https://gbhackers.com/security-information-and-event-management-siem-a-detailed-explanation/
Critical Control 1: Inventory of Authorized and Unauthorized Devices
SIEM can correlate user activity with user rights and roles to detect violations of least
privilege enforcement, which is required by this control.
Critical Control 2: Inventory of Authorized and Unauthorized Software
SIEM should be used as the inventory database of authorized software
products for correlation with network and application activity.
Critical Control 3: Secure Conjurations for Hardware and Software on Laptops, Workstations, and Servers
Known vulnerabilities are still a leading avenue for successful exploits. If an automated
device scanning tool discovers a mis configured network system during a Common
Configuration Enumeration (CCE) scan, that misconfiguration should be reported to the
SIEM as a central source for these alerts. This helps with troubleshooting incidents as
well as improving overall security posture.
Critical Control 4: Secure Configurations for Network Devices such as Firewalls, Routers,and Switches
Any misconfiguration on network devices should also be reported to the SIEM for consolidated analysis
Critical Control 5: Boundary Defense
Network rule violations, like CCE discoveries, should also be reported to one central
source (a SIEM) for correlation with authorized inventory data stored in the SIEM
solution
Critical Control 6: Maintenance, Monitoring, and Analysis of Audit Logs
Control 6 is basically a control about SIEMs, which are a leading means for collecting
and centralizing critical log data; in fact, there is even a subcontrol for analysis that
studies SIEM specifically. SIEMs are the core analysis engine that can analyze log events
as they occur.
Critical Control 7: Application Software Security
Like CCE scan results, vulnerabilities that are discovered in software applications should
also be reported to a central source where these vulnerabilities can be correlated with
other events concerning a particular system. SIEMs are a good place to store these scan
results and correlate the information with network data, captured through logs, to
determine whether vulnerabilities are being exploited in real time.
Critical Control 8: Controlled Use of Administrative Privileges
When the principles of this control are not met (such as an administrator running a
web browser or unnecessary use of administrator accounts), SIEM can correlate access
logs to detect the violation and generate an alert.
Critical Control 9: Controlled Access Based on Need to Know
SIEM can correlate user activity with user rights and roles to detect violations of least
privilege enforcement, which is required by this control.
Critical Control 10: Continuous Critical Control
SIEM can correlate vulnerability context with actual system activity to determine
whether vulnerabilities are being exploited.
Critical Control 11: Account Monitoring and Control
Abnormal account activity can only be detected when compared to a baseline of
known good activity. The baseline to meet this control should be recorded by the
SIEM; and, as future snapshots or baselines are recorded, they can be compared to the
approved baseline in the SIEM.
Critical Control 12: Malware Defenses
Malware that is discovered should be recorded according to this control. Centralized
anti-malware tools should report their findings to a SIEM, which correlates against
system and vulnerability data to determine which systems pose a greater risk due to the
malware discovered on that system
Critical Control 13: Limitation and Control of Network Ports, Protocols, and Services
if a system has a running port, protocol, or service that has not been authorized, it should also be reported to a central source where these vulnerabilities can be correlated with other events concerning a particular system. SIEMs can monitor log data to detect traffic over restricted ports, protocols, and services. Organizations can use these controls to decide which ports and services are useful for business, which are not, and which types of traffic and ports to limit
Critical Control 14: Wireless Device Control
Device misconfigurations and wireless intrusions should be reported to a central
database for incident handling purposes. A SIEM is a perfect candidate to consolidate
this information and use it for correlation or detection of threats to wireless
infrastructure
Critical Control 15: Data Loss Prevention
data loss rule violations, like CCE discoveries, should also be reported to one central source such as a SIEM, which can correlate data loss events with inventory or asset information as well as other system and user activity to detect complex breaches of sensitive data.
Saturday, March 25, 2017
Security Information and Event Management (SIEM)
https://gbhackers.com/security-information-and-event-management-siem-a-detailed-explanation/
1. Authentication Activities
Abnormal authentication attempts, off hour authentication attempts etc, using data from Windows, Unix and any other authentication application.
2. Shared Accounts
Multiple sources(internal/external) making session requests for a particular user account during a given time frame, using login data from sources like Windows, Unix etc.
