The document discusses using machine learning to automate threat hunting by presenting a case study on detecting domain generating algorithms (DGAs) used by ransomware like WannaCry. It provides an example workflow for building a machine learning model to classify domain names as malicious or benign, and evaluates the trained model on unseen WannaCry command and control domains. Key recommendations are to plan threat hunting with clear goals and metrics, and that machine learning can help explore threat data and enable automated mitigation.

1. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
15. NOVEMBER 2017 | FRANKFURT

2. © 2017 SPLUNK INC.
Automating Threat Hunting
With Machine Learning
Philipp Drieger | Sr. Sales Engineer | SME BA IoT ML
15. NOVEMBER 2017 | FRANKFURT

3. © 2017 SPLUNK INC.
During the course of this presentation, we may make forward-looking statements regarding future events or
the expected performance of the company. We caution you that such statements reflect our current
expectations and estimates based on factors currently known to us and that actual events or results could
differ materially. For important factors that may cause actual results to differ from those contained in our
forward-looking statements, please review our filings with the SEC.
The forward-looking statements made in this presentation are being made as of the time and date of its live
presentation. If reviewed after its live presentation, this presentation may not contain current or accurate
information. We do not assume any obligation to update any forward looking statements we may make. In
addition, any information about our roadmap outlines our general product direction and is subject to change
at any time without notice. It is for informational purposes only and shall not be incorporated into any contract
or other commitment. Splunk undertakes no obligation either to develop the features or functionality
described or to include any such feature or functionality in a future release.
Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in
the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.
Forward-Looking Statements

4. © 2017 SPLUNK INC.
Agenda
▶ Threat Hunting
▶ Example: WannaCry
▶ Machine Learning: DGA App
▶ Wrap up | resources to get started

5. © 2017 SPLUNK INC.
I’ll know it
when I see
it
Looking
for
unusual
things
Looking
for specific
behaviors
Looking
for a
specific
actor
Hunting Perspectives

6. © 2017 SPLUNK INC.
▶ Why are you hunting:
• Prevent unexpected outages, learn how ransomware operates
▶ What are you hunting for:
• Ransomware –
▶ What are the indicators/manifestations:
• Exploits smbv1, propagates via network, uses DGA for sandbox check
▶ What will you do when you find it
• Identify additional victims, restore services, create support tickets
▶ When will you stop looking?
• 24 hours from start time
WannaCry Example

7. © 2017 SPLUNK INC.
▶ Understanding the terrain:
• Infection, propagation is via network accessible tcp ports, primarily windows systems
• Physical systems may be in a remote location
▶ Development/tuning of tools and knowledge
• Port scanners, vuln scanners
• Historical data from scanners, network and endpoint logs
▶ Adversary engagement plan
• Do not disconnect systems upon discovery. Do not pay ransomware
▶ Ability to modify the terrain
• Block ports, image systems on identification, spin up new instances of services if needed
▶ Reporting, deconfliction, escalation
• Provide pre-hunt plan to stake holders- management, HR, IT support
WannaCry: Hunting prep

8. © 2017 SPLUNK INC.
Hunting hypotheses
Execute hypotheses
Measure
Effectiveness
Learn/update/modify
Using a simple model

9. © 2017 SPLUNK INC.
DGA App for Splunk
Download for free from splunkbase:
https://splunkbase.splunk.com/app/3559/

10. © 2017 SPLUNK INC.
▶ Assistants: Guide model building,
testing, & deployment for common
tasks
▶ Showcase: 25+ interactive examples
from IT, security, business, and IoT
▶ Algorithms: 30+ standard algorithms
plus an extensibility API
▶ SPL ML Commands: New commands
to fit, test, and operationalize models
▶ Python for Scientific Computing
Library: 300+ open-source algorithms
Splunk Machine Learning Toolkit
extends Splunk with new tools and guided modeling

11. © 2017 SPLUNK INC.
Challenges to detect DGAs:
▶ Static matching runs against
potentially infinite blacklist entries
O(∞)
▶ Regex can narrow down this list, but
still hard to compute and find rules
(and define exceptions for rules)
▶ Unknown unknowns?
▶ Want to get fuzzy?
▶ Let’s ML!
▶ Example of DGAs:
Example IoCs for Wannacry
(https://cert.europa.eu/static/SecurityAdvisories/2017/CERT-EU-SA2017-012.pdf)
Domain Generating Algorithms (DGA)
What’s the problem?

12. © 2017 SPLUNK INC.
▶ Example for end to end data science process
▶ Disclaimer: this is not a turn key solution but a template to get you started
▶ Feel free to improve and let me know your feedback 

13. © 2017 SPLUNK INC.
▶ Small data set with 100K domain names for training and testing

14. © 2017 SPLUNK INC.

15. © 2017 SPLUNK INC.
▶ More features can significantly improve your machine learning models
▶ Extend this with your feature engineering ideas (e.g. subdomains, age of
domain registration, rating/scoring from threatlists for known malicious domains
etc.)

16. © 2017 SPLUNK INC.

17. © 2017 SPLUNK INC.

18. © 2017 SPLUNK INC.

19. © 2017 SPLUNK INC.

20. © 2017 SPLUNK INC.

21. © 2017 SPLUNK INC.

22. © 2017 SPLUNK INC.
▶ Consider your goals using machine learning in the context of your problem:
maximize detection rate? minimize false positives?

23. © 2017 SPLUNK INC.
▶ Check how our trained model performs against
WannaCry C&C domains that the model has
NOT been trained on.
▶ Model predictions can be made actionable
immediately with Splunk Alerts or turn into
notable event frameworks like in ES
Reality check: Detect Unknown Unknowns?
Example WannaCry

24. © 2017 SPLUNK INC.
Wrap up

25. © 2017 SPLUNK INC.
1. Threat hunting must be executed with
intentionality and planning
2. Machine learning enables exploration of
threat data and automated mitigation
3. Read the whitepaper: Operationalizing
Machine Learning to Detect Malicious
Domain Names
4. Explore DGA App for Splunk
5. Explore Security Essentials for
Ransomware
Get started with ML
and threat hunting right
now!
Key
Takeaways

26. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
THANK YOU

27. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
NOVEMBER 15 | FRANKFURT