Structured threat data is commonly formatted using STIX. To help get this data into Elasticsearch, we’re releasing a Python script that converts STIX to an ECS format to be ingested into your stack.

Preamble

Getting started

Prerequisites

Setup

Operation

Arguments

Examples

STIX file input to STDOUT

STIX file input to ECS file output

STIX file input to ECS file output, defining the Provider field

STIX directory input to ECS file outputs

STIX file input to Elasticsearch output

Summary

About Elastic Security Labs

STIXy Situations: ECSaping your threat data

Explore the technical implementation of the Detonate system, including sandbox creation, the supporting technology, telemetry collection, and how to blow stuff up.

Architecture

API server

Interacting with the API server - CLI

Interacting with the API server - Web UI

Interacting with the API server - HTTP client

Queues

Workers

Detonations

VM provisioning

Network configuration

Telemetry collection

Running in production

What's next?

A deeper dive into the technical implementations of Detonate

Into The Weeds: How We Run Detonate

To automate this process and test our protections at scale, we built Detonate, a system that is used by security research engineers to measure the efficacy of our Elastic Security solution in an automated fashion.

What is Detonate?

What does it help us with?

Measuring Efficacy

Supporting existing protections

Threat research

Evaluating new protections

What’s next?

Click, Click… Boom! Automating Protections Testing with Detonate

ICEDID is known to pack its payloads using custom file formats and a custom encryption scheme. We are releasing a set of tools to automate the unpacking process and help analysts and the community respond to ICEDID.

Environment setup

Unpacking the fake GZip

Decrypting the core binary and configuration files

Reading the configuration

Rebuilding the core binary for static analysis

Executing the core binary (Windows only)

Unpacking and rebuilding payloads from the rebuilt core binary

Conclusion

References

A comprehensive tutorial with Elastic Security Labs open source tools

Unpacking ICEDID

Python script to extract the configuration from NETWIRE samples.

Docker

Running it locally

Usage

Configuration extraction tool for the NETWIRE malware.

NETWIRE Configuration Extractor

Python script to extract the configuration and payload from BLISTER samples.

Getting Started

Running it Locally

BLISTER Configuration Extractor

Configuration extractor to dump out hardcoded passwords with BPFDoor.

Overview

BPFDoor Configuration Extractor

Python script to identify hosts infected with the BPFDoor malware.

Permissions

Running Locally

BPFDoor Scanner

Python script that collects Cobalt Strike memory data generated by security events from an Elasticsearch cluster, extracts the configuration from the CS beacon, and writes the data back to Elasticsearch.

Using an Elastic Cloud instance (this is a randomly generated example)

Default output will use localhost:9092, see reference config

Filter by time

Pipe output to other tools

Cobalt Strike Beacon Extractor

Python script to extract the configuration from EMOTET samples.

Configuration extraction tool for the EMOTET malware.

EMOTET Configuration Extractor

Python script to extract the configuration from ICEDID samples.

Configuration extraction tool for ICEDID malware.

ICEDID Configuration Extractor

Python script to extract the payload from PARALLAX samples.

PARALLAX Payload Extractor

Python script to extract the configuration from QBOT samples.

Configuration extraction tool for QBOT malware

QBOT Configuration Extractor

Tools

카테고리

도구

2024년 2월 9일

STIXy 상황: ECS로 위협 데이터 최적화

Detonate 실행 방법 심층 분석

Detonate를 활용한 자동화된 보호 테스트

ICEDID 분석

네트워크 구성 추출기

BLISTER 구성 추출기

BPF문 구성 추출기

BPF도어 스캐너

코발트 스트라이크 비콘 추출기

EMOTET 구성 추출기

ICEDID 구성 추출기

PARALLAX 페이로드 추출기

QBOT 구성 추출기