Back in the day, blocking a single IP address was enough to make us feel like knights defending a medieval castle. You'd find a malicious IP, throw it into the firewall, and sip your coffee in peace. But what about now? Today, attackers rotate IPs every five minutes and hide their infrastructure behind massive cloud services like Cloudfront, Azure, or AWS. So here is my question: We’ve finally stopped trusting 8-character passwords, but do we actually trust the thousands of 'threat feed' indicators hitting our screens every day? Or are we just digital hoarders?
Look, buddy, if you're blindly feeding 'Threat Intel' into your SIEM and getting a dopamine hit every time a red light blinks on your dashboard, you're mostly just creating noise. In today’s world, Cyber Threat Intelligence (CTI) has evolved from static lists into behavioral analysis. Let’s look at how we can handle this more intelligently at testCompany and how we can climb David Bianco’s famous 'Pyramid of Pain' without breaking too much of a sweat.
The Pyramid of Pain: Why Does It Hurt?
You probably remember the pyramid. At the very bottom, we have Hash values and IP addresses. Blocking these is 'Trivial'—total child's play. But for an attacker, changing them doesn't even take a second. At the very top, we have TTPs (Tactics, Techniques, and Procedures). This is the attacker's backbone. If you can detect how an attacker performs obfuscation via PowerShell or how they execute a Reflective DLL Injection in-memory, you’ve essentially ended the game for them. Changing these techniques requires weeks of new training and code development on their end.
From Theory to Practice: Behavioral Detection (Sigma Rules)
Instead of just staring at a 'bad_ip.txt' file, how do we catch anomalies in our system? This is where Sigma rules come into play. Sigma is like a common signature format for logs. Let’s say an attacker is trying to perform Lateral Movement within testCompany servers. They will likely use a tool similar to psexec. But we shouldn't just look for the filename psexec.exe because they can easily rename it to harmless.exe. We need to look at the behavior.
Check out this defanged Sigma rule draft:
title: Suspicious Process Execution via Mock-PsExec
status: experimental
description: Detects execution of tools that behave like PsExec but with different names.
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 1
Image|endswith:
- '\harmless.exe' # Defanged: normally psexec.exe
CommandLine|contains:
- ' -s ' # Parameter to run with System privileges
- ' -i ' # Interactive session
- ' \\\\' # Remote machine access attempt
condition: selection
fields:
- CommandLine
- ParentImage
falsepositives:
- Admin_Scripts.ps1
level: high
This rule doesn't care about the file name; it focuses on the intent. By monitoring specific command-line arguments and execution patterns, we make life much harder for the adversary. This is the difference between just collecting data and actually performing intelligence-led defense.