1 1 00:00:00,180 --> 00:00:02,490 Malicious processes. 2 2 00:00:02,490 --> 00:00:04,590 So the real question we have to ask ourself 3 3 00:00:04,590 --> 00:00:05,423 when we start dealing with 4 4 00:00:05,423 --> 00:00:07,800 malicious process indicators of compromise 5 5 00:00:07,800 --> 00:00:10,650 is how do you tell if something is malicious? 6 6 00:00:10,650 --> 00:00:12,150 Well, one of the ways you do this 7 7 00:00:12,150 --> 00:00:14,460 is by first creating a baseline. 8 8 00:00:14,460 --> 00:00:17,280 You need to know what normal looks like on a system. 9 9 00:00:17,280 --> 00:00:19,500 So when you have a system and you know it's clean 10 10 00:00:19,500 --> 00:00:22,050 because maybe it hasn't been connected to the network yet, 11 11 00:00:22,050 --> 00:00:24,180 you can run some baselines on it. 12 12 00:00:24,180 --> 00:00:26,430 You can identify what are the normal processes 13 13 00:00:26,430 --> 00:00:28,350 that this thing is going to be using, 14 14 00:00:28,350 --> 00:00:30,930 and then as new processes are launched 15 15 00:00:30,930 --> 00:00:32,700 you could see if they're ones you know about 16 16 00:00:32,700 --> 00:00:34,830 or they're ones that are now suspicious 17 17 00:00:34,830 --> 00:00:36,330 that we would look into. 18 18 00:00:36,330 --> 00:00:38,370 When we talk about a suspicious process, 19 19 00:00:38,370 --> 00:00:40,740 we then need to determine is it just suspicious 20 20 00:00:40,740 --> 00:00:42,870 or is it really malicious? 21 21 00:00:42,870 --> 00:00:44,340 If it's a malicious process, 22 22 00:00:44,340 --> 00:00:46,440 this means it's a process that was executed 23 23 00:00:46,440 --> 00:00:49,230 without proper authorization from the system owner 24 24 00:00:49,230 --> 00:00:52,380 for the purpose of damaging or compromising the system. 25 25 00:00:52,380 --> 00:00:54,360 Now, when you deal with a malicious process, 26 26 00:00:54,360 --> 00:00:57,180 this usually comes as the result of malicious code 27 27 00:00:57,180 --> 00:00:58,260 because malicious code 28 28 00:00:58,260 --> 00:01:00,930 will often be injected into a host process 29 29 00:01:00,930 --> 00:01:02,640 by making it load the malware code 30 30 00:01:02,640 --> 00:01:06,900 as part of a dynamic link library, or DLL, within Windows. 31 31 00:01:06,900 --> 00:01:09,990 Now, in Linux, we use a different file called an SO File, 32 32 00:01:09,990 --> 00:01:11,730 but we'll talk about that a little bit later. 33 33 00:01:11,730 --> 00:01:13,050 For now, I want you to remember 34 34 00:01:13,050 --> 00:01:14,760 that malware can actually be shimmed 35 35 00:01:14,760 --> 00:01:17,760 or injected into a process inside of Windows, 36 36 00:01:17,760 --> 00:01:20,400 especially by using dynamic link libraries. 37 37 00:01:20,400 --> 00:01:21,570 Now, when this happens, 38 38 00:01:21,570 --> 00:01:24,780 this can cause abnormal process behavior to occur. 39 39 00:01:24,780 --> 00:01:27,450 Abnormal process behavior is an indicator 40 40 00:01:27,450 --> 00:01:28,590 that a legitimate process 41 41 00:01:28,590 --> 00:01:30,480 has been corrupted with malicious code 42 42 00:01:30,480 --> 00:01:33,930 for the purposes of damaging or compromising the system. 43 43 00:01:33,930 --> 00:01:36,060 Now, when we talk about abnormal behavior, 44 44 00:01:36,060 --> 00:01:37,650 we're talking about things like a process 45 45 00:01:37,650 --> 00:01:40,590 that's making changes to a registry file without permission, 46 46 00:01:40,590 --> 00:01:42,870 accessing data files in temporary locations 47 47 00:01:42,870 --> 00:01:43,860 on the file system, 48 48 00:01:43,860 --> 00:01:46,290 or using the network for malicious activity 49 49 00:01:46,290 --> 00:01:49,050 such as beaconing, or command and control signals, 50 50 00:01:49,050 --> 00:01:51,060 connecting to unknown DNS resolvers, 51 51 00:01:51,060 --> 00:01:53,070 or even trying to use a covert channel. 