Instructor: Disk and file systems. 2 2
In this lesson, we are going to look 3 3
at the different indicators of compromise 4 4
that may exist on your disk or file system. 5 5
Now, as we said before, 6 6
there is a lot of new fileless malware that's out there, 7 7
and while this is really prevalent in the industry, 8 8
malware is still likely to leave 9 9
metadata on the file system, even if it is fileless. 10 10
Now, one of the common ways this happens 11 11
is by using staging areas. 12 12
Now, a staging area is a place where an adversary 13 13
begins to collect data in preparation for data exfiltration. 14 14
This may be a place like a temporary file or folder. 15 15
It might be user profile locations, data masked as logs, 16 16
alternate data streams, or ADS, 17 17
or even files being placed into the recycle bin. 18 18
All of these are places that data can be staged 19 19
awaiting for it to be moved off of that network 20 20
and into an attacker's network. 21 21
Now, when an attacker does this, 22 22
they often will take that data 23 23
and compress it or encrypt it 24 24
and then place it into the staging area. 25 25
So this can be one of the common IOCs that you can look for. 26 26
So if you start finding files 27 27
that are compressed or encrypted 28 28
and placed into certain directories, 29 29
this could be an indication of a staging area. 30 30
Another common area that's used by attackers 31 31
is that of alternate data streams. 32 32
Now, alternate data streams, or ADS, 33 33
is a feature that's embedded inside an NTFS file system. 34 34
Now, NTFS is the file system that's used 35 35
on all Windows machines. 36 36
So you could see here on the screen, 37 37
I have a directory called Test7. 38 38
And inside of that we're taking the word Sample123 39 39
and echoing that into a file called ... 40 40
And inside that file of ... 41 41
we're using an alternate data stream, called Sampleabc.txt. 42 42
That's actually where the file 43 43
is going to contain that word, Sample123. 44 44
Now you can see I've done the same thing here 45 45
using null as the file and then a colon, Sample.txt. 46 46
I'm placing this Sample.txt 47 47
as an alternate data stream in the null file. 48 48
You could see my third attempt here, 49 49
I was going to try to send it over a comms link of com1, 50 50
which is a serial port, 51 51
but on this system that wasn't recognized. 52 52
Now, as I went through and I did DIR, 53 53
you can see all of the files in a particular folder. 54 54
Now when you look at it, you see four different files here. 55 55
You see ., which is this directory, 56 56
.., which is the parent directory, 57 57
..., which is that file that I made 58 58
with the alternate data stream having that text file in it 59 59
and notice it has zero bytes, 60 60
because the null file had no information in it, 61 61
but the alternate data stream did, 62 62
and that's being hidden by this operating system. 63 63
And then you can see again 64 64
that we have this null:sample.txt:$data, 65 65
which is an alternate data stream 66 66
inside of an alternate data stream, 67 67
which gets a little confusing. 68 68
Now again, the concept here is that an attacker 69 69
can hide information in these alternate data streams 70 70
and that way an analyst has to work really hard to find it. 71 71
Now luckily for us, there are tools that will scan 72 72
an entire hard drive or file share 73 73
and identify all of the alternate data streams. 74 74
This way, we can identify those and then look at them 75 75
to see if they contain information 76 76
that's being prepared for exfiltration. 77 77
In addition to looking for alternate data streams, 78 78
there are tools that will scan the entire host file system 79 79
for file archives, compression and encryption types 80 80
and this will help you detect those data staging areas. 81 81
Another great tool to use is a file system viewer. 82 82
Now, a file system viewer is a tool that allows you 83 83
to search the file system for certain keywords very quickly 84 84
and this can include system areas, 85 85
such as the recycle bin and NTFS shadow copy 86 86
and system volume information stores. 87 87
As you use these tools, 88 88
you can start analyzing the file metadata 89 89
and this will allow you to reconstruct a timeline of events 90 90
that may have taken place on a particular computer. 91 91
As an analyst, one of the things you're always trying to do 92 92
is create a timeline. 93 93
By creating that timeline, you can figure out 94 94
exactly what that adversary has done on that system 95 95
or on that network 96 96
and that will help you better defend in the future 97 97
