5‑6

5 Cyber Security

Find Evil‑Know Normal :Tokyo 2020 Games Threat Hunting fromInternal and External Perspectives
HATADA Mitsuhiro

SUDOH Toshiaki

The Olympic and Paralympic Games Tokyo 2020 see a significant increase in the number of users and devices prior tothe opening of the Games and the threats to systems vary accordingly In addition not only systems strictly controlled by
security solutions but also those simply connected to the Internet exist In order to prevent the occurrence and spread ofdamage in such an environment we present case studies of threat hunting based on log analysis inside a network andtraffic analysis at the Internet gateway from various perspectives and discuss prospects of threat hunting for future
eventsKeywords：Threat hunting Log analysis Traffic analysis Intelligence

1．Introduction“Find Evil‑Know Normal”(1)premise that existing security measures cannot detectattacks with truly high impact When a breach has

is a phrase that is truly

already occurred the objective is to minimize damage

realized when threat hunting is conducted to search forby shortening the latent period It is necessary tothreats in a cross‑sectional and combined manner using

suspect the failure of detection caused by both functions

all logs of network devices terminals and various

and operations of devices configurations log collection

security measures as well as the intelligence collected

and analysis and visualization Then making continu-

High‑impact attacks target organization‑specific vulner-

ous improvements could be another objective of threat

abilities using organization‑specific tools and techniques

hunting

so public information and simple Indicator of Compromise (IoC) are not highly effective
Threat hunting is a search activity that proactively

2．Threat Hunting Based on Log Analysis

detects threats that have been overlooked by conducting

In the network of the Olympic and Paralympic Games

security monitoring and analysis including the develop-Tokyo 2020 (hereinafter referred to as “Tokyo 2020

ment of custom IoCs and tools Because it relies on theGames”) the policy is to allow only necessary communication between segments In terms of policy violations
we present two cases in which firewall block logs
between segments were investigated

HATADA Mitsuhiro (IEICE Member)Information Security NTT Communications Corporation
E‑mail mitsuhiro hatada@ntt comSUDOH Toshiaki
Information Security NTT Communications Corporation
E‑mail t sudou@ntt com

day from a large number of source IP addresses in aThe Journal of The Institute of Electronics Information and Communication Engineers Vol 105 No 8 Supplement pp 285‑287 August 2022

address and port number This had been occurring for© 2022 The Institute of Electronics Information and Communication Engineers

We found approximately 2 24 million blocked logs per
specific segment directed to a specific destination IP
several weeks and the number of blocked logs wasSpecial Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020285Figure 1

Daily Ratio of DNS Query Typeincreasing day by day As a result of the investigation by
the partner a server that backs up the data of a certain
system was deployed before the opening ceremony of

3．Traffic Analysis‑based Threat Hunting
In this section we present a case study of traffic

Then the client application with ananomaly analysis that detected a large number of ICMP

incorrect setting of IP address as a backup server wasport unreachable messages We initially assumed that it

distributed to user terminals This is a case where threat

was a response to a port scan or a DDoS attack but

hunting contributed to the improvement of systemtraffic analysis revealed that it was a large number ofavailability in terms of communication failure andDNS responses with a response code of “REFUSED ”

overload on SIEM (Security Information and Event

The DNS request type analysis revealed that HTTPS RR

the OlympicsManagement) caused by a large number of unnecessary(Type 65) queries accounted for 95% of all queries aslogs

shown in Figure 1 Secure DNS service which is theIn another case from the perspective of detecting

DNS resolver deployed in this environment does not

suspicious behavior we investigated terminals where a

support HTTPS RR (Type 65) so all of them returned

set of commands were executed within a few minuteswith REFUSED responses In addition since a large

which are commonly used by attackers (2)A certain

number of queries and query responses were being

application was executing ipconfig netstat ping andtransferred it is assumed that a large number of ICMP

tracert as child processes which looked suspicious But

port unreachable messages were being sent due tothe results of the sandbox analysis showed that it wasabnormal packet processing by NAPT and firewalls

legitimate behavior

As a SIEM analyst

we alsoAt that time only OS X sent HTTPS RR (Type 65)

investigated from various perspectives such as domains

queries by default and it is assumed that many OS X

where only one user was accessing the web site (uniqueusers were connected Although this case is not abehavior of user) and traffic between legitimate users

security incident directly the unintentional and chain ofand IP addresses that attempted to log in to Azure ADlarge‑volume traffic may overload devices such as(communication with the attack source) Finally there

firewalls with overflowing sessions Furthermore it

was no evidence of the breachmay result in missing logs

DoS effects such as

The most important point in conducting log analysis‑

communication failure In the worst case the security

based threat hunting is “As the environment changes

level may be lowered by bypassing the security function

so do the logs As the logs change so does the threat

In traffic analysis‑based threat hunting we detected

hunting ” It is also effective to search for traces ofvulnerable devices being attempted to log in or executeattacks by relaxing the detection conditions of individual

remote commands malicious traffic aimed at infection

security measures and SIEMʼs detection logic It is also

spread or DDoS attacks

crucial to accumulate patterns to be excluded andattempting to enter from the outside We also conductedprioritize others based on the investigation time anda deep analysis escalated by other analysis teams In

number of cases

and anomalous packets

total 206 cases were handled throughout the period andno major damage was confirmed

By leveraging avariety of external threat intelligence our observation
286

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

data and research results we were able to hunt threatsthat were overlooked by external traffic analysis rather
than relying solely on device logs and alerts Even if thesecurity measures are sufficient the external traffic
analysis approach is effective not only in detecting
anomalies but also in determining whether the network
is in a normal state

4．SummaryThe number of users and devices increased significantly prior to the opening of the Tokyo 2020 Games
With these changes the threats to which systems areexposed have also diversified In addition there was a
mixture of systems that can be strictly managed by
security solutions and those that just use InternetaccessIn order to prevent the occurrence andexpansion of damage in such environments this article
presented case studies of threat hunting conducted frommultiple perspectives including log analysis of various
systems and internal networks and external traffic

References()()

SANS Institute, Hunt Evil Poster, 2021.
https://www.sans.org/posters/hunt-evil/
S. Tomonaga, Windows Commands Used by Attackers, JPCERT/CC,2021.
https://blogs.jpcert.or.jp/ja/2015/12/wincommand.html(Received February 28 2022 ; Revised March 1 2022)

HATADA Mitsuhiro (IEICE Member)
Dr Hatada is currently a director of Security
Operation Information Security NTT Communications Corporation He received his B E andM E degrees in computer science and engineering and Ph D in engineering from theWaseda University in 2001 2003 and 2018
respectively He joined NTT Communications
Corporation in 2003 and has been engaged in
the research and development of appliedsecurity
SUDOH Toshiaki
Toshiaki Sudoh graduated from Ehime University in 1995 with a bachelorʼs degree inelectrical and electronic engineering He joined
NTT in the same year He currently engages insecurity service development operation consulting etc at NTT Communications Corporation

analysis at the Internet gateway These cases andlessons learned can be applied not only to future large‑
scale events but also to the organization network㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020287