3. Session Activities
Session duration, inactive sessions etc, using login session related data specifically from Windows server.
4. Connections Details
Connections can be genuine or bogus. Suspicious behavior may include connection attempts on closed ports, blocked internal connections, connection made to bad destinations etc, using data from firewalls, network devices or flow data. External sources can further be enriched to discover the domain name, country and geographical details.
5. Abnormal Administrative Behavior
Monitoring inactive accounts, accounts with unchanged passwords, abnormal account management activities etc, using data from AD account management related activities.
6. Information Theft
Data exfiltration attempts, information leakage through emails etc, using data from mail servers, file sharing applications etc.
7. Vulnerability Scanning and Correlation
Identification and correlation of security vulnerabilities detected by applications like Qualys against other suspicious events.
8. Statistical Analysis
Statistical analysis can be done to study the nature of data. Functions like average, median, quantile, quartile etc can be used for the purpose. Numerical data from all kind of sources can be used to monitor relations like ratio of inbound to outbound bandwidth usage, data usage per application, response time comparison etc.
9. Intrusion Detection and Infections
This can be done by using data from IDS/IPS, antivirus, anti-malware applications etc.
10. System Change Activities
This can be done by using data for changes in configurations, audit configuration changes, policy changes, policy violations etc.
1. Authentication Activities
Abnormal authentication attempts, off hour authentication attempts etc, using data from Windows, Unix and any other authentication application.
2. Shared Accounts
Multiple sources(internal/external) making session requests for a particular user account during a given time frame, using login data from sources like Windows, Unix etc.
3. Session Activities
Session duration, inactive sessions etc, using login session related data specifically from Windows server.
4. Connections Details
Connections can be genuine or bogus. Suspicious behavior may include connection attempts on closed ports, blocked internal connections, connection made to bad destinations etc, using data from firewalls, network devices or flow data. External sources can further be enriched to discover the domain name, country and geographical details.
5. Abnormal Administrative Behavior
Monitoring inactive accounts, accounts with unchanged passwords, abnormal account management activities etc, using data from AD account management related activities.
6. Information Theft
Data exfiltration attempts, information leakage through emails etc, using data from mail servers, file sharing applications etc.
7. Vulnerability Scanning and Correlation
Identification and correlation of security vulnerabilities detected by applications like Qualys against other suspicious events.
8. Statistical Analysis
Statistical analysis can be done to study the nature of data. Functions like average, median, quantile, quartile etc can be used for the purpose. Numerical data from all kind of sources can be used to monitor relations like ratio of inbound to outbound bandwidth usage, data usage per application, response time comparison etc.
9. Intrusion Detection and Infections
This can be done by using data from IDS/IPS, antivirus, anti-malware applications etc.
10. System Change Activities
This can be done by using data for changes in configurations, audit configuration changes, policy changes, policy violations etc.
IOA (Indicator of Attack)
https://gbhackers.com/socsiem-indicator-of-attackioas-a-detailed-explanation/
Use of IoAs - shift from reactive cleanup/recovery to a proactive mode
- attackers are disrupted and blocked before they achieve their goal.
- AV signatures
1) Internal hosts with bad destinations
- communicating with known bad destinations or to a foreign country where you don’t conduct business
2) Internal hosts with non-standard ports
- communicating to external hosts using non-standard ports or protocol/port mismatches, such as sending command shells (SSH) rather than HTTP, HTTPS traffic over port 80,443, the default web port
3) Public Servers/DMZ to Internal hosts
- Publically servers or demilitarized zone (DMZ) hosts communicating to internal hosts.
- allows leapfrogging from the outside to the inside and back, permitting data exfiltration and remote access to assets such as RDP(Remote Desktop Protocol), Radmin, SSH.
- investigate to Highlighted Servers that communicating to Internal hosts via RDP(TCP/3389), SSH(TCP/22)
4) Off-hour Malware Detection
- Alerts that occur outside standard business operating hours (at night or on weekends) could signal a compromised host.
