5/16/22, 9:41 AM Gmail - [advisory-board-open] Detection Engineering Resources

hieu tran <[email protected]>

[advisory-board-open] Detection Engineering Resources

8 messages

Walaa Kabbani via advisory-board-open <[email protected]> Fri, May 13, 2022 at 6:12 PM
Reply-To: Walaa Kabbani <[email protected]>
To: [email protected]

Hello Everyone,

What are good recommended resources / books / websites on detection engineering.

Best Regards,
Walaa Kabbani
Security Engineering
Security Operations Center

_______________________________________________

advisory-board-open mailing list

[email protected]

https://lists.sans.org/mailman/listinfo/advisory-board-open

If you want to unsubscribe from this list, navigate to:

https://lists.sans.org/mailman/listinfo/advisory-board-open

To unsubscribe, you'll need your list password.

If you forgot your password, you can get a reminder at the bottom of

https://lists.sans.org/mailman/listinfo/advisory-board-open

Paul Masek via advisory-board-open <[email protected]> Fri, May 13, 2022 at 8:02 PM
Reply-To: Paul Masek <[email protected]>
To: Walaa Kabbani <[email protected]>
Cc: advisory-board-open <[email protected]>

Walaa,
 
https://mail.google.com/mail/u/0/?ik=6acf903820&view=pt&search=all&permthid=thread-f%3A1732709360364956760&simpl=msg-f%3A1732709360364956760&simpl=msg-f%3A1732892770325500586&simpl=msg-f%3A1732893… 1/9
5/16/22, 9:41 AM Gmail - [advisory-board-open] Detection Engineering Resources
This is a broad, but also fantastic question! Here are *some* resources I’ve amassed over the last few years. I say some as there are many other really
good voices and resources
in this realm, but this will give you a start.
 
SIEM Rulesets (all open and free):
Mitre CAR - https://car.mitre.org/
Splunk - https://github.com/splunk/security_content/tree/develop/detections
Elastic - https://github.com/elastic/detection-rules
Sigma - https://github.com/SigmaHQ/sigma/tree/master/rules
 
***
 
Some Free / Some Paid: SIEM Rule Marketplace: https://socprime.com/
 
Great Threat Hunting Guide: https://www.threathunting.net/files/hunt-evil-practical-guide-threat-hunting.pdf
 
Detection engineering guide. Excellent places to look first: https://redcanary.com/threat-detection-report/
 
SANS Hunt Evil Poster: https://www.sans.org/posters/hunt-evil/ == use this also to spot normal processes such as smss.exe and to know what it should be
spawned by etc, to then
search for anomalies such as smss.exe with a different parent than system or smss.exe started in a location other than system32...
 
Good log source guide: "Advice on best log sources and why - Florian Roth @cyb3rops" https://twitter.com/cyb3rops/status/1193191644679544834
 
Follow going forward and read their history of posts as if they are some of the best books written on detection engineering.
https://twitter.com/nas_bench
https://twitter.com/SBousseaden/
https://twitter.com/cyb3rops
https://mail.google.com/mail/u/0/?ik=6acf903820&view=pt&search=all&permthid=thread-f%3A1732709360364956760&simpl=msg-f%3A1732709360364956760&simpl=msg-f%3A1732892770325500586&simpl=msg-f%3A1732893… 2/9
5/16/22, 9:41 AM Gmail - [advisory-board-open] Detection Engineering Resources
 
SANS Threat Hunting & Incident Response Summits – e.g. 2021 -
https://www.youtube.com/watch?v=OCTz62fN8OA&list=
PLfouvuAjspTpxI8P68vblkcLAtJWKuOxu
A couple of my favorite SANS Instructors on Detection Engineering are Eric Conrad and John Hubbard. Look up videos and other resources from them.
 