52 52 00:01:53,070 --> 00:01:55,500 All of these things would be abnormal process behavior 53 53 00:01:55,500 --> 00:01:56,820 because that isn't approved 54 54 00:01:56,820 --> 00:01:59,010 and isn't what we've designed the system to do. 55 55 00:01:59,010 --> 00:02:00,210 Now, to be able to determine 56 56 00:02:00,210 --> 00:02:02,460 if a process is doing something abnormally, 57 57 00:02:02,460 --> 00:02:05,820 you need to use tools to track and report on the processes. 58 58 00:02:05,820 --> 00:02:08,010 This way you can see what processes are 59 59 00:02:08,010 --> 00:02:09,810 or have been in the past running 60 60 00:02:09,810 --> 00:02:12,090 and we compare that against our baseline image. 61 61 00:02:12,090 --> 00:02:14,040 Again, if we know what normal looks like 62 62 00:02:14,040 --> 00:02:15,510 and we compare it to what's running now, 63 63 00:02:15,510 --> 00:02:18,210 we can quickly identify anything suspicious. 64 64 00:02:18,210 --> 00:02:20,460 So let's dive into Windows for a little bit 65 65 00:02:20,460 --> 00:02:22,440 and talk about a couple of tools that we can use 66 66 00:02:22,440 --> 00:02:24,630 to identify malicious processes. 67 67 00:02:24,630 --> 00:02:26,100 Now, like I said earlier, 68 68 00:02:26,100 --> 00:02:28,140 malicious processes could be inserted 69 69 00:02:28,140 --> 00:02:31,860 into some regular process or like a DLL file. 70 70 00:02:31,860 --> 00:02:33,480 Now, if you suspect something is wrong 71 71 00:02:33,480 --> 00:02:34,590 on your Windows system, 72 72 00:02:34,590 --> 00:02:37,050 you might want to run the System File Checker. 73 73 00:02:37,050 --> 00:02:40,950 This program written out as SFC for System File Checker 74 74 00:02:40,950 --> 00:02:43,590 will allow you to scan all the files on the system 75 75 00:02:43,590 --> 00:02:45,180 that are made by the system. 76 76 00:02:45,180 --> 00:02:46,890 It'll check all those protected files 77 77 00:02:46,890 --> 00:02:49,290 and make sure that they're all running the correct versions 78 78 00:02:49,290 --> 00:02:51,360 and they haven't been modified. 79 79 00:02:51,360 --> 00:02:53,880 It does this by using a digital signature 80 80 00:02:53,880 --> 00:02:54,960 on each of those files 81 81 00:02:54,960 --> 00:02:57,180 and checking that it hasn't been changed. 82 82 00:02:57,180 --> 00:03:00,660 In addition to this, we can analyze the processes themself. 83 83 00:03:00,660 --> 00:03:01,920 We can do this using tools 84 84 00:03:01,920 --> 00:03:05,040 like Process Monitor and Process Explorer. 85 85 00:03:05,040 --> 00:03:05,880 Both of these tools 86 86 00:03:05,880 --> 00:03:07,950 come as part of the Sysinternals Tool Suite 87 87 00:03:07,950 --> 00:03:10,440 and they can be used for live analysis and logging 88 88 00:03:10,440 --> 00:03:12,900 of the processes that are being run on a system. 89 89 00:03:12,900 --> 00:03:15,030 In addition to those, we can use Tasklist, 90 90 00:03:15,030 --> 00:03:17,460 which is a command line version of the task manager 91 91 00:03:17,460 --> 00:03:19,890 and we can use that to display things like memory usage, 92 92 00:03:19,890 --> 00:03:22,260 the state of running threads or process trees, 93 93 00:03:22,260 --> 00:03:24,930 and individual operations for each process. 94 94 00:03:24,930 --> 00:03:27,630 Another tool we might use is PE Explorer. 95 95 00:03:27,630 --> 00:03:30,210 Now, PE Explorer is a proprietary software, 96 96 00:03:30,210 --> 00:03:32,070 but it has a lot of different features, 97 97 00:03:32,070 --> 00:03:34,140 including the ability to browse the structure 98 98 00:03:34,140 --> 00:03:36,240 of an executable Windows file. 99 99 00:03:36,240 --> 00:03:39,780 This is a very useful program to dig into certain processes 100 100 00:03:39,780 --> 00:03:41,250 and see what they're calling, 101 101 00:03:41,250 --> 00:03:44,430 for instance which DLLs are they calling up and using. 