Instructor: Persistence. 2 2
The last type of indicator of compromise 3 3
we need to talk about is persistence. 4 4
Now, persistence is important 5 5
because persistence is the ability of a threat actor 6 6
to maintain covert access to a target host or a network. 7 7
This means that they've gotten into your network, 8 8
and now they're hanging in there. 9 9
They're not going to go anywhere, 10 10
and that's what persistence is all about. 11 11
Now, persistence is usually going to rely 12 12
on modifying the registry or a system's scheduled tasks. 13 13
And therefore, you need to look in both of these areas 14 14
as you're trying to find any anomalies 15 15
or any signs of persistence. 16 16
Let's go ahead and start with the registry. 17 17
Now first, what is the registry? 18 18
Well, the registry is a hierarchal database 19 19
that stores low-level settings for Microsoft Windows 20 20
inside that operating system, 21 21
and for the kernel itself, the device drivers, the services, 22 22
the security accounts manager, and the user interface. 23 23
All of this is stored within the registry. 24 24
It's essentially this big database of knowledge 25 25
about the system and everything that happens to that system. 26 26
Now, a registry viewer is a tool that can allow you 27 27
to extract the Windows Registry files from an image, 28 28
and then display them on the analysis workstation. 29 29
This way, as you're doing your analysis, 30 30
you can see all the different things 31 31
that were inside that registry 32 32
and pull out the important pieces you need. 33 33
If you're dealing with something 34 34
like EnCase or FTK for your forensics, 35 35
you can actually look at the registry through those tools, 36 36
or extract the registry out 37 37
and then open it inside a registry viewer. 38 38
Now, Windows does have its own registry viewer built into it 39 39
and this is actually called regedit, 40 40
but it does have a big disadvantage. 41 41
This is because the built-in regedit tool doesn't display 42 42
the last modification time of a value by default. 43 43
This way, you won't know when it was modified last, 44 44
and that's a big indicator of compromise for you 45 45
is knowing when things happened 46 46
and using that to build your timeline. 47 47
So it's not recommended that you use regedit. 48 48
Instead, you should use different tools. 49 49
For example, you might want to use regdump. 50 50
This is a tool that dumps the contents of the registry 51 51
into a text file with simple formatting 52 52
so that you can search for specific strings 53 53
within that file using the find command. 54 54
Now, you can also use grep to search the contents 55 55
if you're analyzing the contents of that on a Linux system. 56 56
And so both of these are tools you can use. 57 57
Now, all the way back in A+, you learned about regedit, 58 58
and you can see regedit here on the screen, 59 59
which is the registry editor. 60 60
Inside of regedit, 61 61
you have all the different hives of information, 62 62
and as you go down into those particular folders, 63 63
you'll find the individual keys and those keys have data. 64 64
So you could see here I have a registry DNS, 65 65
it's a regular string, 66 66
and then there is some kind of data 67 67
that's going to be filled into there 68 68
as we're editing that string. 69 69
Now as we go into Windows 70 70
and you start looking at your registry, 71 71
there are two types of autorun keys, 72 72
and autorun keys are really important 73 73
because these are the ones 74 74
that attackers use to gain persistence. 75 75
When you deal with autorun keys like Run and RunOnce, 76 76
they're going to allow some kind of program or service 77 77
to actually initialize when you turn on the system. 78 78
If you're using the Run autorun key, 79 79
this is going to initialize its values asynchronously 80 80
when loading them from the registry. 81 81
Now, if you're using RunOnce, 82 82
this is going to initialize its values 83 83
in order when loading them from the registry. 84 84
Now, what does that mean? 85 85
What's the difference here? 86 86
Well, the difference is if I'm using Run, 87 87
I can actually load up all those things in any order, 88 88
but if I'm using RunOnce, 89 89
things are always going to happen in the same order, 90 90
and that can make for a better indicator of compromise. 91 91
Now, where can you find these keys inside the registry? 92 92
Well, you can find them in four places. 93 93
First, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. 94 94
Then you can find them 95 95
in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce. 96 96
Also, you can find it 97 97
in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. 98 98
And finally, you can find it 99 99
in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce. 100 100
(exhales) that's a lot of information there. 101 101
Do you have to memorize these for the exam? 102 102
Well, not really, but in the real world 103 103
this is really important information, 104 104
so keep it in mind and keep it in your notes. 105 105
Now, as you go through these four areas 106 106
and you look at the keys underneath each of them, 107 107
you're going to find different things 108 108
that are located in these Run and RunOnce folders. 109 109
Now, as you look at these, 110 110
remember, these are things that are starting up 111 111
when the system loads. 112 112
So if you see something in there that doesn't look right 113 113
or you're not sure what it is, 114 114
do some research and figure it out 115 115
because attackers love to hide things 116 116
in these keys because it's going to give them persistence. 117 117
Now, another common tactic that's used by malware is 118 118
to modify the registry entries 119 119
for the systems running drivers and services, 120 120
and these are found 121 121
in HKLM\SYSTEM\CurrentControlSet\Services. 122 122
Again, this is another area you should be looking at 123 123
when you're trying to identify things 124 124
that are hiding inside your registry. 125 125
Malware may also attempt to change file associations 126 126
for common executable files, 127 127
