Could We Detect Titan Rain Today?
How advanced tools and threat modeling can make a difference in 2024.
A few weeks ago, we explored Titan Rain, a years-long series of intrusions by APT-1 targeting NASA. The key takeaways were clear: early detection is vital, advanced defensive measures are necessary, and inter-organizational collaboration is critical.
Today, let's explore how we might detect Titan Rain sooner if it happened again in 2024. Would it still take over a year to detect? And what can we do now to improve our defenses?
Understanding the Threat: APT-1 and Their Tactics
Before diving into detection strategies, let's consider the tactics APT-1 uses to gain access and move undetected:
Legitimate Software and Valid Credentials: Attackers use remote monitoring tools and valid user credentials to blend in with normal system activity.
Living Off the Land Techniques: Hackers abuse built-in system tools, hiding their activities among normal processes.
Sophisticated Evasion Tactics: Techniques like obfuscation, masquerading, disabling security tools, and modifying registry entries.
Exploiting Gaps Between Enterprise and Cloud Security: Attackers exploit disconnects in visibility between on-premise and cloud environments.
Using Anonymity Tools: Proxy servers, Tor, and encryption mask hackers’ identities and locations.
Slow and Stealthy Movements: Sophisticated hackers move slowly through systems over long periods to avoid raising alarms.
Exploiting Human Error: Social engineering and phishing tactics allow hackers to gain access through legitimate means that are hard to detect.
Detecting Titan Rain Today
If Titan Rain were to happen today, advanced detection technologies and methodologies would be our first line of defense. A critical technique is detecting Living Off the Land (LOTL) activities. LOTL enables adversaries to dwell inside your network undetected and move towards their objective.
Living Off the Land Detection Spotlight: PsExec
PsExec is a legitimate remote administration tool from the Sysinternals suite, allowing users to execute processes on remote systems. Attackers like APT-1, during Titan Rain, exploited PsExec to:
Execute Commands Remotely: Install backdoors, move laterally, and maintain persistence.
Escalate Privileges: Gain higher-level access to sensitive data.
Exfiltrate Data: Deploy additional tools to locate and exfiltrate sensitive information.
Attackers prefer using tools like PsExec over custom exploits because they blend in with regular administrative activity, making detection much harder. When Titan Rain occurred, organizations had limited capabilities to detect PsExec, relying primarily on basic antivirus and manual log reviews, which were insufficient for identifying such sophisticated techniques.
What Detects Malicious PsExec Use Today?
EDR Solutions: Tools like CrowdStrike or Windows Defender monitor and alert on unusual behavior of legitimate tools.
Behavioral Analytics: Analyzing system tool behavior compared to a baseline to identify anomalies.
Threat Intelligence Feeds: Integrating threat intelligence to provide context to alerts and prioritize known malicious activity patterns.
Relating this to Today’s Tech Stack
Considering the entire attack chain used during Titan Rain and comparing detection times between the 2000s and today shows significant improvements. Note, as performance of tools varies, I’ve grouped capabilities into orders of magnitude (hours, minutes, etc).
Analysis below:
Great! So we know it’d take (in total) several hours to detect APT-1, which is a far cry from over a year…but what’s that got to do with us network defenders? Not everyone can afford the team, time and tooling that’s been flagged in the table above.
That, my friends, is where Threat Modeling comes in.
Threat Modeling
Threat modeling is a proactive approach to identifying and addressing potential threats by thinking like an adversary. Early in my career, working on threat modeling for a large weapon system helped us develop defensive capabilities. By understanding the threats, we could prioritize where and how to spend our time.
What is Threat Modeling?
Threat modeling involves:
Defining the Scope: Identifying the system or application you’re defending, including its components, data flows, and trust boundaries.
Identifying Threats: Using methodologies like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to systematically identify threats.
Evaluating Risks: Assessing the likelihood and impact of each threat.
Developing Mitigations: Implementing countermeasures to address threats.
Reviewing and Updating: Regularly updating the threat model to account for changes.
By referencing tactics used in Titan Rain and adversaries like Comment Panda, defenders can set up monitoring for abnormal use of system tools and credentials. This proactive threat modeling could have identified Titan Rain anomalies much sooner, enabling a quicker response with today’s technology stack.
Free Threat Modeling Tools
To assist in the threat modeling process, several free tools are available that provide user-friendly interfaces and robust functionalities, check them out below and (bonus points) see if you can replicate last week’s MITRE ATT&CK tree using the Navigator link.
MITRE ATT&CK Navigator: A personal favorite for the threat modeling process is the MITRE ATT&CK Navigator. MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a comprehensive knowledge base of adversary tactics and techniques based on real-world observations. It provides a framework for understanding how attackers operate, from initial access to data exfiltration.
OWASP Threat Dragon: An open-source tool that enables you to create threat models using a visual interface. It supports various diagram types and integrates with popular development tools, making it a versatile choice for security professionals. It also has an adorable dragon as its mascot…what’s not to love?!
Conclusion
If Titan Rain were to occur today, advanced detection technologies and proactive threat modeling could significantly reduce the time to detect and respond to such an attack.
While these detection methods are dramatic improvements over what was available in 2004, it's important to understand that these calculations are based on an informed threat modeling approach and a team constantly scouring your environment for advanced, persistent threats. Simply installing EDR doesn't make all of an enterprise’s problems vanish, but it does dramatically improve resilience. Unfortunately, not everyone can afford best-in-class security solutions. That’s why we have threat modeling.
Threat modeling helps teams speed up their detection and investigation by providing context around the threats they are attempting to defend against. With what we know about Titan Rain, organizations like NASA could use threat modeling to detect similar activity much sooner. You can now use threat modeling, today, to prepare your organization for threats most relevant to you.
By leveraging tools like the MITRE ATT&CK Navigator and, if you can, incorporating robust threat intelligence and detection capabilities, organizations can stay ahead of sophisticated adversaries. We’ll be digging into the MITRE ATT&CK Navigator in a few weeks.
For now stay secure and stay curious, my friends!
Damien