Blue Team & Blue Teaming
Our unique approach stands out with the fact that we are not only base our detection on known active crime groups, but focus on a wider perspective which allows us for more effective detection of targeted attacks, which are not detected by common tools and security software. Threat hunting is a constantly evolving process not a technology. We have a solid knowledge on real attacks and track covering techniques which comes directly from the services we offer – red teaming, penetration testing, as well as analysis and detection of such attacks – digital forensics and incident response. We dissect the attackers methods in order to detect them independently of which tools were used to perform them, simultaneously decreasing the number of operations on analyzed data that needs to be performed by the detection system resulting in increasing the efficiency. Additionally we use so called data enrichment for supporting internal data such as logs with outside information from our proprietary CTI (Cyber Threat Intelligence) system.
Proactive threat discovery
We know how to effectively identify attack symptoms and intruder presence in the organization infrastructure. A sample task for a threat hunter is to run a dedicated software (e.g. a honeypot) or monitor the DNS traffic inside a network looking for potentially malicious activity by e.g. checking entropy, types of DNS requests, comparison of domains with IOC (Indicator of Compromise) received from threat intelligence etc. On the other hand log analysis in this case is not only limited to monitoring base events, but means deep analysis by connecting many sources which can indicate that integrity has been compromised. Every solution is individually prepared to fit the customer needs in order to get best detection rates. Thanks to that type of approach there is a real possibility of detecting an attack, including the targeted ones which can help in reacting on time before real damage is done.
Cyber Threat Intelligence (CTI) is used to get constant information updates from outside source about a given organization. The services consists of two main parts: information for security teams and IOC (Indicator of Compromise) mostly used to automatic data enrichment for internal monitoring with SIEM systems, IPS (Intrusion Prevention System) or IDS/NIDS/HIDS (Intrusion Detection System, Network, Host). Simplest example of such enrichment might be acquiring IP addresses information from the honeypot network used by attackers or detecting changes of open ports in the company infrastructure. We use a dedicated proprietary software, which depending on customer needs automatically looks for potential threats or changes that might indicate a compromise. We support infrastructure monitoring with data from CTI which allows us to effectively detect targeted attacks. Our software collects information available on the Internet (OSINT) and actively monitors organization assets to look for changes inside both external (WAN) and internal (LAN) networks.
We perform OSINT engagements (Open-Source Intelligence) where we gather significant amount of information about the target organization on the Internet. Obtained information can be used to identify potentially vulnerable assets and weak spots which threat actors may choose to target. Information retrieved using OSINT techniques include details about employyes, organisation structure, physical assets, IT infrastructure and more.
Incident response (CERT, CSIRT)
Security Operations Center (SOC)
Threat hunting service is usually delivered as the 3rd, last line in the Security Operations Center (SOC). Additionally with our partner we are able to offer full SOC outsourcing, consisting of 3 lines, working 24/7.
Our publications about threat hunting
- Spear-phishing campaign tricks users to transfer money (TTPs & IOC)
- Black Kingdom ransomware (TTPs & IOC)
– featured in BleepingComputer
- Kinsing cryptocurrency mining malware (TTPs & IOC)
- Sodinokibi / REvil / Maze ransomware (TTPs & IOC)
- Deceiving blue teams using anti-forensic techniques
- Bypassing LLMNR/NBT-NS honeypot
- Internal domain name collision
- Threat hunting using DNS firewalls and data enrichment
- Sinkholing BadWPAD infrastructure - wpad.pl / wpadblocking.com case (part 4)
- BadWPAD and wpad.pl / wpadblocking.com case (part 2)
– featured in SANS Daily Network Security Podcast (ISC StormCast)
- BadWPAD, DNS suffix and wpad.pl / wpadblocking.com case
- DNS based threat hunting and DoH (DNS over HTTPS)
– featured in Staff Picks for Splunk Security Reading
- Practical computer forensics analysis
– book, ISBN 9788301193478 (ISBN-10: 8301193476)