Sources of IOC's (also Chrome Bookmarks Folder "IOCs"):
- Mitre ATT&CK - https://attack.mitre.org/matrices/enterprise/ (TTP Techniques Tactics and Procedures-Centric - Provides evidence to base rules on)
    - Refer to this over and over and over again. It’s a gold mine!
- Top ATT&CK Techniques Published - https://ctid.mitre-engenuity.org/our-work/top-attack-techniques/
- https://jpcertcc.github.io/ToolAnalysisResultSheet/
- https://lolbas-project.github.io/ (aka lolbins)
- https://github.com/sophoslabs/IoCs
- https://github.com/3CORESec/MAL-CL
- YT InfoSec Conf Talks (in particular SANS Summits and BSides conferences)
- CERT Reports/Alerts such as: http://www.us-cert.gov/channels/techalerts.rdf
- InfoSec White Papers
- InfoSec Blog Posts
    - https://thedfirreport.com/
    - https://isc.sans.edu/diary
- InfoSec Tweets
    - Shameless plug on one I started here, when I posed the question: "What SIEM query has netted you the most evil?" - https://twitter.com/paul_
masek/status/1443895841824051218
 
Simulate IOC's:
- Atomic Red Team - https://github.com/redcanaryco/atomic-red-team
 
https://mail.google.com/mail/u/0/?ik=6acf903820&view=pt&search=all&permthid=thread-f%3A1732709360364956760&simpl=msg-f%3A1732709360364956760&simpl=msg-f%3A1732892770325500586&simpl=msg-f%3A1732893… 3/9
5/16/22, 9:41 AM Gmail - [advisory-board-open] Detection Engineering Resources
Paul Masek
 

From: advisory-board-open <[email protected]>

On Behalf Of Walaa Kabbani via advisory-board-open

Sent: Friday, May 13, 2022 7:12 AM

To: [email protected]

Subject: [advisory-board-open] Detection Engineering Resources

 

CAUTION: This email originated from outside of the

Ruoff organization. Do not click links or open attachments unless you recognize the sender
and know the content is safe.

[Quoted text hidden]

_______________________________________________

advisory-board-open mailing list

[email protected]

https://lists.sans.org/mailman/listinfo/advisory-board-open

If you want to unsubscribe from this list, navigate to:

https://lists.sans.org/mailman/listinfo/advisory-board-open

To unsubscribe, you'll need your list password.

If you forgot your password, you can get a reminder at the bottom of

https://lists.sans.org/mailman/listinfo/advisory-board-open

Steven D via advisory-board-open <[email protected]> Sun, May 15, 2022 at 1:03 AM

Reply-To: Steven D <[email protected]>
To: Paul Masek <[email protected]>, Walaa Kabbani <[email protected]>
Cc: advisory-board-open <[email protected]>

Paul

Pretty excellent list... I humbly submit a few from my stash as well... What isn't already duplicate. 

Most are focused on Windows logging, since you can't dectect what you can't see/log. :)

Malware Archeology, lots of logging cheat sheets:

https://www.malwarearchaeology.com/cheat-sheets 

https://mail.google.com/mail/u/0/?ik=6acf903820&view=pt&search=all&permthid=thread-f%3A1732709360364956760&simpl=msg-f%3A1732709360364956760&simpl=msg-f%3A1732892770325500586&simpl=msg-f%3A1732893… 4/9
5/16/22, 9:41 AM Gmail - [advisory-board-open] Detection Engineering Resources

Also MS has a decent spot the bad guy via logging here:

https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor

Various government resources:

https://apps.nsa.gov/iaarchive/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm

https://github.com/nsacyber/Event-Forwarding-Guidance

https://www.cyber.gov.au/sites/default/files/2021-10/PROTECT%20-%20Windows%20Event%20Logging%20and%20Forwarding%20%28October%202021%29.pdf

Detection Lab, because It's awesome and you gotta have a place to test detections.

https://www.detectionlab.network/

Sysmon Simulator for those though to generate events.

https://github.com/ScarredMonk/SysmonSimulator

Simulate more TTPs with Caldera (it's what MITRE uses for it's assessments)

https://caldera.mitre.org/

https://github.com/mitre/caldera

Regards,

Steven.
[Quoted text hidden]

_______________________________________________

advisory-board-open mailing list

[email protected]

https://lists.sans.org/mailman/listinfo/advisory-board-open

If you want to unsubscribe from this list, navigate to:

https://lists.sans.org/mailman/listinfo/advisory-board-open

To unsubscribe, you'll need your list password.

