Over the past few years we've seen an expansion in both the variety of canaries and the locations to hide those canaries in the cyber deception realm. What we've yet to see is refinement in the implementation of those canaries to evade discovery from wary attackers.
For blue teams, properly tuned SIEM rules utilizing deception canaries are higher fidelity and lower volume alarms. This means that most of the time when the alarm fires it indicates a true positive. This is usually indicative of an interactive actor or insider threat in the environment.
A deception alarm firing often puts the blue team on edge and leads them to perform a proactive threat hunt rather than remaining reactive to their alarms. This often ruins the opportunity to further any red team engagements that test the SOC’s efficacy, based on their tools and rules, without the defenders having an unfair bias.
What is the solution for attackers? Detect the deception canary beforehand and avoid interacting with it at all!
In this presentation we'll talk about the methodology to detect deception canaries used by blue teamers followed by a deep dive on a couple of the most common deception canaries, how blue teams and open-source code are implementing those deception canaries on a technical level, and the weaknesses in those implementations that allows attackers to enumerate the canaries within seconds.
SANS HackFest Summit 2023
Anti-Deception: Catching the Canaries
Zachary Asher, Lead Cyber Security Engineer, FM Global
View upcoming Summits: www.sans.org/u/DuS
Негізгі бет Anti-Deception: Catching the Canaries
No video
Пікірлер