About jforsythe

This post was authored by Arik Day, a Palo Alto Networks Security Architect     Living Off the Land (LOTL) attacks are used by attackers to evade detection by the system's own native utilities, scripting languages, or trusted applications, rather than resorting to custom or malicious code that may raise suspicion. The use of native tools (Living Off the Land binaries, or LOLBins) also makes LOTL attacks far harder to detect via traditional detection methods.   Real world examples of how LOTL attacks are executed can be found in multiple threat research reports, like the Threat Brief: Ongoing Russia and Ukraine Cyber Activity published by Unit 42 that shows a usage of techniques that are documented in LOLBAS (Living Off the Land Binaries and Scripts) feed by WhisperGate Malware.   The report highlights the utilization of the LOLbin ‘wscript.exe’ to execute a VBS script, which in turn invokes PowerShell to establish a Windows Defender exclusion path. Wscript.exe is just one example of the many LOLbins documented in the LOLBAS feed.   The Importance of Early Detection: Preventing Damage from Living Off The Land Attacks   Since identifying LOTL attacks can be a highly complex task, these attacks can enable bad actors to persistently access systems, siphon off sensitive data, or move laterally within a network without drawing attention to themselves. To prevent data breaches and protect crucial assets, including intellectual property, personal information, and other sensitive data, from unauthorized access or exposure, it is imperative to have efficient methods in place to detect LOTL attacks.   What is the Living Off the Land Binaries and Scripts (LOLBAS) Project?   The LOLBAS project catalogs the binaries, scripts, and libraries of common operating systems that can be utilized for executing Living Off The Land techniques. Within the LOLBAS repository, all available LOLBins can be imported as tool type indicators into the Cortex XSOAR Threat Intelligence Management module (TIM) via the LOLBAS Feed Integration. Each LOLBin tool contains the following information:   LOLBin name MITRE ATT&CK reference to the relevant attack patterns LOLBin paths Detections - links to Sigma and YARA rules if they exist Commands - template of a malicious use of the tool   Fig 1: LOLBin tool indicator layout Fig 1: LOLBin tool indicator layout   Utilizing LOLBAS for Command-Line Analysis   The goal is to verify whether the provided LOLBin command line argument exhibits similarity to the known malicious patterns outlined in the LOLBAS repository. By comparing the given argument to the documented patterns of potentially harmful activities, we aim to identify any potentially malicious behavior associated with the LOLBin command. This analysis helps ensure the security and integrity of system operations by proactively detecting potential threats.   For example: Comparison between the following mshta.exe LOLBin command-line argument that is part of a security incident:   And the mshta.exe malicious argument pattern from LOLBAS:   Key Playbook Automations   StringSimilarity   The StringSimilarity automation uses the SequenceMatcher class that is part of Python’s difflib module to compare between strings and return similarity scores from 0 to 1(1 is identical). The automation outputs all of the strings that have a score equal or greater than a given threshold.   Fig 2: StringSimilarity automation Inputs   Fig 3: StringSimilarity output   Playbook - Search For Suspicious LOLBin Executions   The generic playbook “Command-line Analysis” is enhanced with the sub-playbook “Search For Suspicious LOLBin Executions”. The sub-playbook will execute the following steps:   Receive the relevant process names and process command-line arguments from its inputs Search if the Process image name exists in LOLBAS Feed Compare the provided command line arguments with the template of a malicious use in the tool from LOLBAS Feed If the similarity score is equal or greater than the given threshold, the provided command line argument will be set to the playbook outputs Finding suspicious LOLBin execution will affect the Command-Line Analysis playbook’s final verdict   Fig 4: Search for Suspicious LOLBin Executions playbook   Harnessing the power of LOLBAS for command-line analysis in conjunction with XSOAR provides a robust approach to enhancing security and detecting potential threats. LOLBAS serves as a valuable resource for documenting legitimate binaries and scripts that can be repurposed for Living Off The Land techniques. Integrating the LOLBAS feed into XSOAR's Threat Intelligence Management module allows for seamless ingestion of LOLBins as tool indicators, enabling efficient analysis and identification of suspicious command-line activities. By leveraging this combination of LOLBAS and XSOAR, organizations can strengthen their security posture and stay one step ahead of potential adversaries in the ever-evolving landscape of cybersecurity.   GLOSSARY Living Off the Land (LOTL): threat actors using legitimate system tools during an attack Living Off the Land binaries (LOLBins): The native tools used by threat actors in an attack. Living Off the Land Binaries and Scripts (LOLBAS): A catalog of the binaries, scripts, and libraries of common operating systems that can be utilized for executing Living Off The Land techniques.   ... View more

