Types of Intelligence

The types of intelligence can be categorized in three ways. They vary in how their value relates to the threats.

• Operational Operational intelligence strives to keep business going as planned. You are looking to identify the trends and systemic risks that threaten on an ongoing basis. Operational intelligence includes actively threat hunting for the malicious in your environment and working toward understanding those threats the best you can, before they create an incident, as well as using threat emulation to take new information about attacks and convert it into usable signatures. This gives an organization the ability to block those threats before they have an opportunity to do damage within an enterprise ecosystem.
• Tactical Tactical intelligence represents the “here and now” of needed information. You are looking to understand a specific discovery, perhaps a threat found in the course of incident response. For example, the security operations center (SOC) may have identified a common piece of commodity malware in your environment. Commodity malware is publicly available code that can be purchased but is not customized and used by many threat actors. If this type of threat is found within the organization, a high degree of tactical intelligence will help quickly identify and navigate the response to it.
• Strategic Strategic threat intelligence asks questions while looking further out. Who will be the threat the organization will soon face or can expect to face? What sort of targeted attacks can your industry or the organization come to expect? For example, an industrial espionage attack may target your organization because of specific value or product.

Threat Hunting

The concept of threat hunting means to search for and identify security threats and problems that have yet to be discovered in the environment. The act of threat hunting usually involves going well beyond the typical security technologies and safeguards. The potential reward is preferable to some undiscovered malware. The prize to be sought would be the capable insider threat or shadow IT which, until discovered, had been “flying under the radar.” Other potential discoveries can be bad configurations or outdated processes.

Remember that threat hunting is proactive, unlike most security appliances and technologies. Too often, security devices respond to a threat based on a matching signature. Threat hunting, on the other hand, is a practice or exercise that requires perseverance and creativity. Since human threats, especially ones already established on the inside, will be careful not to reveal their motives or reason, hunt teaming requires patience and vigilance to flush out the threats.

Threat Emulation

The value in carefully analyzing a threat is more than just research. When you can imitate how a threat works and interacts with the vulnerability, you understand more how to mitigate the risk of that threat. Threat emulation is the approach and activity of better understanding a threat for the sake of ultimately minimizing it.

Open-Source Intelligence

The open-source intelligence (OSINT) method allows required information to be delivered as highly relevant research results that can easily be validated and transformed into high-quality intelligence. The idea behind gathering OSINT originated in the military, but it was found to be of great value in the civilian domain as well. OSINT is broadly defined as using established intelligence tradecraft on open sources of information. Open sources range from foreign language translation to exploitation/analysis of multiple, independent, publicly available sources of information. OSINT sources include commercial, scientific, and technical databases; symposium proceedings; published strategies and doctrine; think-tank publications; patent information; and other open-source documents available to the general public. A variety of exploitation techniques are practiced in OSINT, including monitoring social media and gathering contact information from sites such as WHOIS, search engines, and other records.

It's important to note that information being readily available does not make that information free to use as we wish. Information accessibility has value and perhaps a cost associated with producing it. Information created by commercial research or effort can label that information as proprietary and protected. In threat research it is important to respect the difference between available and free to reuse. For example, threat intelligence research firms publish intelligence feeds to disseminate their findings. These intelligence feeds are highly valuable partly because of the vast effort behind making them.

Human Intelligence and Social Engineering

No technology can build or betray confidentiality and trust like human interaction. If you agree with that, consider speaking with a trained professional. But seriously, humans do thrive on interaction and relationships. This can be for good or bad. For our purposes, we're talking about human interaction used for the sake of gathering information.

It's commonly said that the second-oldest profession is spying. Human intelligence (HUMINT) is the personal side of spying or collecting intelligence. While OSINT might involve dumpster diving and scouring social media, HUMINT involves building a genuine rapport and leveraging it for information or access.

HUMINT can be considered a portion of social engineering. Social engineering encompasses a spectrum of methods and devices, such as email, texts, and phone calls.

Speaking personally, social engineering is part of my job. More specifically, when a client asks my employer to perform social engineering, I am sent off for an onsite engagement. Phishing and other online social engineering gets done between myself and others.

