In our last Elastic Security capture the flag event, participants hunted for suspicious behavior after a mock network compromise. See how contenders fared in this blog post.

Last month, members of the <a href="/security">Elastic Security</a> team hosted a <a href="https://community.elastic.co/events/details/elastic-amer-virtual-presents-bsides-satx-2020-threat-hunting-ctf-with-elastic/">threat hunting capture the flag (CTF)</a> event at BSides SATX. We provided the community with an environment to learn and practice threat hunting with our team, and cultivated new relationships with attendees. By sharing information with security practitioners, we can help prepare them to defend their organization’s data from attack through knowledge transfer. Our free and open approach to security includes not only technologies, but our philosophy and methodologies around threat hunting based on the research and content that we also share.
Like many other conferences this year, <a href="https://www.bsidessatx.com/">BSides SATX</a> shifted to a virtual format in light of the global COVID-19 pandemic. The conference was a great experience thanks to the organizers and everyone who participated. Attendees utilized our CTF environment, built with free and open technologies, before learning how to use version 7.8 of the Elastic Stack to hunt for an attacker’s malicious behavior in the proverbial needle in a haystack: 11 million events.
<h2>The scenario</h2>At the beginning of the CTF competition, participants were provided with an all-too-common scenario that included a notification from a business partner. Their network had been compromised and some endpoints were infected with ransomware. They recovered from the incident and offered their assurances that “you shouldn’t be affected.” However, in this scenario, leadership is skeptical and has asked attendees&nbsp; — the participating threat hunters — to look for any suspicious behavior in their environment. After all, the third party has a valid user account for systems in the enterprise that they use occasionally to connect to your network…
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt01c85624c58d522b/5f31cb38327a6201d7ebaa0a/1-fictitious-breach-blog-capture-the-flag.png" data-sys-asset-uid="blt01c85624c58d522b" alt="" style="display: block; margin: auto; border:1px solid black; width: 90%">
<figcaption>Figure 1 - An excerpt from the fictitious breach notification from a business partner</figcaption><h2>Threat hunting methodology</h2>Threat hunting is the proactive pursuit and elimination of adversaries in an organization’s environment before they cause damage and loss. In the spirit of threat hunting, we did not generate any security alerts for participants before the CTF event. After providing attendees with a demonstration of how to use the Discover and Visualize apps in <a href="/kibana">Kibana</a> and execute queries using <a href="https://www.elastic.co/guide/en/kibana/7.8/kuery-query.html">Kibana Query Language (KQL)</a>, we provided them with the fabricated breach notification. As threat hunters, they would need to form hypotheses about which actions the attacker may have taken before searching for the behavior.
An initial hypothesis that could be quickly proved or disproved may be something like: “the attacker abused the valid user account used by the business partner by authenticating to one or more of the endpoints in my network.” If the hypothesis was proven to be true, an additional hypothesis could be formed based on assumptions on what the attacker could have done next. Did they perform any actions to discover the network? Did they establish a command and control channel or exfiltrate any data?
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt976e705549be29cf/5f31cb4b48d3b57cb974969b/2-visualize-in-kibana-blog-capture-the-flag.png" data-sys-asset-uid="blt976e705549be29cf" alt="" style="display: block; margin: auto; border:1px solid black">
<figcaption>Figure 2 - Using Visualize in Kibana to search for rare process command line arguments
</figcaption>Once CTF participants discovered the first signs of malicious activity, they began to track the adversary’s footprints through the data and untangle the story of what happened piece by piece.
If you’re interested in learning more about the fundamentals of effective threat hunting, you can download our free book, <a href="/campaigns/elastic-guide-to-threat-hunting">The Elastic Guide to Threat Hunting</a> and watch our presentation, <a href="https://youtu.be/2Hh5spqA6bw">How to plan and execute a hunt</a>.
 