LIVEcommunity is pleased to announce the 2023-24 Cyber Elite Program!    Cyber Elite members are LIVEcommunity super-users and cybersecurity experts who are generous in sharing their insights and expertise to help others in LIVEcommunity.    Want to know how to tell who is a Cyber Elite expert? Look for the Cyber Elite trophy icon next to a username when interacting in LIVEcommunity forums.    Join Us in Welcoming Our 2023-24 Cyber Elite Experts!  ... View more

  LIVEcommunity is pleased to announce the 2023-24 Cyber Elite Program!    Palo Alto Networks launched the LIVEcommunity Cyber Elite program in summer 2020 as a way to recognize members from around the globe who demonstrate excellence in their participation and contributions to the community. The result is a small but robust team of super-users who are eager to help, supply solutions, and troubleshoot with their fellow cybersecurity professionals looking for answers in LIVEcommunity.    Want to know who's part of the Cyber Elite program? Just look for the Cyber Elite trophy icon next to a username when interacting in LIVEcommunity forums.     The Cyber Elite program has not only been a successful way to celebrate our most engaged and enthusiastic experts, but a path for encouraging interaction, information-sharing, and technical assistance among all LIVEcommunity members.    Your 2023-24 Cyber Elite Members   Please join us in welcoming the 2023-24 Cyber Elite members:    @aleksandar.astardzhiev  @SteveCantwell @OtakarKlier @MP18 @SutareMayur @BPry @Reaper @PavelK @TomYoung  @Raido_Rattameister (new!)   Thank you to these key members, whose contributions have been enumerated by the following stats from the past year:   1,280 Likes Received 2,918 Posts Published 513 Accepted Solutions   Our members are the heart and soul of LIVEcommunity, and we’re grateful to have our Cyber Elite experts onboard! Through the Cyber Elite program, the entire community is the beneficiary of their insightful technical expertise, content, and solutions — all of which help in daily problem-solving and the sharing of knowledge and valuable tips.    For more details about LIVEcommunity's Cyber Elite program and the expert members who help shape our community, visit the Cyber Elite program page.   Interested in Becoming a Cyber Elite Member? To begin your Cyber Elite journey, register in LIVEcommunity, share your knowledge and expertise, engage in discussions, provide answers, and help your peers in the community.    Thanks for being part of LIVEcommunity!   ... View more

  GlobalProtect 5.1 EoL NGFW and Prisma Access Customers running GlobalProtect 5.1.X are requested to consider upgrading GlobalProtect to 6.0.X and above. EoL dates for GlobalProtect 5.1 are published here: GlobalProtect App 5.1 End-of-Life.   Platforms affected: Windows, macOS, Linux, Android, and iOS   Feature Guide links: New Feature Guide for GlobalProtect 6.0 New Feature Guide for GlobalProtect 6.1 New Feature Guide for GlobalProtect 6.2   Addressed Issues: Addressed Issues in 6.0 Addressed Issues in 6.1   Please reach out to the Palo Alto Networks team if you have any further questions or require assistance.   GlobalProtect 5.2 EoE NGFW and Prisma Access Customers running GlobalProtect 5.2.X are requested to consider upgrading GlobalProtect to 6.0.X and above. EoE/EoL dates for GlobalProtect 5.2 are published here. Platforms affected: Windows, macOS, Linux, Android, and iOS   Feature Guide links: New Feature Guide for GlobalProtect 6.0 New Feature Guide for GlobalProtect 6.1 New Feature Guide for GlobalProtect 6.2   Addressed Issues: Addressed Issues in 6.0 Addressed Issues in 6.1 Please reach out to the Palo Alto Networks team if you have any further questions or require assistance. ... View more

LIVEcommunity is now available in a fifth language — Korean!   LIVEcommunity is excited to announce its new Korean-language community!   LIVEcommunity, the official global technical community for Palo Alto Networks, now has a dedicated Korean microsite. You can access it by selecting “Korean” from the language dropdown on the top right-hand side of our homepage (shown below). This new section of community helps us better serve employees, partners, and customers in the Asia-Pacific region and beyond by providing resources in their native language.     You can access the Korean language community by clicking Korean in the language dropdown.   LIVEcommunity is also available in Simplified Chinese, Traditional Chinese and Japanese, in addition to English and Korean. We want to thank all LIVEcommunity members across the globe for their participation.   Thank you for reading and, as always, let us know your feedback in the comments below! ... View more

