1 1 00:00:00,600 --> 00:00:02,460 Persistence. 2 2 00:00:02,460 --> 00:00:04,410 The last type of indicator of compromise 3 3 00:00:04,410 --> 00:00:06,870 we need to talk about is persistence. 4 4 00:00:06,870 --> 00:00:08,220 Now, persistence is important 5 5 00:00:08,220 --> 00:00:11,040 because persistence is the ability of a threat actor 6 6 00:00:11,040 --> 00:00:14,790 to maintain covert access to a target host or a network. 7 7 00:00:14,790 --> 00:00:16,530 This means that they've gotten into your network, 8 8 00:00:16,530 --> 00:00:18,420 and now they're hanging in there. 9 9 00:00:18,420 --> 00:00:19,890 They're not going to go anywhere, 10 10 00:00:19,890 --> 00:00:22,110 and that's what persistence is all about. 11 11 00:00:22,110 --> 00:00:24,030 Now, persistence is usually going to rely 12 12 00:00:24,030 --> 00:00:27,870 on modifying the registry or a system's scheduled tasks. 13 13 00:00:27,870 --> 00:00:30,390 And therefore, you need to look in both of these areas 14 14 00:00:30,390 --> 00:00:32,310 as you're trying to find any anomalies 15 15 00:00:32,310 --> 00:00:34,530 or any signs of persistence. 16 16 00:00:34,530 --> 00:00:36,510 Let's go ahead and start with the registry. 17 17 00:00:36,510 --> 00:00:38,670 Now first, what is the registry? 18 18 00:00:38,670 --> 00:00:41,220 Well, the registry is a hierarchal database 19 19 00:00:41,220 --> 00:00:44,460 that stores low-level settings for Microsoft Windows 20 20 00:00:44,460 --> 00:00:45,750 inside that operating system, 21 21 00:00:45,750 --> 00:00:49,590 and for the kernel itself, the device drivers, the services, 22 22 00:00:49,590 --> 00:00:52,800 the security accounts manager, and the user interface. 23 23 00:00:52,800 --> 00:00:54,990 All of this is stored within the registry. 24 24 00:00:54,990 --> 00:00:57,090 It's essentially this big database of knowledge 25 25 00:00:57,090 --> 00:01:00,960 about the system and everything that happens to that system. 26 26 00:01:00,960 --> 00:01:03,390 Now, a registry viewer is a tool that can allow you 27 27 00:01:03,390 --> 00:01:06,960 to extract the Windows Registry files from an image, 28 28 00:01:06,960 --> 00:01:09,930 and then display them on the analysis workstation. 29 29 00:01:09,930 --> 00:01:11,850 This way, as you're doing your analysis, 30 30 00:01:11,850 --> 00:01:13,350 you can see all the different things 31 31 00:01:13,350 --> 00:01:15,090 that were inside that registry 32 32 00:01:15,090 --> 00:01:17,580 and pull out the important pieces you need. 33 33 00:01:17,580 --> 00:01:19,354 If you're dealing with something 34 34 00:01:19,354 --> 00:01:20,940 like EnCase or FTK for your forensics, 35 35 00:01:20,940 --> 00:01:23,310 you can actually look at the registry through those tools, 36 36 00:01:23,310 --> 00:01:25,080 or extract the registry out 37 37 00:01:25,080 --> 00:01:27,333 and then open it inside a registry viewer. 38 38 00:01:28,320 --> 00:01:31,590 Now, Windows does have its own registry viewer built into it 39 39 00:01:31,590 --> 00:01:33,210 and this is actually called regedit, 40 40 00:01:33,210 --> 00:01:35,160 but it does have a big disadvantage. 41 41 00:01:35,160 --> 00:01:38,250 This is because the built-in regedit tool doesn't display 42 42 00:01:38,250 --> 00:01:41,940 the last modification time of a value by default. 43 43 00:01:41,940 --> 00:01:44,400 This way, you won't know when it was modified last, 44 44 00:01:44,400 --> 00:01:46,830 and that's a big indicator of compromise for you 45 45 00:01:46,830 --> 00:01:48,360 is knowing when things happened 46 46 00:01:48,360 --> 00:01:50,190 and using that to build your timeline. 47 47 00:01:50,190 --> 00:01:52,920 So it's not recommended that you use regedit. 48 48 00:01:52,920 --> 00:01:55,320 Instead, you should use different tools. 49 49 00:01:55,320 --> 00:01:58,200 For example, you might want to use regdump. 