00:00

Introduction to MISP: Malware Information Sharing Platform Overview

Andres Elliku, a SecOps engineer, introduces MISP as a platform for sharing malware information, incident response, and data classification for effective defense. The agenda covers setting up MISP, creating events, utilizing galaxies and taxonomies, and emphasizing quality over quantity in information sharing. With practical guidance on installation and utilization, the talk emphasizes building trust within communities to enhance cybersecurity practices.

ciuciu
Télécharger la présentation

Introduction to MISP: Malware Information Sharing Platform Overview

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Introduction to MISP Jeffney Hoogervoorst

  2. $WHOAMI ● Andres Elliku ● SecOps engineer at TransferWise ● Previously Cyber Security Expert at CERT-EE ● SysAdmin before that, mostly focusing on Windows ● Occasional client-side Red Teamer at various exercises ● https://github.com/haam3r ● https://twitter.com/haam3r

  3. Agenda What is MISP Getting up and running Creating events Galaxies Taxonomies Sharing Automation ● ● ● ● ● ● ●

  4. Malware Information Sharing Platform

  5. Use cases Incident response Sharing ○ IoC-s ○ Vulnerabilities ○ Information leaks (AIL) Storage, aggregation and correlation Consuming for defense (Firewalls & IDS sensors) ● ● ● ●

  6. Quality over quantity Make an effort to minimize the amount of false positives ● Classify data (taxonomies & galaxies) so others understand the context ● Share as widely as you can ● Build trust ●

  7. Existing communities CIRL ○ ○ ○ ○ FIRST.org’s MISP community Ad-hoc exercise communities ● Private sector community CSIRT community Financial sector community ... ● ●

  8. Getting up and running https://www.circl.lu/doc/misp/

  9. Playground https://misp.elliku.ee ● OAS 1: ○ ● User: oas1@example.com OAS 2: ○ ● User: oas2@example.com OAS 3: ○ ● User: oas3@example.com Password: OASTra1n1ng! ●

  10. Installation Script based ○ https://misp.github.io/MISP/ ● Docker based ○ https://github.com/MISP/misp-docker ● Pre-built VM (for testing and training) ○ https://www.circl.lu/services/misp-training-materials/#misp-virtual-machine ●

  11. Events,Attributes & Objects

  12. Events Event ~= Case 1 event is comprised of 1 one more attributes and/or objects ● ●

  13. Attributes Asingle IoC Part of an event ● ●

  14. Objects An object is a combination of multiple attributes ●

  15. Galaxies Classify events Meant for human consumption Some existing galaxies: ○ Threat-Actor ○ MITREATT&CK ○ Exploit-Kit Key-value pairs Easy to create ● ● ● ● ●

  16. Sharing

  17. Sharing Your organization only This Community only Connected communities All communities Sharing group ● ● ● ● ●

  18. Automation For production systems consider advanced authkeys ● NIDS rules ● MISP modules - https://github.com/MISP/misp-modules ● https://github.com/MISP/PyMISP - Python library to access MISP ● ● curl --header "Authorization: YOUR API KEY" --header "Accept: application/json" --header "Content-Type: application/json" https://<misp url>/

  19. Credits ● https://www.circl.lu/services/misp-training-materials/ • Aka the awesome people at CIRCL-LU who in addition to making an awesome tool, provide extensive training materials as well

  20. Introduction to MISP Jeffney Hoogervoorst

More Related