Threat hunting with MITRE ATT&CK and Wazuh

Threat searching is the system of seeking for destructive activity and its artifacts in a laptop or computer technique or network. Risk looking is carried out intermittently in an ecosystem irrespective of irrespective of whether or not threats have been identified by automatic security methods. Some risk actors may perhaps keep dormant in an organization’s infrastructure, extending their entry even though ready for the proper prospect to exploit found weaknesses.

Hence it is critical to complete risk hunting to recognize destructive actors in an environment and stop them right before they achieve their top intention.

To efficiently perform risk searching, the risk hunter need to have a systematic solution to emulating feasible adversary conduct. This adversarial actions establishes what artifacts can be searched for that indicate ongoing or past malicious activity.

MITRE ATT&CK

More than the many years, the security neighborhood has observed that danger actors have generally utilized lots of strategies, methods, and processes (TTPs) to infiltrate and pivot throughout networks, elevate privileges, and exfiltrate confidential facts. This has led to the enhancement of many frameworks for mapping the pursuits and strategies of menace actors. One particular illustration is the MITRE ATT&CK framework.

MITRE ATT&CK is an acronym that stands for MITRE Adversarial Strategies, Techniques, and Prevalent Information (ATT&CK). It is a effectively-documented knowledge base of real-globe danger actor actions and behaviors. MITRE ATT&CK framework has 14 strategies and many tactics that identify or point out an attack in development. MITRE makes use of IDs to reference the tactic or strategy used by an adversary.

The Wazuh unified XDR and SIEM system

Wazuh is an open source unified XDR and SIEM platform. The Wazuh resolution is produced up of a one common agent that is deployed on monitored endpoints for danger detection and automated response. It also has central elements (Wazuh server, indexer, and dashboard) that assess and visualize the security functions information collected by the Wazuh agent. It shields on-premises and cloud workloads.

Determine 1: Wazuh security celebration dashboard
Risk hunting with Wazuh

Menace hunters use various instruments, procedures, and techniques to lookup for destructive artifacts in an surroundings. These include but are not constrained to making use of instruments for security monitoring, file integrity monitoring, and endpoint configuration assessment.

Wazuh gives sturdy abilities like file integrity checking, security configuration evaluation, risk detection, automated response to threats, and integration with options that deliver threat intelligence feeds.

Wazuh MITRE ATT&CK module

Wazuh comes with the MITRE ATT&CK module out-of-the-box and threat detection policies mapped against their corresponding MITRE procedure IDs. This module has four elements which are:

a. The intelligence component of the Wazuh MITRE ATT&CK module: Is made up of comprehensive information about risk groups, mitigation, program, techniques, and techniques applied in cyber assaults. This part can help threat hunters to identify and classify distinctive TTPs that adversaries use.

Determine 2: Wazuh MITRE ATT&CK Intelligence

b. The framework component of the Wazuh MITRE ATT&CK module: Can help risk hunters slender down threats or compromised endpoints. This ingredient employs precise methods to see all the gatherings linked to that method and the endpoints the place these functions took place.

Determine 3: Wazuh MITRE ATT&CK framework

c. The dashboard part of the MITRE ATT&CK module: Allows to summarize all occasions into charts to support threat hunters in owning a swift overview of MITRE similar routines in an infrastructure.

Figure 4: Wazuh MITRE ATT&CK dashboard

d. The Wazuh MITRE ATT&CK situations ingredient: Shows events in serious-time, with their respective MITRE IDs, to superior realize each claimed notify.

Figure 5: Wazuh MITRE ATT&CK situations

Wazuh procedures and decoders

Wazuh has out-of-the-box procedures and decoders to parse security and runtime facts generated from distinct resources. Wazuh supports guidelines for various technologies (e.g., Docker, CISCO, Microsoft Trade), which have been mapped to their acceptable MITRE IDs. Users can also produce customized principles and decoders and map every rule with its appropriate MITRE tactic or technique. This weblog write-up demonstrates an example of leveraging MITRE ATT&CK and Wazuh tailor made procedures to detect an adversary.

Security Configuration Evaluation (SCA) module

The Wazuh SCA module performs periodic scans in endpoints to detect system and application misconfigurations. It can also be made use of to scan for indicators of compromise, like destructive documents and folders that have been developed by malware. Examining computer software inventories, companies, misconfigurations, and improvements in the configuration on an endpoint can assist danger hunters detect attacks underway.

Figure 6: Wazuh SCA dashboard

Integration with menace intelligence alternatives

Thanks to its open up supply mother nature, Wazuh delivers an opportunity to integrate with menace intelligence APIs and other security options. Wazuh integrates with open up source risk intelligence platforms like Virustotal, URLHaus, MISP, and AbuseIPDB to identify a few. Dependent on the integration, related alerts surface in the Wazuh dashboard. Distinct information and facts, such as IP addresses, file hashes, and URLs, can be queried working with filters on the Wazuh dashboard.

File integrity monitoring

File integrity monitoring (FIM) is used to check and audit delicate files and folders on endpoints. Wazuh presents an FIM module that screens and detects modifications in specified directories or documents on an endpoint’s filesystem. The FIM module can also detect when documents released to endpoints match hashes of known malware.

Wazuh archives

Wazuh archives can be enabled to accumulate and retail store all security occasions ingested from monitored endpoints. This element helps menace hunters by supplying them with information that can be utilised to build detection rules and keep ahead of threat actors. Wazuh archives are also practical in conference regulatory compliance where audit log history is expected.

Conclusion

The MITRE ATT&CK framework will help to effectively classify and recognize threats in accordance to found out TTPs. Wazuh uses its devoted MITRE ATT&CK parts to exhibit facts about how security facts from endpoints correspond to TTPs. The menace hunting abilities of Wazuh assistance cybersecurity analysts to detect obvious cyber assaults as effectively as underlying compromises to infrastructure.

Wazuh is a totally free and open source system that can be applied by businesses with cloud and on-premises infrastructure. Wazuh has a person of the speediest-expanding open up supply local community in the earth, exactly where finding out, conversations, and help is made available at zero price. Look at out this documentation to get commenced with Wazuh.

Identified this article interesting? Follow THN on Fb, Twitter  and LinkedIn to examine much more unique content we put up.

Some parts of this article are sourced from:
thehackernews.com