<div class="video embed-container" style="height: 319.725px;">
	<img class="vidyard-player-embed" src="https://play.vidyard.com/8PKneMzyB45NAMP7dBxzYm.jpg" data-uuid="8PKneMzyB45NAMP7dBxzYm" data-v="4" data-type="inline" style="width: 100%; margin: auto; display: block;">
</div>
<h2>Preparing the CTF environment</h2>While designing the environment for the CTF, we decided to keep it relatively simple. We configured the following components, as shown in Figure 3:
<ul>
	<li>x1 Windows Server 2016 host configured as a domain controller</li>
	<li>x20 Windows 10 endpoints joined to the domain</li>
	<li>We installed several applications on each endpoint using <a href="https://ninite.com/">Ninite</a> in order to generate benign events and make the task of finding the flags in the dataset a bit more challenging for participants — after all, the goal of a threat hunter is to find the true threat amidst the noise</li>
	<li><a href="/beats/winlogbeat">Winlogbeat</a> was installed on all endpoints and configured to ship Windows event logs, PowerShell logs, and <a href="https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon">Sysmon</a> events to <a href="/elastic-stack">Elasticsearch</a>. We used Olaf Hartong's popular <a href="https://github.com/olafhartong/sysmon-modular">sysmon-modular</a> configuration with Sysmon</li>
	<li><a href="/beats/packetbeat">Packetbeat</a> was installed on all endpoints to ship network events to Elasticsearch</li>
	<li>All events were shipped to Elasticsearch running in an <a href="/cloud/">Elastic Cloud</a> cluster</li>
	<li>Participants utilized <a href="/kibana">Kibana</a> to search and visualize the events indexed in Elasticsearch</li>
	<li>A <a href="https://ctfd.io/">CTFd</a> platform was setup for participants to submit flags and score points during the event</li>
</ul><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt4483b0dc55e52ffb/5f31cb5f7ca22b018aed84b4/3-configure-CTF-range-blog-capture-the-flag.png" data-sys-asset-uid="blt4483b0dc55e52ffb" alt="" style="display: block; margin: auto; border:1px solid black">
<figcaption>Figure 3 - Overview of how we configured our CTF range
</figcaption>Once the CTF environment was configured and the logs were flowing to Elasticsearch, it was time to simulate the malicious activity of our threat actor as they worked to achieve their mission: stealing sensitive data from their target. Our team executed offensive techniques across the <a href="https://attack.mitre.org/">MITRE ATT&CK®</a> matrix in order to simulate attacker activity and achieve their objective.
Attacker techniques were executed using both <a href="https://github.com/LOLBAS-Project/LOLBAS">living-off-the-land</a> methods and <a href="/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql">off-the-shelf offensive tools</a> to complete objectives such as obtaining initial access to an endpoint, establishing a command and control channel, maintaining persistence, and moving laterally between endpoints. CTF participants were asked to hunt for evidence of the nefarious activity without many leads and earn points for submitting the correct flags. The winner was the first person to submit all of the correct flags.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt862241dc6591d60b/5f31cb6e7f3b7908db0322b0/4-ctfd-scoreboard-capture-the-flag.png" data-sys-asset-uid="blt862241dc6591d60b" alt="" style="display: block; margin: auto; border:1px solid black">
<figcaption>Figure 4 - Our CTFd scoreboard
</figcaption>For the benefit of people who had not used Kibana to execute queries or build visualizations before, we provided them with a brief demonstration and links to resources to jump start their threat hunting efforts. We saw a few people who were new to threat hunting with Elastic arrive on the leaderboard early on. We received positive feedback from attendees, including someone who was new to Elastic and was looking to sharpen their skills before starting a new job the following week. Congratulations again to the winner, <a href="https://twitter.com/theparanoidnerd">@theparanoidnerd</a>!
 
 <h2>How Elastic enables security teams</h2>A successful security team has implemented human processes that are aided by technology. Whether a security practitioner belongs to a threat hunting, security operations, or incident response team, they must be able to rely on both their tools and the <a href="https://en.wikipedia.org/wiki/Data_quality">quality</a> of their data.
<h3>Ensuring data quality with Beats and Elastic Common Schema</h3>To help ensure security teams have the right data available to them in Elastic Security for monitoring and detection, we have <a href="https://www.elastic.co/guide/en/beats/filebeat/7.8/filebeat-modules.html">numerous </a>Beats that can collect, normalize, and ship data directly to Elasticsearch. Each Beat comes with a variety of modules that will create the index mappings and predefined dashboards, specific to the log source.
A security team must be able to rely on the accuracy and timeliness of their data. If you don’t know which systems have logging and event forwarding enabled, which fields are available in each log and the expected data types or values for those fields, or if the schema for a data source changes unexpectedly, you cannot rely on the results of your queries.
The <a href="https://www.elastic.co/guide/en/ecs/current/index.html">Elastic Common Schema (ECS)</a> defines a common set of fields to be used when storing event data in Elasticsearch, such as logs and metrics. This may sound simple at first, but taking on the task of extracting, transforming, and loading events from multiple sources into a single destination can be a costly, time consuming, and continuous effort. Since version 7.0 of our Beats framework, the normalization of data to ECS is taken care of for you, ensuring consistency across your data and helping users execute searches effectively.
<figcaption><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltaa232bbebf5385b1/5f32c8787ca22b018aed893b/5-ECS-fields-blog-capture-the-flag-2.png" data-sys-asset-uid="bltaa232bbebf5385b1" alt="" style="display: block; margin: auto; border:1px solid black; width: 55%"></figcaption><figcaption>Figure 5 - ECS fields shown in Kibana Discover along with event filter options
</figcaption>ECS also adds <a href="https://www.elastic.co/guide/en/ecs/current/ecs-category-field-values-reference.html">categorization fields</a> to each event, allowing threat hunters to describe the data they are looking for as opposed to querying for the specific event information. For example, Windows event ID 4624 records a “Successful Logon” event. With ECS we can find it using the query <code>event.category: authentication and event.outcome: success</code>. This allows a threat hunter to search across multiple data sources without having to be concerned about the specific fields and values in each log.
<figcaption><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltebda99de5a7b19e6/5f32c94c8e1e8d4046e9f300/6-event-category-field-blog-capture-the-flag-2.png" data-sys-asset-uid="bltebda99de5a7b19e6" alt="" style="display: block; margin: auto; border:1px solid black; width: 55%"> Figure 6 - Example values for the event.category field
</figcaption><h3>Schema on write and for faster search results</h3>Elastic uses <a href="/blog/schema-on-write-vs-schema-on-read">schema on write</a> to extract the necessary fields from logs prior to storing them. With schema on write, analysts do not have to figure out how to extract fields after the fact, speeding up their queries, and dramatically increasing the value they get from their log data.
Elastic takes care of the <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.8/mapping-types.html">mapping</a> of data types to the various fields in an event. This allows for additional functionality when searching. For example, by mapping the <code>source.bytes</code> field as a <code>long</code> data type, threat hunters can use a range of numbers as opposed to a single number. If <code>source.bytes</code> was mapped to the <code>text</code> or <code>keyword</code> data type, it could not be used the same way.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt1f8964774e3b49df/5f31cb9f168ec908bebe96cb/7-winlogbeat-blog-capture-the-flag.png" data-sys-asset-uid="blt1f8964774e3b49df" alt="" style="display: block; margin: auto; border:1px solid black">
<figcaption>Figure 7 - Reviewing field mappings for the Winlogbeat index
</figcaption>Using schema on write also allows for the enriching of data with other information such as indicator of compromise (IOC) matches, user information such as department and role, and the risk level of an asset. When events are enriched, it’s easy to search for the relevant fields and help with an analyst’s situational awareness.
Figure 8 shows how <a href="https://www.elastic.co/guide/en/kibana/7.8/discover.html">Discover</a> helps users construct search queries by utilizing KQL’s autocomplete feature to suggest valid field names.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt488cb414ba2c0a3d/5f31cbb18e1e8d4046e9eec9/8-kql-autocomplete-blog-capture-the-flag.gif" data-sys-asset-uid="blt488cb414ba2c0a3d" alt="" style="display: block; margin: auto; border:1px solid black; width: 90%">
<figcaption>Figure 8 - Using KQL’s autocomplete feature
</figcaption>After choosing a field to include in a query, KQL’s autocomplete asks the user what operator they would like to use with the field, based on its <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.8/mapping-types.html">data type mapping</a>. For example, a numeric field type like <code>source.bytes</code> can be used with the operators, as shown in Figure 9 below.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt317c1d68ac8d77a5/5f31cbbec9ec57071816e76b/9-numeric-field-types-blog-capture-the-flag.jpg" data-sys-asset-uid="blt317c1d68ac8d77a5" alt="" style="display: block; margin: auto; border:1px solid black; width: 90%">&nbsp;<figcaption>Figure 9 - List of operators that can be used with the numeric field type, source.bytes
</figcaption><h2>Detecting malicious behavior with Elastic Security</h2>Elastic Security builds on the power of the Elastic Stack to deliver out-of-the-box capabilities that help security operations teams do their jobs more effectively. For example, Elastic Security has 140+ prebuilt <a href="https://github.com/elastic/detection-rules">detection rules</a> to alert on attacker behavior on endpoint, network, and cloud platforms. All detections are mapped to the relevant ATT&CK techniques and include useful references to help analysts triage and investigate alerts. Users also have the option to create their own rules and we are always excited to work alongside members of the community to help with and accept their <a href="https://github.com/elastic/detection-rules/blob/main/CONTRIBUTING.md">contributions</a>.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltf4319b5921db4cb3/5f31cbc9c9ec57071816e76f/10-alerts-detection-rules-blog-capture-the-flag.png" data-sys-asset-uid="bltf4319b5921db4cb3" alt="" style="display: block; margin: auto; border:1px solid black">
<figcaption>Figure 10 - Alerts generated by detection rules in Elastic Security
</figcaption>Analysts can drag and drop fields of interest into the Timeline for further investigation. Data from multiple indices, or data sources, can be added to Timeline, which enables analysts to organize leads and investigate complex threats.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt35f269fc1ab7657a/5f31cbd69af97004e7f63d58/11-timeline-blog-capture-the-flag.gif" data-sys-asset-uid="blt35f269fc1ab7657a" alt="" style="display: block; margin: auto; border:1px solid black">
<figcaption>Figure 11 - Using Timeline in Elastic Security to investigate schtasks.exe creation events
</figcaption> 
<h2>Conclusion</h2>In this post, we shared some details about the threat hunting CTF event that Elastic Security delivered for <a href="https://twitter.com/BSidesSATX">BSides SATX</a> using free and open technologies. Thank you to all of the BSides organizers and participants that made the virtual conference a success.
We also discussed how the Elastic Stack enables threat hunting and how Elastic Security can help security operations teams with their monitoring and detection efforts to protect their organization’s data from attack.
If you’re interested in learning more about Elastic Security, you can <a href="/security">download for free</a> or sign up for a free 14-day trial of <a href="/cloud/">Elastic Cloud</a>.

blog-banner-ctf-maze.png

blog-thumbnail-ctf-maze.png

Threat hunting capture the flag with Elastic Security: BSides 2020

Start free trial

Blog Footer CTA

Sign up for Elastic Cloud free trial

headshot-neil-desai-300x300.jpg

Security Specialist

Neil Desai

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_self">Terms of Service</a>, and you agree to receive the <a href="/legal/privacy-statement#how-we-use-the-information" target="_self">selected communications</a> at the contact details you provided above. See <a href="/legal/privacy-statement/" target="_self">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Communication Preferences - ONLY for /communication-preferences

Durch das Absenden erklären Sie, dass Sie unsere <a href="/de/legal/elastic-cloud-account-terms" target="_self">Nutzungsbedingungen</a> gelesen haben und mit ihnen einverstanden sind und dass Sie Elastic erlauben, <a href="/de/legal/privacy-statement#how-we-use-the-information" target="_self">ausgewählte Nachrichten und Informationen</a> an die oben von Ihnen bereitgestellten Kontaktangaben zu senden. Weitere Informationen, darunter auch dazu, wie Sie Ihre Einwilligung zurückziehen können, finden Sie in der <a href="/de/legal/privacy-statement/" target="_self">Datenschutzerklärung von Elastic</a>.

By submitting you acknowledge that you've read and agree to our <a href="/legal/serverless-preview-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Serverless GDPR Text

Durch das Absenden erklären Sie, dass Sie unsere <a href="/de/legal/serverless-preview-terms" target="_self">Nutzungsbedingungen</a> gelesen haben und mit ihnen einverstanden sind und dass Sie Elastic erlauben, bezüglich unserer zugehörigen Produkte und Dienstleistungen und unter Nutzung der von Ihnen oben bereitgestellten Kontaktangaben <a href="/de/legal/privacy-statement#how-we-use-the-information" target="_self">mit Ihnen in Kontakt zu treten</a>. Weitere Informationen, darunter auch dazu, wie Sie Ihre Einwilligung zurückziehen können, finden Sie in der <a href="/de/legal/privacy-statement/" target="_self">Datenschutzerklärung von Elastic</a>.

By submitting you agree to <a href="/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud Terms of Service</a>. Your personal data will be processed in accordance with <a href="/legal/privacy-statement">Elastic's Privacy Statement</a>.

Cloud Trial GDPR Text

Beim Absenden akzeptieren Sie die <a href="/de/agreements/global/cloud-services-monthly" rel="nofollow">Nutzungsbedingungen von Elastic Cloud</a>. Die Verarbeitung Ihrer personenbezogenen Daten unterliegt der <a href="/de/legal/privacy-statement">Datenschutzerklärung von Elastic</a>.

By submitting you acknowledge that you've read and agree to our <a href="/legal/terms-of-use" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Newsletter GDPR Text

Durch das Absenden erklären Sie, dass Sie unsere <a href="/de/legal/terms-of-use" target="_self">Nutzungsbedingungen</a> gelesen haben und mit ihnen einverstanden sind und dass Sie Elastic erlauben, bezüglich unserer zugehörigen Produkte und Dienstleistungen und unter Nutzung der von Ihnen oben bereitgestellten Kontaktangaben <a href="/de/legal/privacy-statement#how-we-use-the-information" target="_self">mit Ihnen in Kontakt zu treten</a>. Weitere Informationen, darunter auch dazu, wie Sie Ihre Einwilligung zurückziehen können, finden Sie in der <a href="/de/legal/privacy-statement/" target="_self">Datenschutzerklärung von Elastic</a>.

Explore similar demos

Overview

Speakers

Close

See more insights

The content on this page is not available in the selected language. As Elastic grows globally, we continue to support content in multiple languages.

The content on this page is not available in the selected language.

Der Inhalt dieser Seite ist in der ausgewählten Sprache nicht verfügbar. Wir bei Elastic arbeiten daran, die bereitgestellten Inhalte in verschiedenen Sprachen anzubieten. Bis dahin bitten wir Sie um etwas Geduld und hoffen auf Ihr Verständnis!

Author

Watch now (no PT)

Watch now

See all top stories

All (no PT translation)

Contact information

Press Release

Share on Reddit

Articles by

Share this story

Share by Email

Thank you for your interest!

Contact Info

Follow us on Youtube

Load More

Share on LinkedIn

Follow us on LinkedIn

Search Integrations

All Solutions

Video for

Follow us on Twitter

See when this webinar starts in my time zone

Register to Watch

Register now

See All Posts

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content

Sie können nicht dabei sein? Registrieren Sie sich, damit wir Ihnen die Aufzeichnung zukommen lassen können. Außerdem erhalten Sie eine E‑Mail mit Begleitmaterial.

Small image for

On-demand webinar

Featured webinar

Register to Attend

Share on Facebook

Reset all

Upcoming webinar

View more posts

Print

Hosted by

Sign In to Attend

View next

Follow us on Facebook

Share

Highlights

Learn More

Read less

You'll also receive an email with related content

Wir schicken Ihnen zudem relevante Informationen, die von Interesse sein könnten.

Thank you for registering. We will send you a confirmation email soon.

Vielen Dank für Ihre Registrierung. Sie erhalten in Kürze eine Bestätigungs-E‑Mail von uns.

Author

Articles by Neil Desai

Security Specialist, Elastic

Threat hunting capture the flag with Elastic Security: BSides 2020