The Audit Date Stamp is a new LIVEcommunity feature that lets users when an article has been reviewed for accuracy.   LIVEcommunity recently introduced a new feature to help you know when content has been reviewed for accuracy: the Audit Date Stamp.    With this latest enhancement, you can now easily identify when an article has been audited, confirming that the information current, screenshots are up-to-date, and any solutions or use cases function as expected.    As shown in the screenshot below, when a piece of content has been audited, you will see when it was reviewed and by whom.      We have already audited dozens of articles using this tool, and will continue to audit our catalog of content on a weekly basis. We hope this new feature helps you, our members, rest at ease knowing that the LIVEcommunity knowledge base is continuously being reviewed by experts and we will maintain valid, accurate, fresh content — all in effort to help you make the most of your Palo Alto Networks products.    We value your feedback and suggestions. Have an article in mind that you'd like audited? Don't hold back! Drop us a comment below and let your voice be heard.    As always, thank you for being part of LIVEcommunity. We couldn’t do it without you! ... View more

We're thanking the LIVEcommunity members who gave their valuable insights with a special badge.   LIVEcommunity recently hosted one-on-one sessions and shared a survey with members, as part of an ongoing effort to improve community experience for our 200,000+ users from around the world.  Survey Enthusiast Badge   We want to sincerely thank those who took the time to meet with us or fill out the UX survey throughout the months of April and May. And for our fabulous survey participants, you've just unlocked a super-cool new badge! This is just one fun way we want to say thank you for your awesome participation.   You Spoke and We Listened   We are thrilled to share that the feedback from a majority of our valued community members has been overwhelmingly positive! Your voices have echoed the sentiment that LIVEcommunity is truly a valuable learning resource. We appreciate your engagement and input, as it has played a vital role in shaping our continuous improvement efforts.   In response to your feedback, we have already made two exciting changes that we believe will enhance your experience. First, we have increased the number of posts displayed on all LIVEcommunity landing pages from five to fifteen. This update ensures that you can easily stay up-to-date with the most recent topics and discussions.   Secondly, we have introduced clickable clouds of top tags on each page. This new feature allows you to effortlessly explore popular content that aligns with your interests. With just a click, you'll be able to access the most relevant and engaging discussions within the community.   Top tags cloud   Your Feedback Powers Positive Change   We couldn't make these improvements without hearing from you! We are devoted to continuing to leverage your input to enhance the LIVEcommunity experience for all its visitors.  As we move forward, we’ll continue to reach out and listen to your suggestions to make this community even better.   Thank you for being an integral part of our community!   As always, if you have more ideas to share, please feel free to email us at community@paloaltonetworks.com, or leave a comment on this blog. ... View more

