How To perform Compromise Assessment with DRONE

Updated: 14th June 2024

Immediately identify and focus on the most critical areas for further investigation

DRONE is AIR’s built-in automated compromise assessment technology which slashes the time required to identify and investigate IoCs during a threat investigation and begin containment and remediation. DRONE flies above your live systems and data acquisitions to deliver an unparalleled decision support system.

DRONE provides rapid, automated analysis that will guide investigators, helping them pinpoint anomalies quickly by labeling findings by their severity, High, Medium, Low, or Matched.

Streamlining Investigation Workflows

Binalyze AIR streamlines the investigative workflow by combining evidence acquisition and analysis into a single, efficient process. An acquisition task can be initiated automatically via a webhook, scheduled for specific times, or created manually. Regardless of the initiation method, DRONE automates the analysis, ensuring that all findings are seamlessly consolidated in the Investigation Hub. This integration simplifies the investigator's job, making it faster and easier to gather and assess critical evidence

Investigators can easily enable or disable DRONE, or any of the individual analyzers in AIR, by toggling the associated switches on or off, either when setting up automated acquisition profiles or before manually launching an AIR task.

Disabling DRONE will continue to display your evidence in AIR’s Investigation Hub as an acquisition tasking report. However, it will not include automated analysis or reveal any findings related to that evidence:

When the same acquisition profile is run again just minutes later, this time with DRONE activated, it quickly becomes apparent that there are issues with this asset. The DRONE findings are highlighted, offering extremely useful insights. This enables the investigators to immediately identify and focus on the most critical areas for further investigation:

DRONE, your rapid and fully automated decision

support system

Each evidence item is processed by DRONE’s 20 proprietary analyzers (see table below) which check for specific characteristics of the evidence data.

Each analyzer has multiple stages through which the evidence item must pass to identify if the item is ‘correct’ or not, to then assign it a level of severity to help prioritise next steps in the investigation.

High: Flags threats that pose immediate and significant risks, demanding urgent action to prevent or mitigate severe impacts. Example: An IIS process executing cmd.exe or powershell.exe, which could indicate a web shell.

Medium: Targets activities that deviate from expected norms and could indicate potential threats, suggesting a need for deeper scrutiny. Example: A running unsigned process located in a temporary folder, or use of known hacking tools like "mimikatz."

Low: Identifies less critical but still unusual activities that could benefit from further investigation to clarify their nature and intent. Example: System-level processes initiated by non-privileged users, or processes operating from non-existent directories.

Matched: Involves confirmed matches to predefined security rules, keywords, hashes, or patterns within the analyzed data, signaling recognized threat indicators. Example: A detected scheduled task named "MalwareTask*" that aligns with a user-defined keyword "MalwareTask*".

Additionally, it is important to note that any High, Medium, or Low finding can also be marked as 'Matched,' and that this can occur multiple times. For instance, a file classified as a High finding could also contain a keyword or triage hit, making it appear as a Matched item as well as a High finding.

A good example would be a password-protected archive or a macro-enabled document. While these file types are commonly used for legitimate purposes, they have for some time been popular among malicious actors for exploitation. As a result, such files might receive a Medium severity finding. If the file name also contains a keyword you are searching for, it would be additionally marked as 'Matched.

DRONE will then report, within the Investigation Hub, on any item that displays attributes the analyzer believes may be worthy of further investigation, along with detailing the reasons for highlighting issues with that particular item.

DRONE is not simply detecting malware, in fact, malware detection is only a small part of the process and a by-product of MITRE ATT&CK scanning. The DRONE analyzers deliver much more and guide the investigator as to where to prioritize their efforts to help speed up the entire investigation.

Without DRONE, investigators will, as they have done for many years, work their own, individual manual ‘pipelines’ and processes using a variety of often very slow legacy forensic techniques and tools. 

For instance, investigators will need to select and investigate individual processes, assess entropy levels, and organize process lists. They must also search for potential encryption, review command histories, and filter processes for those that are 'unsigned.' Additionally, sorting by username and creation date is essential. These steps must be repeated for each subsequent item under investigation 

It’s an extremely manual, laborious, and time-consuming process.

DRONE automates all these tasks for the investigator and more. By utilizing Webhooks (integrations) and accessing the AIR API, the entire process can be completely automated, complementing existing security investments and eco-system. Consequently, the first item an investigator and his team might encounter following a breach is DRONE findings in the Investigation Hub that directly highlights critical areas of concern. In the section below, we will explore a scenario where DRONE is effectively utilized. 

Within AIR, an EDR alert has automatically initiated an acquisition profile, tasking the Responder to execute on a specified, or any number of assets. Concurrently, DRONE runs its MITRE ATT&CK analyzers on the asset and applies additional analyzers to the gathered evidence. The findings, alongside the evidence, are then displayed in the Investigation Hub. They can be presented as either an individual report for the specific tasking assignment or consolidated with other related activities for a case. All findings are categorized as High, Medium, Low, or Matched, highlighting actionable items that offer valuable insights into the incident, facilitating further investigation and remediation efforts

The Process Analyzer discovers an unsigned process running, DRONE reports a finding scored as Medium to bring it to the attention of investigators.

The pipeline is ordered by the severity level descending, so this means higher-scoring finding rules are checked first, and as soon as there is a hit the pipeline does not need to be checked any further.

