O h Imp f Cyb-Df L Am Y d d b, y d hw dv E Lv, F Hm, Phpp Lwk m AG 2017 m.m
Wh w? <p f m CERT> m AG 2017 Pg 3
Y d d b, y d hw dv Wh h k b Wh w dd Wh w h p Wh h k NOT b C p-by-p hw fx hg Cd Vd bhg A mk y f. B y d my Th g -bw mp h hmv. m AG 2017 Pg 4
Exmp m AG 2017 m.m
Exmp : Mw v m Hw h p p m? Hw d y yz? I gd k m mw? Dd h k h hm? Wh h If pb f h? Hw d y pv h hd mw fm xfg d fm fd mh? Hw y mk m f dd? Hw y pv h fm bg fd by h m mw? m AG 2017 Pg 6
Th d wy Rp m V T Cp Empy Dy Av Dy Tk Tk I Tk Ibx Ivg Ayz hm Ayz R dbx Ex p C&C URL Vg h f Id/URL IEM (PxyLg) Pxy 1 m AG 2017 Pg 7
Ev 1 - p m AG 2017 m.m
M p Ev 1 - p Amd p Rp m Rp v V T Cp Empy Dy (C)IO L Av Dy Tk Tk I Tk M DB Ivg Ayz hm Ayz R dbx Ex p C&C URL Vg d -f. Id/URL TI Pfm h f Id/URL IEM (PxyLg) m AG 2017 Pg 9 kh Pxy 1 Pxy 2
p: p d p w y pfm h k f p w by y b d by h h y pg q gd ddg f h /v d y fw d h p Eh y h dff fv pg gg hd p g h p m AG 2017 Pg 10
Ev 2 - API m AG 2017 m.m
M p Ev 2 - API Amd p M DB Rp m Rp v V T Cp Empy Dy (C)IO L A V Av Dy Tk Tk I Tk Rmd Tk T Ayz hm Ayz R dbx Ex p C&C URL Vg T d -f. Id/URL TI Pfm h f Id/URL IEM (PxyLg) m AG 2017 kh C bk Pxy 1 Pxy 2 Pg 12
API: dm m AG 2017 Pg 13
API: p mpy: wh vybdy p g LDAP v, y dvp kw hw qy RET API. Ab: Cdg g RET API w y xhg h bkd,.g. pg mm wh p, g mpm h m f Fxby: RET API f h b dvpd by y, vybdy p g g h/h gg f pf Ah: wppg h g f m API w f b dy mgm (.g. hd dff h) m AG 2017 Pg 14
API: Ex p Gb h m AG 2017 Pg 15
API: Ex p - Mg g m AG 2017 Pg 16
API: Ex p - Vg f m AG 2017 Pg 17
Exmp - vd m AG 2017 m.m
Exmp: Hw d w hd dy M pd pm Rp PAM/Mw Ay f h m Ay f m hm M vg f y Th g pg H h pxy g Ig f md k I-h dvpd Ok pg. d m ( hm) p mbx. Tkg f md m AG 2017 Pg 19
Exmp: Hw d w hd dy M pd pm MALT (MALw mgt) Ay f h m Ay f m hm M vg f y Th g pg H h pxy g Ig f md k I-h dvpd m bx d yz vd m f p + WbGUI Tkg f md m AG 2017 Pg 20
Exmp: Hw d w hd dy M pd pm MALT (MALw mgt) Ay f h m Ay f m hm M vg f y Th g pg H h pxy g Ig f md k I-h dvpd m bx d yz vd m f p + WbGUI Tkg f md m AG 2017 Pg 21
Exmp: Hw d w hd dy M pd pm CMAP Ay f h m Ay f m hm M vg f y Th g pg H h pxy g Ig f md k Tkg f md m AG 2017 Pg 22
Exmp: Hw d w hd dy M pd pm CMAP Ay f h m Ay f m hm M vg f y Th g pg H h pxy g Ck dbx + I-h dvpd GUI d dd y Ig f md k Tkg f md m AG 2017 Pg 23
Exmp: Hw d w hd dy M pd pm Th Ig Vg If Ay f h m Ay f m hm M vg f y Th g pg H h pxy g Ig f md k Cm WbGUI f vg. I v d fm dbx y, f d h hm, pp g d ph bk h hg TI db. Tkg f md m AG 2017 Pg 24
Exmp: Hw d w hd dy M pd pm Th Ig Vg If Ay f h m Ay f m hm M vg f y Th g pg H h pxy g Ig f md k Cm WbGUI f vg. I v d fm dbx y, f d h hm, pp g d ph bk h hg TI db. Tkg f md m AG 2017 Pg 25
Exmp: Hw d w hd dy M pd pm Ay f h m Ay f m hm MANTI MIP I-h dvpd, ppg TIX/TAXII Nw MIP- h M vg f y Th g pg H h pxy g dbx (CMAP) Vg (TI VI) TI DB (MIP) Ig f md k Tkg f md m AG 2017 Pg 26
