Threat

Hunting for C2
with Sqrrl
Nov 30 2016 | Josh Liburdi

Presenter

Josh Liburdi

Security Technologist at Sqrrl

Formerly General Electric CIRT, CrowdStrike Professional Services
3+ years in incident response

What Youll Learn Today

Why you need to detect command and control activity

How Sqrrl automatically detects command and control patterns
How Sqrrl makes it easy to investigate IOCs
How Sqrrl lets you hunt with common techniques

2016 Sqrrl Data, Inc. All rights reserved.

WHY WE NEED TO DETECT C2

Understanding the Attack Lifecycle

What is most impactful to the organization?

Type of threat (targeted or opportunistic)
Outcome (nancial loss, sensitive data loss)
Evaluate threats and prescribe detection

Attacker
Defender
2016 Sqrrl Data, Inc. All rights reserved.

Why We Need to Detect C2

Required step of the kill chain in remote attacks

Predictable architecture, diverse execution
Client-Server
Peer-to-Peer
Leading techniques
1. Encrypted channels
Standard protocols (HTTPS)
Custom protocols (XOR)
2. Domain Generation Algorithms (DGA)
Ransomware (Locky, Cryptolocker)
3. Tunneling
Point of Sale malware (FrameworkPOS, NewPosThings)
2016 Sqrrl Data, Inc. All rights reserved.

HUNTING MATURITY MODEL

Hunting Maturity Model

Many organizations are in HM0, HM1, and HM2

2016 Sqrrl Data, Inc. All rights reserved.

DATA DOMAINS

Data domains

Network

Endpoint

Application

Enrichment

2016 Sqrrl Data, Inc. All rights reserved.

10

UNCOVERING C2 WITH
SQRRL

Sqrrl Detection Analytics

Sqrrl comes with

three machine
learning-driven C2
detection analytics
Beacon
Domain
Generation
Algorithms
(DGA)
DNS tunneling

2016 Sqrrl Data, Inc. All rights reserved.

12

DEMO

SUMMARY

Benets of Hunting with Sqrrl

1. Isolate attacker TTPs, like DGA or DNS tunneling, with detection analytics
2. Determine attack context with data domains unied in a linked model
3. Find emerging threats by acting on the latest intel and analysis procedures

2016 Sqrrl Data, Inc. All rights reserved.

15

Want to Learn More?

Go to sqrrl.com to
Download Sqrrls Threat Hunting eBook
Download the Sqrrl
White Paper on Threat Hunting Platforms
Request a Sqrrl Test Drive VM
Download Sqrrls Product Paper
Reach out to us at info@sqrrl.com