DNS is just part of our landscape
when it comes to security.
We've already talked a little bit
about how DNS could be leveraged to exfiltrate data.
But we could also talk about how we could investigate
DNS patterns in order to find out how an attacker may
be attempting to attack us.
And what types of threats they could carry out.
Even how their files or their execution patterns
are being communicated outbound towards the attackers
infrastructure.
Using things like Cisco AMP with Threat Grid in conjunction WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Using things like Cisco AMP with Threat Grid in conjunction
with the Cisco Umbrella product, we
can leverage one of the features called Cisco Umbrella
Investigate to get an entire picture of how a threat could
be carried out against us.
And including, what does their infrastructure look like?
What are they going to be communicating to?
What are the malicious domains or the IP addresses
that are also going to be part of this attack as well?
Let's talk more about Cisco Umbrella Investigate.
Now, thanks to the power of Cisco's dCloud,
we can actually see Cisco Umbrella in action. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can actually see Cisco Umbrella in action.
This is one of the cooler things about the analytics platforms
and the reporting platforms within Cisco
is they give us great resources to actually test drive
these products, like dCloud.
I think the D actually stands for demo, for demo Cloud,
so that you can demo these products.
So if you see on the screen right here,
I've got this particular Umbrella version 2.1
Instance Demo spun up.
This is the URL, you do have to get logged in,
and then you want to click this view button right here
and it will launch you straight into the dCloud environment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and it will launch you straight into the dCloud environment.
Which looks like this.
This is Cisco Umbrella.
You get to see it in action now at this particular point.
And what I like to see is I like to see right here
we've got some malware attempts, 2,105 requests
blocked in the last 24 hours.
We've got Command and Control, that's those C&C items where
they're trying to use tunnels to command and control
what the malware is doing.
There's also cryptomining requests
that have been going on in our environment.
So if we want to investigate-- that's what we're really here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we want to investigate-- that's what we're really here
to talk about is the Umbrella Investigate product--
we can dig in to what these types of threats really do.
So let's go into cryptomining real quick
and see the view details.
And look at the threats that have been stopped
thanks to Cisco's Umbrella.
Well, I see exactly which identity
or where this is being located.
And what policies and rules are being triggered here.
And I also see exactly what the destination is
that they're trying to go to.
So when I see minergate.com, that makes me think, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So when I see minergate.com, that makes me think,
OK, well clearly this is the cryptomining threat
that they're talking about and it's
trying to go to minergate.com.
So somebody has installed some sort of application
in their environment that's trying
to do some low, lightweight cryptomining behind the scenes
so that they can use our resources to gain
cryptocurrency.
So let's do this.
Let's try and dig in to Miner Gate by investigating.
So I'll go to the Investigate section
right here on the left hand side.
And you can see we can now do some searches based WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And you can see we can now do some searches based
on hostname, URL, Autonomous System Number, IP address,
hash, or an email address.
So I'll say minergate.com and click Investigate.
OK, so it tells me some things about MinerGate.
First of all, it's kind of a low risk.
It is in the cryptomining category.
I can even look at the security indicators
here and look for any unusual patterns
or any unusual keywords.
Just some different categories and scores
that we have here within the specific domain name. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we have here within the specific domain name.
But then I see the number of DNS queries
that have been happening in my environment,
again, for the last month.
I think that's going to be an important one to see
is what kind of query volume have we
had for the past month for this specific URL?
And down here, we can actually see an entire timeline
of the history of this domain.
This little blue box right here is indicating our timeline
that we're viewing above and then
this yellow bar here shows the security categories that have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this yellow bar here shows the security categories that have
existed since actually, 2017.
So when I hover over this, we see
that dating all the way back to October 11, 2017 this category
was potentially harmful.
And that's what that yellow is indicating to us.
Anything yellow is potentially harmful.
Interestingly, we can see some DNS resolution information.
So when we try to go to minergate.com,
it shows me here is the IP addresses that it resolves to.
But these IP addresses are the ones
that are potentially harmful.
I think that's pretty interesting.
And then we can also see when we first saw that IP address, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we can also see when we first saw that IP address,
as well as when we last saw that IP address--
notice this is paginated.
So we can go through a list of pages
that these IP addresses resolve to.
We get the who is information, so that we can investigate who
owns this domain potentially.
And then we can also get some more geographic information
regarding the distribution of requests for the specific IP
address.
Notice the list of geographies that we're looking at here.
Turkey, Brazil, Nigeria, and Russia--
these don't necessarily have the best reputation when WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
these don't necessarily have the best reputation when
it comes to network traffic and being
destined for a specific domain.
Now, this is where it gets really interesting.
The associated samples and the threat scores.
We can see that there are some types of threats like Trojans,
which have a maxed out threat score of 100
that this domain is associated with.
In other words, when these types of threats or Trojans
or malware make their way into our environment,
that's when we start seeing the spike in traffic
to minergate.com. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to minergate.com.
Because these attacks are all about using your computing
resources to mine cryptocurrency into this pool
of minergate.com.
So you can see with the Investigate button
we can get into a lot more detail about
how this particular URL or autonomous system or IP address
fares against the community, what
is the overall summary of it, and what
is our traffic and destination traffic look like.
Beyond that, we can also see what kind of threats WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Beyond that, we can also see what kind of threats
are associated with the URL IP address,
and so on thanks to the Cisco Umbrella.
Again, consider the fact that this is all part of the threat
intelligence community.
So this is constantly learning and constantly evolving
and therefore, constantly protecting your environment.
That's why you're interested in products like this,
because they constantly evolve and can stop these zero day
attacks from occurring even using that retrospective
analysis.
So that's been introducing the Cisco Umbrella Investigate WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that's been introducing the Cisco Umbrella Investigate
product.
I hope this has been informative for you,
and I'd like to thank you for viewing.