against those attacks and reconstitute your network 98 98
after an adversary has been inside one. 99 99
Here on the screen, 100 100
you can see a tool called the file system browser. 101 101
Notice here that we can see inside that drive 102 102
and we're not seeing just the files and folders, 103 103
like boot and documents and settings, 104 104
but we're also seeing those hidden files and folders 105 105
or those system files and folders, 106 106
like the ones that begin with a dollar sign. 107 107
These are shadow files 108 108
and these are ones that are normally hidden 109 109
from the operating system, 110 110
but by using a tool like file system browser, 111 111
you as an analyst can go in and look at those things. 112 112
Now, you can also look at these types of files 113 113
by using the command line. 114 114
All the way back in your A+ studies 115 115
you learned about the DIR command, or dir. 116 116
This Windows directory command has some 117 117
advanced functionality for file system analysis. 118 118
There are lots of different options that we need to consider 119 119
and we're going to cover just three of them in this lesson. 120 120
Now, the first one is dir/Ax. 121 121
When you use dir/Ax, the X is actually going to be 122 122
a variable here. 123 123
So if I use /Ax it's going to then identify the filter 124 124
for all the different file or folder types 125 125
that will match that given parameter of X, that variable. 126 126
So for example, if I use dir/AH, 127 127
that's going to give me all of the hidden files and folders. 128 128
To find a full list of all the different variables 129 129
or parameters you could use, 130 130
go ahead and look at the command line dir 131 131
using the help command and it will give you 132 132
all the information on it. 133 133
Next, we have dir/Q. 134 134
Now, for dir/Q, the /Q is going to tell us 135 135
to display who owns each file. 136 136
This will also give us all of our standard information, 137 137
but also who owns that file. 138 138
And that's important 139 139
because if we start seeing files that should be 140 140
owned by a particular user, 141 141
but they're now being owned by system 142 142
or some other driver or device, that could actually indicate 143 143
that that file has been taken over by an adversary. 144 144
And the third one we have is dir/R. 145 145
Now, this is a capital R. 146 146
The /R is going to display 147 147
all the alternate data streams for a file. 148 148
This is another way for us to find 149 149
those alternate data streams and figure out 150 150
if there are any things that are being hidden 151 151
inside of them. 152 152
Now, another type of disk or file indicator of compromise 153 153
occurs when you start seeing your hard drive fill up. 154 154
If the drive starts losing capacity, 155 155
that could be an indication that something bad is happening. 156 156
Now, it's also just an indication 157 157
that somebody's using a lot of hard drive space, 158 158
but when you see something like that, 159 159
you do want to question it. 160 160
If you're used to seeing lots of free space 161 161
on a given hard drive for your baseline assets, 162 162
but now you're seeing very little space, 163 163
that machine may be used to stage information. 164 164
That means people are taking information 165 165
from all over the network and putting it on that one machine 166 166
in preparation for the adversary to take it 167 167
from that machine and then upload it to their own servers. 168 168
When this happens, 169 169
essentially malware is starting to cache those files locally 170 170
for later exfiltration over the network 171 171
or later on if somebody plugs in a USB device 172 172
to download all those things locally. 173 173
Both of these are reasons why you may see 174 174
the hard drive filling up and having 175 175
a very high capacity consumption being used. 176 176
Now, the next tool we want to talk about 177 177
is disc utilization tools. 178 178
So, instead of just going into my computer 179 179
and looking and seeing if your hard drive is filled, 180 180
you can actually use a tool to do that. 181 181
And disk utilization tools can actually scan a file system 182 182
and retrieve a comprehensive list of different statistics. 183 183
This may give you other information about it, 184 184
such as a visual representation of the storage space 185 185
so you know how much is being used. 186 186
It might provide you with a directory listing 187 187
of that storage space, telling you all the different files 188 188
and folders in it, and it can also give you real-time usage 189 189
of data being written to that disk. 190 190
All of these are good indicators you can use 191 191
