valitydev/atomic-threat-coverage
14
0
Fork 0
mirror of https://github.com/valitydev/atomic-threat-coverage.git synced 2024-11-06 09:35:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

added new Response Actions; Phishing Playbook updated

Browse Source
This commit is contained in:
Yugoslavskiy Daniil 2019-02-06 01:44:48 +01:00
parent d4f2f588da
commit 7e3a8d3f4f
11 changed files with 94 additions and 106 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
response_actions/RA_0011_eradication_revoke_compromised_credentials.yml
View File

@ -1,12 +1,14 @@
title: RA_0011_eradication_revoke_compromised_credentials
stage: eradication
author: Name Surname
creation_date: DD.MM.YYYY
references:
- https://example.com
author: Daniil Yugoslavskiy
creation_date: 31.01.2019
references:
- https://adsecurity.org/?p=556
- https://adsecurity.org/?p=483
description: >
Response Action for
Response Action for revokation of compromised credentials.
workflow: |
Description of how to handle multiple Response Actions (if it is an aggregated Response Action) or workflow for single Response Action in markdown format.
Here newlines will be saved.
On this step you supposed to know what kind of credentials have beed compromised.
You need to revoke them in your Identity and Access Management system where they were created (like, Windows AD) using native functionality.
Warning:
- If adversary has generated Golden Ticket in Windows Domain/forest, you have to revoke KRBTGT Account password **twice** for each domain in a forest and proceed monitor malicious activity for next 20 minutes (Domain Controller KDC service doesn’t perform validate the user account until the TGT is older than 20 minutes old)

25
response_actions/RA_0012_eradication_report_phishing_attack_to_external_companies.yml Normal file
View File

@ -0,0 +1,25 @@
title: RA_0012_eradication_report_phishing_attack_to_external_companies
stage: eradication
automation:
- thehive # integration with MISP
author: Daniil Yugoslavskiy
creation_date: 31.01.2019
references:
- https://www.antiphishing.org/report-phishing/
- https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en
- https://www.ic3.gov/default.aspx
- http://www.us-cert.gov/nav/report_phishing.html
- https://blog.thehive-project.org/2017/06/19/thehive-cortex-and-misp-how-they-all-fit-together/
- https://www.sei.cmu.edu/education-outreach/computer-security-incident-response-teams/national-csirts/
description: >
Report phishing attack to external companies
workflow: |
Report phishing attack to external companites:
1. [National Computer Security Incident Response Teams (CSIRTs)](https://www.sei.cmu.edu/education-outreach/computer-security-incident-response-teams/national-csirts/)
2. [U.S. government-operated website](http://www.us-cert.gov/nav/report_phishing.html)
3. [Anti-Phishing Working Group (APWG)](http://antiphishing.org/report-phishing/)
4. [Google Safe Browsing](https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en)
5. [The FBI's Intenet Crime Complaint Center (IC3)](https://www.ic3.gov/default.aspx)
This Response Action could be automated with [TheHive and MISP integration](https://blog.thehive-project.org/2017/06/19/thehive-cortex-and-misp-how-they-all-fit-together/).

12
response_actions/RA_0012_eradication_report_source_of_malicious_activity_to_external_companies.yml
View File

@ -1,12 +0,0 @@
title: RA_0012_eradication_report_source_of_malicious_activity_to_external_companies
stage: eradication
author: Name Surname
creation_date: DD.MM.YYYY
references:
- https://example.com
description: >
Response Action for
workflow: |
Description of how to handle multiple Response Actions (if it is an aggregated Response Action) or workflow for single Response Action in markdown format.
Here newlines will be saved.

19
response_actions/RA_0013_lessons_learned_develop_incident_report.yml
View File

@ -1,12 +1,19 @@
title: RA_0013_lessons_learned_develop_incident_report
stage: lessons_learned
author: Name Surname
creation_date: DD.MM.YYYY
author: Daniil Yugoslavskiy
creation_date: 31.01.2019
references:
- https://example.com
- https://attack.mitre.org/tactics/enterprise/
- https://en.wikipedia.org/wiki/Kill_chain
description: >
Response Action for
Develop Incident Report
workflow: |
Description of how to handle multiple Response Actions (if it is an aggregated Response Action) or workflow for single Response Action in markdown format.
Here newlines will be saved.
Develop Incident Report using your corporate template.
It should include:
1. Executive Summary with short description of damage, actions taken, root cause, and key metrics (Time To Detect, Time To Respond, Time To Recover)
2. Detailed timeline of adversary actions, mapped to [ATT&CK tactics](https://attack.mitre.org/tactics/enterprise/) (you can use [Kill Chain](https://en.wikipedia.org/wiki/Kill_chain), but 95% of all actions will be in Actions On Objective stage, which is not really representative, meaningfull and usefull)
3. Detailed timeline of actions taken by Incident Responders
4. Root Cause Analysis and Recommendations for improvements based on its conclusion
5. List of specialists involved into Incident Response with their roles