If you forgot your password, you can get a reminder at the bottom of

https://mail.google.com/mail/u/0/?ik=6acf903820&view=pt&search=all&permthid=thread-f%3A1732709360364956760&simpl=msg-f%3A1732709360364956760&simpl=msg-f%3A1732892770325500586&simpl=msg-f%3A1732893… 5/9
5/16/22, 9:41 AM Gmail - [advisory-board-open] Detection Engineering Resources

https://lists.sans.org/mailman/listinfo/advisory-board-open

Chris Crowley via advisory-board-open <[email protected]> Sun, May 15, 2022 at 5:02 AM
Reply-To: Chris Crowley <[email protected]>
To: Steven D <[email protected]>
Cc: advisory-board-open <[email protected]>

TL;DR: build a pipeline then fill in details, then improve the pipeline.

Great lists of references with technical details above, glad these got consolidated. I'll surely use them.  I'll contribute one that isn't already on the list. David J Bianco's Toppling
the Stack:

https://www.youtube.com/watch?v=7q7GGg-Ws9s

To me, detection engineering is a part of the larger use case development program (as in, the people, processes, and technology to make something happen). Further
elaboration here:

https://www.youtube.com/watch?v=Dd_R-BeyS2I

Detection Engineering entails an engineering effort, and the use case development I describe above is the pipeline for creation of detections (I call them detection opportunities
in that video) occur. One feasible implementation might be in a SIEM or a SOAR.

Chris Crowley 

[Quoted text hidden]

[Quoted text hidden]
_______________________________________________

advisory-board-open mailing list

[email protected]

https://lists.sans.org/mailman/listinfo/advisory-board-open

If you want to unsubscribe from this list, navigate to:

https://lists.sans.org/mailman/listinfo/advisory-board-open

To unsubscribe, you'll need your list password.

If you forgot your password, you can get a reminder at the bottom of

https://lists.sans.org/mailman/listinfo/advisory-board-open

_______________________________________________

advisory-board-open mailing list

[email protected]

https://lists.sans.org/mailman/listinfo/advisory-board-open

If you want to unsubscribe from this list, navigate to:

https://mail.google.com/mail/u/0/?ik=6acf903820&view=pt&search=all&permthid=thread-f%3A1732709360364956760&simpl=msg-f%3A1732709360364956760&simpl=msg-f%3A1732892770325500586&simpl=msg-f%3A1732893… 6/9
5/16/22, 9:41 AM Gmail - [advisory-board-open] Detection Engineering Resources
https://lists.sans.org/mailman/listinfo/advisory-board-open

To unsubscribe, you'll need your list password.

If you forgot your password, you can get a reminder at the bottom of

https://lists.sans.org/mailman/listinfo/advisory-board-open

Michael via advisory-board-open <[email protected]> Sun, May 15, 2022 at 5:33 AM

Reply-To: Michael <[email protected]>
To: Chris Crowley <[email protected]>, Steven D <[email protected]>
Cc: advisory-board-open <[email protected]>

If I may ask a related question, is anyone else working to streamline detection engineering using an actual devops/CI pipeline and git repo?

Any thoughts on that?

BR,
Michael
[Quoted text hidden]

_______________________________________________

advisory-board-open mailing list

[email protected]

https://lists.sans.org/mailman/listinfo/advisory-board-open

If you want to unsubscribe from this list, navigate to:

https://lists.sans.org/mailman/listinfo/advisory-board-open

To unsubscribe, you'll need your list password.

If you forgot your password, you can get a reminder at the bottom of

https://lists.sans.org/mailman/listinfo/advisory-board-open

Chris Crowley via advisory-board-open <[email protected]> Sun, May 15, 2022 at 7:40 AM
Reply-To: Chris Crowley <[email protected]>
To: Michael <[email protected]>
Cc: advisory-board-open <[email protected]>

I have a customer I am working with this on. Can't provide additional details now.  I'll likely be able to eventually abstract it and share it to the community.