50 50 00:01:58,200 --> 00:02:00,690 This is a tool that dumps the contents of the registry 51 51 00:02:00,690 --> 00:02:03,120 into a text file with simple formatting 52 52 00:02:03,120 --> 00:02:05,100 so that you can search for specific strings 53 53 00:02:05,100 --> 00:02:07,860 within that file using the find command. 54 54 00:02:07,860 --> 00:02:10,140 Now, you can also use grep to search the contents 55 55 00:02:10,140 --> 00:02:13,320 if you're analyzing the contents of that on a Linux system. 56 56 00:02:13,320 --> 00:02:16,170 And so both of these are tools you can use. 57 57 00:02:16,170 --> 00:02:20,040 Now, all the way back in A+, you learned about regedit, 58 58 00:02:20,040 --> 00:02:21,690 and you can see regedit here on the screen, 59 59 00:02:21,690 --> 00:02:23,580 which is the registry editor. 60 60 00:02:23,580 --> 00:02:24,630 Inside of regedit, 61 61 00:02:24,630 --> 00:02:26,820 you have all the different hives of information, 62 62 00:02:26,820 --> 00:02:29,340 and as you go down into those particular folders, 63 63 00:02:29,340 --> 00:02:33,030 you'll find the individual keys and those keys have data. 64 64 00:02:33,030 --> 00:02:35,790 So you could see here I have a registry DNS, 65 65 00:02:35,790 --> 00:02:37,140 it's a regular string, 66 66 00:02:37,140 --> 00:02:38,880 and then there is some kind of data 67 67 00:02:38,880 --> 00:02:40,290 that's going to be filled into there 68 68 00:02:40,290 --> 00:02:42,210 as we're editing that string. 69 69 00:02:42,210 --> 00:02:44,100 Now as we go into Windows 70 70 00:02:44,100 --> 00:02:45,750 and you start looking at your registry, 71 71 00:02:45,750 --> 00:02:48,000 there are two types of autorun keys, 72 72 00:02:48,000 --> 00:02:50,430 and autorun keys are really important 73 73 00:02:50,430 --> 00:02:51,810 because these are the ones 74 74 00:02:51,810 --> 00:02:54,420 that attackers use to gain persistence. 75 75 00:02:54,420 --> 00:02:57,810 When you deal with autorun keys like Run and RunOnce, 76 76 00:02:57,810 --> 00:03:00,090 they're going to allow some kind of program or service 77 77 00:03:00,090 --> 00:03:02,940 to actually initialize when you turn on the system. 78 78 00:03:02,940 --> 00:03:05,220 If you're using the Run autorun key, 79 79 00:03:05,220 --> 00:03:07,890 this is going to initialize its values asynchronously 80 80 00:03:07,890 --> 00:03:10,140 when loading them from the registry. 81 81 00:03:10,140 --> 00:03:11,670 Now, if you're using RunOnce, 82 82 00:03:11,670 --> 00:03:13,230 this is going to initialize its values 83 83 00:03:13,230 --> 00:03:15,930 in order when loading them from the registry. 84 84 00:03:15,930 --> 00:03:16,980 Now, what does that mean? 85 85 00:03:16,980 --> 00:03:18,450 What's the difference here? 86 86 00:03:18,450 --> 00:03:21,540 Well, the difference is if I'm using Run, 87 87 00:03:21,540 --> 00:03:24,780 I can actually load up all those things in any order, 88 88 00:03:24,780 --> 00:03:26,070 but if I'm using RunOnce, 89 89 00:03:26,070 --> 00:03:28,590 things are always going to happen in the same order, 90 90 00:03:28,590 --> 00:03:31,470 and that can make for a better indicator of compromise. 91 91 00:03:31,470 --> 00:03:34,860 Now, where can you find these keys inside the registry? 92 92 00:03:34,860 --> 00:03:37,380 Well, you can find them in four places. 93 93 00:03:37,380 --> 00:03:42,380 First, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. 94 94 00:03:44,910 --> 00:03:45,930 Then you can find them 95 95 00:03:45,930 --> 00:03:50,930 in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce. 96 96 00:03:52,830 --> 00:03:54,000 Also, you can find it 97 97 00:03:54,000 --> 00:03:59,000 in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. 98 98 00:04:00,870 --> 00:04:02,340 And finally, you can find it 99 99 00:04:02,340 --> 00:04:07,340 in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce. 100 100 00:04:09,941 --> 00:04:12,644 (exhales) that's a lot of information there. 