  Welcome to our May 2023 Rewind, where we review some of LIVEcommunity’s biggest headlines from the past month!   In May, we shared a new product page Cloud NGFW for Azure, Member Testimonials, helpful GlobalProtect 6.2 content for GP users, new PANCast podcast episodes, and more! Read on to see community’s May 2023 highlights.    New Cloud NGFW for Azure Product Page      Cloud NGFW for Azure leverages machine learning to stop more zero-day attacks than traditional security solutions. It enables you to manage network security centrally using Panorama and easily extend best-in-class security when your network extends to Azure. This is your one-stop shop for all documentation, videos, discussions, and more related to Palo Alto Networks' Cloud NGFW for Azure, a fully managed, Azure-native, next-generation firewall service.    GlobalProtect 6.2 New Features   In today's digital landscape, where remote work and connectivity are the new norm, organizations require robust and secure solutions to enable seamless access to their networks, resources, and the internet. Check out how some of the latest features introduced in GlobalProtect 6.2 excel at accomplishing exactly that.    Plus: Prisma Access 4.0 Adds Explicit Proxy Support to GlobalProtect Agent 6.2   New Member Testimonials    LIVEcommunity aims to be a helpful, easy-to-use resource for Palo Alto Networks customers. In this video series, community members from around the world share their experience on LIVEcommunity, the importance of connecting with peers in cybersecurity, and what keeps them coming back. Check out our most recent testimonials:   LIVEcommunity Member Testimonial: Tom Piens @Reaper In his interview, Tom says that the LIVEcommunity allows him to communicate with others on a human level and find solutions to problems that he might face. He observes that the community has become a platform where people can converse, share their experiences, and find answers to their questions.    LIVEcommunity Member Testimonial: Kim Wens @Kiwi Kim talks about the fast response times to questions and problems that are posted - noting that most are answered within 24 hours. This makes LIVEcommunity a first stop for many Palo Alto Networks customers and partners, as it makes it faster and easier to find an answer to their questions.   Register Now for the Code to Cloud Cybersecurity Summit!     It's bigger and better: the Code to Cloud Cybersecurity Summit returns on June 21-22 and July 11, 2023. We're gathering the most loved experts and up-and-coming voices in the cloud, DevOps and security to share their key insights and unique perspectives. Tune in to our DevOps and SecOps tracks, where you'll discover practical how-tos and visionary ideas that you can apply to your day-to-day work.   You'll be joined by thousands of your peers as you hear from 25+ speakers across 20+ keynotes, technical sessions, roundtable discussions, hands-on labs and more.   Register now for the Code to Cloud Cybersecurity Summit   2023 Attack Surface Risk, Challenges and Changes   While digitization has simplified many organizational tasks, it has simultaneously made other facets of business more complex, including an ever-growing attack surface. As the number of connected devices and online services continues to grow, identifying all of these assets and potential vulnerabilities is a challenge. Implementing effective security measures becomes more difficult, especially if you are relying on manual inventory processes.   Read this blog to learn more about what attack surface challenges do organizations face, how to better understand your attack surface, and how the unit 42 attack surface assessment can help you gain full visibility of your on-premise and cloud environments.   New PANCast Episodes: Panorama Logging and GlobalProtect Troubleshooting Each month brings to new episodes of PANCast, a Palo Alto Networks podcast, to our members! Check them out:    PANCast Episode 17: GlobalProtect Connections and Troubleshooting     PANCast Episode 18: Panorama as Logging Solution     How To: Set-Up Incident Automation Rules and Logs in XDR   Repetitive workflows and manual handling of similar events take up a considerable amount of time and leave you unable to focus on alerts and tasks that really matter.    Cortex XDR 3.6 now includes simple automation that nullifies redundant workflows, eliminates human error and reduces the amount of headcount required for low tier analysts. Developed from understanding the need for automating day to day activities natively within the product, XDR can now automate responses where we already know the entire workflow, thereby eliminating tier 1 and tier 2 level decisions. This allows SOC analysts to focus on alerts that really matter.   Tips & Tricks: Commit & Config Locks   Palo Alto Networks' Commit and Config Locks are important features that help ensure the integrity of network configurations and prevent unauthorized changes.   The Commit operation, in Palo Alto Networks devices, is the process of applying configuration changes made to the device to the running configuration. It is an essential step in the configuration process, as it allows the changes to take effect and be enforced. Before committing configuration changes, administrators can preview the changes and validate them to ensure that they are accurate and won't cause any disruption to the network.   Why SaaS for XSOAR?   With the release of XSOAR 8.X, the hosted offering of XSOAR was changed to that of a SaaS architecture. This is a fantastic advancement that further decreases the customer’s responsibility for their XSOAR instance but also increases the stability of their environment. To best explain why the move to SaaS is awesome, let's clarify what SaaS is and the difference between XSOAR 6.X Hosted and XSOAR 8.X SaaS.    Tips & Tricks: SSL Forward Proxy   In today's digital world, where encryption is all around us, SSL decryption becomes a real superhero in the fight against hidden threats and bolstering network security. Luckily, Palo Alto Networks Next-Generation Firewall comes to the rescue with its powerful SSL decryption capabilities. With these tools, organizations can gain insight into encrypted traffic, spot potential risks, and take proactive measures to keep their network safe and sound. Dive into the steps of enabling SSL inbound decryption in this Tips & Tricks blog!   May ‘23 Discussion Highlights: Posts With Accepted Solutions Nominated Discussions help LIVEcommunity Solutions Engineers highlight a discussion that has an Accepted Solution, and turn it into an article with additional helpful information, documentation, and clarity! Here are the Nominated Discussions we published this past month:   Nominated Discussion: User ID group mapping, not pulling groups  Nominated Discussion: What does "SWITCH" in hardware architecture mean?  Nominated Discussion: Configure a second DUO for PA firewall MFA  Nominated Discussion: SSL Decryption Session is Full  Nominated Discussion: CLI Guide Needed for Palo Alto FW You're now fully briefed on LIVEcommunity's May 2023 highlights!   If this was helpful, be sure to give this blog a thumbs up. See you next month! ... View more

Security Consolidation Chat Webinar Series, Episode 2: Cybersecurity Solutions That Work Better Together   Did you know that Palo Alto Networks is hosting a Security Consolidation Chat Webinar Series?   Join the second episode of the series, Cybersecurity Solutions That Work Better Together, to join Palo Alto Networks security experts as they share the benefits of cybersecurity platforms. We’ll share details on our holistic solutions that cover every defense vector with security tools that share intelligence and work together—from prevention to detection and response—to stop the most complex threats.   Security Consolidation Chat Webinar Series Episode 2: Cybersecurity Solutions That Work Better Together   Register for Wednesday, June 14, 2023 Time: 10 a.m. PT / 1 p.m. ET   Register for Wednesday, July 12, 2023 Time: 10 a.m. PT / 1 p.m. ET ... View more