Chris
[Quoted text hidden]

https://mail.google.com/mail/u/0/?ik=6acf903820&view=pt&search=all&permthid=thread-f%3A1732709360364956760&simpl=msg-f%3A1732709360364956760&simpl=msg-f%3A1732892770325500586&simpl=msg-f%3A1732893… 7/9
5/16/22, 9:41 AM Gmail - [advisory-board-open] Detection Engineering Resources

_______________________________________________

advisory-board-open mailing list

[email protected]

https://lists.sans.org/mailman/listinfo/advisory-board-open

If you want to unsubscribe from this list, navigate to:

https://lists.sans.org/mailman/listinfo/advisory-board-open

To unsubscribe, you'll need your list password.

If you forgot your password, you can get a reminder at the bottom of

https://lists.sans.org/mailman/listinfo/advisory-board-open

Ahmed via advisory-board-open <[email protected]> Sun, May 15, 2022 at 6:47 PM

Reply-To: Ahmed <[email protected]>
To: Chris Crowley <[email protected]>
Cc: advisory-board-open <[email protected]>

In a previous company i have built a pipeline where we have rules maintained i GitHub and a workflow for reviews and approvals they get deployed into SIEM.

Those rules are either built by an analyst or an automated hunting rules built automatically using Jinja templates based on a very custom rules in a Threat Intel platform. 

[Quoted text hidden]

--

Best Regards,
Ahmed Elshaer

_______________________________________________

advisory-board-open mailing list

[email protected]

https://lists.sans.org/mailman/listinfo/advisory-board-open

If you want to unsubscribe from this list, navigate to:

https://lists.sans.org/mailman/listinfo/advisory-board-open

To unsubscribe, you'll need your list password.

If you forgot your password, you can get a reminder at the bottom of

https://lists.sans.org/mailman/listinfo/advisory-board-open

Steven Goossens via advisory-board-open <[email protected]> Sun, May 15, 2022 at 7:04 PM
Reply-To: Steven Goossens <[email protected]>
https://mail.google.com/mail/u/0/?ik=6acf903820&view=pt&search=all&permthid=thread-f%3A1732709360364956760&simpl=msg-f%3A1732709360364956760&simpl=msg-f%3A1732892770325500586&simpl=msg-f%3A1732893… 8/9
5/16/22, 9:41 AM Gmail - [advisory-board-open] Detection Engineering Resources
To: Ahmed <[email protected]>, Chris Crowley <[email protected]>
Cc: advisory-board-open <[email protected]>

We are doing that based on the https://github.com/splunk/security_content project.

Basically, the rules are written in a yaml format by a detection engineer
and jinja templates translate it to Splunk config. The pipeline checks for basic syntax related stuff and builds a config set. You could take it further and
release the new content from
the pipeline as well to a test environment and run sample event sets to perform automated testing.

Outlook voor Android downloaden

From: advisory-board-open <[email protected]> on behalf of Ahmed via advisory-board-open <advisory-board-open@lists.

sans.org>

Sent: Sunday, May 15, 2022 1:47:12 PM

To: Chris Crowley <[email protected]>

[Quoted text hidden]
 
[Quoted text hidden]

_______________________________________________

advisory-board-open mailing list

[email protected]

https://lists.sans.org/mailman/listinfo/advisory-board-open

If you want to unsubscribe from this list, navigate to:

https://lists.sans.org/mailman/listinfo/advisory-board-open

To unsubscribe, you'll need your list password.

If you forgot your password, you can get a reminder at the bottom of

https://lists.sans.org/mailman/listinfo/advisory-board-open

https://mail.google.com/mail/u/0/?ik=6acf903820&view=pt&search=all&permthid=thread-f%3A1732709360364956760&simpl=msg-f%3A1732709360364956760&simpl=msg-f%3A1732892770325500586&simpl=msg-f%3A1732893… 9/9