5) Network scans by internal hosts
- communicating with multiple hosts in a short time frame, which could reveal an attacker moving laterally within the network
6) Multiple alarm events from a single host
- “User Login Failures” from Single Hosts
Note: some login failed events form e-mail applications on mobile phones can generate events more 500 events/minute. I found this case when the password of a user account is expired but they have not change the new password on their devices.
8. Multiple Login from different regions
- user account trying to login to multiple resources within a few minutes from/to different region. This is a sign that user’s credentials have been stolen or that a user is up to mischief.
9. Internal hosts use much SMTP
- EMail Protocol such as SMTP (Simple Mail Transfer Protocol), POP3 or IMAP4 should be monitoring. Some malware will use these port for send information to Suspicious or Hacker’s server.
(Infected client that use SMTP(TCP/25))
10. Internal hosts many query to External/Internal DNS
- Many organization has Internal DNS servers for caching records and serve DNS service to internal hosts. DHCP configuration is defined Primary DNS Server to Internal DNS server. If you found that some internal hosts query to External DNS such as 8.8.8.8, 8.8.4.4 (Google DNS), you should try scan malware on that clients.
- Some Incidents found that the internal host query many requests to the internal DNS server (> 1,000 events/hour)
Use of IoAs - shift from reactive cleanup/recovery to a proactive mode
- attackers are disrupted and blocked before they achieve their goal.
- AV signatures
1) Internal hosts with bad destinations
- communicating with known bad destinations or to a foreign country where you don’t conduct business
2) Internal hosts with non-standard ports
- communicating to external hosts using non-standard ports or protocol/port mismatches, such as sending command shells (SSH) rather than HTTP, HTTPS traffic over port 80,443, the default web port
3) Public Servers/DMZ to Internal hosts
- Publically servers or demilitarized zone (DMZ) hosts communicating to internal hosts.
- allows leapfrogging from the outside to the inside and back, permitting data exfiltration and remote access to assets such as RDP(Remote Desktop Protocol), Radmin, SSH.
- investigate to Highlighted Servers that communicating to Internal hosts via RDP(TCP/3389), SSH(TCP/22)
4) Off-hour Malware Detection
- Alerts that occur outside standard business operating hours (at night or on weekends) could signal a compromised host.
5) Network scans by internal hosts
- communicating with multiple hosts in a short time frame, which could reveal an attacker moving laterally within the network
6) Multiple alarm events from a single host
- “User Login Failures” from Single Hosts
Note: some login failed events form e-mail applications on mobile phones can generate events more 500 events/minute. I found this case when the password of a user account is expired but they have not change the new password on their devices.
8. Multiple Login from different regions
- user account trying to login to multiple resources within a few minutes from/to different region. This is a sign that user’s credentials have been stolen or that a user is up to mischief.
9. Internal hosts use much SMTP
- EMail Protocol such as SMTP (Simple Mail Transfer Protocol), POP3 or IMAP4 should be monitoring. Some malware will use these port for send information to Suspicious or Hacker’s server.
(Infected client that use SMTP(TCP/25))
10. Internal hosts many query to External/Internal DNS
- Many organization has Internal DNS servers for caching records and serve DNS service to internal hosts. DHCP configuration is defined Primary DNS Server to Internal DNS server. If you found that some internal hosts query to External DNS such as 8.8.8.8, 8.8.4.4 (Google DNS), you should try scan malware on that clients.
- Some Incidents found that the internal host query many requests to the internal DNS server (> 1,000 events/hour)
Saturday, December 3, 2016
Bible #15
141. My lover
Song of songs 5:16
His mouth is sweetness itself; he is altogether lovely. This is my lover, this my friend, O daughters of Jerusalem.
142. The Lord will help you find your way back
Song of songs 6:1
Where has your lover gone, most beautiful of women? Which way did your lover turn, that we may look for...
143. Lover
Song of songs 7:10-11
I belong to my lover, and his desire is for me. Come, my lover, let us go to the countryside...
144. Solar Plexus Activated
Revelation 22:4-6
They will see his face ad his name will be on their foreheads. There will be no more nights...
Song of songs 5:16
His mouth is sweetness itself; he is altogether lovely. This is my lover, this my friend, O daughters of Jerusalem.
142. The Lord will help you find your way back
Song of songs 6:1
Where has your lover gone, most beautiful of women? Which way did your lover turn, that we may look for...