things like EXE, BAT, COM, and CMD files, 128 128
also known as exec, bat, com, and command files. 129 129
Now, if you start seeing these type of changes 130 130
that's going to happen inside the registry as well. 131 131
There are file extension registry entries. 132 132
They're located in the following three places. 133 133
You can find them in HKEY_CLASSES_ROOT under HKCR, 134 134
or you can find it under HKEY\SOFTWARE\Classes, 135 135
or under HKCU\SOFTWARE\Classes. 136 136
Another area of the registry 137 137
that you should be looking at is the registry entries 138 138
for recently used files. 139 139
These are usually stored 140 140
in HKCU\SOFTWARE\Microsoft\Windows 141 141
\CurrentVersion\Explorer\RunMRU. 142 142
In this area, you're going to find 143 143
any of those recently used files, 144 144
essentially recent documents, or recent executables, 145 145
and that will tell you what has recently been run 146 146
before you had those indications 147 147
of whatever malicious activity there were. 148 148
Again, this can help you build your timeline 149 149
and identify what things have been run in what order. 150 150
Now, the last thing to consider with the registry is 151 151
that you need to make sure you have a known good baseline. 152 152
By having this known good baseline 153 153
of what the registry should look like, 154 154
you can compare your known key values 155 155
to their current values or to that configuration baseline, 156 156
and this will help you to identify 157 157
if tampering has occurred. 158 158
There are special tools you can use for this, 159 159
as well as just doing a simple comparison 160 160
between the current version 161 161
and the known good baseline version. 162 162
And by doing that difference, 163 163
you can see quickly any changes 164 164
and identify if those are malicious. 165 165
Now, the second way that an attacker 166 166
can gain persistence is to use scheduling. 167 167
Now on Windows, we have the Windows Task Scheduler. 168 168
This is a tool that's there to enable you 169 169
to create new tasks to run at predefined times. 170 170
And this is really helpful, for instance, 171 171
you might want to have every day 172 172
at midnight a virus scan run, 173 173
or every day at 3:00 AM a backup of your computer. 174 174
And Windows Task Scheduler allows you to do that, 175 175
but it can also enable an attacker 176 176
to have some kind of persistence 177 177
because every day at 3:00 AM something's going to happen. 178 178
So what you want to do is look 179 179
through your tasks on the computer 180 180
in your Task Scheduler and see what tasks are there. 181 181
If there's one you don't understand 182 182
or one that looks malicious, 183 183
this could be something that is an indicator of compromise 184 184
and a place that attackers go to maintain persistence. 185 185
To look at the tasks on your system, 186 186
simply open up your Task Scheduler. 187 187
While you're in there, 188 188
you can actually go into that task 189 189
and look at the history of every time it's been run. 190 190
For example here, you can see 191 191
the system service control manager has been run, 192 192
and it happens at a particular time on that event, 193 193
and you can see that it's run at a certain time, 194 194
and under history, you can see all the times it's been run. 195 195
So if you're going back 196 196
and trying to recreate that timeline 197 197
and figure out what bad things have happened, 198 198
and if you find persistence was being used 199 199
by this Task Scheduler, you can go in that history 200 200
and find out exactly when it happened and what happened. 201 201
Now, Task Scheduler may be able to capture the history 202 202
of non-system services as well 203 203
like malware that's installing itself as its own service. 204 204
So it is a great place to look 205 205
as you're doing analysis on a victim machine 206 206
to figure out if there's been persistence 207 207
that's been on that machine 208 208
and what things have been happening. 209 209
Now, that's great if you're using a Windows system, 210 210
but what if you're using a Linux system? 211 211
Well, there is no Windows Task Scheduler on Linux, 212 212
but there is crontab. 213 213
crontab is a tool that matches cron jobs. 214 214
And cron jobs are essentially 215 215
the Linux equivalent of scheduled tasks. 216 216
By using crontab, 217 217
you can actually list out all the current jobs. 218 218
You do this by using crontab -l. 219 219
This command is going to show you the current cron jobs 220 220
that are scheduled to occur. 221 221
By doing this, you can see 222 222
if there's any persistence being used as part of cron job 223 223
that may be running every day at a certain time. 224 224
Now, let's talk about the exam for a second. 225 225
We talked a lot about specific registry keys 226 226
that you should be searching for. 227 227
We talked a lot about in-depth things in this lesson. 228 228
Now, do you need to know these 229 229
and memorize these for the exam? 230 230
Well, no, you don't, but you should be familiar 231 231
with looking at the registry and analyzing it 232 232
and using these keys as your starting point 233 233
in the real world for your job as a cybersecurity analyst. 234 234
These are important things 235 235
that you should put down in your playbook, 236 236
things that you're going to be looking for 237 237
as a cybersecurity analyst. 238 238
But for the exam, 239 239
you don't need to know all this in depth. 240 240
Instead, you need to know 241 241
that there are two main ways that persistence happens. 242 242
One is through the registry 243 243
and the other is through schedule tasks. 244 244
The other thing you need to know 245 245
in terms of the registry is the difference 246 246
between Run and RunOnce. 247 247
And when you see those two things, 248 248
remember they're associated with persistence 249 249
Run, it's going to run those tasks 250 250
asynchronously in any order. 251 251
RunOnce, they're going to run in the specific order. 252 252
Keep that in mind, and you should do your great on the exam.