Sponsored: The intrusion signals hiding in plain sight

0:03James Wilson: Hey everyone, I'm James Wilson from Risky Business and welcome to this sponsored interview with Permisso CTO Ian Ahl. In this interview, Ian's going to take us through what it's like to watch a shiny hunter style attack unfold, both from the perspective of catching one in incident review, as well as what it looks like in real time as they start to pivot through your systems. We talk about how these identity led attackers move through cloud environments, SaaS environments that even use those to tunnel down to on-prem, and also why AI is compressing these attacks from what used to be days down to just now four hours, and that time window will no doubt only get smaller.

0:42James Wilson: We also talk about how, as Ian says, the signals are abundantly present, but it's connecting the dots that remains difficult, and that's where Permiso can really help. I'll drop you in here where Ian outlines the overall shape of a Shiny Hunter's attack from initial access right through to extortion. Enjoy. Yeah, for me, when I think about this group, it's like really three phases to their attack. So initial access, myriad of ways that can occur. Sometimes it is, hey, they stole some credentials from sales loft back in the day. So great, I'll go ahead and use those if they want. Sometimes it's what they're notoriously known four, just call the help desk, fish your way through.

1:26But honestly, regardless of how they get in there, the first thing they do afterwards is always a pretty good tell, which is they want to register their own MFA. So you'll see things like, ooh, this is somebody who's been an Android user in my environment for seven years. They just registered an Apple device. That's often a tell that you wouldn't think about from a detection perspective traditionally, but it's really, honestly, I see a password reset, a device swap, and followed by somebody landing in SharePoint and searching for AVD or whatever the mission happens to be. A lot of Badger virtual desktop searching around recently.

2:11But the first phase, get in and establish a way to stay in. Second phase is they got to learn your environment and they have to learn it as fast as possible to be able to carry out their mission. So if they're going after a large software firm and maybe they want code signing certs, well, how are they going to go and figure that out? The same way your engineer does. They're gonna click into Confluence. They're gonna click into SharePoint, whatever your document store is. And they're just gonna search. And in my opinion, that is the most underrepresented area for detection opportunities out there.

2:47Nobody monitors searches. And it's consistent. Like the search terms I see, there's like 30-ish that I've seen for the last three years from this group. Sometimes they type them in the same exact order. Like, you know what they're looking for. Search terms show intent. You know what they want when you can see what they're searching for. So yeah, phase two is all about just learn as much as they can through your own SaaS applications. Now it depends on what their mission is. If I'm going after that software firm, Um, I need to get into your CICD pipeline if I want that code signing cert. So this, this initial phase, uh, initial access, then recon, figure out where you're going to go.

3:30What happens here really dictates what happens in that third phase. If I'm going after an airline, uh, instead, well, man, what, uh, what are they willing to pay for? Terminals being shut down. So the goal there, get on-prem as fast as possible and destruct, but they're going to go on-prem from the cloud. They're going to use Azure Virtual Desktop as a pivot point because it always bridges those networks. So it all depends on the goal from there, but it is usually get on-prem, get to data or get into your CICD pipeline. And for this group, they've gotten a whole lot better recently on Salesforce, Snowflake, Tableau.

4:11So they're in those types of applications because that's where they're going to find the juicy data that they want to be able to store you for and more credentials.

4:20James Wilson: Right, right. And you mentioned there that there's the gap of not watching search, which would provide some pretty interesting signals. But I guess what signals do we have and where should people be looking for this? Is it still largely a problem of a human operator and maybe augmented by LLMs as having to sit across multiple event streams or have we gotten better about sort of high quality ways to detect this through, I guess, higher signal to noise ratio sort of detections? I'm trying to put myself in the position of a SOC operator or analyst and imagining like what does their day look like when one of these attacks is happening?

4:59Yeah, no, it's interesting. When I see one of these attacks happen and I come in to analyze it afterwards, it is always very obvious, right? Like from the IR perspective, it's like, oh, yeah, somebody went from never downloading anything in SharePoint to downloading a thousand files with a Python user agent. Like, OK, like that looks strange. But when you're trying to detect that in modern environments, that kind of event happens 20 times a day, 100 times a day. So what I think you have to do is you got to bring the streams together. Right. And yes, sims have been out there for forever, and that can be a good place to do it.

5:44But you've got to find a way to start getting your knowledge transferred to the event logs that you're bringing in and mapping them together. A good example of this is in the situation we were just talking about. You have somebody who just reset their password. They switch devices, probably not enough to raise an alert yet. But now they just clicked into AWS and they assumed a role that they've never assumed before. Never assumed this role. So now they're in AWS and they're doing everything. But from CloudTrail's perspective, that's all happening from an assumed role that you have to, you got to map these two together.

6:21In order for you to know, oh, yeah, this came from that same identity that just reset their password as well. And just got a device change. And once you start putting these signals together over the multiple streams, it becomes very obvious like, oh, yeah, Ian is definitely a baddie. He just reset his password. He just searched for 15 suspicious things. And now he's in AWS for the first time using S3 browser to harvest anything he can out of your S3 buckets.

6:56James Wilson: Right. Keeping sort of like a more industry-wide view on this before we dive into some of the specifics of how Permisso helps here, but like, is there advice you would give to CISOs and to, you know, cybersecurity professionals out there about how to, almost like, you know, what's the playbook here of the top three signals that you should be correlating or, you know, what's the top five data sources that you should always be looking to try to map together? You know, just to try to cut through, like there's probably hundreds of data sources that I could, would, and should be looking at, but I just don't necessarily have the time for.

