APT Detection

5 automated security scanners

Exfiltration Channel Discovery

Purpose: This scanner is designed to analyze and detect potential exfiltration channels used by adversaries in organizations. It evaluates the presence of mechanisms that can be employed to covertly transfer data out of an organization’s network, such as DNS tunneling for ICMP messages, personal cloud storage blocking, and email encryption detection.

What It Detects:

DNS Tunneling for ICMP Messages: Detection of potential exfiltration via DNS tunneling using ICMP protocols that might bypass traditional monitoring tools.
Personal Cloud Storage Blocking: Identification of systems where personal cloud storage services are not blocked, allowing employees to use these platforms for data theft.
Email Encryption Detection: The ability to detect if emails containing sensitive information have been encrypted, which could be a critical mitigation against unauthorized access and data leakage.

Inputs Required:

<domain>: The target domain name of the organization under assessment.

Business Impact: The primary business impact of this scanner is to identify vulnerabilities in network security that could allow sensitive information to be exfiltrated without detection, potentially leading to significant data breaches and legal repercussions. Effective mitigation of these risks can significantly enhance an organization’s cybersecurity posture by ensuring that critical assets are protected from potential adversaries.

Risk Levels:

Critical: The scanner identifies a lack of any form of exfiltration prevention mechanisms across all identified channels, indicating severe vulnerability to data theft.
High: The scanner detects the presence of basic transfer monitoring but lacks advanced features such as egress traffic analysis or covert channel detection capabilities.
Medium: The scanner flags specific gaps in detection capabilities, such as DNS tunneling not being monitored or personal cloud storage blocking mechanisms that are partially effective.
Low: Comprehensive exfiltration channel detection is identified, including transfer monitoring, covert channel detection, and DLP (Data Loss Prevention) measures.
Info: Informational findings indicate the presence of basic network security elements but do not reveal significant vulnerabilities in data protection or theft prevention capabilities.

Example Findings:

The scanner detected that DNS tunneling for ICMP messages was actively used by an adversary to bypass traditional monitoring tools, indicating a critical vulnerability in network security.
Personal cloud storage services were identified as being partially blocked, which could lead to unauthorized data exfiltration and is considered a high-risk exposure.

Data Staging Identification

Purpose: This scanner is designed to analyze and identify data staging detection capabilities for a given domain. It evaluates various aspects such as file system monitoring, internal share activities, data aggregation, compression and encryption practices, and job indicators related to threat hunting roles to determine the level of vulnerability in data staging detection.

What It Detects:

File System Monitoring: The scanner identifies whether there is a presence of unusual file creation, large file aggregation, monitoring of temporary directories, tracking of compressed files, and integrity monitoring.
Internal Share Activities: It detects abnormal access patterns, bulk copy detection, cross-department access, elevated privilege access, and the use of specific tools for share monitoring.
Data Aggregation: The scanner looks for signs of large volume data aggregation, automated gathering through scripts or other methods, tracking database export activities, and identification of compression practices used in staging locations.
Compression and Encryption: It assesses whether there is detection of archiving data before exfiltration, monitoring of encryption tools used during the process, scaling of archive operations to accommodate large volumes, and recognition of password protection mechanisms applied to compressed data.
Job Indicators: The scanner evaluates the presence of roles related to threat hunting, such as threat hunting analysts, and checks for indicators of potential data loss prevention and insider threats by analyzing job descriptions or activities within the organization.

Inputs Required:

<domain>: The target domain whose security posture is being evaluated regarding data staging detection capabilities.

Business Impact: The identification of weak points in data staging detection can significantly impact an organization’s cybersecurity posture, making it easier for adversaries to stage and exfiltrate sensitive information without being detected. This could lead to unauthorized access to critical systems, theft of intellectual property, and potential regulatory fines due to non-compliance with privacy standards.