to develop your indicators of compromise. 192 192
Now, in the rest of this lesson, 193 193
we are going to talk about some specific tools for Linux, 194 194
because we just covered a lot of Windows tools. 195 195
Now, when I talk about Linux file system analysis tools, 196 196
there are many of them out there, 197 197
but the ones we're going to cover are lsof, df and du. 198 198
Now, lsof is a tool that retrieves a list 199 199
of all the files that are currently open 200 200
on the operating system. 201 201
This allows us to quickly get a list 202 202
of all the resources that a process is currently using. 203 203
Now, why is that? 204 204
Well, it's because in Linux, 205 205
everything is treated as a file, 206 206
whether it's a file, a folder, a disk, 207 207
or even a resource like a printer. 208 208
All of those are considered files 209 209
inside the Linux operating system, 210 210
so using lsof can quickly get us list 211 211
of all of those resources. 212 212
For example, let's say I did lsof -u root -a p 1645. 213 213
What does that say? 214 214
Well, this says I want to show all of the files 215 215
that are currently open on this computer 216 216
that were opened by the user root 217 217
and they're actively using the process number 1645. 218 218
And this way I can find everything that's associated 219 219
with that particular process. 220 220
This is really helpful when you start doing 221 221
adversary hunting and you start having pieces of information 222 222
like you know there was a malicious process that was run 223 223
and now you want to see everything else that was launched 224 224
from that process. 225 225
This type of a command can allow you to do that. 226 226
Next, we want to talk about df. 227 227
Now, df is a tool that retrieves how much disk space 228 228
is being used by all mounted file systems 229 229
and how much space is available for each. 230 230
Essentially, df is going to find out 231 231
how much disk space is there 232 232
for all of your different disks. 233 233
Now, the other command we want to talk about is du. 234 234
And du is a tool that enables you to retrieve 235 235
how much disk space each directory is using 236 236
based on a specified directory. 237 237
So when we deal with df, we're dealing with the entire disk. 238 238
When we're dealing with du, 239 239
we are dealing with a specific directory. 240 240
Sometimes you want to look at the full disk, 241 241
sometimes you want to look at the directory. 242 242
For example, if I was using something on a server, 243 243
I would be more inclined to look at a directory, 244 244
instead of the full disc. 245 245
If I was looking at a workstation, on the other hand, 246 246
I'd be more inclined to look at df 247 247
looking at the disk itself. 248 248
Now, if I'm going to use du, how would I use that command? 249 249
Well, I would type something like this: du/var/log. 250 250
This will tell me how much space is the log directory using 251 251
on this particular computer. 252 252
That would be a good indication if I'm above baseline, 253 253
below baseline, or at baseline of what I expect to see. 254 254
The final thing we need to talk 255 255
about when we talk about disk and file IOCs is cryptography 256 256
because a lot of times people will encrypt files 257 257
in preparation for staging, like we talked about before. 258 258
Now you can use cryptographic analysis tools 259 259
to help you determine the type of encryption algorithm 260 260
that's being used and assess the strength 261 261
of the encryption key. 262 262
If you find some directories or files 263 263
on your drive that are encrypted and you didn't encrypt them 264 264
and your user didn't encrypt them, 265 265
this might be something that's being used as staging. 266 266
Now, as you look at that, 267 267
you want to find out what's inside those files. 268 268
Well, to do that, you're going to have to analyze them 269 269
using cryptography to figure out 270 270
if you can even open those or figure out what that key is. 271 271
Now, just like we use encryption to protect 272 272
our data from attackers, attackers use encryption 273 273
to protect our data from us 274 274
because they're trying to steal that data. 275 275
And so as an analyst, you have to recover 276 276
or brute force the user password to be able to obtain 277 277
the decryption key for an encrypted volume. 278 278
And so, if there's some piece of malware 279 279
or ransomware or an attacker that has encrypted these files, 280 280
without that key, those files are as good as gone. 281 281
You won't be able to read them 282 282
and you won't be able to analyze them.