Are Your Hunting Rules Still Working?
You are working in an organization which implemented good security practices: log events are collected then indexed by a nice powerful tool. The next step is usually to enrich this (huge) amount of data with external sources. You collect IOC's, you get feeds from OSINT. Good! You start to create many reports and rules to be notified when something weird is happening. Everybody agrees on the fact that receiving too many alerts is bad and people won't get their attention to them if they are constantly flooded. So, you fine-tuned your rules to get a correct amount of alerts with a low (read: acceptable) rate of false positives. But are your rules still relevant or properly implemented? Is it normal to never get a notification?
In physical security, it is mandatory to perform a regular test of fire alarms in big buildings. Here, in Belgium, it is usually scheduled at noon every first Thursday of the month. And what about infosec? I met a C-level who was always asking:
"Hey Guys, anything suspicious detected on our infrastructure?"
"Nothing special, we are fine!"
"Hmmm, maybe I should be scared of this answer!"
As our infrastructures are quickly changing, it could be a good idea to implement the same kind of regular check-up to trigger your hunting rules. Are you looking for suspicious DNS traffic, then schedule a monthly DNS resolution of a pre-defined FQDN. It must trigger your rule. If it's not the case, you're in trouble and you're maybe missing real suspicious traffic.
We hate to be flooded with false positives but never get one is even more suspicious! And it keeps your security analysts awake!
Did you implement suck controls? Feel free to share!
Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant
PGP Key
Reverse-Engineering Malware: Advanced Code Analysis | Online | Greenwich Mean Time | Oct 28th - Nov 1st 2024 |
Comments
I'd toyed with the idea of making a nagios check that would occasionally wget a virus test file (or something that would predictably cause an alert to fire) and then check the logs for that event. 'Never got around to it though (and we were recently acquired and the stuff I setup is gradually being torn down). But that would be an easy nagios plugin to make...
Anonymous
Jun 21st 2018
6 years ago
It's so easy to catch wonky traffic if you only white list...
Sucks for those things such as Facebook and the other internet heavy apps that change ip addresses, but still...
Anonymous
Jun 30th 2018
6 years ago