Exmp: Hw d w hd dy M pd pm Ay f h m Ay f m hm MANTI MIP I-h dvpd, ppg TIX/TAXII Nw MIP- h M vg f y Th g pg H h pxy g dbx (CMAP) Vg (TI VI) TI DB (MIP) Ig f md k Tkg f md m AG 2017 Pg 27
Exmp: Hw d w hd dy M pd pm H g h Ay f h m Ay f m hm M vg f y Th g pg H h pxy g Ig f md k Tkg f md m AG 2017 Pg 28
Exmp: Hw d w hd dy M pd pm Ay f h m Rmd k I-h dvpd y hd f md k Ay f m hm M vg f y Th g pg H h pxy g Ig f md k Tkg f md m AG 2017 Pg 29
Exmp: Hw d w hd dy M pd pm Ay f h m Rq Tk Op kg ym + my mz Ay f m hm M vg f y Th g pg H h pxy g Ig f md k Tkg f md m AG 2017 Pg 30
Ev 3 Wh x? m AG 2017 m.m
M p Wh x? Amd p M DB Rp m Rp v V T Cp Empy Dy (C)IO L A V Av Dy Tk Tk I Tk Rmd Tk T Ayz hm Ayz R dbx Ex p C&C URL Vg T d -f. Id/URL TI Pfm h f Id/URL IEM (PxyLg) m AG 2017 kh C bk Pxy 1 Pxy 2 Pg 33
m AG 2017 Pg 34 Wh x? M p Amd p M D B db x Vg T IEM (PxyLg) Tk T k Rmd Tk T TI P f m V T R p v A v D y C p E m p y D y ( C ) I O L P x y 2 P x y 1 C b k k h A V Rp m Ayz hm Ex p C&C URL h f Id/URL Ayz R I Tk d -f. Id/URL M D B db x Vg T IEM (PxyLg) Tk T k Rmd Tk T TI P f m V T R p v A v D y C p E m p y D y ( C ) I O L P x y 2 P x y 1 C b k k h A V Rp m Ayz hm Ex p C&C URL h f Id/URL Ayz R I Tk Rmd Tk T M D B db x Vg T IEM (PxyLg) Tk T k Rmd Tk T TI P f m V T R p v A v D y C p E m p y D y ( C ) I O L P x y 2 P x y 1 C b k k h A V Rp m Ayz hm Ex p C&C URL h f Id/URL Ayz R I Tk d -f. Id/URL M D B db x Vg T IEM (PxyLg) Tk T k Rmd Tk T TI P f m V T R p v A v D y C p E m p y D y ( C ) I O L P x y 2 P x y 1 C b k k h A V Rp m Ayz hm Ex p C&C URL h f Id/URL Ayz R I Tk d -f. Id/URL Vg T TI P f m V T R p v P x y 2 P x y 1 C b k k h Rp m db x Vg T IEM (PxyLg) Tk T k Rmd T TI P f m C b k Ex p C&C URL h f Id/URL d -f. Id/URL IEM (PxyLg) Tk T k Rmd T
Wh x? V T Rp v (C)IO L A V Cp Empy Dy Av Dy C Wkfw Eg M DB Tk Tk Rmd Tk T Vg T dbx TI Pfm Empy C bk IEM (PxyLg) m AG 2017 If Off Ay kh Pxy 1 Pxy 2 Pg 35
Wh x? INCIDENT HANDLING PLAYBOOK I f p m pd p 1: Ayz m d x URL p 2: Ayz mp dbx p 3: If Th Idx > 10 h C Wkfw Eg m AG 2017 Pg 36
L Ld m AG 2017 m.m
L d Mk y! U h m f y d x v/d. m AG 2017 Pg 38
L d Wk f Wk f y Evy mpy/ dff m AG 2017 Pg 39
L d M h w? p! Opmz m v m! m AG 2017 Pg 40
L d Cz y! Lw p vhd h g d pvd w-dmd p f f. m AG 2017 Pg 41
L d ddz y f! Ty k h m k (pgmmg gg, fmwk, b). m AG 2017 Pg 42
L d Mg y y! Ey ff h khd y mpy (m f) y. m AG 2017 Pg 43
L d Cmpm (mm)! Fd dff bw dpg y y p d v v. m AG 2017 Pg 44
L d DIY b d DIY! D' (wy) mpm y w, b h fg p-. m AG 2017 Pg 45
L d Mk y! U h m f y d x v/d. Wk f Wk f y! Evy mpy/ dff. If y hv d m h w, p! Opmz m v m! Cz y! Lw p vhd h g d pvd w-dmd p f f. ddz y f! Ty k h m k (pgmmg gg, fmwk, b). Mg y y! Ey ff h khd y mpy (m f) y. Cmpm (mm)! Fd dff bw dpg y y p d v v. D yf b d d yf!: D' (wy) mpm y w, b h p-. m AG 2017 Pg 46
Q? E Lv F Hm Phpp Lwk m CERT CT RDA IT CER-DE O-Hh-Rg 6 81739 Müh.v@m.m hm.f@m.m phpp.wk@m.m @m.m hp://www..m.m m AG 2017 Pg 47