Practical Cyber Threat Intelligence with STIX

Transcript Practical Cyber Threat Intelligence with STIX

PRACTICAL CYBER THREAT INTELLIGENCE WITH STIX

Sean Barnum Nov 2013 https://stix.mitre.org

Sponsored by the US Department of Homeland Security

Diverse and evolving threats Balance inward & outward focus

Standardized

Information Sharing

Cyber threat information (particularly indicators) sharing is not new Typically very atomic and very limited in sophistication

IP lists, File hashes, URLs, email addresses, etc.

Most sharing is unstructured & human-to-human Recent trends of machine-to-machine transfer of simple/atomic indicators

STIX aims to enable sharing of more expressive indicators as well as other full spectrum cyber threat information.

What is STIX?



language

for the characterization and communication of cyber threat information

– NOT a sharing program, database, or tool  …but supports all of those uses and more 

Developed with open community feedback



Supports

– Clear understandings of cyber threat information – Consistent expression of threat information – Automated processing based on collected intelligence – Advance the state of practice in threat analytics © 2013 The MITRE Corporation. All rights reserved.

STIX Use Cases

STIX provides a common mechanism for addressing structured cyber threat information across and among this full range of use cases improving consistency, efficiency, interoperability, and overall situational awareness.

What is “Cyber (Threat) Intelligence?” Consider these questions:

 What activity are we seeing?

 What threats should I look for on my networks and systems and why?

 Where has this threat been seen?

 What does it do?

 What weaknesses does this threat exploit?

 Why does it do this?

 Who is responsible for this threat?

 What can I do about it?

6 | 6 |

| 7 |

| 8 |

| 9 |

| 10 |

| 11 |

| 12 |

| 13 |

| 14 |

| 15 |

Why were they doing it?

Why should you care about it?

| 16 |

What you are looking for What exactly were they doing?

Who was doing it?

What were they looking to exploit?

What should you do about it?

Where was it seen?

Expressing Relationships

ObservedTTP Infrastructure “Bad Guy” Backdoor Badurl.com, 10.3.6.23, … Observables Indicator-9742 Email-Subject: “Follow-up” RelatedTo CERT-2013-03… “BankJob23” RelatedTo Indicator-985 Observables MD5 hash… 17

[email protected]

Expressing Relationships in STIX

Initial Compromise Spear Phishing Email Sender: John Smith Subject: Press Release Indicator Observable Electronic Address Pamina Republic Army Targets Leet Unit 31459 Leverages Infrastructure Observed TTP Associated Actor Observed TTP Observed TTP Establish Foothold WEBC2 Indicator Malware Behavior Observed TTP Observed TTP Escalate Privilege Uses Tool Uses Tool cachedump lslsass Internal Reconnaissance Attack Pattern MD5: d8bb32a7465f55c368230bb52d52d885 Observable ipconfig net view net group “domain admins” Khaffeine Bronxistan Perturbia Blahniks . . .

C2 Servers Exfiltration Uses Tool GETMAIL IP Range: 172.24.0.0-112.25.255.255

Data Markings, Profiles and Privacy



STIX leverages an abstract data markings approach

– Enables marking of content data down to the field level with any number of custom marking models – Current default model implementations exist for Traffic Light Protocol (TLP) and Enterprise Data Header (EDH) 

Profiles can be defined to specify relevant subsets of the language

– Can be used to scope what information is exchanged between parties, what capabilities a tool or service provides, or to support differential policies on different types of information 

Addressing privacy with STIX

– Structured representation assists in explicitly delineating types of information – Profiles assist in explicit design-time specification of scoping policy around data with potential privacy implications – Data markings assist in explicit implementation-time labeling of content based on policy around potential privacy implications © 2013 The MITRE Corporation. All rights reserved. | 19 |

Implementations



Initial implementation has been done in XML Schema

 Ubiquitous, portable and structured  Concrete strawman for community of experts  Practical structure for early real-world prototyping and POC implementations  Plan to iterate and refine with real-world use 

Next step will be a formal implementation-independent specification

Enabling Utilities



Utilities to enable easier prototyping and usage of the language.



Utilities consist of things like:

       Language (Python) bindings for STIX, CybOX, MAEC, etc.