7:30James Wilson: So how would you advise them to prioritize their efforts here? Yeah, for me, it's where do we see the attackers most often is the place I want to invest my good logging in, and that is your IDPs, that is your cloud providers, that is your knowledge area, whether that be Confluence or 365, something to that effect. And then what is the big target all the time now? It's always Salesforce, Snowflake, Databricks, like your big data lakes, your big SaaS platforms like that. I'd be spending my money to make sure that we're logging the right things in those places and have a way of at least being able to investigate when something does occur in one of those areas.

8:17James Wilson: I guess the attackers are still limited by their own resources. and so they still triage and go after and prioritize the higher value targets. I'd imagine there's a risk, though, of like the long tail here of, well, I guess, have you seen these threat actors sort of change techniques over time? Like, am I right in saying they're still constrained by their own sort of resources and therefore they go after the things that you just enumerated? Or do you see sort of more attackers coming along, maybe going after the longer tail of things that are less defended, which presents its own sort of challenges for defenders, I guess?

8:50Yeah, a little bit of that, right? Like they don't care inherently, you know, what knowledge software you use. They're just going to, you know, go into your IDP portal and click the button that takes them to it. So for them, it doesn't matter as much. Where I will say they have changed a lot. And I know that we weren't going to bring up AI in this episode, but it is like in 365, my search terms that I love looking for to know when a bad guy is in your environment are less and less effective now because they just go to Copilot instead and ask the question. And Copilot does a better job of bringing all that data in.

9:31So convenience for us is also convenience for attackers. So that's one. and another AI one is in Snowflake. It used to be, you see just a very standard select all copy into some external storage. And that was about as complex as they would get in Snowflake. And now they're creating stored procedures. They're doing their stored procedures in JavaScript instead of SQL. So they're getting around the detections everybody was writing for SQL. When they run into problems in Snowflake, they're troubleshooting well they look like snowflake admins and why well man when it's obvious uh to anybody it's uh yeah the chat gpt is is helping them out just like they're it's helping us out right um uh even one of those store procedures when they when you try to create a store procedure in snowflake if it fails the error log contains the entire store procedure So I could see like, oh, it didn't work.

10:35Then you see the chat GPT style comments as they're like iterating through like four or five different times trying to get this store procedure created. They're evolving with the times as well.

10:49James Wilson: Let's delve into Permisso and where it helps here, right? You've sort of created a picture of some of the signals that you can see, but the challenge here is that there's so many signals that sometimes it gets lost. And the real value here is being able to correlate a lot of these things. And of course, as you said there, the IDP is one of the richest sources of data here. So tell me how Permisso helps in this sort of attack scenario. Yeah, for us, it's stringing all that identity together, all that identity data together. So when Ian takes an action in AWS, if I did it through a role, it's still attributed to me.

11:22I'm still the person who did that action. And I got a team of 15 threat researchers. we're a relatively small company, right? Startup, we're a 60 person company. And for us to have 15 people dedicated to just detection and hunting on my team, it speaks a lot to, you know, Jason and Paul, our co-founders, our co-CEOs about how much they care about that part of the mission. And that is a benefit to everybody because unfortunately, even if you had all this data, you still need to know what to look for. You need to know what the signals are. You need to know that when somebody uses S3 browser, man, very often S3 browser is associated with a bad guy, even though that's a normal utility.

12:09And if you don't live with that data day in, day out, it's a hard thing to keep up with. So bringing the frontline knowledge to the identity place and really honing in on the threat detection side is our bread and butter. Right.

12:26James Wilson: and so i guess to before we wrap up i'm curious as to where you see this going from here and and and i want to explore this from two angles first is sort of where are you thinking about the product going in terms of like a product roadmap but also how is that being informed by what you're seeing and or sort of hypothesizing about where these these threat actors go now right you touched on one thing there around how ai is making them seemingly much better and much more skilled i would say at certain attack paths, but you're, you're the expert here. Where's, where's this go from here in terms of the, the capabilities and the way these groups operate and how does that inform your, your product roadmap?

13:00Yeah, I will say first off, they're going to get the same benefits we all get. So every intrusion, I should have brought this up earlier too, you know, common intrusion from this group three years ago, about 72 hours before you're, you know, seeing data theft and they're trying to extort you. Last case, about four hours, four hours from getting into the environment to taking everything that they need and already sending that extortion notice.

13:29James Wilson: And what's the limiting factor there? Like what's, what's changed? What's keeping it at four hours? What's allowed it to go from 20 plus down to four hours? Yeah, I think some of it's repetition. Like they've learned a lot themselves. Others, unfortunately is the AI side of this, right? I don't need to go and search through 30 Confluence articles, I can go to the AI helper and ask it, where can I find code signing certs? Or how do I get into the code signing cert process? It's a lot easier for them to do that initial phase, or I guess the middle phase is a lot easier now of learning enough about the environment to be able to carry out your mission.

14:12For us, we've always really been very good at detecting the malicious thing. We never really got into the blocking game. So that's an area we're heading towards is everyone wants the ability to flip the kill switch now. We stayed away from that. We thought that's something people ask for, but nobody ever really does it. And I think we're actually getting to a point where people are willing to go farther with that. The other thing is we think of ourselves as an identity security company. we've always been good at detection but identity risk is more than just detection so we we've built the posture side of our our product not too long ago so you'll see more coming in to how can i tell you hey scatter spider did these 15 things to get into in this environment these are the 15 things maybe you want to try to fix for your users in the meantime, preventative wise.

15:11So more prevention, more blocking, same great detection.

15:16James Wilson: Awesome. And then that is a great way to wrap it up. Ian, thank you just so much for dropping by. Ian R. CTO of Permisso. Great to chat with you. Great to chat with you as well.