102 102 00:03:44,430 --> 00:03:47,040 That way you can identify what processes are calling 103 103 00:03:47,040 --> 00:03:49,890 which possibly suspicious DLLs. 104 104 00:03:49,890 --> 00:03:51,240 Now, in addition to Windows, 105 105 00:03:51,240 --> 00:03:53,280 there's a lot of people who are using Linux systems, 106 106 00:03:53,280 --> 00:03:54,600 especially Linux servers, 107 107 00:03:54,600 --> 00:03:57,240 and so we have to look at some Linux tools too. 108 108 00:03:57,240 --> 00:04:01,350 On Linux, we have tools like pstree and ps. 109 109 00:04:01,350 --> 00:04:03,480 Now, both of these will allow you to look at processes, 110 110 00:04:03,480 --> 00:04:05,130 but in a very different way. 111 111 00:04:05,130 --> 00:04:06,930 Before we dig into these two tools though, 112 112 00:04:06,930 --> 00:04:09,750 we need to talk about some basic terms within Linux 113 113 00:04:09,750 --> 00:04:11,340 because it's important to understand these 114 114 00:04:11,340 --> 00:04:13,380 before we can look at processes within Linux 115 115 00:04:13,380 --> 00:04:16,050 because they do run a little bit differently than Windows. 116 116 00:04:16,050 --> 00:04:18,180 First, we have the term daemon. 117 117 00:04:18,180 --> 00:04:19,980 Now, a daemon is a background service 118 118 00:04:19,980 --> 00:04:21,720 in the Linux operating system, 119 119 00:04:21,720 --> 00:04:24,510 and it runs as a process with the letter d after it. 120 120 00:04:24,510 --> 00:04:27,300 For instance, if you're running an http server, 121 121 00:04:27,300 --> 00:04:32,190 it would be known as httpd, which is the http daemon. 122 122 00:04:32,190 --> 00:04:34,200 We also have the secure shell daemon, 123 123 00:04:34,200 --> 00:04:36,600 or the file transfer protocol daemon. 124 124 00:04:36,600 --> 00:04:38,790 All of these are basically background services 125 125 00:04:38,790 --> 00:04:40,620 that can run inside the system. 126 126 00:04:40,620 --> 00:04:42,990 Now, there is a specific daemon that we need to talk about 127 127 00:04:42,990 --> 00:04:44,460 before we jump into processes 128 128 00:04:44,460 --> 00:04:47,040 and this is the first daemon that's launched on a system. 129 129 00:04:47,040 --> 00:04:49,200 It's known as systemd. 130 130 00:04:49,200 --> 00:04:52,740 The init daemon in Linux is the first executed by the kernel 131 131 00:04:52,740 --> 00:04:54,420 during your boot up process, 132 132 00:04:54,420 --> 00:04:58,260 and it's always going to have a process ID, or PID, of 1. 133 133 00:04:58,260 --> 00:05:01,950 Now, that brings up the term PID, which is a process ID. 134 134 00:05:01,950 --> 00:05:03,360 Now, a process ID, 135 135 00:05:03,360 --> 00:05:05,730 or process identification number, is a PID, 136 136 00:05:05,730 --> 00:05:07,620 and this is a unique identification number 137 137 00:05:07,620 --> 00:05:10,260 of a process launched by a Linux system. 138 138 00:05:10,260 --> 00:05:12,690 We use this PID to identify the process 139 139 00:05:12,690 --> 00:05:15,480 and, if needed, kill that process. 140 140 00:05:15,480 --> 00:05:19,320 Now, in addition to a PID, every PID has a parent PID, 141 141 00:05:19,320 --> 00:05:21,990 and a parent PID is a unique identification number 142 142 00:05:21,990 --> 00:05:23,250 of the parent process 143 143 00:05:23,250 --> 00:05:25,980 for every process launched by a Linux system. 144 144 00:05:25,980 --> 00:05:28,200 So now with all of that background behind us, 145 145 00:05:28,200 --> 00:05:32,520 we can now go into our tools and the first one is pstree. 146 146 00:05:32,520 --> 00:05:34,740 Now, pstree is a Linux command 147 147 00:05:34,740 --> 00:05:36,690 that provides a parent/child relationship 148 148 00:05:36,690 --> 00:05:39,510 of all the processes on a given system. 149 149 00:05:39,510 --> 00:05:43,620 So if I run pstree, I'm going to see something like this. 150 150 00:05:43,620 --> 00:05:45,900 Now, notice the first process we see. 151 151 00:05:45,900 --> 00:05:49,050 systemd with a process ID of 1. 152 152 00:05:49,050 --> 00:05:51,180 This is the first process that is launched 153 153 00:05:51,180 --> 00:05:52,950 when you start up the system. 