On March 27, 2018, US-CERT publicly disclosed widespread cyber-attacks on domestic energy and other infrastructure locations. These attacks had been occurring since at least March 2016 and had successfully compromised a number of locations including some nuclear facilities, water, and aviation locations.

This was not a typical drive-by attack. It was a systematic, multi-staged effort that advanced up the kill chain and utilized several sophisticated targeting techniques including spear-phishing, watering-hole domains, and ultimately the targeting of industrial control systems infrastructure.

Some details of this attack became known to the targets by at least September 2017, approximately six months before the public disclosure.

Arming yourself against future attacks

The emergency readiness team produced a comprehensive document that described the full strategy and tactics used by the attackers. This included details of the entire kill chain, from the reconnaissance phase, through lateral spread to other devices on their network. When they published their findings, they highlighted important “indicators of compromise” (IOCs) including:

  • Suspicious URLs
  • Suspicious IP addresses
  • MD5 Hashs and filenames associated with a malware attack

With these IOCs, organisations can arm themselves against similar attacks in the future. These can be used to provide network security tools, including firewalls, IPS/IDS, and web proxies with a list of the IP addresses and URLs to interfere with the communication lines for this attack. In addition, the MD5 hashes allow network and endpoint solutions to be aware of the malware associated with this group.

The challenge is that once these IOCs are known, it becomes less likely that these same adversaries will continue to use them. This is because it becomes more difficult to use the same strategy once your targets become aware of your tactics. Some copycat adversaries may use this as a blueprint for ways to launch similar attacks, but these adversaries are often less resourceful than the originators of the attack.

So, while having public disclosure of the details and IOCs are useful, often the security operations team is left wondering what they may have prevented had they been informed of these IOCs six months earlier and not after they become less valuable.

Hindsight is key to good threat hunting

Organisations would be able to use these IOCs to discover new attacks using the same techniques – and to look into the past to identify whether these important markers were present before you became aware of them. Unfortunately, most organizations do not have easy access to this information, and you can’t start after there has been a big discovery.

The US-CERT announcement should be the wake-up call to not just monitor and track the information frequently associated with IOCs, but also to include a simple and consolidated method to search for these following an announcement like this.

Many organisations already log this data but isn’t always collected, archived and maintained in a system that is easily queried. As a result, this data is used in forensics to determine how a serious breach occurred, once it is discovered, but it isn’t often the vehicle that enables this detection itself.

Source: CSO Online