cau - epm theft detection and monitoring v6凭证盗窃检测监控

EPMFundamentals

CredentialTheftProtection

andEventMonitoringCyberArkUniversity2017PrivilegedManagementImplementationWorkflowServerInstallationAgentDeploymentSilentApplicationDiscoveryPolicyCreationExceptionManagementMonitoringReportingAUDITINGPOLICIESDISCOVERYDEPLOYMENTINSTALLATIONObjectivesThissessionwillexplainthefollowingconceptsandfunctionality:ThreatDetectionTriggeringThreatDetectionAlertsfordemosandPOCsPrivilegeThreatAnalytics(PTA)andSIEMIntegrationReportsandDashboardsNotethattheThreatDetectionfunctionalityisnotavailableintheGPOeditionofEPM.DetectandBlockSuspectedCredentialTheftAttemptsbyMaliciousUsersandApplicationsWhatriskdocompromisedcredentialsrepresent?GivedirectaccesstoaccountsonvariousplatformsUserspecifiessamepasswordforseveralaccountsondifferentplatformsThreatDetectionmonitorsfordifferentattackvectorsNoadditionalendpointrequirementotherthanEPMagentFunctionalityintendedtobecontinuouslyupdatedHowDoesitWork?CyberArkLabinvestigates

variousattackvectorsAttackindicationareextracted(e.g.unexpectedaccesstoLSASSmemory)EPMinternalpolicyisupdated

byR&DwiththeindicatorsEPMdevicedrivernowhookstheseaccessestoLSASSAccessisblockedAccessisdetectedAlertissenttoEPMconsoleBLOCKINGMODEDETECTIONMODE6.0DetectionandBlockingCapabilitiesLSASSCredentialsHarvestingSAMHashHarvestingFirefoxCredentialsTheftChromeCredentialsTheftWinSCPCredentialsTheftVNCCredentialsTheft6.1DetectionandBlockingCapabilitiesServiceAccountCredentialsTheftDomainCredentialsCacheHarvestingCheckPointEndpointSecurityVPNCredentialsTheftmRemoteNGCredentialsTheftSuspectedRegistryDumpSuspectedPathRename6.1DetectionandBlockingCapabilitiesSuspiciousRequesttoBootinSafeModeSuspiciousRequesttoBootinTestSigningModeSuspiciousRequesttoBootinDebugMode6.2DetectionandBlockingCapabilitiesToadForOracleDatabaseClientCredentialsTheftSQLServerManagementStudioCredentialsTheftFileZillaCredentialsTheftDashLaneCredentialsTheftTeamViewerCredentialsTheftRemoteDesktopConnectionMgr.CredentialsTheftLogMeInProCredentialsTheftThreatDetectionUIClickingonThreatDetection

showsallpoliciesShowswhetherstatusisactiveornotforeachpolicyAlsoshowsifpolicyissettodetectorblockattackActivatingTheftDetectionPoliciesClickonOptionsthenActivateallToactivatesinglepolicies,selectdesiredpolicythen:RightclickonpolicyandclickActivateindrop-downClickonOptionsthenActivateEditingaThreatDetectionPolicyActivatingapolicysetsactiontoDetectbydefaultToblockandchangeadvancedpolicysettings,right-clickonpolicyandclickEditEditingaThreatDetectionPolicy(Action)ActivatingapolicysetsactiontoDetectbydefaultDetect:Credentialtheftattemptsarenotblocked,butgeneratealertsBlock:BlockfutureattemptsofcredentialtheftEditingaThreatDetectionPolicy(ApplyPolicytoselectedComputersinSet,ADComputerGroups)ThreatDetectionPoliciescanberestrictedto:SpecificComputersEPMComputerGroupsADComputerGroups

EditingaThreatDetectionPolicy(ExcludedApps)Ifnecessary,excludespecificapplicationsfromPolicyClickonEdittoaddexclusionsExclusioncanbeappliedtofilename,pathWildcardscanbeusedforfilenameorpathEditingaThreatDetectionPolicy(End-UserUI)SetwhetheruserwillbealertedwhenpolicyistriggeredDefaultisShowNothingOtherwise,selectwhichmessagewillbedisplayedtoend-userviasystemtraybubble.ThreatDetectionDefinitionsFileDefinitionsarestoredinPASPD.DLL

CyberArkwillreleasenewversionsoftheDLLwithenhancedprotectionagainstnewattackvectors

UpgradedfilescanbeuploadedbyaccountadministratorsUpdatingThreatDetectionDefinitionsFileLoginasanaccountadministratorBrowsetoConfiguration=>ThreatDetectionClickonUpgradeBrowsetoandselectupdatedfile,thenclickonOKTriggeringThreatDetectionAlerts

forDemosandPOCsGeneratingEventsManuallyorwithThird-partyToolsItpossibletogenerateThreatDetectionalertsmanuallyusingvariousprogrammingorscriptingtechniques,commandlinetoolsandscript-kiddyattackGUIs.Unfortunatelyduetolegalrestrictions,wecan’tteachyouthesetechniquesortoolsthatleveragethemIfrequired,suspendpoliciesondemomachineusingsystemtrayicon(informationinTroubleshootingsection)DNADiscoveryandAudit

CyberArktoolforevaluatingprivilegedaccountusageandvulnerabilitiesincustomerenvironment

Discoversuserswhostillhaveadminrights.Organizationmayhavestandarduserpolicyinplace,butsome“privilege”groupsstillhaveadminrights

UsestechniqueswhichtriggerThreatDetectionalertsLSASSaccessPass-the-hashIntroducingViper

MostImportant!