154 154 00:05:52,950 --> 00:05:55,410 All the other processes you see on the screen 155 155 00:05:55,410 --> 00:05:57,990 are going to be children of systemd. 156 156 00:05:57,990 --> 00:06:01,260 Now, the first process on my screen here is ModemManager, 157 157 00:06:01,260 --> 00:06:04,500 which shows up as process ID 936. 158 158 00:06:04,500 --> 00:06:07,020 This is the child of systemd 159 159 00:06:07,020 --> 00:06:10,800 and it is a child of parent process ID 1. 160 160 00:06:10,800 --> 00:06:12,450 Now, underneath ModemManager 161 161 00:06:12,450 --> 00:06:15,480 we have additional processes that have been launched. 162 162 00:06:15,480 --> 00:06:17,700 You can see here gdbus. 163 163 00:06:17,700 --> 00:06:19,440 Now, notice next to gdbus 164 164 00:06:19,440 --> 00:06:22,620 we have the same process ID of 936. 165 165 00:06:22,620 --> 00:06:25,890 That's because it's saying 936 launched me, 166 166 00:06:25,890 --> 00:06:28,170 which in this case was the ModemManager. 167 167 00:06:28,170 --> 00:06:31,560 So gdbus is a sub-process or child process 168 168 00:06:31,560 --> 00:06:33,240 of the ModemManager. 169 169 00:06:33,240 --> 00:06:34,980 Now, if I jump down to the next one, 170 170 00:06:34,980 --> 00:06:36,570 you can see NetworkManager. 171 171 00:06:36,570 --> 00:06:38,910 And under that we also have gdbus, 172 172 00:06:38,910 --> 00:06:41,490 but this version of gdbus, this process, 173 173 00:06:41,490 --> 00:06:45,300 was launched under 928, which is the NetworkManager. 174 174 00:06:45,300 --> 00:06:48,660 So you can have processes that are launched multiple times 175 175 00:06:48,660 --> 00:06:50,670 from multiple different other processes 176 176 00:06:50,670 --> 00:06:52,650 and the child process will always link back 177 177 00:06:52,650 --> 00:06:56,250 to the parent ID using that parenthesis after its name. 178 178 00:06:56,250 --> 00:06:59,940 Now, the other process analysis tool we have in Linux is ps. 179 179 00:06:59,940 --> 00:07:02,070 And ps is a command that lists the attributes 180 180 00:07:02,070 --> 00:07:04,200 of all the current processes. 181 181 00:07:04,200 --> 00:07:06,450 So if I use the ps command, 182 182 00:07:06,450 --> 00:07:09,060 by default it's only going to show processes 183 183 00:07:09,060 --> 00:07:11,850 started by the current user when you launch it. 184 184 00:07:11,850 --> 00:07:15,030 So if I go to my command prompt and type in ps, enter, 185 185 00:07:15,030 --> 00:07:17,310 all I'm going to get is the one process 186 186 00:07:17,310 --> 00:07:18,570 that was launched by me. 187 187 00:07:18,570 --> 00:07:21,480 In this case, I've only launched one process on my system, 188 188 00:07:21,480 --> 00:07:24,780 the bash command, which was this shell that I'm typing into. 189 189 00:07:24,780 --> 00:07:26,670 Now, if I want to take this further 190 190 00:07:26,670 --> 00:07:28,080 and be able to see a full list 191 191 00:07:28,080 --> 00:07:30,840 of all the running processes for all the users, 192 192 00:07:30,840 --> 00:07:35,580 I'm going to use the command ps-A or ps-e. 193 193 00:07:35,580 --> 00:07:38,100 Both of these are equivalent to show me a full list 194 194 00:07:38,100 --> 00:07:40,740 of all the running processes for all the users, 195 195 00:07:40,740 --> 00:07:42,750 and it'll look something like this. 196 196 00:07:42,750 --> 00:07:46,830 Notice here I use ps-A, and you could see PID 1. 197 197 00:07:46,830 --> 00:07:48,060 It was the first one launched, 198 198 00:07:48,060 --> 00:07:51,090 and it was launched as sbin/launchd, 199 199 00:07:51,090 --> 00:07:53,430 which again launches the system daemon. 200 200 00:07:53,430 --> 00:07:55,650 And then I have other process IDs going down. 201 201 00:07:55,650 --> 00:07:59,160 For instance, 43 shows me that I launched the syslog daemon. 202 202 00:07:59,160 --> 00:08:02,280 44 shows me that I launched the UserEventAgent. 