McHugh Security

Building CCCS’ AssemblyLine for Static Analysis

July 12, 2021July 12, 2021 McHughSecurity No Comments

This is post 1 of 1 in the series “Malware Analysis with AssemblyLine” System Requirements For this build, I will be deploying AssemblyLine on my bare-metal hypervisor exposed to the Internet. This is not always a good idea, however, my build will be further hardened by additional controls which I will explain in subsequent articles…

Static Analysis

Hardening TheHive4 and Cortex for public deployment

June 18, 2021June 19, 2021 McHughSecurity 1 Comment

Deploying an incident response platform on the open internet is not always a good idea. For whatever reason you choose to do so, there are some things you need to do before going live with TheHive and Cortex.

In this post, I talk about hardening TheHive and Cortex for an Internet-accessible deployment. This includes the application of TLS v1.2+ and the configuration of multi-factor authentication. Cortex can be further hardened through IP whitelisting, and even walled gardens implemented through Cloudflare.

Build, Digital Forensics & Incident Response

[Part 4] Building a Threat Integration and Testing Lab – MISP Threat Intelligence Sharing Platform

June 18, 2021June 18, 2021 McHughSecurity No Comments

This is post 4 of 4 in the series “Building a Threat Integration and Testing Lab”

[Part 1] Building a Threat Integration and Testing Lab
[Part 2] Building a Threat Integration and Testing Lab – Elastic Cloud Enterprise (On-Premises)
[Part 3] Building a Threat Integration and Testing Lab – Splunk Enterprise
[Part 4] Building a Threat Integration and Testing Lab – MISP Threat Intelligence Sharing Platform

MISP is a threat intelligence platform for sharing, storing and correlating Indicators of Compromise of targeted attacks, threat intelligence, financial fraud information, vulnerability information or even counter-terrorism information.

Within a well structured SIEM environment, a Threat Intelligence Platform may allow an organisation to generate new intelligence relevant to the organisation, and it may allow for the ingestion of external intelligence sources.

Build

Using the workflow taxonomy in MISP

May 23, 2021May 23, 2021 McHughSecurity No Comments

In the context of MISP, intelligence handling usually requires a set of stages for that information to be handled effectively. This can be addressed procedurally through a workflow.

Understanding how a taxonomy may be implemented in MISP to assist this process is handy.

MISP - Open Source Threat Intelligence Platform

Using the Estimative Language Taxonomy in MISP

May 11, 2021May 11, 2021 McHughSecurity No Comments

This is post 3 of 3 in the series “Implementing and utilising MISP Taxonomies”

Using the Course of Action Taxonomies in MISP
Using the Data Classification Taxonomies in MISP
Using the Estimative Language Taxonomy in MISP

According to the MISP taxonomies listing for Estimative Language, this taxonomy is used to descrie the quality and credibility of the underlying information sources, data, and methodologies as described under the Intelligence Community Directive 203 (ICD 203) and JP 2-0. In this article I will describe how these tags may be applied by either an intelligence originator, or when the information is polled from a known credible source to convey likelihood.

MISP - Open Source Threat Intelligence Platform

Using the Data Classification Taxonomies in MISP

May 11, 2021May 11, 2021 McHughSecurity No Comments

This is post 2 of 3 in the series “Implementing and utilising MISP Taxonomies”

Using the Course of Action Taxonomies in MISP
Using the Data Classification Taxonomies in MISP
Using the Estimative Language Taxonomy in MISP

Data classification is broadly defined as the process of organising data by relevant categories so that it may be used and protected more efficiently. On a basic level, the classification process makes data easier to locate and retrieve.

In this article, I will be discussing the usage of the data-classification taxonomy for MISP events and attributes within those events. The intent of this taxonomy being categorising the value of data to provide some additional context to the information or asset being affected.

