Structured threat data is commonly formatted using STIX. To help get this data into Elasticsearch, we’re releasing a Python script that converts STIX to an ECS format to be ingested into your stack.

Preamble

Getting started

Prerequisites

Setup

Operation

Arguments

Examples

STIX file input to STDOUT

STIX file input to ECS file output

STIX file input to ECS file output, defining the Provider field

STIX directory input to ECS file outputs

STIX file input to Elasticsearch output

Summary

About Elastic Security Labs

STIXy Situations: ECSaping your threat data

Explore the technical implementation of the Detonate system, including sandbox creation, the supporting technology, telemetry collection, and how to blow stuff up.

Architecture

API server

Interacting with the API server - CLI

Interacting with the API server - Web UI

Interacting with the API server - HTTP client

Queues

Workers

Detonations

VM provisioning

Network configuration

Telemetry collection

Running in production

What's next?

A deeper dive into the technical implementations of Detonate

Into The Weeds: How We Run Detonate

To automate this process and test our protections at scale, we built Detonate, a system that is used by security research engineers to measure the efficacy of our Elastic Security solution in an automated fashion.

What is Detonate?

What does it help us with?

Measuring Efficacy

Supporting existing protections

Threat research

Evaluating new protections

What’s next?

Click, Click… Boom! Automating Protections Testing with Detonate

ICEDID is known to pack its payloads using custom file formats and a custom encryption scheme. We are releasing a set of tools to automate the unpacking process and help analysts and the community respond to ICEDID.

Environment setup

Unpacking the fake GZip

Decrypting the core binary and configuration files

Reading the configuration

Rebuilding the core binary for static analysis

Executing the core binary (Windows only)

Unpacking and rebuilding payloads from the rebuilt core binary

Conclusion

References

A comprehensive tutorial with Elastic Security Labs open source tools

Unpacking ICEDID

Python script to extract the configuration from NETWIRE samples.

Docker

Running it locally

Usage

Configuration extraction tool for the NETWIRE malware.

NETWIRE Configuration Extractor

Python script to extract the configuration and payload from BLISTER samples.

Getting Started

Running it Locally

BLISTER Configuration Extractor

Configuration extractor to dump out hardcoded passwords with BPFDoor.

Overview

BPFDoor Configuration Extractor

Python script to identify hosts infected with the BPFDoor malware.

Permissions

Running Locally

BPFDoor Scanner

Python script that collects Cobalt Strike memory data generated by security events from an Elasticsearch cluster, extracts the configuration from the CS beacon, and writes the data back to Elasticsearch.

Using an Elastic Cloud instance (this is a randomly generated example)

Default output will use localhost:9092, see reference config

Filter by time

Pipe output to other tools

Cobalt Strike Beacon Extractor

Python script to extract the configuration from EMOTET samples.

Configuration extraction tool for the EMOTET malware.

EMOTET Configuration Extractor

Python script to extract the configuration from ICEDID samples.

Configuration extraction tool for ICEDID malware.

ICEDID Configuration Extractor

Python script to extract the payload from PARALLAX samples.

PARALLAX Payload Extractor

Python script to extract the configuration from QBOT samples.

Configuration extraction tool for QBOT malware

QBOT Configuration Extractor

Tools

Categoria

Ferramentas

9 de fevereiro de 2024

Situações STIXy: ECSaping seus dados de ameaças

Into The Weeds: Como corremos Detonate

Clique, clique… Boom! Automatizando testes de proteção com Detonate

Desempacotando o ICEDID

Extrator de configuração NETWIRE

BLISTER Configuration Extractor (Extrator de configuração do BLISTER)

Extrator de configuração BPFDoor

BPF Scanner de porta

Extrator de farol de ataque de cobalto

Extrator de configuração EMOTET

Extrator de configuração ICEDID

Extrator de carga útil PARALLAX

QBOT Configuration Extractor (Extrator de configuração do QBOT)