Narrator: Malicious processes. 2 2
So the real question we have to ask ourself 3 3
when we start dealing with 4 4
malicious process indicators of compromise 5 5
is how do you tell if something is malicious? 6 6
Well, one of the ways you do this 7 7
is by first creating a baseline. 8 8
You need to know what normal looks like on a system. 9 9
So when you have a system and you know it's clean 10 10
because maybe it hasn't been connected to the network yet, 11 11
you can run some baselines on it. 12 12
You can identify what are the normal processes 13 13
that this thing is going to be using, 14 14
and then as new processes are launched 15 15
you could see if they're ones you know about 16 16
or they're ones that are now suspicious 17 17
that we would look into. 18 18
When we talk about a suspicious process, 19 19
we then need to determine is it just suspicious 20 20
or is it really malicious? 21 21
If it's a malicious process, 22 22
this means it's a process that was executed 23 23
without proper authorization from the system owner 24 24
for the purpose of damaging or compromising the system. 25 25
Now, when you deal with a malicious process, 26 26
this usually comes as the result of malicious code 27 27
because malicious code 28 28
will often be injected into a host process 29 29
by making it load the malware code 30 30
as part of a dynamic link library, or DLL, within Windows. 31 31
Now, in Linux, we use a different file called an SO File, 32 32
but we'll talk about that a little bit later. 33 33
For now, I want you to remember 34 34
that malware can actually be shimmed 35 35
or injected into a process inside of Windows, 36 36
especially by using dynamic link libraries. 37 37
Now, when this happens, 38 38
this can cause abnormal process behavior to occur. 39 39
Abnormal process behavior is an indicator 40 40
that a legitimate process 41 41
has been corrupted with malicious code 42 42
for the purposes of damaging or compromising the system. 43 43
Now, when we talk about abnormal behavior, 44 44
we're talking about things like a process 45 45
that's making changes to a registry file without permission, 46 46
accessing data files in temporary locations 47 47
on the file system, 48 48
or using the network for malicious activity 49 49
such as beaconing, or command and control signals, 50 50
connecting to unknown DNS resolvers, 51 51
or even trying to use a covert channel. 52 52
All of these things would be abnormal process behavior 53 53
because that isn't approved 54 54
and isn't what we've designed the system to do. 55 55
Now, to be able to determine 56 56
if a process is doing something abnormally, 57 57
you need to use tools to track and report on the processes. 58 58
This way you can see what processes are 59 59
or have been in the past running 60 60
and we compare that against our baseline image. 61 61
Again, if we know what normal looks like 62 62
and we compare it to what's running now, 63 63
we can quickly identify anything suspicious. 64 64
So let's dive into Windows for a little bit 65 65
and talk about a couple of tools that we can use 66 66
to identify malicious processes. 67 67
Now, like I said earlier, 68 68
malicious processes could be inserted 69 69
into some regular process or like a DLL file. 70 70
Now, if you suspect something is wrong 71 71
on your Windows system, 72 72
you might want to run the System File Checker. 73 73
This program written out as SFC for System File Checker 74 74
will allow you to scan all the files on the system 75 75
that are made by the system. 76 76
It'll check all those protected files 77 77
and make sure that they're all running the correct versions 78 78
and they haven't been modified. 79 79
It does this by using a digital signature 80 80
on each of those files 81 81
and checking that it hasn't been changed. 82 82
In addition to this, we can analyze the processes themself. 83 83
We can do this using tools 84 84
like Process Monitor and Process Explorer. 85 85
Both of these tools 86 86
come as part of the Sysinternals Tool Suite 87 87
and they can be used for live analysis and logging 88 88
of the processes that are being run on a system. 89 89
In addition to those, we can use Tasklist, 90 90
which is a command line version of the task manager 91 91
and we can use that to display things like memory usage, 92 92
the state of running threads or process trees, 93 93
and individual operations for each process. 94 94
Another tool we might use is PE Explorer. 95 95
Now, PE Explorer is a proprietary software, 96 96
but it has a lot of different features, 97 97
including the ability to browse the structure 98 98
of an executable Windows file. 99 99
This is a very useful program to dig into certain processes 100 100
and see what they're calling, 101 101
for instance which DLLs are they calling up and using. 102 102
That way you can identify what processes are calling 103 103
which possibly suspicious DLLs. 104 104
Now, in addition to Windows, 105 105
there's a lot of people who are using Linux systems, 106 106
especially Linux servers, 107 107
and so we have to look at some Linux tools too. 108 108
On Linux, we have tools like pstree and ps. 109 109
Now, both of these will allow you to look at processes, 110 110
but in a very different way. 111 111
Before we dig into these two tools though, 112 112
we need to talk about some basic terms within Linux 113 113
because it's important to understand these 114 114
before we can look at processes within Linux 115 115
because they do run a little bit differently than Windows. 116 116
First, we have the term daemon. 117 117
Now, a daemon is a background service 118 118
in the Linux operating system, 119 119
and it runs as a process with the letter d after it. 120 120
For instance, if you're running an http server, 121 121
it would be known as httpd, which is the http daemon. 122 122
We also have the secure shell daemon, 123 123
or the file transfer protocol daemon. 124 124
All of these are basically background services 125 125
that can run inside the system. 126 126
Now, there is a specific daemon that we need to talk about 127 127
before we jump into processes 128 128
and this is the first daemon that's launched on a system. 129 129