Risk Levels:

Critical: When no data staging detection capabilities are identified at all, or when there is a clear absence of file system and share monitoring, aggregation or compression detection mechanisms.
High: When only partial detection mechanisms are present, such as file monitoring but not temporary directory monitoring, which can lead to the concealment of pre-exfiltration activities.
Medium: When specific detection points are unclear, like bulk copy detection in shares or cloud storage staging, allowing potential large-scale data collection without alerting security controls.
Low: When comprehensive data staging detection mechanisms such as file monitoring, share activity, aggregation and compression practices are identified.
Info: When the scanner identifies specific tools used for monitoring (e.g., Varonis) but does not detect any significant weaknesses in data staging capabilities.

Example Findings:

The domain lacks any form of file system or internal share activity monitoring, making it highly vulnerable to unauthorized access and data theft.
While there is evidence of data aggregation, the compression and encryption practices used are unclear, indicating a potential gap in pre-exfiltration preparation detection.

Long-term Compromise Assessment

Purpose: The purpose of this scanner is to assess the long-term compromise detection capabilities for a given domain by evaluating its historical analysis, persistence detection, dormant threats, dwell time analysis, and forensic readiness.

What It Detects:

This scanner detects whether there are mechanisms in place to identify long-term compromises through log retention duration, retrospective detection, autorun monitoring, scheduled task persistence, inactive malware detection, timeline reconstruction, initial access dating, evidence preservation, and endpoint forensics.
It also identifies the presence of dormant threats using tools like sandbox analysis and evaluates forensic readiness with data retention policies, evidence preservation, incident reconstruction, and endpoint forensic capabilities.
Additionally, it checks for job indicators such as threat hunting roles and focuses on forensic analysis and incident response.

Inputs Required:

Domain: The target domain to be assessed for long-term compromise detection.

Business Impact: This assessment is crucial as it helps in identifying the presence of APTs that may have been operating undetected over an extended period. Properly addressing these vulnerabilities can significantly enhance the security posture by ensuring comprehensive detection and response capabilities against potential threats.

Risk Levels:

Critical: If no long-term compromise detection capabilities are identified, such as missing historical analysis and persistence detection, it poses a critical risk as APTs may remain undetected for extended periods.
High: If there is a lack of forensic readiness or data retention policies, which could lead to the loss or overwriting of critical forensic data, this represents a high risk.
Medium: Incomplete dwell time calculation or detection of persistence mechanisms can indicate medium risks as certain APT persistence techniques may be invisible.
Low: If comprehensive long-term compromise detection is identified through historical analysis, persistence detection, and forensic readiness, the risk level is considered low.
Info: Informational findings such as no long-term trend analysis or retention tools are indicative of lower impact but still important to address for continuous improvement.

Example Findings:

“No long-term compromise detection capabilities identified” - This finding suggests that the domain lacks any mechanisms to detect prolonged compromises, which is a critical vulnerability.
“Missing historical analysis and persistence detection” - This indicates a significant shortfall in detecting past APT activities, posing a high risk of ongoing or previous compromises going undetected.

Command Control Detection

Purpose: The Command Control Detection Scanner is designed to identify and detect command and control (C2) infrastructure by analyzing domain and IP range data through various threat intelligence feeds. This tool helps in identifying malicious activities, unauthorized access points, and potential vulnerabilities that could be exploited for C2 operations.

What It Detects:

Threat Indicators in Domain/IP Reputation:
- Identifies patterns such as CVEs, malware keywords, command and control phrases, and phishing indicators to detect malicious activities.
Exposure Indicators:
- Detects data breach terms, unauthorized access attempts, and data dump references that could expose sensitive information.
Vulnerability Indicators from Shodan:
- Identifies exposed services and detects known vulnerabilities in these services using the Shodan API.
IP Reputation Analysis:
- Checks IP reputation scores and analyzes historical abuse reports to identify malicious IPs.
CVE Database Lookup:
- Looks up CVEs related to the domain and IP range to find known vulnerabilities that could be exploited for C2 activities.