My onsite work does not include breaking in after hours with specialized tools. I respect professionals who have that skill and practice. One of the penetration testers on my team is skillful at lock picking, but for now, such tools are outside our rules of engagement. We must stick to social engineering. Plus, unlike a door-opening tool, real people give you access and point you right where you need to be.

Instead, I gain access only by interacting with an employee. Naturally, that insider is not aware of my goal. In social engineering, the engagement is based on deceit, and time is needed to build a rapport. I do get in, but people do take more time than tools. And perhaps most importantly, I am ever careful to not put someone in a position of being embarrassed or being left feeling more vulnerable afterward. The goal is security awareness and team education. In almost every case, I am not forced to reveal the identity or insider who allowed me in.

MITRE Adversarial Tactics, Techniques and Common Knowledge

The MITRE Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) framework is what happens when you take the brains of a well-schooled, methodical attacker and spray them on a highly organized matrix. Not a delicate picture, but neither is the ATT&CK matrix.

MITRE is the not-for-profit research organization that brought you the Common Vulnerabilities and Exposures (CVE), the leader in ranking and categorizing vulnerabilities. MITRE's ATT&CK framework by its full name is Adversarial Tactics, Techniques and Common Knowledge. So, yes, this means taking the brains of an attacker and categorizing them into methods and flow.

The MITRE ATT&CK Matrix for Enterprise is organized to identify top-level tactics that include hundreds of techniques that attackers use. In examining the ATT&CK Matrix, you are probably identifying techniques that seem to relate to only one operating system. Meanwhile, the overall structure and the majority of tactics and techniques can apply to any platform. The ATT&CK Matrix for Enterprise accommodates all OSs, but MITRE does have matrices specific to Windows, Linux, macOS, and mobile systems.

Let's take a quick look at the top-level tactics from the ATT&CK framework. Later, with other frameworks, you can compare and contrast the length and flow. The tactics from the MITRE ATT&CK Matrix for Enterprise include the following:

• Reconnaissance
• Resource development
• Initial access
• Execution
• Persistence
• Privilege escalation
• Defense evasion
• Credential access
• Discovery
• Lateral movement
• Collection
• Command and control
• Exfiltration
• Impact

ATT&CK for Industrial Control Systems

There is an ATT&CK matrix tailored for industrial control systems (ICSs). Recall that ICS refers to operational technology systems that monitor and control industrial operations, such as wastewater and other utilities, manufacturing, and so on. This also applies to supervisory control and data acquisition (SCADA) systems.

There is something important to understand here about ATT&CK for ICS. The ICS matrix does not seek to replace the more generic “IT” version of ATT&CK. Obviously, industry control systems also include the enterprise IT, so a replacement would just result in 90 percent duplication. The ATT&CK for ICS spotlights the attack techniques and tactics particular to the industry control components.

The MITRE ATT&CK for ICS tactics include the following:

• Collection
• Command and control
• Discovery
• Evasion
• Execution
• Impact
• Impair process control
• Inhibit response function
• Initial access
• Lateral movement
• Persistence

There is some overlap but even at the highest level you notice the shifted focus. Dig into the techniques, and you'll see how ATT&CK for ICS is quite different from IT systems. A good resource for exploring this is collaborate.mitre.org/attackics/index.php/Main_Page.

Cyber Kill Chain

The Cyber Kill Chain is similar to MITRE's ATT&CK framework, since both describe how an attacker goes about compromising a system or network. A noticeable difference is that the Cyber Kill Chain is shorter and more concise. Another difference is the ATT&CK framework is fixed in terms of naming those top-level tactics. The Cyber Kill Chain can be found in a few different iterations. Lockheed Martin started it, evolving it from a military model. Now Gartner has its version, which is not too different but Gartner claims it as its own. For the CASP+ exam, it's best if you remember the terms of the Lockheed Martin model. The Cyber Kill Chain tactics follow these steps:

1. Reconnaissance
2. Weaponization
3. Delivery
4. Exploitation
5. Installation
6. Command & control (C2)
7. Actions on objectives

To learn more about the Cyber Kill Chain, see lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html.