21
response_actions/RA_0014_lessons_learned_conduct_lessons_learned_exercise.yml
View File

@ -1,12 +1,21 @@
title: RA_0014_lessons_learned_conduct_lessons_learned_exercise
stage: lessons_learned
author: Name Surname
creation_date: DD.MM.YYYY
author: Daniil Yugoslavskiy
creation_date: 31.01.2019
references:
- https://example.com
- http://shop.oreilly.com/product/0636920043614.do
- https://www.amazon.com/Incident-Response-Computer-Forensics-Third/dp/0071798684
description: >
Response Action for
Conduct lessons learned exercise
workflow: |
Description of how to handle multiple Response Actions (if it is an aggregated Response Action) or workflow for single Response Action in markdown format.
Here newlines will be saved.
This Lessons Learned phase evaluates the team's performance through each step.
Basically, this takes the incident report and answers some basic questions:
- What happened?
- What did we do well?
- What could we have done better?
- What will we do differently next time?
The goal of the Lessons Learned phase is to discover how to make the next incident response go faster, smoother, or ideally never happen at all.
Keep in mind that incident report is a key. If, for example, Time To Respond looks horrible, it was caused by some problem.
The only way to solve it is to bring it up and start working on it.

10
response_actions/RA_0040_identification_put_on_monitoring_compromised_accounts.yml Normal file
View File

@ -0,0 +1,10 @@
title: RA_0040_identification_put_on_monitoring_compromised_accounts
stage: identification
author: Daniil Yugoslavskiy
creation_date: 31.01.2019
description: >
Put (potentially) compromised accounts on monitoring
workflow: |
Start monitoring for authentification attempts and all potentially harmful actions from potentially compromised accounts.
Look for anomalies, strange network connections, unusual geolocation/time of work, actions which were never executed before.
Keep in touch with real users and in case of need ask them if they executing these actions by themselves or not.

18
response_actions/RA_0041_eradication_report_incident_to_external_companies.yml Normal file
View File

@ -0,0 +1,18 @@
title: RA_0041_eradication_report_incident_to_external_companies
stage: eradication
automation:
- thehive # integration with MISP
author: Daniil Yugoslavskiy
creation_date: 31.01.2019
references:
- https://blog.thehive-project.org/2017/06/19/thehive-cortex-and-misp-how-they-all-fit-together/
- https://www.sei.cmu.edu/education-outreach/computer-security-incident-response-teams/national-csirts/
- https://www.crowdstrike.com/blog/indicators-attack-vs-indicators-compromise/
- https://mitre.github.io/unfetter/about/
description: >
Report incident to external companies
workflow: |
Report incident to external companites, like [National Computer Security Incident Response Teams (CSIRTs)](https://www.sei.cmu.edu/education-outreach/computer-security-incident-response-teams/national-csirts/).
Provide all Indicators of Compromise and Indicators of Attack you've observed.
This Response Action could be automated with [TheHive and MISP integration](https://blog.thehive-project.org/2017/06/19/thehive-cortex-and-misp-how-they-all-fit-together/).

2
response_actions/respose_action.yml.template
View File

@ -10,7 +10,7 @@ creation_date: DD.MM.YYYY
references:
- https://example.com
description: >
Aggregated Response Action for blocking threats on Network Level.
(Aggregated) Response Action for blocking threats on Network Level.
linked_ra: # could be empty in case of single Response Action
- RA_0006_containment_block_domain_on_email # Response Actions could be aggregated
- RA_0009_containment_block_url_on_proxy # and contain links to multiple Response Actions