Inputs Required:

domain (string): The primary domain to analyze, such as example.com.
ip_range (string): The IP range to scan for C2 infrastructure, such as 192.168.1.0/24.

Business Impact: This scanner is crucial for organizations looking to protect their networks from unauthorized access and potential exploitation by malicious actors using command and control infrastructures. By identifying threats early on, organizations can implement preventive measures to safeguard their systems and data.

Risk Levels:

Critical: Conditions that directly lead to significant security breaches or the exposure of highly sensitive information are considered critical.
High: Conditions that pose a high risk of unauthorized access or significant damage to network integrity are considered high.
Medium: Conditions that may indicate potential vulnerabilities but do not immediately threaten system stability or data confidentiality are considered medium.
Low: Informative findings that provide minimal actionable insight and generally do not impact security posture significantly are considered low.
Info: Informational findings that provide general insights into network activity without immediate risk are considered informational.

If specific conditions for each risk level were not provided in the README, they have been inferred based on the scanner’s purpose and potential impacts.

Example Findings:

The scanner identifies a domain with multiple CVEs related to known vulnerabilities that could be exploited for C2 activities.
An IP range contains several IPs with high abuseIPDB scores indicating malicious activity, which are flagged as critical by the scanner.

Lateral Movement Analysis

Purpose: This scanner analyzes lateral movement detection capabilities for a given domain by examining various indicators of compromise and potential attack vectors. It aims to identify weaknesses in credential theft, remote access monitoring, privilege escalation, east-west traffic visibility, and protocol abuse within the network infrastructure.

What It Detects:

Credential Theft Detection: The scanner identifies if credentials are being dumped from memory or stored files, tracks access to Kerberos tickets, and checks for pass-the-hash attacks.
Remote Access Monitoring: It detects monitoring of RDP sessions and PSExec commands, as well as potential lateral movement through WinRM and SSH connections.
Privilege Escalation Detection: The scanner looks for signs of privilege escalation by granting higher privileges to user accounts or services, schedules malicious tasks in the background, and monitors modifications to system registry settings.
East-West Traffic Analysis: It assesses network traffic flow between servers and workstations, analyzing SMB file shares and RPC calls as potential lateral movement vectors.
Protocol Abuse Detection: The scanner checks for misuse of PowerShell scripts and WMI commands that could facilitate remote execution and unauthorized data access.

Inputs Required:

<domain>: The target domain to be analyzed for lateral movement detection capabilities.

Business Impact: This analysis is crucial as it helps in understanding the potential risk associated with lateral movement attacks, which are critical stages in an adversary’s engagement within a network. Weaknesses in these areas can lead to unauthorized access and data theft, significantly impacting both business operations and security posture.

Risk Levels:

Critical: If no lateral movement detection capabilities are identified across all aspects (credential theft, remote access, privilege escalation, east-west traffic visibility, protocol abuse), the risk is considered critical as attackers can move undetected within the network.
High: Issues such as missing RDP monitoring or incomplete credential theft detection that limit visibility into unauthorized access methods are flagged at high risk.
Medium: Inconsistencies in detecting specific lateral movement techniques (e.g., SSH lateral movement not monitored) place the risk level at medium, indicating significant but mitigated vulnerabilities.
Low: A comprehensive set of detection mechanisms across all areas suggests a low risk, with minimal exposure to unauthorized access and data theft.
Info: Provides informational findings about specific detections that do not significantly impact overall network security but are indicative of potential improvements in the defensive posture.

Example Findings:

No lateral movement detection capabilities identified: The scanner did not detect any evidence of credential theft, remote access monitoring, privilege escalation, east-west traffic visibility, or protocol abuse. This severely limits the ability to detect and prevent unauthorized activities.
Remote access monitoring present but RDP sessions not tracked: While some forms of remote access are monitored, the lack of tracking for RDP sessions leaves a critical gap in detecting potential adversaries exploiting this common vector for lateral movement.