09bdHImCB5VxrXo2gIA&sig2=1CI3ffYHiBNLliisz6EbAw Nobody can agree on names.  Even to the untrained eye it's obvious that there's a communication issue present here. The most amazing thing is how simple it would be to fix all of this, but none of these vendors have because #branding #sorrynotsorry #aptlolwut . The excuse "but we'd have to rename everything" is silly, because if you want to present the image of being a quali...

This is a quick one, but I wanted to call out a piece shared with me by a peer in the industry: http://harvardpolitics.com/covers/cyberespionage-need-norms/ A truly key point here: [C]onsider how almost every recent cybercrime is called a “cyberattack” by the media. North Korea’s hack into Sony Pictures, China’s theft of American personnel records, and Russia’s attack on Estonian online infrastructure were all dubbed "cyberattacks," despite their significant differences. The repeated use of this simplistic label has muddied dialogue surrounding this issue by obscuring the unique qualities of different cybercrimes—making it difficult to keep track of what actions warrant retaliation. This has been a pain-point of mine for a few years now, but I have yet to convince many others in my field that computer/network espionage (CNE) is explicitly NOT an attack. Also, I hate the prefix cyber. It has no meaning. For more info on this, see: http://willusingtheprefixcybermakem...

https://www.us-cert.gov/ncas/alerts/TA17-075A Last time it was GRIZZLY STEPPE, this time they're saying that TLS inspection is bad. Let's start by explaining what they're talking about. Many organizations use HTTPS interception products for several purposes, including detecting malware that uses HTTPS connections to malicious servers. This is essentially your basic SSL/TLS man-in-the-middle attack, but in an approved fashion. On an enterprise web-proxy, this allows you to do all kinds of wonderful things, like monitor C2 over HTTPS, or even detect delivery of malicious payloads from HTTPS-enabled websites. So why is US-CERT saying this is dangerous? All systems behind a hypertext transfer protocol secure (HTTPS) interception product are potentially affected. They just used a terrible word: "potentially". Why is this a bad word? Because its meaning has no value in terms of estimative probability - it just means "greater-than-0% probability", wh...

Rich Headers are awesome and you should read about them here: http://www.ntcore.com/files/richsign.htm I was looking at a sample recently and, being the good analyst I am, attempted to automate my DFIR processes using the tools I had handy. Step 1: Get the Rich Headers for the malicious binary. Let's use 9e6658fab423d9b3fabc3578ac5482bf4f21f6fb98949d8ef4f3cad349862b82, a known RAMNIT ransomware sample. $ laika.py 9e6658fab423d9b3fabc3578ac5482bf4f21f6fb98949d8ef4f3cad349862b82 | jq '.scan_result[].moduleMetadata | select(.META_PE) | .META_PE."Rich Header"' { "Checksum": 3183276661, "Hashes": { "SHA1": "dd0f0861bc67028b3cab0d6cdc55a29cc2822f64", "SHA256": "8fd544eee7389c64a29440555f5b968ae0632ed3b989a63402b6d43934a8973e", "MD5": "8451f317057b289c04b2c5b202c09715" }, "Rich Header Values": [ { "Count": 6, "Version": ...

I want to start a series of posts on how to do CND/DFIR/CTI on a budget. I've spent the last decade of my life working in the IT world. I spent about half that time working as a part-time administrator/engineer in a small datacenter within a large corporation. I touched a lot of tech during that time frame and adopted a significant amount of it into my own homelab. But the last five years of my life have been devoted to CND/DFIR/CTI. One of the things I've experienced working in this field has been the vast differences between the large and small companies in terms of capabilities. My current job involves sharing CTI with a wide variety of companies with a wide variety of maturity in terms of CND/DFIR/CTI capabilities. A common complaint I hear from the small-/medium-sized companies is that they could never keep up with the bigger companies because they lack resources. If you fall into this bucket, then this series is for you. A few problems I hope to solve on shoestring ...

Here's some links for now: https://github.com/agrajag9/a9dotfiles This is a collection of my bashrc and related files. I've been daily-driving Linux terminals now for years and this is one of the first things I install. The screenshot below however is taken from one of my Windoze hosts. https://github.com/agrajag9/getrichlaikaboss If you work in CND/DFIR/CTI and you aren't familiar with LaikaBOSS, I recommend taking a look. It's a framework originally intended as an IDPS, but it's since grown to do far more than just those tasks. The core concept is that modern file-types tend to be tiered and follow an object-oriented design, so a modern IDS/IPS needed to be able to analyze these objects as such. getrichlaikaboss was a short script I wrote to determine the compilation toolset of a Windoze PE. Every exe and dll compiled with Visual Studio will contain a Rich Header, which in turn contains a list of tools used to compile, assemble, and link all of the file...