Diamond Model of Intrusion Analysis

An altogether different concept is the Diamond Model of Intrusion Analysis, which is presented as a simple diamond shape. Each corner of the diamond is labeled like this:

• Left corner: Infrastructure
• Top corner: Adversary
• Right corner: Capability
• Bottom corner: Victim

Far from the linear progression of steps of the other two models, the Diamond Model of Intrusion Analysis aims to help threat intelligence analysts organize large amounts of data. Every incident connects these labels to insight and knowledge as well as exposes knowledge gaps. Using this model, an intelligence analyst can show with precision how an adversary uses their capability within an infrastructure against the victim.

The CASP+ exam does not require that you have experience using the model, or even know how to work with it. However, it's a good idea to know at least how to label it. I suggest you watch a 10-minute YouTube video called Diamond Model of Intrusion Analysis: An Overview (youtube.com/watch?v=3PoQLOJr5WI).

Reading the Logs

Logs are the greatest source of IoCs. As great as logs are, they are a double-edged sword. The more you log, the more detailed information you're gathering, at your disposal, ready for your review. And the more you log, the more there is to review. Logs provide evidence that will prove useful in any forensic audit after a security breach. Some compliance requirements will state how long logs must be kept.

Intelligent log management goes a long way toward watching for indicators of compromise. Let's review the types of logs proving to be a good source for IoCs.

• Network Logs Network devices are the eyes and ears of the network. Network switches and routers can monitor for abnormal traffic, odd levels of traffic, unusual sources or destinations, triggered rules, and signatures. Use this capability to watch the perimeter as well as interior networks. When the time comes to investigate indicators of compromise, your network logs can provide breadcrumbs to follow.
• Vulnerability Logs Identifying and assessing vulnerabilities is a key part of risk management. After scanning a system for vulnerabilities, keep those logs as your baseline. Those vulnerability logs are a valuable resource when trying to understand or validate an indicator of compromise.
• Operating System Logs OS logs are your one-stop shop to tons of information related to the host system, the server's interfaces, OS errors, and failures. As with other logs, you get out of operating system logs only as much as you allow the operating system to record.

  Windows Event Viewer Application, Security, and System logs can be critical in a forensic investigation. Windows Event logs are stored locally in %SystemRoot%System32WinevtLogs.

  Most Linux log files are stored in a plain ASCII text file and are in the /var/log directory and subdirectory. Logs are generated by the Linux system daemon log, syslogd, or rsyslogd.

• Access Logs Want to know who signed in to what, when, and from where? Access logs can answer all those questions. Depending on whether sufficient logging is done, an access log can either confirm suspicions or instill doubt.

• NetFlow Logs In case you're not familiar with network monitoring protocol NetFlow, Cisco created it to assist in collecting statistics on IP traffic as it traverses the network. There are a variety of commercial tools to gather and make pretty graphs from what NetFlow monitors. Those NetFlow logs might be a gold mine to you when reviewed in conjunction with network device logs.

  NetFlow collects packets via a router interface. They are then provided to a NetFlow collector. A NetFlow application can then analyze the data, which is useful for incident investigations for intrusion analysis. An alternative to NetFlow is sFlow (sampled flow), which is also used for network monitoring. sFlow samples packets and provides analysis to identify unauthorized network activity and investigate DDoS attacks.

Intrusion Detection and Prevention

Intrusion detection has come a long way since the concept was created in the 1980s. Early intrusion detection and prevention systems (IDPSs) were clearly divided into two broad types: network intrusion detection systems (NIDSs) and host-based intrusion detection systems (HIDSs). These can be further divided into categories based on the internal engine or approach to detecting anomalies and unusual process activity. They typically include the following:

• Signature: Seeks to match based on known signature rules
• Anomaly: Examines traffic and looks for activity that is abnormal, based on behavior rules
• Protocol: Examines data and compares it to a database of known protocols and their activity

The IT security industry has grown to require more from these devices. This is how intrusion prevention systems (IPSs) were born. The IPS was designed to move beyond IDSs and provide the capability to enforce computer security policies, acceptable use policies, or standard security practices. Today, this technology has continued to evolve into what is known as intrusion detection and prevention (IDP). IDPs can record information related to observed events, generate notifications, generate IDS/IPS alerts, and create reports. Many IDPs can also respond to a detected threat by attempting to prevent it from succeeding. They use several response techniques, which involve the IDPs stopping the attack itself, changing the security environment through alteration of a firewall setting, or changing the attack's content.

