During Microsoft Ignite, Microsoft announced Defender ATP EDR capabilities for Mac is available in preview.
It’s great to see Microsoft extends the EDR capabilities to cross-platform
Rich investigation experience – including machine timeline, process creation, file creation, network connections and, of course, the popular Advanced Hunting.
Optimized performance – enhanced CPU utilization in compilation procedures and large software deployments.
In-context AV detections – just like with Windows, get insight into where a threat came from and how the malicious process or activity was created.
Azure Sentinel—the cloud-native SIEM that empowers defenders is now generally available
Some of the new features are:
Workbooks are replacing dashboards, providing for richer analytics and visualizations
New Microsoft and 3rd party connectors
Detection and hunting:
Out of the box detection rules: The GitHub detection rules are now built into Sentinel.
Easy elevation of MTP alerts to Sentinel incidents.
Built-in detection rules utilizing the threat intelligence connector.
New ML models to discover malicious SSH access, fuse identity, and access data to detect 35 unique threats that span multiple stages of the kill chain. Fusion is now on by default and managed through the UI
Template playbooks now available on Github.
New threat hunting queries and libraries for Jupyter Notebooks
Incidents:
The interactive investigation graph is now publicly available.
Incidents support for tagging, comments, and assignments, both manually and automatically using playbooks.
When working with Incident Response you from time to time find artifacts that you need to block, IP Addresses or specific URLs. Instead of doing this on the proxies or firewalls its often more efficient to do this on the endpoint level to catch roaming machines where ever they are. In some cases you also work with other TI vendors and get IPs and URLs you want to block and build automation around. This feature is currently in preview
So, with
WDATP you can now block or allow IPs and Urls.
For this
feature to work you need to have some prerequisites
Windows
10 1709 Pro, E3/E5 or Edu
Windows
Defender Network Protection
Windows
Defender AV
Cloud
Delivered Protection Enabled
It’s
possible to enable Network Protection in several ways
In our case we will just leverage PowerShell. To set and verify its configured
Set-MpPreference -EnableNetworkProtection Enabled
Get-MpPreference | fl
Once you
have prepared the endpoint you can go to the MDATP Portal and add your IPs/URLs
Navigate to Settings > Rules >
Indicators.
Select
the IP Address tab to view the list of IP’s.
Select the URLs/Domains to view the list of
URLs/domains.
In this tutorial we will Add a URL but the same procedure would apply for an IP.
1. Click on
Add Indicator
2. Enter a url and select if you want the block to expire
3. Add an Action as you like and descriptive texts as you want to have with your alerts. In this case we want to block and get an alert for this.
4. Select Scope, in this case we will select all machines but if you have built a structure with Machine Groups you can select to target specific machine groups where this will apply.
5. On the Summary screen click Save.
Note: from entering an IP/URL it can take some time for it to propagate to the endpoints and when it comes to removal it may even take a bit longer.
So when this has propagated to the endpoints we can test it out and see how this looks on the endpoint.
When browsing to the URL the end user will be notified about that something is blocked with a toast notification and an event log entry will also be logged.
In our case an alert will also be triggered in in the MDATP console as well where we can continue our investigation. I hope this gave a little valuable insight on this feature.
There are still many companies using forward proxies and when analyzing traffic from endpoints this can be a bit challenging. This due to that the client connects to the forward proxy instead of the public endpoint like http://blog.sec-labs.com.
So instead of the public endpoint you would see that the process is connecting to the proxy.
Microsoft have engineers around this and by enabling the Network Protection feature in either Audit Mode or Block mode you can now see the public endpoint the process is actually communicating with behind the forward proxy.
Events that is coming from this type of detection is flagged with the a “NetworkProtection” tag.
If you want to use thees events generated when you do Hunting they are found under Network CommunicationEvents and if you know your proxy ip address you can get everything that has gone via the proxy with the following query.
NetworkCommunicationEvents
| where ActionType == “ConnectionSuccess” and RemoteIP != “ProxyIP”
A few days ago, a post on medium stated that an arbitrary code execution was possible in Squirrel which affected Teams and other applications which used Squirrel and Nuget for updates.
In the post, Teams is mentioned as example but other affected application were mentioned on twitter.
So, to see what our environment is up to with regards to this. Our favorite place to go to: Defender ATP – Advanced Hunting!
To explain the query, since there are other apps than teams which uses Squirrel, we aim to keep the query as broad as we can.
Since some applications uses Squirrel and web for updates we can’t simply say that all web requests are malicious. But we have done some verification and discovered many apps vulnerable to this.
To make it more easy to overview we’re adding the URL to a column
To continue this we can count unique URL’s to find anomalies
CTF, Capture the
Flag is a known form of a game mode for various games like Paintball, laser
games and Computer games, but it’s also used in Computer Security.
Capture the Flag is a really good way of enhancing your Security skills, it starts with a few clues and quests you must solve to retrieve the flag for the challenge. These are named as Jeopardy-style CTF. They are often devided into different types of challenges i.e.:
Cryptography
Web
Forensics
Binary Exploitation
Reversing
Networking
There are also modes for CTF called Attack-Defense, where the teams have to defend their own network or machine and att the same time attack the opponents. There is also a version like one team is defending and the other one is attacking, a Blue Team – Red Team approach. Blue Team defends and tries to find out how and when the Red Team makes their way to get the Flag.
Who is CTF for?
It’s for everyone
with a interest in cyber security.
Qualify for bigger events
Some CTF’s are qualifiers for bigger CTF events, so get going and solve the challenges!
Example challenge from (https://capturetheflag.withgoogle.com):
This CTF has beginner challenges (which I can recommend if you’re new to this).
Amongst the beginner challenges we have the following one.
This challenge want us to find the flag which will look like “CTF{xxxxxx}” by using the clues in the text and the file which we are able to download.
We download the file (Attachment) and extract the content
The clue from the challenge indicates it’s something fishy with this .ico file.
Tha the initial view, it looks alright.
Let’s use binwalk which is a tool for searching binary images for embedded files and executable code to see if there is something hidden inside.
It looks like we’re getting somewhere, it seems to be a zip archive.
Let’s try to list the content with 7zip
Works! Next step would be to unpack the content in our hunt for the flag
We have extracted our files
And we now have the flag!
We enter it on the website and the challenge is completed and can start the next challenge…
Where to start?
So, for those of you
who are new or want to get some good links into CTF, I have tried to
gather all CTF Links in this post for reference, I will try to keep the links
updated along the way.
