Investigating EASM Inventory Fluctuations Between Scans

// Understanding EASM Inventory Discrepancies

Enterprise Attack Surface Management (EASM) tools can reveal snapshots of your assets, but what's important is understanding the discrepancies in inventory counts between scans. Such fluctuations could indicate genuine changes in your network or, more insidiously, an evasion tactic employed by an adversary.

// Common Reasons for Fluctuations

Here are several reasons why your asset count may differ between scans:

1. New Assets: Devices added to the network since the last scan.

2. Decommissioned Assets: Devices removed or repurposed but not updated in the EASM tool.

3. Network Configuration Changes: Changes in your network architecture impacting asset visibility.

4. Adversarial Action: Malicious actors may be actively trying to conceal their presence by unpublishing services or using stealth techniques.

5. Scan Configuration: Variations in scan parameters or timing can also lead to different results.

6. False Positives/Negatives: The EASM tool might misidentify or overlook assets due to outdated signatures or improper configurations.

// Workflow to Analyze Discrepancies

Running a systematic check can tighten your understanding of these fluctuations. Here’s a workflow to analyze the situation:

Step 1: Execute Initial Scan

Use your EASM tool to perform an initial scan and export the results. Here's an example command using a hypothetical tool:

./easm-tool scan --output-format json --output-path /tmp/easm_initial_scan.json

Step 2: Record Current Asset Inventory

Parse the output to gather the current asset inventory. If your tool outputs JSON, you can use jq for parsing. Here’s how:

cat /tmp/easm_initial_scan.json | jq '.assets[] | {ip: .ip, hostname: .hostname, service: .service}' > /tmp/current_inventory.txt

Step 3: Execute Follow-Up Scan

Run a follow-up scan. Make sure the timing is consistent with your first scan.

./easm-tool scan --output-format json --output-path /tmp/easm_followup_scan.json

Step 4: Compare Inventories

Now compare the two scans to see what assets were added or removed:

jq --slurp '.[0].assets as $first | .[1].assets as $second | $first - $second' /tmp/easm_initial_scan.json /tmp/easm_followup_scan.json

This command identifies assets present in the initial scan that are missing in the follow-up scan.

Step 5: Investigate Changes

For any differences observed, investigate the specifics. Here’s what to check for:

• New Assets: Validate if these assets were officially added.
• Removed Assets: Confirm these assets are no longer in use. Speak with your network team.
• Configuration Changes: Check if there were any network architecture changes.
• Potential Threats: Look for assets that might have been evaded. Review firewall logs or use tools like nmap to probe for hidden services.

Step 6: Document Findings

Ensure your findings are documented clearly in your threat-hunting log. A good entry should include:

• Date of scans
• Assets identified or removed
• Any communications with teams about changes
• Follow-up actions required

// Defensive Implications

Understanding fluctuations in EASM inventory isn't just about asset management; it's a critical part of an organization's security posture. Defensive teams should:

• Regularly verify asset inventories.
• Ensure that new assets are registered and tracked immediately.
• Monitor for unauthorized asset changes, which can indicate potential breaches.

// Mistakes to Avoid

• Skipping Documentation: Failing to document time frames and asset changes can lead to confusion during investigations.

• Ignoring False Positives: Always validate assets that are flagged as new or missing. Misinterpretation can lead to overlooking genuine issues.

• Neglecting Follow-ups: Ensure you take necessary actions on findings. Relying solely on tools may leave gaps in your security posture.

// Conclusion

Regular analysis of your EASM inventory can significantly enhance your threat-hunting capabilities. By following the outlined workflow, you will be better equipped to understand the reasons behind fluctuations in asset visibility and ensure that your defenses remain robust. Ensure you conduct these assessments in a controlled environment, such as a disposable range, to maximize learning without risk.

--- // FIELDOPS REPORT AUTHORIZED BY: Bruce H. //