Thetoolshouldbeusedonlyandexclusivelyforitsdesignatedpurpose.Thescopeofthescanshouldbelimitedtotheminimumrequired.ThetoolshouldbeusedonlybyCyberArktrainedteams.Thetoolshouldbeusedonlyduringsales/demonstrationmeetingsbetweenCyberArktrainedpersonnelandthecustomer.Oncethemeetingisoverthetoolshouldbefullyclosed/shutdown,withoutallowingthecustomerstomakeanyfurtheruseofthetool.Thecustomersshouldbeadvisednottocopy/forwardthetool.Anyreportthatthetoolproducesshouldbeconsideredasconfidentialinformationofthecustomer,andthecustomershouldbeadvisedaccordingly.SimpleUIwhichrunsdifferentactionsthattriggerThreatDetectionalertsAninternaltoolthatshouldberunonlybyCyberArktrainedteamsfordemopurposesUsingViperinCourseLabEnvironmentOnlysuppliedforuseintrainingenvironment

Donotcopytool

Requestcopyfromaccountmanager,ifrequiredAlwaysrunasadministratorMicrosoftDefenderneedstobedisabled,isalreadydisabledinourenvironmentViper–SelectingAttacksChoosecredentialattacksBrowserLocalWindowsSecurityMimikatzADandKerberosClickLaunchtorunselectedattacksViper–HarvestingCredentialsReviewresultsDigit: Numberofaccountsharvestedusingattack

E: Error

-(dash): ToolwaslaunchedbutthisattackdoesnottrytoretrievecredentialsitselfViper–HarvestingCredentialsExecutionreportshowsconsoleoutputfromrespectivetoolsShowsinformationaboutretrievedcredentialsWhenrunningoncustomersystems,donotremovefromsitewithoutauthorisationfromclientReviewActivityinEPMConsoleAggregatedEventspagelistsapplicationsthattriggeredThreatDetectionevents.ApplicationControlPoliciescanbecreatedtoblockmalwarePoliciescanalsobecreatedtoallowparticularappsthatrequireaccesstocredentialsChangeThreatDetectionPoliciestoBlockIntheThreatDetectionwindow,editthepoliciesChangeeachpolicytoBlockMakesurethatthepoliciesareupdatedandresumedontargetRe-runViperWithBlockingOnCloseandrestartVip3rexecutableRe-runtestsNoteallMimikatztestsnowfailtoretrievecredsAlthoughLsass.exeandSAMfilecopyshowsuccess,reviewingexecutionreportshowsnocredentialswereretrieved.AggregatedEventsviewnowshowseventsasblockedPrivilegeThreatAnalytics(PTA)

andSIEMIntegrationPTAIntegrationtoShowCredentialsTheftIncidents*ThreatDetectioneventsinEPMcantriggeralertsinPTA(PrivilegedThreatAnalytics)AlertsaredisplayedinthePTAconsoleSOC(SecurityOpsCentre)staffcandrilldownintoeventtoseemoreinformation*PTAintegrationnotavailableforSaaSinstallationsRetrievingConnectionCredentialsfromPTATheconnectionbetweenEPMandPTAneedstobeauthenticatedRequiredcredentialsarestoredinfilecalledprepwiz.logonPTAserverForPTA3.3,fileislocatedin/opt/apache-tomcat-7.0.40/prepwiz/logsSearchforEPPcredentials,noteUsernameandPasswordConfiguringPTAintegrationIntheConfiguration=>ThreatDetectionsection,clickonPTAConfiguration

EntertheUsernameandPasswordretrievedfromprepwiz.log

ClickonSaveConfiguringEventListenersAllowsconfigurationofexternallistenerssuchasSIEM

InServerConfiguration=>EventListenerssection,clickonNonenexttoThird-PartyListenersConfiguringEventListenersOntheChangeConfigurationParameterValuescreen,clickonOffnexttothelistener

SelectOnfromthedropdownSettheconfigurationasrequiredClickOKthenSaveSupportedEventListenersLogstash-Systemforlogcollection,processing,storageandsearchingactivities.TextFile–XMLfilecreatedontheEPMServerSysLog-Astandardformessageloggingthatpermitsseparationofthesoftwarethatgeneratesmessages,thesystemthatstoresthem,andthesoftwarethatreportsandanalyzesthem.Splunk-Captures,indexesandcorrelate