The Threat Detection with Cloud API Logs: A Case Study from Capital One

 

My notes:

• Methodologies for Cyber Threat Intelligence: [06:00]
  
• Blacklist - hashes, IP, ports, 
• Statistical Analysis
  
• Behavior Analysis - Mitre Att&ck (intention/tactics) [06:55]
  
• Case Study : Capital One Attack [08:58]
• T1595: Active scanning
  
• T1190: Exploit webap (SSRF) [13:25]  
• T1552: Access EC2 metadata service [14:14]
• T1526: Discover Token to access to all S3 bucket [15:20] 
• T1530: Data exfil from S3 cloud storage
• The Cloud API Service [18:50]
• CloudTrail - for threat hunting using API calls [20:00]  
• Azure Resource Provider Operations [30:00]
• Portal
• CLI: az privoder operation list
• Azure Activity Log [33:13]
• only provides Create, Update, Delete (no Read)
• Grouped by correlation ID
• Azure IMDSv1 Vs IMDSv2
  

Prediction in Threat Intelligence

One way Artificial Intelligence (AI) can be used in Cybersecurity is for predicting in Threat Intelligence with big data.

For example, cve-2021-29097. There is no poc/exploit found, and no malware being reported, no successful exploitation being reported, and CVSS(2) base score is below 7. Basically, there isn't much info at NVD (as of today).

Will you patch the vulnerability? Or wait till the threat landscape changes? How about AI prediction? Can we "predict" the threat?

With Kenna.VI, we can "predict" the threat even though we have no enough information from NVD. See below, as this is an example that I found recently that is predicted to be exploitable in the future.

 [*] Searching cve-[['2021-29097']] vulnerability definitions within Kenna.VI+....


[ CVE Description ]
 [*] CVE_ID : CVE-2021-29097
 [_] Desc   : Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.

 [_] C:2021-03-23 / P:2021-03-25 / L:2021-03-31
 [*] Vuln Risk           : 41.4226
 [*] Exploited [trend]   : 0 [holding]  [RCE]
 [_] Exploit/likehood    : 🌟 True/79.6353% confidence

 [*] Malware sample : 0
 [*] Exploits/POC   : [0]
 [_] Fixes          : [0]
 [_] Threat Actors  : [0]
 [_] CVSS2 / CVSS3  : [ 6.8 / 7.8 ]

 [_] Vuln Products  : [4]

[ CVE Malware Family Info : None ]

[ High_Profile_Vulnerability ]
 [!!!]   CVE-2021-29097 (41.4226) : []


 ** [5] threads completed [2 tasks] / [1.91 KB] within [2.71 sec].
 

Links:

• https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/
• https://nvd.nist.gov/vuln/detail/CVE-2021-29097
  

What Happen in the Past-14-Day?

Do you know how many new CVE have been added to NVD in the past 2 weeks? And how many old CVE have been updated, like new poc exploit released or malware released? How about ransomware and crypto-mining attack?

The answer is 10,768 CVE have been updated. 

10,768 CVE updated in past 14 days

 This includes:

• New CVE been released.
• Old CVE with new details being released.
• Any pre-NDV vulnerabilities
  

Yes, you may get those information from National Vulnerability Database. However, how are you going to do a quick analysis of all those CVE, like:

• What is the trend and velocity of a particular CVE being attack now?
  
• What are the new exploit being released? 
• Any malware or ransomware being released for a CVE?
• Any prediction on a particular CVE with artificial intelligence analysis on how likely a particular CVE is going to be exploited in the future.
  

Finally, how fast you learn about all these new CVE/attack/ransomware/cryptomining? 

(Below is the quick dump of all the information above into a CSV file. And it just happen that while I exporting the CSV, the list becomes 10769 CVE)

10,769 cve exported