101 101 00:04:12,644 --> 00:04:13,920 Do you have to memorize these for the exam? 102 102 00:04:13,920 --> 00:04:16,830 Well, not really, but in the real world 103 103 00:04:16,830 --> 00:04:18,870 this is really important information, 104 104 00:04:18,870 --> 00:04:21,510 so keep it in mind and keep it in your notes. 105 105 00:04:21,510 --> 00:04:23,280 Now, as you go through these four areas 106 106 00:04:23,280 --> 00:04:25,410 and you look at the keys underneath each of them, 107 107 00:04:25,410 --> 00:04:26,970 you're going to find different things 108 108 00:04:26,970 --> 00:04:29,910 that are located in these Run and RunOnce folders. 109 109 00:04:29,910 --> 00:04:31,440 Now, as you look at these, 110 110 00:04:31,440 --> 00:04:33,540 remember, these are things that are starting up 111 111 00:04:33,540 --> 00:04:34,980 when the system loads. 112 112 00:04:34,980 --> 00:04:37,050 So if you see something in there that doesn't look right 113 113 00:04:37,050 --> 00:04:38,550 or you're not sure what it is, 114 114 00:04:38,550 --> 00:04:40,260 do some research and figure it out 115 115 00:04:40,260 --> 00:04:42,330 because attackers love to hide things 116 116 00:04:42,330 --> 00:04:46,170 in these keys because it's going to give them persistence. 117 117 00:04:46,170 --> 00:04:48,870 Now, another common tactic that's used by malware is 118 118 00:04:48,870 --> 00:04:50,550 to modify the registry entries 119 119 00:04:50,550 --> 00:04:53,160 for the systems running drivers and services, 120 120 00:04:53,160 --> 00:04:53,993 and these are found 121 121 00:04:53,993 --> 00:04:58,890 in HKLM\SYSTEM\CurrentControlSet\Services. 122 122 00:04:58,890 --> 00:05:01,440 Again, this is another area you should be looking at 123 123 00:05:01,440 --> 00:05:02,940 when you're trying to identify things 124 124 00:05:02,940 --> 00:05:05,340 that are hiding inside your registry. 125 125 00:05:05,340 --> 00:05:08,610 Malware may also attempt to change file associations 126 126 00:05:08,610 --> 00:05:10,680 for common executable files, 127 127 00:05:10,680 --> 00:05:15,680 things like EXE, BAT, COM, and CMD files, 128 128 00:05:15,840 --> 00:05:20,130 also known as exec, bat, com, and command files. 129 129 00:05:20,130 --> 00:05:22,110 Now, if you start seeing these type of changes 130 130 00:05:22,110 --> 00:05:24,990 that's going to happen inside the registry as well. 131 131 00:05:24,990 --> 00:05:27,000 There are file extension registry entries. 132 132 00:05:27,000 --> 00:05:29,460 They're located in the following three places. 133 133 00:05:29,460 --> 00:05:31,960 You can find them in HKEY_CLASSES_ROOT under HKCR, 134 134 00:05:34,778 --> 00:05:38,522 or you can find it under HKEY\SOFTWARE\Classes, 135 135 00:05:38,522 --> 00:05:42,390 or under HKCU\SOFTWARE\Classes. 136 136 00:05:42,390 --> 00:05:43,710 Another area of the registry 137 137 00:05:43,710 --> 00:05:46,380 that you should be looking at is the registry entries 138 138 00:05:46,380 --> 00:05:48,300 for recently used files. 139 139 00:05:48,300 --> 00:05:49,440 These are usually stored 140 140 00:05:49,440 --> 00:05:54,286 in HKCU\SOFTWARE\Microsoft\Windows 141 141 00:05:54,286 --> 00:05:58,500 \CurrentVersion\Explorer\RunMRU. 142 142 00:05:58,500 --> 00:06:00,030 In this area, you're going to find 143 143 00:06:00,030 --> 00:06:02,070 any of those recently used files, 144 144 00:06:02,070 --> 00:06:05,250 essentially recent documents, or recent executables, 145 145 00:06:05,250 --> 00:06:07,470 and that will tell you what has recently been run 146 146 00:06:07,470 --> 00:06:09,090 before you had those indications 147 147 00:06:09,090 --> 00:06:10,950 of whatever malicious activity there were. 148 148 00:06:10,950 --> 00:06:12,870 Again, this can help you build your timeline 149 149 00:06:12,870 --> 00:06:16,230 and identify what things have been run in what order. 150 150 00:06:16,230 --> 00:06:18,540 Now, the last thing to consider with the registry is 151 151 00:06:18,540 --> 00:06:22,230 that you need to make sure you have a known good baseline. 