Many IDPs exist, and some are community based and therefore free. Snort is one of the most popular and has been around for several years now. A more recent addition to the community is Suricata. It is offered by the Open Information Security Foundation (OISF) with funding from the U.S. Department of Homeland Security (DHS) and the U.S. Navy's Space and Warfare Command (SPAWAR) as well as the Open Information Security Foundation (OISF) Consortium. More information about Suricata is available at suricata-ids.org.

Threat intelligence sources may also provide IoCs. These are the telltale signs that an attack has taken place and may include file signatures, log patterns, and other evidence left behind by attackers. IoC may also be found in file and code repositories that offer threat intelligence information.

Exercise 3.1 will demonstrate how to perform a basic packet capture with WinDump and how this technology can be used to monitor and detect anomalies as well as look for indicators of compromise.

Notifications and Responses to IoCs

When we first recognize an indicator of compromise and our minds ask 100 questions at once, the panicked reaction is to respond. We want to respond immediately. The superior approach is to avoid panic and dig deeper for more information to make a more informed response. Tools that are monitoring and digesting information from our network can alert us when human hands are needed.

• FIM Alerts Would you know if the master price list was changed? Imagine the scenario where the master price list is updated every Monday morning. However, on Thursday, your service responsible for file integrity monitoring alerts you that a change was made by someone not in the appropriate department.

  File integrity monitoring (FIM) will monitor for changes in the file. FIM alerts can tell you practically in real time, permitting you to immediately investigate. This wouldn't include end-user files, which we can safely expect to change constantly.

• Antivirus Alerts On end devices, commonly on an end-user workstation or production server, the antivirus software is working quietly in the background. However, when it does float an antivirus alert to the workstation user, it is an immediate indicator of compromise warranting further research.
• IPS/IDS Rules and Alerts Alerts from intrusion detection systems and intrusion prevention systems prove a significant indicator of suspect activity on the network. IDS or IPS alerts come when activity might get triggered when the activity matches the signature.

  Depending how the organization manages alerts, the notification may feed into a security information and event management (SIEM) system. SIEM alerts provide security analysts a more centralized view compared to receiving alerts directly from individual systems.

• Scripts/Regular Expressions In earlier years, intrusion detection and antivirus systems had a processing technique using regular expressions (regex) and scripts to identify a match between a known signature and what was seen on the wire. Regex or regular expression matching was the default approach, but regex matching does take considerable overhead in memory. With the speed and volume of traffic today, regex matching is not quite fast enough, and other methods have met the need.
• DLP Rules and Alerts Detecting and blocking data exfiltration requires the use of security event management solutions that can closely monitor outbound data transmissions. Data loss prevention (DLP) requires the analysis of egress network traffic for anomalies and the use of better outbound firewall controls that perform deep packet inspection. Deep packet inspection normally occurs by a device at a network boundary, for example by a web application firewall at the trusted network's perimeter. To select where such a device should be placed in any organization, it's important to have a data flow diagram, depicting where and how data flows throughout the network. On this device, DLP rules establish what and how data flows will trigger DLP alerts. A DLP alert warns the security analyst or administrator of the likelihood of data being exfiltrated out of the network.

More notification types and rules to trigger are discussed in the following section through other situations. However, here we can already understand how valuable an alert or notification is to kick off our training in reviewing IoCs and possibly moving onto incident response.

