FireEye Technology The Nuts and Bolts · 2019. 4. 10. · ©2019 FireEye FireEye 郵件安全技術之一: Impersonation Detection 7 用來檢測商業郵件詐欺(BEC) 利用郵件信頭資料產生MD5

©2019 FireEye

FireEye TechnologyThe Nuts and Bolts

Nicholas Hsiao

©2019 FireEye

FireEye 主要的防禦方案

3

FireEye Expertise

Mandiant Services Managed DefenseThreat Intelligence

Expertise On-DemandFireEye and Third Party Apps FireEye Market

FireEye Helix Security Operations Platform

Security Information& Event Management

Orchestration& Automation

ContextualIntelligence

ComplianceReporting

Alerts / CaseManagement

FireEye Network Security and Forensics

FireEye Email Security

FireEye Endpoint Security

Third-Party Solutions

©2019 FireEye

FireEye 郵件安全

©2019 FireEye

FireEye 郵件安全技術之一: Advanced Threat Analysis

5

End User

DUAFAUDE

利用前線分析產生技術

DTI

使用新技術檢測新攻擊

©2019 FireEye

FireEye 郵件安全技術之一: PhishVision

6

▪ FireEye Advanced URL Defense 套件

▪ 影像分類引擎

– 使用 AI 深度學習 CNN 技術, 用來探測圖片以及惡意程式的關係, 釣魚網站等等

– 用來比對攻擊目標，以及釣魚郵件中的 URL 所截取的網站影像

▪ 能提供想要攻擊的公司/網站目標情報

▪ 在檢測釣魚攻擊以及降低誤判上，有非常高的成效

©2019 FireEye

FireEye 郵件安全技術之一: Impersonation Detection

7

▪用來檢測商業郵件詐欺 (BEC)

▪利用郵件信頭資料產生 MD5 後，與用戶設定的資料進行比對

– Username Matching

– Friendly Display Name Matching

▪ Sounds Like and Looks Like Filters

– Metaphone 語音演算法

– 字串比對演算法 (string similarity algorithm )

©2019 FireEye

FireEye 郵件檢測技術概觀

8

COMPARISON Cloud Edition Server Edition

Unknown threats (0 day / 0 hour) ✓ ✓

Phishing / Spear Phishing ✓ ✓

Impersonation Detection (e.g. CEO fraud) ✓ ✓ (Eiger)

Riskware (Spyware, Adware) Categorization ✓

Integrated Threat Intelligence ✓ ✓

Smart DNS – Use of Newly Existing Domain (NED) filtering as well as email specific metadata tracking. ✓

Content Filtering Policies ✓ ✓

Attachment analysis – Documents (.exe, .dll, .doc/.docx, .xls/.xlsx, .ppt/.pptx, .jpg, .png, .pdf, .swf, .mp3/.mp4), Archives (.7z, .7 zip, .cab, .lzh, .rar, .tnef, .zip)

✓ ✓

Attachment analysis – Encrypted and Password Protected ✓ ✓

Advanced URL Defense for analysis of spear-phishing sites (including full web page) ✓ ✓

MacOS Guest Image Support ✓

URL Rewriting With Custom Landing Page Support ✓ ✓

Multi-Vector Analysis (Web, Email, Endpoint), Multi-Flow Analysis (multiple files arrive in flow to craft attack) ✓ ✓

Microtasking VM’s (detonating file across multiple application versions) ✓ ✓

Analysis – JavaScript, VBScript, etc., Total File Type Support (Java, Flash, Help, Link, etc.) ✓ ✓

Controlled Live Mode ✓ ✓ (configurable)

©2019 FireEye

FireEye 郵件檢測技術概觀

9

COMPARISON Cloud Edition Server Edition

Guest Image Customization ✓

Proprietary Hypervisor – Secure Hardened ✓ ✓

2-Way Dynamic Threat Intelligence ✓ ✓

1-Way Dynamic Threat Intelligence (DTI) ✓

Cloud-based Advanced URL Defense/AV Suite with 1-Way Dynamic Threat Intelligence

(DTI) (enabled via CLI)✓

Custom Yara rules ✓ ✓

Custom password lists for password protected attachments ✓

Custom queue settings for analysis engines ✓

Automatically scheduled summary reports (hourly/daily/weekly/monthly) ✓

Analysis – Anti Evasion Techniques ✓ ✓

Outbound Scanning Compatibility ✓

AVAS (Antivirus and Anti-spam) Add-on* ✓

In-house detection and blocking as soon as new spam campaigns are found ✓

Deep Relationship Analysis to spot anomalous traffic ✓

Newly Existing Domain (NED) filtering detection of first email sent within 24 hours