MISP - Open Source Threat Intelligence Platform

Using the Course of Action Taxonomies in MISP

May 10, 2021May 11, 2021 McHughSecurity No Comments

This is post 1 of 3 in the series “Implementing and utilising MISP Taxonomies”

Using the Course of Action Taxonomies in MISP
Using the Data Classification Taxonomies in MISP
Using the Estimative Language Taxonomy in MISP

One of the great aspects of MISP, is the use of tags to give an indication of what needs to be done with an indicator within an event. Whole events may be assigned tags, but in this article I am going to talk to marking specific indicators with a Course of Action which implies a response when / if that indicator as been encountered.

MISP - Open Source Threat Intelligence Platform

[Part 3] Building a Threat Integration and Testing Lab – Splunk Enterprise

April 28, 2021June 18, 2021 McHughSecurity 1 Comment

This is post 3 of 4 in the series “Building a Threat Integration and Testing Lab”

[Part 1] Building a Threat Integration and Testing Lab
[Part 2] Building a Threat Integration and Testing Lab – Elastic Cloud Enterprise (On-Premises)
[Part 3] Building a Threat Integration and Testing Lab – Splunk Enterprise
[Part 4] Building a Threat Integration and Testing Lab – MISP Threat Intelligence Sharing Platform

As a bake off for the Threat Lab and Incident Response capabilities, we will also be installing Splunk Enterprise. This will be in the 30 day trial mode, so it would be advisable to seek advice from your Splunk sales representative prior to using this installation in a production environment.

Build

[Part 2] Building a Threat Integration and Testing Lab – Elastic Cloud Enterprise (On-Premises)

April 28, 2021June 18, 2021 McHughSecurity 1 Comment

This is post 2 of 4 in the series “Building a Threat Integration and Testing Lab”

[Part 1] Building a Threat Integration and Testing Lab
[Part 2] Building a Threat Integration and Testing Lab – Elastic Cloud Enterprise (On-Premises)
[Part 3] Building a Threat Integration and Testing Lab – Splunk Enterprise
[Part 4] Building a Threat Integration and Testing Lab – MISP Threat Intelligence Sharing Platform

You can potentially use a Cloud-hosted instance of Elastic Cloud Enterprise, however since I am trying to avoid putting this environment on the Internet, I will be building ECE in my home lab environment.

Build

[Part 1] Building a Threat Integration and Testing Lab

April 28, 2021June 18, 2021 McHughSecurity No Comments

This is post 1 of 4 in the series “Building a Threat Integration and Testing Lab”

[Part 1] Building a Threat Integration and Testing Lab
[Part 2] Building a Threat Integration and Testing Lab – Elastic Cloud Enterprise (On-Premises)
[Part 3] Building a Threat Integration and Testing Lab – Splunk Enterprise
[Part 4] Building a Threat Integration and Testing Lab – MISP Threat Intelligence Sharing Platform

For this article and subsequent articles, I will be talking through the installation, configuration, and integration components in building an integrated threat and incident response lab. The primary purpose of this lab is to be able to replay malicious attack data into a SIEM environment (Splunk and Elastic will be used) and then generate appropriate alerts and actions within those SIEMs for an analyst to action. In addition, both SIEMS will be integrating MISP as a Threat Intelligence Platform to consume enriched intelligence and store and process newly generated intelligence from the lab.

Build

Building CCCS’ AssemblyLine for Static Analysis

Like this:

Hardening TheHive4 and Cortex for public deployment

Like this:

[Part 4] Building a Threat Integration and Testing Lab – MISP Threat Intelligence Sharing Platform

Like this:

Using the workflow taxonomy in MISP

Like this:

Using the Estimative Language Taxonomy in MISP

Like this:

Using the Data Classification Taxonomies in MISP

Like this:

Using the Course of Action Taxonomies in MISP

Like this:

[Part 3] Building a Threat Integration and Testing Lab – Splunk Enterprise

Like this:

[Part 2] Building a Threat Integration and Testing Lab – Elastic Cloud Enterprise (On-Premises)

Like this:

[Part 1] Building a Threat Integration and Testing Lab

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this: