Defense Evasion: How Defenders Can Detect and Disrupt Intrusions
Summary
The article offers practical guidance for detecting defense evasion through layered security, monitoring system and account changes, proactive threat hunting, and testing incident response plans.
Key points
- Prioritize foundational controls such as patching, asset inventory, MFA, backups, and reducing internet exposure, including closing RDP to the internet.
- Monitor for malicious files and unexpected system or account changes, which may reveal activity even when attackers evade other defenses.
- Use security telemetry and tools such as Sysmon, Wazuh, and Elastic to gather, query, and alert on activity.
- Apply stronger protections to critical systems and sensitive data, while tailoring controls to the importance and limitations of each asset.
- Use proactive threat hunting and honey-based traps to look for activity that alerts may miss and to surface adversary behavior.
- Practice threat containment, machine isolation, account remediation, and backup restoration; use collaborative exercises to identify and improve detection gaps.
Article Details
- Defense Focus
- Detect defense evasion by monitoring the impact of adversary activity, especially malicious files, anomalous system or account changes, and activity involving processes, persistence, or network communications.
- Detection Methods
- Monitor for malicious files dropped on disk.
- Alert on system and account changes that do not match expected activity, including changes involving privileged accounts or disabled defenses.
- Hunt across process, persistence, and network activity for behaviors consistent with intrusion, remote control, or beaconing.
- Use honeypot-based traps to alert on suspicious interaction.
- Test and tune detections through collaborative adversary emulation, investigating missed activity and false positives.
- Data Sources
- Sysmon telemetry
- Windows Event Logs, collected through WEC and WEF
- Antivirus alerts
- Process and persistence activity
- Network communications
- File creation and system or account changes
- Platforms
- Windows endpoints and servers
- Active Directory environments
- Domain controllers
- User workstations
- Defensive Actions
- Maintain patch management and an inventory of internet-exposed machines and other assets.
- Harden Active Directory and close Remote Desktop Protocol access from the internet.
- Deploy multifactor authentication and monitor for suspicious authentication behavior.
- Restrict applications with allow-listing and apply tighter PowerShell restrictions to high-value systems.
- Enable relevant event logging and expand log retention where appropriate.
- Use a tiered protection model for critical systems, including domain controllers, backup servers, and internet-facing servers.
- Monitor for data exfiltration and maintain tested backups.
- Practice threat containment and machine isolation; rehearse account-level threat removal and backup restoration.
- Run tabletop incident simulations and test security controls through collaborative adversary emulation.
MITRE ATT&CK
People
Anthony SmithHuntress colleague whose threat-hunting guidance the article references.Casey SmithCited as a source of guidance about honey-based security projects.Chris SandersCited for threat-hunting guidance and advice on deploying traps.Dray AghaAuthor of the article.IppsecCited as a source of guidance about honey-based security projects.Rob NoethHuntress Principal Software Engineer interviewed about Process Insights and its approach to detecting attacker behaviors.
Vendors
Products
Huntress Neighbourhood Watchon security telemetry in your network (like Sysmon, Wazuh, Elastic’s stack, and I’mma include Huntress Neighbourhood Watch because it’s dope).Wazuhthat will allow you to gather, query and alert on security telemetry in your network (like Sysmon, Wazuh, Elastic’s stack, and I’mma include Huntress Neighbourhood Watch because it’s dope).Windows Sysmontechnologies that will allow you to gather, query and alert on security telemetry in your network (like Sysmon, Wazuh, Elastic’s stack, and I’mma include Huntress Neighbourhood Watch because it’s dope).
Tools
MimikatzIn your network, I see way too many `ransomware.exes` and mimikatz binaries pulled straight from Github for any of you to be worried about the polymorphic quantum C3 malware that your security product says it can thwart.PowerShellallow/deny listing isn't too shabby when you can deploy via Group Policy. And what about giving PowerShell a lil shackling down, too, while you’re here? Whilst you’re at it, would you give your Event Logs somePsExecSecurity product X just told you there’s lateral movement with the humble PsExec. What you doing now, chief?