152 152 00:06:22,230 --> 00:06:23,760 By having this known good baseline 153 153 00:06:23,760 --> 00:06:25,590 of what the registry should look like, 154 154 00:06:25,590 --> 00:06:27,480 you can compare your known key values 155 155 00:06:27,480 --> 00:06:30,570 to their current values or to that configuration baseline, 156 156 00:06:30,570 --> 00:06:31,920 and this will help you to identify 157 157 00:06:31,920 --> 00:06:33,390 if tampering has occurred. 158 158 00:06:33,390 --> 00:06:35,430 There are special tools you can use for this, 159 159 00:06:35,430 --> 00:06:37,710 as well as just doing a simple comparison 160 160 00:06:37,710 --> 00:06:39,360 between the current version 161 161 00:06:39,360 --> 00:06:41,400 and the known good baseline version. 162 162 00:06:41,400 --> 00:06:42,630 And by doing that difference, 163 163 00:06:42,630 --> 00:06:44,310 you can see quickly any changes 164 164 00:06:44,310 --> 00:06:46,260 and identify if those are malicious. 165 165 00:06:46,260 --> 00:06:47,700 Now, the second way that an attacker 166 166 00:06:47,700 --> 00:06:50,580 can gain persistence is to use scheduling. 167 167 00:06:50,580 --> 00:06:53,400 Now on Windows, we have the Windows Task Scheduler. 168 168 00:06:53,400 --> 00:06:55,230 This is a tool that's there to enable you 169 169 00:06:55,230 --> 00:06:57,900 to create new tasks to run at predefined times. 170 170 00:06:57,900 --> 00:06:59,520 And this is really helpful, for instance, 171 171 00:06:59,520 --> 00:07:00,990 you might want to have every day 172 172 00:07:00,990 --> 00:07:03,330 at midnight a virus scan run, 173 173 00:07:03,330 --> 00:07:06,120 or every day at 3:00 AM a backup of your computer. 174 174 00:07:06,120 --> 00:07:08,520 And Windows Task Scheduler allows you to do that, 175 175 00:07:08,520 --> 00:07:10,980 but it can also enable an attacker 176 176 00:07:10,980 --> 00:07:12,330 to have some kind of persistence 177 177 00:07:12,330 --> 00:07:15,780 because every day at 3:00 AM something's going to happen. 178 178 00:07:15,780 --> 00:07:17,460 So what you want to do is look 179 179 00:07:17,460 --> 00:07:19,260 through your tasks on the computer 180 180 00:07:19,260 --> 00:07:22,530 in your Task Scheduler and see what tasks are there. 181 181 00:07:22,530 --> 00:07:23,820 If there's one you don't understand 182 182 00:07:23,820 --> 00:07:25,230 or one that looks malicious, 183 183 00:07:25,230 --> 00:07:27,660 this could be something that is an indicator of compromise 184 184 00:07:27,660 --> 00:07:31,080 and a place that attackers go to maintain persistence. 185 185 00:07:31,080 --> 00:07:32,550 To look at the tasks on your system, 186 186 00:07:32,550 --> 00:07:34,860 simply open up your Task Scheduler. 187 187 00:07:34,860 --> 00:07:35,880 While you're in there, 188 188 00:07:35,880 --> 00:07:37,950 you can actually go into that task 189 189 00:07:37,950 --> 00:07:40,770 and look at the history of every time it's been run. 190 190 00:07:40,770 --> 00:07:42,510 For example here, you can see 191 191 00:07:42,510 --> 00:07:45,540 the system service control manager has been run, 192 192 00:07:45,540 --> 00:07:47,790 and it happens at a particular time on that event, 193 193 00:07:47,790 --> 00:07:50,070 and you can see that it's run at a certain time, 194 194 00:07:50,070 --> 00:07:53,130 and under history, you can see all the times it's been run. 195 195 00:07:53,130 --> 00:07:54,000 So if you're going back 196 196 00:07:54,000 --> 00:07:55,620 and trying to recreate that timeline 197 197 00:07:55,620 --> 00:07:57,720 and figure out what bad things have happened, 198 198 00:07:57,720 --> 00:07:59,520 and if you find persistence was being used 199 199 00:07:59,520 --> 00:08:02,220 by this Task Scheduler, you can go in that history 200 200 00:08:02,220 --> 00:08:05,550 and find out exactly when it happened and what happened. 