JWP-Binde-McRee-OConnor

Assessing Outbound Traffic to Uncover Advanced Persistent Threat
Table of Contents
Executive Summary .................................................................................................................. 2
Introduction ................................................................................................................................ 3
Operation Aurora ................................................................................................................... 4
RSA Breach ........................................................................................................................... 6
APT Detection ........................................................................................................................... 8
Rule Sets ............................................................................................................................... 9
Statistical and Correlation Methods ..................................................................................... 14
Manual Approaches ............................................................................................................. 20
Automatic Blocking of Data Exfiltration ................................................................................ 24
Conclusions ............................................................................................................................. 28
Appendices .............................................................................................................................. 29
Appendix A - dnsWatch.py .................................................................................................. 29
Appendix B - trackByGeo.py ................................................................................................ 30
References .............................................................................................................................. 31
Table of Figures
Figure 1: Anatomy of the Operation Aurora Attack ....................................................................... 4
Figure 2: PI-RAT (Poison Ivy Remote Access Toolkit) ................................................................. 7
Figure 3: Replicating the Operation Aurora Attack in Metasploit ................................................ 10
Figure 4: Fast Flux Traffic ........................................................................................................... 14
Figure 5: SIAPT Splunk app ....................................................................................................... 16
Figure 6: Splunk alert conditions ................................................................................................. 18
Figure 7: Snort alert noted via Sguil ............................................................................................ 19
Figure 8: Possible APT correlation ............................................................................................. 20
Figure 9: Sguil view of pivot host's scan probe ........................................................................... 21
Figure 10: Squert/AfterGlow visualization of pivot host's scan probe ......................................... 22
Figure 11: LizaMoon script injection detection ............................................................................ 23
Figure 12: Perimeter Protection By Allowing Only Port 443 Outbound from Proxy .................... 27
Page 1