Cyber Defense eMagazine May 2019

Using Behavior to Detect Complete Attack Chains
User and Entity Behavior Analytics (UEBA) allows security analysts to do just that. UEBA products take
a thumbprint of what activities are normal for each user and compare that to activities the user performs
in near real time. Coupling that with tactics and techniques known to be risky from ATT&CK, UEBA
interfaces then highlights the activity as being both atypical and risky. The more of these tactics and
techniques that an attacker uses, the higher the risk score within UEBA interfaces and the more this
stands out to SOC analysts.
By tying together the behaviors identified as anomalous and risky with the techniques identified in the
ATT&CK framework, responders can now trace the steps an attacker has used and predict where they
may be heading next. Only once the attack chain is fully understood can the SOC analyst then take
appropriate remediation steps to preserve evidence instead of re-imaging the system and possibly
destroying key evidence needed to perform additional forensic examination of the compromised system.
Given the gravity of the compromises depicted here, every piece of evidence in this crime scene needs
to be preserved for the duration of the investigation. Each incident needs to be seen as part of a bigger
picture. Closing a ticket is not the same thing as solving a crime.
About the Author
Erik Randall is a Security Engineer at Exabeam. He is an information
security leader with proven success implementing leading-edge
technology solutions while balancing risk, business operations and
innovations. Specialties include security service management, systems
architecture, network design, and systems administration with extensive
experience in engineering, manufacturing, services and financial
industries.
49