Instructor: Analyzing network IOCs 2 2
or indicators of compromise. 3 3
Now, in this section, we're really going to focus 4 4
on all of the different ways 5 5
of identifying bad behavior on a network. 6 6
Once we find an indicator of compromise, 7 7
we can then use that to create defenses 8 8
against these different types of attacks 9 9
and then we can also use those inside of our threat hunting. 10 10
Now, there's lots of reasons for using IOCs: 11 11
we can use it to create defenses or do threat hunting. 12 12
We can use it for instant response 13 13
and forensic investigations and lots of other things. 14 14
Now, while the way we'll use those different IOCs 15 15
may be very different, 16 16
the way we learn about these IOCs and gather them 17 17
and analyze them is going to be very much the same. 18 18
Now, when we start dealing with network related IOCs, 19 19
there are lots of different ones out there. 20 20
For example, what if we start seeing things 21 21
like port scanning and sweeps? 22 22
If we see that they may be the indicator 23 23
that there's an attack coming next. 24 24
We might identify things like non-standard port usage. 25 25
For example, maybe I'm seeing SSL being used 26 26
on some port for web traffic that isn't 443. 27 27
Well, that would be something that would flag 28 28
as something I should look for. 29 29
And if the same attacker uses the same type 30 30
of ports every single time 31 31
for the same type of malware, 32 32
that would be a good indicator or compromise we could use. 33 33
Maybe we start identifying a covert channel. 34 34
Like for instance, we start seeing data 35 35
that's being sent out over a ping packet, 36 36
because normally, ping packets don't carry data 37 37
and so that would be something that would be unusual. 38 38
And if we identify that 39 39
that might be a sign of a data exfiltration 40 40
or beaconing or C2 or something like that. 41 41
Or maybe we start looking around our network 42 42
and we start seeing devices that we don't recognize. 43 43
For instance, there's a new wireless access point 44 44
or a new wireless network out there 45 45
or there's a new switch. 46 46
Any of these things could be rogue devices 47 47
and that could have been something that's an indicator 48 48
of an insider threat. 49 49
Now, that insider might have had intention with this 50 50
or it might have just been something they were doing 51 51
for convenience. 52 52
Either way, they're bringing a threat to our network 53 53
and it's something that we can identify 54 54
and then relate that back to the intrusion set, 55 55
in this case, an insider threat. 56 56
All these things are what we're looking for 57 57
when we start analyzing networks to identify these IOCs 58 58
or indicators of compromise. 59 59
And as we go through the next several lessons 60 60
in this course, 61 61
we're going to start talking about individual IOCs 62 62
and how to identify them.