1. What term describes the search for an insider threat or shadow IT, which, until discovered, had been “flying under the radar?”
   1. Threat hunting
   2. Threat emulation
   3. Intelligence
   4. Targeted attacks
2. LoJax, Bad Rabbit, and NotPetya are three examples of what?
   1. Zero-day threats
   2. Malware
   3. APTs
   4. Competitors
3. You discover log entries that raise suspicion that a security incident might have occurred. You decide more investigation is needed. What describes what you found?
   1. Vulnerabilities
   2. ACLs
   3. Threat intelligence types
   4. Indicators of compromise
4. What is a key strength the disgruntled employee has over an outsider?
   1. Trust
   2. Time
   3. Money
   4. Signature
5. Your manager asks if you've noticed any abnormal volumes of network traffic or other network issues. What logs might help you answer those concerns?
   1. FIM logs
   2. NetFlow logs
   3. Firewall logs
   4. Access logs
6. Which of the following alerts warns the security analyst or administrator of the likelihood that data was exfiltrated out of the network?
   1. IoC
   2. FIM
   3. DLP
   4. ICE
7. What intrusion detection processing technique is common for identifying a positive match but struggles to keep up with today's traffic speeds and volumes?
   1. SIEM
   2. Regular expressions
   3. Signature-based
   4. Anomaly or behavior
8. Which of the following can block traffic based on the source and destination address?
   1. The Deep Web
   2. Script kiddie
   3. ICS
   4. ACL
9. In the following example of an access control list, which of the following answers is true?

   hostname R1
   !
   Interface ethernet0
   Ip access-group 102 in
   !
   access-list 102 deny tcp any any eq 23
   access-list 102 permit ip any any 
   1. TCP traffic bound for port 102 is permitted.
   2. TCP traffic bound for port 23 is blocked.
   3. TCP traffic bound for port 102 is blocked.
   4. TCP traffic bound for port 23 is permitted.
10. You got an alert that unusual changes were made to files in a customer directory. What type of alert was this?
    1. DLP
    2. IDS
    3. FIM
    4. IPS
11. Which of the following is not a label for the conceptual Diamond Model of Intrusion Analysis?
    1. Capability
    2. Attacks
    3. Victim
    4. Infrastructure
12. For the purpose of better understanding a company, an employee is tasked with browsing social media, listening to recorded speeches, and reading patents. What type of intelligence gathering is this employee performing?
    1. HUMINT
    2. APT
    3. OSINT
    4. ATT&CK
13. A determined security analyst discovered some evidence on a system that warranted more investigation. Ultimately, the analyst identified that advanced malware was resident and difficult to remove. The security analyst recommended the system be rebuilt from scratch. What is it the analyst had discovered?
    1. IoC
    2. ACL
    3. DLP
    4. APT
14. What intelligence collection method is described as the personal side of spying or collecting intelligence?
    1. Lessons learned report
    2. Deep Web
    3. HUMINT
    4. OSINT
15. If you needed to find out an organization's technical contact or registration information about their domain, what OSINT resource might be helpful?
    1. DNS records
    2. Deep Web
    3. TRA
    4. WHOIS
16. Whether following the Cyber Kill Chain or the ATT&CK framework, which of the following tactics would occur first?
    1. Reconnaissance
    2. Command and control
    3. Exfiltration
    4. Discovery
17. In the ATT&CK framework, which of the following tactics occurs last?
    1. Initial access
    2. Persistence
    3. Discovery
    4. Defense evasion
18. For the purpose of gaining access to a competitor's property, you are tasked with befriending the competitor's employees, using social media, conversations, and empathy to build personal trust. What type of intelligence gathering are you performing?
    1. HUMINT
    2. APT
    3. OSINT
    4. ATT&CK
19. Which dangerous category of bad actors describes those seeking to compromise critical infrastructures such as nuclear power plants, power generation stations, and water treatment plants?
    1. Script kiddie
    2. Organized crime
    3. Insider threat
    4. Nation-state
20. A few months after the legal firm Dewey, Cheatem, and Howe outsourced their accounts receivable department, the law firm suffered from hacked bank accounts. They are growing suspicious of an attack. Which of the following terms describes what likely happened?
    1. Denial-of-service attack
    2. SYN flood attack
    3. Disgruntled employee
    4. Supply chain attack