Black Hat Asia 2023 NOC: XDR (eXtended Detection and Response) in Motion

Black Hat Asia 2023 NOC: XDR (eXtended Detection and Response) in Motion


The core mission within the Community Operations Middle (NOC) is community resilience. We additionally present built-in safety, visibility and automation: a SOC (Safety Operations Middle) contained in the NOC, with Gifter and Bart because the leaders.

Partly one, Black Hat Asia 2023 NOC: Connecting Singapore, we lined the community:

  • Designing the Black Hat Community
  • AP (Entry Factors) Placement Planning, by Uros Mihajlovic
  • Safety Middle Investigations, by Uros Mihajlovic
  • Meraki and ThousandEyes, by Uros Mihajlovic
  • Meraki Dashboards, by Steven Fan
  • Meraki Alerting, by Connor Loughlin
  • Meraki Programs Supervisor, by Paul Fidler
  • A Higher Technique to Design Coaching SSIDs/VLANs, by Paul Fidler

Partly two, we concentrate on safety:

  • Integration is Key to Safety
  • Integrating Safe Cloud Analytics into the Black Hat Ecosystem Story, by Ryan MacLennan
  • What’s Your VPN (Digital Non-public Community) Doing within the Background, by Aditya Raghavan
  • Script Kiddie will get a Timeout, by Ben Greenbaum and Shawn Coulter
  • Correlating Meraki Scanning Information with Umbrella DNS (Area Title Service) Safety Occasions, by Christen Clauson
  • Area Title Service Statistics and Improved Visibility, by Alejo Calaoagan

Integration is Key to Safety

For Black Hat Asia 2023, Cisco Safe was the official Cellular Gadget Administration, DNS and Malware Evaluation Supplier.

Because the wants of Black Hat developed, so did the Cisco Safe Applied sciences within the NOC:

The Cisco XDR dashboard made it simple to see the standing of every of the linked Cisco Safe applied sciences, and the Meraki APs for the community.

Since becoming a member of the Black Hat NOC in 2016, I regularly advocate for integration and automation. Black Hat 2023 was essentially the most built-in NOC to this point.

This requires collaboration and open communication with the NOC companions.

Under are the Cisco XDR integrations for Black Hat Asia, empowering analysts to analyze Indicators of Compromise (IOC) in a short time, with one search.

The integrations comprised two screens. So as to add an integration, we merely click on on the module within the record under after which add the API (Utility Programming Interfaces) key.

We recognize, Pulsedive and Recorded Future donating full licenses to the Black Hat Asia 2023 NOC.

File Evaluation and Teamwork within the NOC

Corelight and NetWitness extracted a number of PDFs from the convention community stream, which have been despatched for evaluation in Cisco Safe Malware Analytics (Risk Grid). Within the glovebox video, they have been noticed as quotes from an Audio-Visible rental firm vendor working on the Black Hat convention. The quotes contained private and proprietary enterprise info, which might make it fairly simple to craft spear phishing assaults towards each the rental firm and the purchasers.

Investigation by the Corelight workforce decided the consumer downloaded the primary file by way of HTTP from an unsecure portal [http://imxx[.][.]sg/login/login[.]cfm], with login credentials within the clear.

Then they emailed by way of unsecure SMTP protocol to the shopper. The Palo Alto Firewall workforce confirmed the SMTP e mail and recordsdata.

The NetWitness workforce reconstructed the emails. The NOC workforce created a findings report for the seller, to help them in securing their webserver and switching to a safe e mail protocol.

Integrating Safe Cloud Analytics into the Black Hat Ecosystem Story, by Ryan MacLennan

For Black Hat Asia, Cisco was ready so as to add Safe Cloud Analytics (SCA) into the combination as a community analytics platform, to assist enrich and supply an extra layer of safety to the Black Hat convention.

To start our deployment, we first wished to deploy the brand new Cisco Telemetry Dealer (CTB); nonetheless, this may increasingly have induced points with useful resource administration on our Intel NUC that was offering different vital infrastructure. To alleviate any useful resource administration points we may run into, we deployed a light-weight on-prem community sensor as an alternative of CTB. At future conferences, we shall be utilizing one other NUC with CTB deployed, as that’s the really useful method to ship on-prem community knowledge to SCA.

After deploying the on-prem sensor we labored with the Arista workforce to get us a community faucet and enabled our Meraki MXs to ship Netflow knowledge to the sensor.

With us getting knowledge from Arista for something getting in or out of the community and Meraki offering NetFlow knowledge on inner connections, we may then use the Umbrella and Meraki SCA integrations to counterpoint the community analytics inside SCA.

With these two integrations enabled we began seeing the details about every host and noticed the judgements of domains and URLs these hosts go to inside SCA.

We added personalized alerts for notification, added third social gathering menace intelligence lists, configured international locations we wish to watch, and added teams of categorizations of our community to inform when sections of our community discuss to one another once they shouldn’t be doing so.

After these configurations have been put in place, we have been now capable of begin getting significant alerts about what is occurring in our community. Within the picture under, you possibly can see that we’ve got gotten a number of alerts throughout the convention and responded to every with an investigation.