DRONE scoring mechanism

Let's delve into how DRONE allocates points and assigns findings to items, categorizing them as High, Medium, or Low.

Here's an overview of the scoring system and classification process used by DRONE to ensure accurate threat assessment.

Some rules, on their own, may not be worth reporting, but when brought together with others, they could assist in solving a case. 

Example 1: Scheduled Task Analyzer

In the Scheduled Task Analyzer, DRONE checks the command lines of scheduled tasks. If one line is "cmd.exe /c start C:\temp\m.bat", it would be captured by two scoring rules:

1. The item has a scripting extension - the ‘.bat’
2. The item's location is unusual. 

The result of this is that this particular item will be allocated a score of 65, which means that it is categorized as "Medium" by DRONE.

In the example above, DRONE has identified four critical factors that justify categorizing a file found in the Windows Prefetch as 'High' severity. These factors collectively elevate its score above the 80 points required for a ‘High’ severity classification:

• The file was only executed once.
• It happened at a super-relevant time.
• The entropy is suspiciously high.
• The location from where it ran is ‘rare’.
• And the file name is unusually short.

Another example of how the score of an item can result in a finding can be seen with date relevance:

This function is used to check if the item's date and time stamps display activity at a time relevant to the incident under investigation:

SuperRelevant is between now and 1 week

HighlyRelevant is between now and 3 weeks

Relevant - between now and 3 months

In all other cases, later dates, the function return is irrelevant and no points will be allocated.

This analyzer pipeline process is implemented by proprietary algorithms, so they’re not publicly available.

Example 2: Process Analyzer

Let’s look at another example: Imagine AIR’s collection engine, has collected all of the artifacts requested in an acquisition profile, and passed them to DRONE for post-acquisition analysis. 

As we now know, DRONE has a number of analyzers, and each of them executes rules for the specific type of artifact collected. For example, the Process Analyzer executes the rules related to processes only. 

Let's say AIR has collected 5 processes and we’ve 3 rules in the processes analyzer, in reality, DRONE actually has many more rules in the pipeline for the analysis of processes. The 3 rules will be executed against each of the 5 collected processes, so basically this pipeline has 3 stages through which the process artifact must pass.

This means a process artifact visits only 1 pipeline. Most of the analyzers work in this way right now, but this is not a constant behavior and can be changed according to needs.

DRONE Analyzers

Let's take a look at some more information about the DRONE analyzers:

Browsing History Analyzer as an example, here we check the URLs for; Cross-Site Scripting, XSS strings, Macro Enabled Extensions, and blacklisted domains. 

• So, any document files downloaded with macros will result in a finding
• Any strange domain extensions identified will also equal a finding
• Application categories such as Bitcoin wallets will also be shown as a finding.

The Ransomware Identifier Analyzer is based on YARA rules and runs on the endpoint not the collected data. We only search using these YARA rules in specific paths such as;

• Running process paths and sub-directories
• Prefetch paths and subdirectories
• User folders and subdirectories
• Recycle bin folders

The Events of Interest Analyzer takes a look at certain Windows events of note - a good example being where there have been a lot of RDP connection requests in the night, this will equal a finding.

The DRONE Generic Webshell Analyzer will also detect 95%+ of Webshell compromises. 

Let’s take a look at a more detailed list of the DRONE analyzers for Windows:

The MITRE ATT&CK Framework is globally recognized as a leading knowledge base with a standardized language of adversary tactics and techniques based on real-world observations.

The MITRE ATT&CK scanner in DRONE is powerful and uses over a thousand YARA rules to detect Indicators of Compromise (IoCs) and Tactics, Techniques, and Procedures (TTPs). These findings are invaluable for threat investigations. Developed by our world-class DFIR Lab team, the scanner offers high detection rates with minimal false positives

Looking at the investigation process as a whole, with the MITRE ATT&CK scanner in place we’re now delivering a platform that supplies investigators with the most comprehensive solution for threat investigations. This information gives key pointers and direct signposting as to where and how breaches may have occurred, simplifying an often complex portion of the investigation, especially for less-seasoned analysts and responders, by providing a quick overview of public-knowledge attack vectors

As with all parts of AIR, we’ll continue to enhance this capability – adding further rules to shorten overall investigation times and reduce the potential for data loss and reputational damage. 

AIR now automatically checks for any new MITRE ATT&CK rules that the Binalyze Threat Hunting Team has written. If you don’t have the latest version, the new rules will be pushed to your AIR platform automatically, potentially saving yet more valuable time, and avoiding any delay to you having access to the latest rule sets.

With our comprehensive analyzers, customers will see the attack stages, the footprints of any attackers, and which of the Tactics in MITRE ATT&CK were used.

By using this option, users have a greater understanding of what the attacker's intentions were and what they’ve done in their systems. We then have three verdict levels representing how serious any discovered threat is.

Deploy DRONE in your Investigation Workflows

Binalyze AIR is the disruptive force in the cybersecurity space right now. This is because we combine lightning-fast forensics with automation, supporting a wide range of integrations with which SOC investigators can today, easily and quickly remediate incidents.

All of this is further enhanced with DRONE’s powerful capabilities, enabled with just one click. Along with new enhancements like our Investigation Hub, consolidating insights in a single, collaborative workspace.

So, if you’re ready to see how AIR and DRONE’s automated compromise assessment can make a difference in your organization, help maintain a more resilient cyber security posture, and save you time - why not sign up for a free 14-day trial?