Defensive Security (Blue Team)¶

# SIEM queries (Splunk example)
index=windows EventCode=4625           # Failed logons
| stats count by src_ip, user
| where count > 10                      # Brute force detection  # (1)!

index=proxy
| eval domain=lower(url_domain)
| search domain="*.exe" OR domain="*malware*"  # Malicious downloads

# Elastic Security (ELK Stack)
event.code: 4720 AND user.name: admin  # New user creation by admin
process.name: powershell.exe AND process.command_line: *-enc*  # (2)!

# Sigma rules (universal SIEM format)
title: Suspicious PowerShell Execution
detection:
  selection:
    EventID: 4688
    CommandLine|contains:
      - '-enc'
      - 'IEX'
      - 'downloadstring'
  condition: selection  # (3)!

# Triage (SANS 6-step process)
# 1. Preparation
# 2. Identification
# 3. Containment
# 4. Eradication
# 5. Recovery
# 6. Lessons Learned

# Live response (Windows)
wmic process list full                  # Running processes
netstat -anob                           # Network connections with PIDs  # (1)!
Get-WinEvent -LogName Security -MaxEvents 100  # Recent events
Get-ScheduledTask | where {$_.State -ne "Disabled"}  # Scheduled tasks

# Memory acquisition
winpmem-3.3.exe mem.raw                 # Windows memory dump
avml memory.lime                        # Linux memory dump (Azure tool)

# Disk imaging
dc3dd if=/dev/sda of=evidence.img hash=md5,sha256  # (2)!
FTK Imager                              # GUI disk imaging (Windows)

# Timeline analysis
log2timeline.py timeline.plaso evidence.img  # Plaso timeline
psort.py -o l2tcsv timeline.plaso -w timeline.csv

# Static analysis
file malware.exe                        # File type identification
strings malware.exe | less              # Extract strings
objdump -d malware.elf | less          # Disassemble Linux binary

# Hash analysis
md5sum malware.exe                      # MD5 hash
sha256sum malware.exe                   # SHA256 (better)

# VirusTotal
curl --request POST \
  --url https://www.virustotal.com/api/v3/files \
  --header 'x-apikey: YOUR_API_KEY' \
  --form file=@malware.exe  # (1)!

# Dynamic analysis (sandbox)
cuckoo submit malware.exe               # Cuckoo Sandbox  # (2)!
# Or use online: any.run, hybrid-analysis.com, joe sandbox

# Detonation
remnux                                   # REMnux Linux distro for malware analysis
flare-vm                                 # FLARE-VM Windows VM with tools

# Hypothesis-driven hunting
# Hypothesis: "Attackers using LOLBins for lateral movement"

# Hunt for suspicious certutil usage (Windows)
index=windows EventCode=4688
CommandLine="*certutil*" AND CommandLine="*-urlcache*"  # (1)!

# Hunt for WMI lateral movement
index=windows EventCode=4688 ProcessName="*wmic.exe*"
CommandLine="*/node:*" CommandLine="*process call create*"  # (2)!

# Hunt for Kerberoasting
index=windows EventCode=4769
TicketOptions=0x40810000
TicketEncryptionType=0x17  # (3)!

# Elastic Detection Rule (EQL)
name: Suspicious PowerShell Download
type: eql
query: |
  process where process.name == "powershell.exe" and
  process.command_line matches (
    "*.DownloadString*",
    "*.DownloadFile*",
    "*Invoke-WebRequest*",
    "*wget *",
    "*curl *"
  )
risk_score: 73
severity: high
tags:
  - "Defense Evasion"
  - "Execution"  # (1)!

# Custom Python detection script
import pandas as pd
from datetime import datetime, timedelta

def detect_brute_force(df, threshold=10, window_minutes=5):
    """Detect failed login brute force attempts."""
    now = datetime.now()
    window_start = now - timedelta(minutes=window_minutes)

    recent_failures = df[
        (df['event_id'] == 4625) &  # Failed logon
        (df['timestamp'] >= window_start)
    ]

    grouped = recent_failures.groupby(['src_ip', 'username']).size()
    alerts = grouped[grouped >= threshold]  # (1)!

    return alerts

# Usage
df = pd.read_csv('security_logs.csv')
alerts = detect_brute_force(df, threshold=10, window_minutes=5)
for (ip, user), count in alerts.items():
    print(f"ALERT: {count} failed logins from {ip} for user {user}")

## Ransomware Response Playbook

### 1. Identification (5 minutes)
- [ ] Confirm ransomware (file encryption, ransom note)
- [ ] Identify patient zero (first infected system)
- [ ] Determine ransomware family (check ransom note IOCs)

### 2. Containment (15 minutes)
- [ ] Isolate infected systems (network segmentation)
- [ ] Disable compromised accounts (AD lockout)
- [ ] Block C2 domains/IPs (firewall rules)
- [ ] Snapshot VMs (before eradication)  # (1)!

### 3. Eradication (2-4 hours)
- [ ] Identify all infected systems (EDR query)
- [ ] Rebuild systems from clean backups
- [ ] Reset all passwords (especially privileged)
- [ ] Patch vulnerabilities exploited

### 4. Recovery (4-24 hours)
- [ ] Restore from backups (test integrity first)
- [ ] Verify decryption (if paying ransom - last resort)
- [ ] Monitor for re-infection (7-14 days)

### 5. Lessons Learned (1 week post-incident)
- [ ] Root cause analysis
- [ ] Improve detections
- [ ] Update runbooks

# 1. Static analysis (safe, no execution)
file malware.bin
strings malware.bin | grep -i http  # Extract URLs
exiftool malware.bin                # Metadata
pe-sieve malware.exe                # Check for process hollowing

# 2. Hash check (known malware?)
sha256sum malware.bin
curl "https://www.virustotal.com/api/v3/files/SHA256" \
  -H "x-apikey: KEY"

# 3. Yara rules (signature matching)
yara -r rules/ malware.bin          # (1)!

# 4. Sandbox (automated dynamic analysis)
cuckoo submit malware.bin

# 5. Manual dynamic analysis (if needed)
# Boot FlareVM, take snapshot, run malware
procmon.exe                          # Process Monitor
wireshark                            # Network capture
regshot                              # Registry changes

-- Hunt: Persistence via Registry Run Keys
SELECT *
FROM registry_changes
WHERE path LIKE '%Run%' OR path LIKE '%RunOnce%'
AND timestamp > datetime('now', '-1 hour');

-- Hunt: Suspicious parent-child process relationships
SELECT parent.name AS parent, child.name AS child, COUNT(*) as count
FROM processes child
JOIN processes parent ON child.parent = parent.pid
WHERE (parent.name = 'winword.exe' AND child.name = 'powershell.exe')
   OR (parent.name = 'excel.exe' AND child.name = 'cmd.exe')
GROUP BY parent.name, child.name
HAVING count > 1;  # (1)!