143. Lover
Song of songs 7:10-11
I belong to my lover, and his desire is for me. Come, my lover, let us go to the countryside...
144. Solar Plexus Activated
Revelation 22:4-6
They will see his face ad his name will be on their foreheads. There will be no more nights...
Bible #14
131. Be happy while you are here on Earth
Ecclesiastes 11:9
Be happy, young man, while you are young and let your heart give you joy in the days of your life...
132. Silver Cord
Ecclesiastes 12:6-7
Remember him-before the silver cord is severed or the golden bowl is broken; before the pitcher is shattered at the...
133. Solomon to lovers <3
Song of songs 1:9
I liken you, my darling, to a mare harnessed to one of the chariots of Pharaoh.
134. Woman must behave before the coming of the man for them
Song of songs 2:7
Daughters of Jerusalem, I charge you by the gazelles and by the does of the field: Do not arouse...
135. Lover
Song of songs 2:16
My lover is mine and I am his; he browses among the lilies.
136. Wait and behave again - 2nd warning :P
Song of songs 3:5
Daughters of Jerusalem, I charge you by the Gazelles and by the does of the field: Do not arouse...
137. Let go..
Song of songs 3:1-2
All night long on my bed I looked for the one my heart loves; I looked for but did not find him. I will get up now and go about the city, through its streets and squares; I will search for the one my heart loves. So I looked for him but did not find him.
138. Gilead
Song of songs 4:1
How beautiful you are, my darling! Oh how beautiful! Your eyes behind your veil are doves. Your hair is like...
139. Let go..
Song of songs 5:6
I opened for my lover, but my over had left; he was gone. My heart sank at his departure...
140. God will find your way back to me :)
Song of songs 5:8
O daughters of Jerusalem, I charge you - if you find your lover, what will you tell him? Tell him I am faint with love.
Ecclesiastes 11:9
Be happy, young man, while you are young and let your heart give you joy in the days of your life...
132. Silver Cord
Ecclesiastes 12:6-7
Remember him-before the silver cord is severed or the golden bowl is broken; before the pitcher is shattered at the...
133. Solomon to lovers <3
Song of songs 1:9
I liken you, my darling, to a mare harnessed to one of the chariots of Pharaoh.
134. Woman must behave before the coming of the man for them
Song of songs 2:7
Daughters of Jerusalem, I charge you by the gazelles and by the does of the field: Do not arouse...
135. Lover
Song of songs 2:16
My lover is mine and I am his; he browses among the lilies.
136. Wait and behave again - 2nd warning :P
Song of songs 3:5
Daughters of Jerusalem, I charge you by the Gazelles and by the does of the field: Do not arouse...
137. Let go..
Song of songs 3:1-2
All night long on my bed I looked for the one my heart loves; I looked for but did not find him. I will get up now and go about the city, through its streets and squares; I will search for the one my heart loves. So I looked for him but did not find him.
138. Gilead
Song of songs 4:1
How beautiful you are, my darling! Oh how beautiful! Your eyes behind your veil are doves. Your hair is like...
139. Let go..
Song of songs 5:6
I opened for my lover, but my over had left; he was gone. My heart sank at his departure...
140. God will find your way back to me :)
Song of songs 5:8
O daughters of Jerusalem, I charge you - if you find your lover, what will you tell him? Tell him I am faint with love.
Bible #13
121. Rare Jewel
Proverbs 20:15
Gold there is and rubies in abundance but lips that speak knowledge are a rare jewel.
122. Right and Just is better than sacrifice
Proverbs 21:3
To do what is right and just is more acceptable to the Lord than sacrifice.
123. Live righteously
Proverbs 21:21
He who pursues righteousness and love finds life, prosperity and honor.
124. Only God can decide our future
Proverbs 21:31
The horse is made ready for the day of battle, but victory rests with the Lord.
125. Parents
Proverbs 23:22
Listen to your father, who gave you life and do not despise your mother when she is old.
126. Humble brags
Proverbs 27:2
Let another praise you and no your own mouth; someone else and not your own lips.
127. No remedy
Proverbs 29:1
A man who remains stiff necked after many rebukes will suddenly be destroyed without remedy.