After these configurations have been put in place, we have been now capable of begin getting significant alerts about what is occurring in our community. Within the picture under, you possibly can see that we’ve got gotten a number of alerts throughout the convention and responded to every with an investigation.

What’s your VPN Doing within the Background, by Aditya Raghavan

Safe Cloud Analytics was setup with integrations to 3rd social gathering watchlists, like OSINT (Open-Supply Intelligence) Risk Feed, Rising Risk Compromised IPs and Blocklist DE, along with the built-in Talos menace feed. Safe Cloud Analytics flagged a Consumer Watchlist Alert detecting uncommon site visitors to an IP on the Blocklist DE record, highlighting the weird site visitors measurement of simply 60 bytes to and from the watchlist IP which appeared like malware beaconing.

We dug down deeper with our companions.

The Palo Alto Networks workforce confirmed this site visitors on the firewall, which helped figuring out the endpoint sourcing this site visitors. Safe Cloud Analytics additionally flagged quite a few Geographic Watchlist Observations of the identical site visitors from that endpoint to varied international locations the world over, so we noticed repeated such habits. The Corelight workforce was capable of pinpoint this site visitors to a single ICMP ping and response from the consumer endpoint. The hosts producing it have been flagged by Corelight as VPNInsights::PIA.

Primarily based on our evaluation, we have been capable of pinpoint this site visitors being produced by Non-public Web Entry (PIA) VPN shopper on the consumer endpoint. This VPN software was seen to ship pings to hundreds of IPs throughout the whole world each 60 seconds, to check latency to the VPN headend servers.

Ultimately, we discovered the underlying explanation for the bizarre site visitors that appeared like malware going to thousand IPs the world over, and decided it was nothing malicious.

Script Kiddie will get a Timeout, by Ben Greenbaum and Shaun Colter

One attendee tried to paint outdoors the traces and needed to be reminded that (by the ability of the XDR method, enabled by integration with a number of companions) the NOC sees all. Safe Cloud Analytics warned us, by way of Cisco XDR, about potential port scanning habits emanating from the convention community towards the skin world.

Inside a couple of minutes, analysts of the NOC companions have been all alerted about totally different exercise towards outdoors, “actual world” targets, all from the identical host: Log4j exploitation makes an attempt, WordPress assaults towards a widely known restaurant chain, SQL injection and different assaults towards a outstanding cost processor, and plenty of others.

The incident of Suspected Port Abuse on an Exterior goal, moved to the highest of the Incidents.

The Incident Description offered extra info to collaborate with the NOC companions.

The collated occasions from all related sources are detailed within the XDR Detections web page under.

Community detection is a foundational pillar of safety consciousness and was the primary telemetry extensively out there to safety operators for a cause. The supply of the scanning exercise was a tool on the overall convention attendee Wi-Fi and due to this fact not more likely to be related to any ongoing coaching. We investigated the system’s community exercise and located that the scanning comprised over 50% of their whole community site visitors at the moment. The scans focused precisely 1000 distinctive ports between 1 and 65389, and included all the standard service ports in addition to frequent secondary choices.

The NetWitness workforce analyzed the PCAP (packet seize) of the assault.

The Palo Alto Networks Firewall workforce alerted on a number of tried exploits.

The Meraki MX Safety Staff tracked the assaults within the Safety Middle.

The Corelight assault notices additionally confirmed the assaults.

As well as, this topic was seen performing varied attack-adjacent actions, reminiscent of passive DNS analysis, CRL manipulation, HTTP scanning, port scanning and others.

The visualization in Cisco XDR helped the NOC workforce perceive the scope of the assault, whereas shifting tangential info out of direct view.

Additional evaluation in these and different instruments revealed a sample of habits that had a begin earlier within the morning, a niche of about an hour, after which roughly quarter-hour of uninterrupted excessive quantity assault exercise that signified the usage of automation.

Whereas there are a lot of issues this workforce is tasked to look at however not intrude with, the Black Hat Code of Conduct expressly forbids attacking outdoors targets from anyplace inside the Black Hat community. We offered Palo Alto Networks Firewall workforce with the attacker’s MAC tackle, who initiated a captive portal for the consumer a captive portal that politely reminded them of the Code of Conduct and ended with “if it continues we’ll come discover you”.

It didn’t proceed.

Correlating Meraki Scanning Information with Umbrella DNS Safety Occasions, by Christian Clasen

During the last three Black Hat occasions, we used Meraki scanning knowledge to get location knowledge for particular person shoppers, as they roamed the convention. The venture has slowly developed from merely saving knowledge off to flat textual content recordsdata for future evaluation, to producing heatmaps utilizing Python Folium, to populating a database, and at last correlating Umbrella DNS safety occasions.

Because the convention grew from the pandemic-era attendance (about 20% of earlier occasions) again to full capability, we needed to make some changes to the method of ingesting the information from the Meraki streaming API. To help with different integrations, we started writing the incoming knowledge to recordsdata as an alternative of on to the database inside the Flask app. We then added a scheduled job to learn the recordsdata into the database each 5 seconds.