203 203 00:08:02,280 --> 00:08:04,650 All of these are different daemons and different processes 204 204 00:08:04,650 --> 00:08:06,780 that have been launched on my system, 205 205 00:08:06,780 --> 00:08:08,520 but they weren't launched by me. 206 206 00:08:08,520 --> 00:08:10,200 A lot of these were launched by other users 207 207 00:08:10,200 --> 00:08:12,120 or the operating system itself. 208 208 00:08:12,120 --> 00:08:14,160 In this case, it was launched by the operating system 209 209 00:08:14,160 --> 00:08:15,840 when I booted up my computer. 210 210 00:08:15,840 --> 00:08:17,400 Now, as you could see here on the screen, 211 211 00:08:17,400 --> 00:08:20,970 there is a lot of information inside the ps command. 212 212 00:08:20,970 --> 00:08:23,460 I get the PID, which tells me what process it is. 213 213 00:08:23,460 --> 00:08:26,130 I get the TTY if we're connected remotely. 214 214 00:08:26,130 --> 00:08:27,510 I get the TIME which tells me 215 215 00:08:27,510 --> 00:08:29,310 how long has this been up and running. 216 216 00:08:29,310 --> 00:08:31,230 And then I have the command that launched it. 217 217 00:08:31,230 --> 00:08:32,910 So when you're looking at all this data, 218 218 00:08:32,910 --> 00:08:34,890 it actually goes on for several pages. 219 219 00:08:34,890 --> 00:08:38,100 I only showed you a small chunk of my operating system here. 220 220 00:08:38,100 --> 00:08:40,260 If you want to define certain commands, 221 221 00:08:40,260 --> 00:08:42,960 for instance, I wanted to search and find cron command, 222 222 00:08:42,960 --> 00:08:46,920 I can do that by using ps-C, for command, 223 223 00:08:46,920 --> 00:08:49,440 and then the command I'm looking for, cron. 224 224 00:08:49,440 --> 00:08:52,380 This command will display the process for the cron command, 225 225 00:08:52,380 --> 00:08:54,840 essentially just the one line I need. 226 226 00:08:54,840 --> 00:08:57,300 Now, if I wanted to sort all that display, 227 227 00:08:57,300 --> 00:08:59,850 I can do that by using ps-A 228 228 00:08:59,850 --> 00:09:02,310 and then piping that over to the sort command. 229 229 00:09:02,310 --> 00:09:04,380 We talked about the sort command previously. 230 230 00:09:04,380 --> 00:09:07,500 When we're dealing with the sort command with -k3, 231 231 00:09:07,500 --> 00:09:08,760 what does that mean? 232 232 00:09:08,760 --> 00:09:11,400 Well, it means I'm going to sort the third column, 233 233 00:09:11,400 --> 00:09:12,960 which was execution time, 234 234 00:09:12,960 --> 00:09:14,790 and that I'm going to display to the screen. 235 235 00:09:14,790 --> 00:09:18,690 So now I can see what has been executed the longest 236 236 00:09:18,690 --> 00:09:20,970 or what has been executed the shortest. 237 237 00:09:20,970 --> 00:09:23,130 This way I can sort things by execution time 238 238 00:09:23,130 --> 00:09:24,330 and if I know something happened 239 239 00:09:24,330 --> 00:09:26,040 five minutes ago in my system, 240 240 00:09:26,040 --> 00:09:28,500 I can go back and look what happened five minutes ago 241 241 00:09:28,500 --> 00:09:31,410 that may be malicious and identify that process. 242 242 00:09:31,410 --> 00:09:32,610 Now, as I mentioned earlier, 243 243 00:09:32,610 --> 00:09:33,840 when you're dealing with Windows, 244 244 00:09:33,840 --> 00:09:36,750 malware will try to inject itself into DLLs, 245 245 00:09:36,750 --> 00:09:39,390 while in Linux, malware's often going to use injection 246 246 00:09:39,390 --> 00:09:41,520 into Linux shared libraries. 247 247 00:09:41,520 --> 00:09:45,090 These are also known as Shared Objects or .so files. 248 248 00:09:45,090 --> 00:09:46,590 If you're responsible for conducting 249 249 00:09:46,590 --> 00:09:48,180 threat hunting on Linux systems, 250 250 00:09:48,180 --> 00:09:49,890 it is recommended that you start learning 251 251 00:09:49,890 --> 00:09:52,500 about these Shared Objects or these SO files 252 252 00:09:52,500 --> 00:09:54,840 because they're often the target of malicious code 253 253 00:09:54,840 --> 00:09:56,223 being injected into them.