36
response_actions/status.md
View File

@ -1,36 +0,0 @@
- [x] RA_0001_identification_get_original_email
- [x] RA_0002_identification_extract_observables_from_email
- [x] RA_0003_identification_make_sure_email_is_a_phising
- [x] RA_0004_identification_analyse_obtained_indicators_of_compromise
+ [ ] RA_0015_identification_analyse_domain_name
+ [ ] RA_0016_identification_analyse_filehash
+ [ ] RA_0017_identification_analyse_ip
+ [ ] RA_0018_identification_analyse_macos_macho
+ [ ] RA_0019_identification_analyse_ms_office_file
+ [ ] RA_0020_identification_analyse_pdf
+ [ ] RA_0021_identification_analyse_unix_elf
+ [ ] RA_0022_identification_analyse_uri
+ [ ] RA_0023_identification_analyse_windows_pe
- [x] RA_0005_identification_find_all_phising_attack_victims
+ [ ] RA_0026_identification_find_emails_opened
+ [ ] RA_0030_identification_find_all_hosts_communicated_with_domain
+ [ ] RA_0031_identification_find_all_hosts_communicated_with_ip
+ [ ] RA_0032_identification_find_all_hosts_communicated_with_url
+ [ ] RA_0033_identification_find_files_created
+ [ ] RA_0034_identification_find_all_victims_in_security_alerts
- [x] RA_0006_containment_block_domain_on_email
- [x] RA_0028_containment_block_threat_on_network_level
+ [x] RA_0007_containment_block_ip_on_border_firewall
+ [x] RA_0008_containment_block_domain_on_dns
+ [x] RA_0009_containment_block_url_on_proxy
+ [x] RA_0035_containment_block_domain_on_ips
+ [x] RA_0036_containment_block_domain_on_ngfw
+ [x] RA_0037_containment_block_ip_on_ips
+ [x] RA_0038_containment_block_ip_on_ngfw
+ [x] RA_0039_containment_block_url_on_ngfw
- [x] RA_0010_eradication_delete_malicious_emails
- [ ] RA_0011_eradication_revoke_compromised_credentials
- [ ] RA_0012_eradication_report_source_of_malicious_activity_to_external_companies
- [ ] RA_0013_lessons_learned_develop_incident_report
- [ ] RA_0014_lessons_learned_conduct_lessons_learned_exercise

36
response_actions/untitled.md
View File

@ -1,36 +0,0 @@
- [x] RA_0001_identification_get_original_email
- [x] RA_0002_identification_extract_observables_from_email
- [x] RA_0003_identification_make_sure_email_is_a_phising
- [x] RA_0004_identification_analyse_obtained_indicators_of_compromise
+ [ ] RA_0015_identification_analyse_domain_name
+ [ ] RA_0016_identification_analyse_filehash
+ [ ] RA_0017_identification_analyse_ip
+ [ ] RA_0018_identification_analyse_macos_macho
+ [ ] RA_0019_identification_analyse_ms_office_file
+ [ ] RA_0020_identification_analyse_pdf
+ [ ] RA_0021_identification_analyse_unix_elf
+ [ ] RA_0022_identification_analyse_uri
+ [ ] RA_0023_identification_analyse_windows_pe
- [x] RA_0005_identification_find_all_phising_attack_victims
+ [ ] RA_0026_identification_find_emails_opened
+ [ ] RA_0030_identification_find_all_hosts_communicated_with_domain
+ [ ] RA_0031_identification_find_all_hosts_communicated_with_ip
+ [ ] RA_0032_identification_find_all_hosts_communicated_with_url
+ [ ] RA_0033_identification_find_files_created
+ [ ] RA_0034_identification_find_all_victims_in_security_alerts
- [x] RA_0006_containment_block_domain_on_email
- [x] RA_0028_containment_block_threat_on_network_level
+ [x] RA_0007_containment_block_ip_on_border_firewall
+ [x] RA_0008_containment_block_domain_on_dns
+ [x] RA_0009_containment_block_url_on_proxy
+ [x] RA_0035_containment_block_domain_on_ips
+ [x] RA_0036_containment_block_domain_on_ngfw
+ [x] RA_0037_containment_block_ip_on_ips
+ [x] RA_0038_containment_block_ip_on_ngfw
+ [x] RA_0039_containment_block_url_on_ngfw
- [x] RA_0010_eradication_delete_malicious_emails
- [ ] RA_0011_eradication_revoke_compromised_credentials
- [ ] RA_0012_eradication_report_source_of_malicious_activity_to_external_companies
- [ ] RA_0013_lessons_learned_develop_incident_report
- [ ] RA_0014_lessons_learned_conduct_lessons_learned_exercise

3
response_playbooks/RP_0001_phishing_email.yml
View File

@ -19,13 +19,14 @@ identification:
- RA_0003_identification_make_sure_email_is_a_phising
- RA_0004_identification_analyse_obtained_indicators_of_compromise
- RA_0005_identification_find_all_phising_attack_victims
- RA_0040_identification_put_on_monitoring_compromised_accounts
containment:
- RA_0006_containment_block_domain_on_email
- RA_0028_containment_block_threat_on_network_level
eradication:
- RA_0010_eradication_delete_malicious_emails
- RA_0011_eradication_revoke_compromised_credentials
- RA_0012_eradication_report_source_of_malicious_activity_to_external_companies
- RA_0012_eradication_report_phishing_attack_to_external_companies
lessons_learned:
- RA_0013_lessons_learned_develop_incident_report
- RA_0014_lessons_learned_conduct_lessons_learned_exercise