It's known as systemd. 130 130
The init daemon in Linux is the first executed by the kernel 131 131
during your boot up process, 132 132
and it's always going to have a process ID, or PID, of 1. 133 133
Now, that brings up the term PID, which is a process ID. 134 134
Now, a process ID, 135 135
or process identification number, is a PID, 136 136
and this is a unique identification number 137 137
of a process launched by a Linux system. 138 138
We use this PID to identify the process 139 139
and, if needed, kill that process. 140 140
Now, in addition to a PID, every PID has a parent PID, 141 141
and a parent PID is a unique identification number 142 142
of the parent process 143 143
for every process launched by a Linux system. 144 144
So now with all of that background behind us, 145 145
we can now go into our tools and the first one is pstree. 146 146
Now, pstree is a Linux command 147 147
that provides a parent/child relationship 148 148
of all the processes on a given system. 149 149
So if I run pstree, I'm going to see something like this. 150 150
Now, notice the first process we see. 151 151
systemd with a process ID of 1. 152 152
This is the first process that is launched 153 153
when you start up the system. 154 154
All the other processes you see on the screen 155 155
are going to be children of systemd. 156 156
Now, the first process on my screen here is ModemManager, 157 157
which shows up as process ID 936. 158 158
This is the child of systemd 159 159
and it is a child of parent process ID 1. 160 160
Now, underneath ModemManager 161 161
we have additional processes that have been launched. 162 162
You can see here gdbus. 163 163
Now, notice next to gdbus 164 164
we have the same process ID of 936. 165 165
That's because it's saying 936 launched me, 166 166
which in this case was the ModemManager. 167 167
So gdbus is a sub-process or child process 168 168
of the ModemManager. 169 169
Now, if I jump down to the next one, 170 170
you can see NetworkManager. 171 171
And under that we also have gdbus, 172 172
but this version of gdbus, this process, 173 173
was launched under 928, which is the NetworkManager. 174 174
So you can have processes that are launched multiple times 175 175
from multiple different other processes 176 176
and the child process will always link back 177 177
to the parent ID using that parenthesis after its name. 178 178
Now, the other process analysis tool we have in Linux is ps. 179 179
And ps is a command that lists the attributes 180 180
of all the current processes. 181 181
So if I use the ps command, 182 182
by default it's only going to show processes 183 183
started by the current user when you launch it. 184 184
So if I go to my command prompt and type in ps, enter, 185 185
all I'm going to get is the one process 186 186
that was launched by me. 187 187
In this case, I've only launched one process on my system, 188 188
the bash command, which was this shell that I'm typing into. 189 189
Now, if I want to take this further 190 190
and be able to see a full list 191 191
of all the running processes for all the users, 192 192
I'm going to use the command ps-A or ps-e. 193 193
Both of these are equivalent to show me a full list 194 194
of all the running processes for all the users, 195 195
and it'll look something like this. 196 196
Notice here I use ps-A, and you could see PID 1. 197 197
It was the first one launched, 198 198
and it was launched as sbin/launchd, 199 199
which again launches the system daemon. 200 200
And then I have other process IDs going down. 201 201
For instance, 43 shows me that I launched the syslog daemon. 202 202
44 shows me that I launched the UserEventAgent. 203 203
All of these are different daemons and different processes 204 204
that have been launched on my system, 205 205
but they weren't launched by me. 206 206
A lot of these were launched by other users 207 207
or the operating system itself. 208 208
In this case, it was launched by the operating system 209 209
when I booted up my computer. 210 210
Now, as you could see here on the screen, 211 211
there is a lot of information inside the ps command. 212 212
I get the PID, which tells me what process it is. 213 213
I get the TTY if we're connected remotely. 214 214
I get the TIME which tells me 215 215
how long has this been up and running. 216 216
And then I have the command that launched it. 217 217
So when you're looking at all this data, 218 218
it actually goes on for several pages. 219 219
I only showed you a small chunk of my operating system here. 220 220
If you want to define certain commands, 221 221
for instance, I wanted to search and find cron command, 222 222
I can do that by using ps-C, for command, 223 223
and then the command I'm looking for, cron. 224 224
This command will display the process for the cron command, 225 225
essentially just the one line I need. 226 226
Now, if I wanted to sort all that display, 227 227
I can do that by using ps-A 228 228
and then piping that over to the sort command. 229 229
We talked about the sort command previously. 230 230
When we're dealing with the sort command with -k3, 231 231
what does that mean? 232 232
Well, it means I'm going to sort the third column, 233 233
which was execution time, 234 234
and that I'm going to display to the screen. 235 235
So now I can see what has been executed the longest 236 236
or what has been executed the shortest. 237 237
This way I can sort things by execution time 238 238
and if I know something happened 239 239
five minutes ago in my system, 240 240
I can go back and look what happened five minutes ago 241 241
that may be malicious and identify that process. 242 242
Now, as I mentioned earlier, 243 243
when you're dealing with Windows, 244 244
malware will try to inject itself into DLLs, 245 245
while in Linux, malware's often going to use injection 246 246
into Linux shared libraries. 247 247
These are also known as Shared Objects or .so files. 248 248
If you're responsible for conducting 249 249
threat hunting on Linux systems, 250 250
it is recommended that you start learning 251 251
about these Shared Objects or these SO files 252 252
because they're often the target of malicious code 253 253
being injected into them.