High-level programmatic APIs for common needs/activities Conversion utilities from commonly used formats & tools Comparator tools for analyzing language-based content STIX-to-HTML Stixviz (simple visualization tool) Utilities supporting common use cases  E.g. Email_to_CybOX utility supporting phishing analysis & management 

Open communities on GitHub (STIXProject, CybOXProject & MAECProject)

STIXViz with STIX-to-HTML Example

Adoption & Usage

Still in its early stages but already generating extensive interest and initial operational use



Actively being worked by numerous information sharing communities



Initial operational use by several large “user” organizations



Actively being worked by numerous service/product vendors

Some of the organizations contributing to the STIX conversation:

Recent Focus



Make it easier for people to understand and use STIX

 Improve documentation  Develop supporting utilities  Provide collaborative guidance  Gather feedback 

Refine and extend the language based on feedback and needs

Timelines



Current Versions

 CybOX 2.0.1, MAEC 4.0.1, STIX 1.0.1 (Sep 2013) 

Near Term

 CybOX 2.1 (EOY 2013)  MAEC 4.1, STIX 1.1 (January 2014) 

Mid Term

 CybOX 3.0, MAEC 5.0, STIX 2.0 (Summer 2014) 

Long Term

For more information



STIX Website

– – Contains official releases and other info http://stix.mitre.org/ 

Sign up for the STIX Discussion and Announcement mailing lists

– http://stix.mitre.org/community/registration.html



Open issues can be discussed on GitHub

– https://github.com/STIXProject 

STIX-related software can be found on GitHub

– https://github.com/STIXProject/python-stix – https://github.com/STIXProject/Tools 

Related sites

– – – – https://cybox.mitre.org/ https://maec.mitre.org/ https://capec.mitre.org/ https://taxii.mitre.org/

Orient on the Adversary!

| 28 |

We want you to be part of the conversation.

[email protected]

https://stix.mitre.org

Backup TAXII Slides

Trusted Automated eXchange of Indicator Information (TAXII)

Open community led by DHS and coordinated by MITRE

 

Defines services and messages for sharing cyber threat info Not bound to one sharing architecture

  – Composable TAXII services support many sharing models – Support push or pull sharing – Do not force data consumers to host network services

Enable (but don’t require) authentication/encryption Do not dictate data handling

– TAXII handles transport; storage & access control left to back-end 

Core services and data models are protocol/format neutral

– Binding specs standardize TAXII’s use of specific protocols/formats – Users not forced to use one protocol or format 

Convey any data (not just STIX)

TAXII 1.0



TAXII 1.0 Specifications

– TAXII Overview  Defines the primary concepts of TAXII – TAXII Services Specification = core services and exchanges – TAXII Message Binding = how to express messages in a format  TAXII 1.0 has an XML Message Binding – TAXII Protocol Binding = how to transmit message over the network  TAXII 1.0 has an HTTP (and HTTPS) Message Binding 

TAXII core services

– – – – Discovery Poll Inbox – Indicates how to communicate with other services Feed Management – Identify and manage subscriptions to data feeds – Support pull messaging – Receive pushed messages

Identified Sharing Models



Research identified three primary sharing models:

– Source/subscriber – Peer-to-peer – Hub and spoke Subscriber Source Peer D Peer C Subscriber Peer E Peer A 

TAXII supports all three

Peer B Spoke (Consumer & Producer) Spoke (Consumer only) Hub Subscriber Subscriber Spoke (Producer only) Spoke (Consumer & Producer)

Simple Hub & Spoke Example

Poll Inbox Client Push data to the hub Spoke 1 Pull data from the hub Hub Spoke 2 Spoke 3 Spoke 4

Hub & Spoke Example

Discovery Feed Manage.

Poll Client Inbox Spoke 1 Get connection info Pull recent data from the hub Hub Subscribe to data feeds Push recent data to a spoke Spoke 2 Push new data to the hub Spoke 3 Spoke 4

Peer-to-Peer Example

Inbox Client Peer 1 Peer 2 Peer 3 Peer 5 Peer 4

RID-T Example

Inbox Client Peer 1 Peer 5 Peer 2 For internal MITRE use Peer 3 Peer 4

For more information



TAXII Website

– Contains official releases and other info – http://taxii.mitre.org/ 

Sign up for the TAXII Discussion and Announcement mailing lists

– http://taxii.mitre.org/community/registration.html



Open issues can be discussed on GitHub

– https://github.com/TAXIIProject/TAXII-Specifications 

TAXII-related software can be found on GitHub

– https://github.com/TAXIIProject 

Related sites

– https://stix.mitre.org/