201 201 00:08:05,550 --> 00:08:08,610 Now, Task Scheduler may be able to capture the history 202 202 00:08:08,610 --> 00:08:10,650 of non-system services as well 203 203 00:08:10,650 --> 00:08:13,650 like malware that's installing itself as its own service. 204 204 00:08:13,650 --> 00:08:15,000 So it is a great place to look 205 205 00:08:15,000 --> 00:08:17,520 as you're doing analysis on a victim machine 206 206 00:08:17,520 --> 00:08:19,500 to figure out if there's been persistence 207 207 00:08:19,500 --> 00:08:20,640 that's been on that machine 208 208 00:08:20,640 --> 00:08:23,010 and what things have been happening. 209 209 00:08:23,010 --> 00:08:25,500 Now, that's great if you're using a Windows system, 210 210 00:08:25,500 --> 00:08:27,720 but what if you're using a Linux system? 211 211 00:08:27,720 --> 00:08:30,750 Well, there is no Windows Task Scheduler on Linux, 212 212 00:08:30,750 --> 00:08:32,850 but there is crontab. 213 213 00:08:32,850 --> 00:08:35,400 crontab is a tool that matches cron jobs. 214 214 00:08:35,400 --> 00:08:36,840 And cron jobs are essentially 215 215 00:08:36,840 --> 00:08:39,480 the Linux equivalent of scheduled tasks. 216 216 00:08:39,480 --> 00:08:40,770 By using crontab, 217 217 00:08:40,770 --> 00:08:43,470 you can actually list out all the current jobs. 218 218 00:08:43,470 --> 00:08:46,560 You do this by using crontab -l. 219 219 00:08:46,560 --> 00:08:48,840 This command is going to show you the current cron jobs 220 220 00:08:48,840 --> 00:08:50,490 that are scheduled to occur. 221 221 00:08:50,490 --> 00:08:51,690 By doing this, you can see 222 222 00:08:51,690 --> 00:08:55,140 if there's any persistence being used as part of cron job 223 223 00:08:55,140 --> 00:08:57,720 that may be running every day at a certain time. 224 224 00:08:57,720 --> 00:09:00,030 Now, let's talk about the exam for a second. 225 225 00:09:00,030 --> 00:09:02,880 We talked a lot about specific registry keys 226 226 00:09:02,880 --> 00:09:04,350 that you should be searching for. 227 227 00:09:04,350 --> 00:09:07,380 We talked a lot about in-depth things in this lesson. 228 228 00:09:07,380 --> 00:09:08,580 Now, do you need to know these 229 229 00:09:08,580 --> 00:09:10,200 and memorize these for the exam? 230 230 00:09:10,200 --> 00:09:13,200 Well, no, you don't, but you should be familiar 231 231 00:09:13,200 --> 00:09:15,570 with looking at the registry and analyzing it 232 232 00:09:15,570 --> 00:09:17,880 and using these keys as your starting point 233 233 00:09:17,880 --> 00:09:21,270 in the real world for your job as a cybersecurity analyst. 234 234 00:09:21,270 --> 00:09:22,440 These are important things 235 235 00:09:22,440 --> 00:09:24,450 that you should put down in your playbook, 236 236 00:09:24,450 --> 00:09:25,800 things that you're going to be looking for 237 237 00:09:25,800 --> 00:09:27,420 as a cybersecurity analyst. 238 238 00:09:27,420 --> 00:09:28,710 But for the exam, 239 239 00:09:28,710 --> 00:09:30,630 you don't need to know all this in depth. 240 240 00:09:30,630 --> 00:09:31,980 Instead, you need to know 241 241 00:09:31,980 --> 00:09:35,130 that there are two main ways that persistence happens. 242 242 00:09:35,130 --> 00:09:36,450 One is through the registry 243 243 00:09:36,450 --> 00:09:38,760 and the other is through schedule tasks. 244 244 00:09:38,760 --> 00:09:40,140 The other thing you need to know 245 245 00:09:40,140 --> 00:09:42,270 in terms of the registry is the difference 246 246 00:09:42,270 --> 00:09:44,430 between Run and RunOnce. 247 247 00:09:44,430 --> 00:09:45,690 And when you see those two things, 248 248 00:09:45,690 --> 00:09:48,330 remember they're associated with persistence 249 249 00:09:48,330 --> 00:09:50,250 Run, it's going to run those tasks 250 250 00:09:50,250 --> 00:09:52,410 asynchronously in any order. 251 251 00:09:52,410 --> 00:09:55,290 RunOnce, they're going to run in the specific order. 252 252 00:09:55,290 --> 00:09:58,103 Keep that in mind, and you should do your great on the exam.