128. Wise man is quiet
Proverbs 29:11
A fool gives full vent to his anger, but a wise man keeps himself under control.
129. This is how we make people know who we are with the Lord and how to teach the word of God
Ecclesiastes 5:1-2
Guard you steps when you go to the house of God. Go near to listen rather than to offer...
130. Patience is better than pride
Ecclesiastes 7:8
The end of a matter is better than its beginning and patience is better than pride.
Proverbs 20:15
Gold there is and rubies in abundance but lips that speak knowledge are a rare jewel.
122. Right and Just is better than sacrifice
Proverbs 21:3
To do what is right and just is more acceptable to the Lord than sacrifice.
123. Live righteously
Proverbs 21:21
He who pursues righteousness and love finds life, prosperity and honor.
124. Only God can decide our future
Proverbs 21:31
The horse is made ready for the day of battle, but victory rests with the Lord.
125. Parents
Proverbs 23:22
Listen to your father, who gave you life and do not despise your mother when she is old.
126. Humble brags
Proverbs 27:2
Let another praise you and no your own mouth; someone else and not your own lips.
127. No remedy
Proverbs 29:1
A man who remains stiff necked after many rebukes will suddenly be destroyed without remedy.
128. Wise man is quiet
Proverbs 29:11
A fool gives full vent to his anger, but a wise man keeps himself under control.
129. This is how we make people know who we are with the Lord and how to teach the word of God
Ecclesiastes 5:1-2
Guard you steps when you go to the house of God. Go near to listen rather than to offer...
130. Patience is better than pride
Ecclesiastes 7:8
The end of a matter is better than its beginning and patience is better than pride.
Bible #12
111. Be with the same soul spirit
Proverbs 14;7
Stay away from a foolish man, for you will not find knowledge in his lips.
112. God knows what pleases him.
Proverbs 15:8
The Lord detests sacrifice of the wicked, but the prayer of the upright pleases him.
113. Instruction of discernment
Proverbs 15:14
The discerning heart seeks knowledge, but the mouth of a fool feeds on folly.
114. Correction
Proverbs 15:32-33
He who ignores discipline despises himself, but whoever heeds correction gains understanding
115. When we ask Him our plans
Proverbs 16;1-2
To man belongs the plans of the heart, but from the Lord comes the reply of the tongue.
116. Discernment
Proverbs 16:21
The wise in heart are called discerning, and pleasant words promote instruction
117. Rebuke
Proverbs 17:10
A rebuke impresses a man of discernment more than a hundred lashes a fool.
118. Wife
Proverbs 18:22
He who finds a wife finds what is good and receives favour from the Lord.
119. Rebuke
Proverbs 19:25
Flog a mocker and the simple will learn prudence; rebuke a discerning man, and he will gain knowledge.
120. Slow to anger
Proverbs 20:3
It is to a man's honor to avoid strife, but every fol is quick to quarrel.
Proverbs 14;7
Stay away from a foolish man, for you will not find knowledge in his lips.
112. God knows what pleases him.
Proverbs 15:8
The Lord detests sacrifice of the wicked, but the prayer of the upright pleases him.
113. Instruction of discernment
Proverbs 15:14
The discerning heart seeks knowledge, but the mouth of a fool feeds on folly.
114. Correction
Proverbs 15:32-33
He who ignores discipline despises himself, but whoever heeds correction gains understanding
115. When we ask Him our plans
Proverbs 16;1-2
To man belongs the plans of the heart, but from the Lord comes the reply of the tongue.
116. Discernment
Proverbs 16:21
The wise in heart are called discerning, and pleasant words promote instruction
117. Rebuke
Proverbs 17:10
A rebuke impresses a man of discernment more than a hundred lashes a fool.
118. Wife
Proverbs 18:22
He who finds a wife finds what is good and receives favour from the Lord.
119. Rebuke
Proverbs 19:25
Flog a mocker and the simple will learn prudence; rebuke a discerning man, and he will gain knowledge.
120. Slow to anger
Proverbs 20:3
It is to a man's honor to avoid strife, but every fol is quick to quarrel.
Subscribe to:
Posts (Atom)