The key difference between threat hunting and incident response is that threat hunting is proactive, the goal of threat hunting is to detect and mitigate threats before they can cause damage. Incident response is reactive, the goal of incident response is to minimize the damage caused by the incident and prevent it from happening again. Often times great incident responders make legendary threat hunters because their experience helps them to accurately determine how an attacker will behave and what they might do next.

• Accessing the TestDrive Experience
  • Access TestDrive LIVE environment
  • Access Carbon Black Cloud within TestDrive environment
• Section 2: Attack Stages
  • A phishing email to the victim
  • What's visible to the victim
  • What is actually happening on the endpoint
• Section 3: Lab time
  • Wear a hat as a Victim
  • Wear a hat as a security operations center (SOC) analyst
  • Investigate each process, command, binary leveraging CB

Note: Carbon Black is set to Detection only policy for demonstration purposes. Initial stages of this attack could have been prevented leveraging Carbon Black prevention policies.

We have multiple hits on watchlists (as we do with all stages of this attack). Watchlists provide custom detection and continuous monitoring of the environment. They compromise of reports, which are collections of IOCs. With Carbon Black XDR, you have the ability to use custom watchlists or use the watchlists that are provided by Carbon Black.

As well as the watchlist hits, we also have netconns being made from powershell.exe.  Lets looks specifically at the netconns. This will provide us more detail into how freecoupon_forlife got onto our network.

9. filter on netconns to investigate the network connections

Carbon Black XDR has network connection visibility. Network connection visibility enables customers to visualize and analyze network data in context, using the Carbon Black Cloud. The XDR network telemetry includes continuous capture and analysis of network fingerprints, flow and TLS data, and application-protocol data.

You can see that a https connection was made to freecup0ns.com using TLS 1.2, and the flow events show that we have a large number of bytes received (this would be the download of freecoupon_forlife.exe). I also see information on the certificate and JA3 used - both can be useful for future detection and prevention.

We have visibility of the process and the visibility of the network connection.

There are other instances of powershell.exe running at the same time, from the same winword.exe process, lets look into them.

10. In process tree, select and expand the second powershell.exe instance.

Here we see network discovery tasks, such as ipconfig.exe and netstat being run. If we look at the the cmdline (at top of page), we can see that the outputs are being written to a file called fc_info.txt and then are uploaded to a dropbox.tk website.

11. In process tree, select and expand the third powershell.exe instance.

This process tree shows us how the text file was opened on the desktop as soon as we enabled the macro on the the word doc. A powershell script was used to open notepad.exe.

12. In process tree, select and expand the forth powershell.exe instance

Here we see that powershell is used to run an executable, freecoupon.exe which in turn runs other cmd.exe and powershell.exe instances. I can see in the cmdline, that a curl is run to c3.freecup0ns.com, a file freecoupons.exe is written to \programdata and the executed.

Note: if this command was encoded, Carbon Black would have decoded it automatically.

Looking at the netconns, I can see established and outbound connections to c3.freecup0ns.com.

What happend once freecoupons.exe is run?

13. Click on cmd.exe to find out more.

We see that cmd.exe is used to load a payload.bat file. That does not look too great, and we need to know what this payload.bat file does.

14. Select child process of cmd.exe, powershell.exe

cmd.exe, runs payload.bat which uses powershell to make network connections. I see an alert on a connection to 192.168.52.131 (this is our C2 Server).

15. Lets expand this event.

The connection is over 443, I see many XDR TTPs (bypass policy, code_drop, fileless, leverages_system_utility). I also see that XDR sees that the adversary is trying to run malicious code. This is the implant to the C2, the C2 is issuing powershell commands (auto runs) to this machine using a reverse shell over 443.

I also noticed a strange connection between two machines in my network over 5985.

16. Expand the netconn event

The connection is between two machines on my network. I can see that WinRM is being used as this is the user-agent, and I can see bytes being sent. This is indicative of lateral movement. The adversary comprised one machine, and from that, is moving through my network, using WinRM.

We now have a complete picture of what happened, all visible in a single console, with XDR TTP tags, MITRE ATT&CK Framework mapping and clear descriptions helping make understanding the attack simple.

This behavior of lateral movement using WinRM was also picked up by our Intrusion detection system (IDS) engine. The purpose of IDS is to detect and respond to malicious activity. Carbon Black XDRs IDS instantly identify malicious network behavior's.

We are monitoring the activity on a host for signs of suspicious behaviour, such as changes to system files, unauthorized access attempts, or unusual network traffic. We use a mix of signature-based detection and behavioural analysis to identify potential security threats.

We provide you the most important observations fast .

17. Go back to Observations tab (Investigate>Observations) deselect Indicator of attack and select Intrusion Detection System type.

Expanding the IDS alert gives information on what XDR has seen. You can see we have seen this as lateral movement using windows remote management - for info on any of the fields, select i icon.

With Carbon Black XDR, you get complete process, identity and network visibility. Carbon Black XDR gives you the power to detect, respond and remediate in real time, stopping active attacks and repairing damage quickly. Reducing complexity, accelerating investigations and greatly reduced dwell time and average time to detection and time to resolution.

By providing this unmatched visibility into the process and network data, Carbon Black XDR helps to reduce risk and provides you with the tools required to protects against modern threats.