of domain registration✓

IP Reputation Blacklisting (RBL) ✓

Newsletter Detection ✓

SPF/DKIM/DMARC Validation ✓

©2019 FireEye

FireEye 端點安全

©2019 FireEye

FireEye Endpoint Security 的核心之一: Ring Buffer

11

URL

Network

DNS

Processes

Files

Registry

Flight

Recorder

TTPs

Registry key關於註冊機碼的變化, 基本上是註冊到 autorun 的機碼

File creation檔案的路徑, hash , 城市的相關資訊等等

Network accessDNS, URL, IP 資訊以及試圖連

線的程式資訊

Process execution新執行程式以及載入模組

的相關資訊

At1.job

Job scheduler列出由使用者或是系統所建立的排程工作

Network configuration

APR, DNS 表, 網路存取資料

AutorunAutorun 相關的註冊資

訊

File system在主要路徑系統上的檔案的 metadata

User information使用者帳號資訊

.PF

Recently Run List

最近執行的程式清單

Process List正在執行的程式以及處理

的資訊等 metadata

Browser access history

用戶的瀏覽器訪問歷史

+

©2019 FireEye

FireEye 端點安全技術之一: EDR

12

URL

Network

DNS

Processes

Files

Registry

即時動態記錄電腦活動

即時偵測

自動更新 Mandiant 分析手法根據外部情報，自行輸入FieEye NX,EX 自動學習手法

企業查詢

輸入任何已知的 IOC 指標 (70+)快速盤查受影像的範圍

證據保留與分析

自動手動進行採證自動分析出相關的攻擊訊息根據線索分析前後相關事件

對歷史軌跡記錄

能記錄/查找過去發生過的行為提供額外訊息(如 MD5), IP 等

©2019 FireEye

FireEye 端點安全技術之一: Exploit Guard

13

隔離利用 Exploit Guard 阻止惡意程式執行

2 Heap Spray*

1 Adobe Reader

3 Integer Overflow**4 ROP^ Exploit

5 Shellcode^^

NtCreateFile: push ebpmov ebp,

esp…

6 Payload

Exploit Detection Flow

1. Packaging (PDF) - 0 points

2. Pre-Exploit (Heap Spray) - 5 points

3. Exploit (Integer Overflow) - 15 points

4. Control Flow (ROP) - 20 points

5. Malicious Activity (Shellcode) - 10 points

Final Score 50 points

©2019 FireEye

FireEye 端點安全技術之一: Malware Guard

14

▪與 Malware 偵測整合

– 檢測未知的惡意程式

– 根據 FireEye 特有的真實世界所採集的樣本進行機器學習

– 對加殼，勒索等惡意軟體有極佳的效果

▪支援即時檢測

– 能夠直接檢測檔案，不需要將檔案送到其他地方

– 在檔案有讀/寫的時候進行檢測

©2019 FireEye

FireEye 網路安全

©2019 FireEye

FireEye 網路安全核心技術: 總覽

16

▪對於先進的威脅，能利用靜態分析以及動態分析 (MVX) 技術，對惡意流量利用 Multi-Flow / Session Base 進行分析。

▪ SSL – 對 https 進行解析

▪對於 Callback 流量，進行檢測攔截

▪ IPS – 對 packet 利用 snort 技術檢測攔截，並與 MVX 進行關聯

▪ SmartVision – 150+ suricata 規則. (Mimikatz, PSEXEC, Sysinternals)

▪風險軟體 – 一般威脅檢測

▪ Evidence Collector – 提高對 L7 網路的 metadata 的可視性 (good, bad, or ugly)

http

SmartVision

IPS

MVX

/ https

©2019 FireEye

FireEye 網路安全核心技術: MVX 與流量處理(session base)

17

HTML

JS

FLASH

DNS

CONTENT (CSS/JPEG/TXT)

BINARIES (ZIP/PE/DOC/JAR)

MVX

NX Sensor

靜態分析

動態分析

0

5

30

20

40

10

COPY OF SESSION

總分大於 > 50

©2019 FireEye

FireEye 網路安全核心技術: 從一個 Alert 看 NX 不同的地方

18

多種靜態分析引擎

學習到的殭屍網路聯絡命令

動態沙箱分析

©2019 FireEye

FireEye 網路安全核心技術: 利用不同視野檢視沙箱分析結果

19

©2019 FireEye


20

©2019 FireEye

FireEye 產品在攻擊週期每個階段的防禦

26

FireEye 解決方案

攻擊週期 vs. FireEye 功能

初始偵查

Initial Reconnaissance

初步感染

Initial Compromise

建立立足點

Establish Foothold

提升權限

Escalate Privileges

橫向偵查移動

Lateral Movement

保持存在

Maintain Presence

完成任務

Complete Mission

EX

Impersonation Yes

AntiPhishinig Yes

Advanced Threat Yes Yes

NX

上網 (HTTP/S) Yes Yes Yes Yes

IPS Yes Yes Yes Yes

SmartVision Yes Yes Yes Yes

AV/Malware Guard Yes Yes Yes

HX

Malware/Malware

GuardYes Yes Yes

Exploit Guard Yes Yes Yes

Real Time Detection Yes Yes Yes Yes Yes Yes

Enterprise Search Yes Yes Yes Yes Yes Yes Yes