In previous conferences, we might manually run the scripts to generate heatmaps (.html recordsdata) for evaluation. This time, we wished the maps to be generated mechanically, all the time be up-to-date and be out there to everybody over an internet service. So, we created a brand new module that might host one other Flask net app. Within the module, we outlined the bounds of every day in epoch time, and scheduled a job to create the maps each 5 minutes:

A map for every day was then generated and dropped into the “/templates” folder. By utilizing the “render_template()” perform, it shows the heatmap within the browser when navigating to the suitable path. For instance, we may make a request to https://webserver/wed and be served the heatmap for Wednesday, 10 Could:

This manner, anybody within the NOC may open the trail to the present day of their browser and see the most recent map as much as the earlier 5 minutes. However we didn’t wish to should manually refresh the web page to get the most recent map, so we added some JavaScript that might immediate the browser to refresh. First, we added a hyperlink to “refresh.js” within the map HTML:

Then we added a easy window refresh within the file, situated within the “templates” listing:

Area Title Service Statistics and Improved Visibility, by Alejo Calaoagan

Since 2018, we’ve got been monitoring the DNS stats on the Black Hat Asia conferences. This yr’s attendance noticed effectively over 6.2 million whole DNS queries.

This was the very best up to now for Black Hat Asia.

This yr’s Black Hat noticed over 1,100 apps hook up with the community, practically half of what was seen final yr. This was the primary time we’ve got ever seen a decline within the variety of Apps.

Ought to the necessity come up, we will block any software, reminiscent of any of the high-risk apps recognized above.

Bettering Community Visibility

At each Black Hat we assist, we’re all the time in search of methods to enhance site visitors visibility to assist us determine malicious consumer exercise extra rapidly. To facilitate higher knowledge, we labored with the community design workforce to outline every room and space of the convention flooring with their very own VLAN and subnet.

By defining subnets and VLANs for every space in use on the present, we have been now capable of determine malicious occasions by the realm the request was made. This added perception improved our knowledge high quality and helped us determine threats and developments a lot sooner inside our menace looking duties.

Trying on the safety occasions above, we see that these requests got here from one of many Black Hat coaching rooms. In years previous, we must bounce by a pair totally different consumer interfaces (Meraki/Umbrella) to validate intent and site. Now, after a fast check-in with the coaching room teacher to ensure these requests have been a part of the course curriculum, we will safely transfer on to the subsequent hunt.

Bettering visibility even additional, we labored with James Holland and the Palo Alto Networks firewall workforce to assist us uncover knowledge that’s usually masked inside Umbrella.

The savvier customers on the market might laborious code DNS on their machines to keep up some stage of management and privateness. To account for this, Palo Alto Networks NAT’ed (Community Deal with Translation) all this masked site visitors by our Umbrella digital home equipment on web site. Visitors beforehand masked was now seen and trackable inside the VLANs and subnets outlined above. This added visibility improved the standard of our statistics, supplying knowledge that was beforehand a black field.

That is what it appeared like contained in the Palo Alto Networks Firewall.

This allowed us to detect site visitors to a malicious area.

Then use Umbrella Examine to be taught extra and take acceptable motion.

That may be a wrap people, one other Black Hat Asia within the historical past books. With over 2,500 whole attendees this yr, it’s secure to say that the present was a hit. Studying from previous occasions, we’ve got really streamlined our deployment and investigative processes.

We’re pleased with the collaboration of the Cisco workforce and the NOC companions. Black Hat USA shall be in August 2023 on the Mandalay Bay… Hope to see you there!




Thanks to the Cisco NOC workforce:

  • Cisco Safe: Christian Clasen, Alex Calaoagan, Ben Greenbaum, Ryan Maclennan, Shaun Coulter and Aditya Raghavan; with digital assist by Ian Redden and Adi Sankar
  • Meraki Programs Supervisor: Paul Fidler and Connor Loughlin
  • Meraki Community: Steven Fan, Uros Mihajlovic and Jeffrey Chua; with digital assist by Evan Basta and Jeffry Handal

Additionally, to our NOC companions: NetWitness (particularly David Glover, Iain Davidson and Alessandro Zatti), Palo Alto Networks (particularly James Holland), Corelight (particularly Dustin Lee), Arista, MyRepublic and the whole Black Hat / Informa Tech workers (particularly Grifter ‘Neil Wyler,’ Bart Stump, Steve Fink, James Pope, Mike Spicer, Jess Stafford and Steve Oldenbourg).

About Black Hat

For 25 years, Black Hat has offered attendees with the very newest in info safety analysis, growth, and developments. These high-profile world occasions and trainings are pushed by the wants of the safety neighborhood, striving to carry collectively the very best minds within the trade. Black Hat conjures up professionals in any respect profession ranges, encouraging progress and collaboration amongst academia, world-class researchers, and leaders in the private and non-private sectors. Black Hat Briefings and Trainings are held yearly in america, Europe and USA. Extra info is obtainable at: Black Black Hat is delivered to you by Informa Tech.


We’d love to listen to what you assume. Ask a Query, Remark Under, and Keep Related with Cisco Safe on social!

Cisco Safe Social Channels